Privacy Policy
Privacy Policy
1) Introduction and Contact Details of the Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how your personal data is handled when you use our website. Personal data means all data that can be used to identify you personally.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Laurin Koop, Koop Candles, Moltkeallee 3, 22926 Ahrensburg, Germany, Tel.: 015770419942, Email: laurin.koop@koop-candles.com. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
2) Data Collection When Visiting Our Website
When using our website for informational purposes only, meaning that you do not register or otherwise provide us with information, we collect only the data that your browser transmits to the page server (so-called “server log files”). When you access our website, we collect the following data, which is technically required to display the website to you:
- Our website visited
- Date and time of access
- Amount of data sent in bytes
- Source/referrer from which you accessed the page
- Browser used
- Operating system used
- IP address used (where applicable: in anonymized form)
Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or otherwise used. However, we reserve the right to subsequently review the server log files if there are specific indications of unlawful use.
3) Hosting & Content Delivery Network
Shopify
We use the system of the following provider to host our website and display its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorized disclosure to third parties.
When data is transferred to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
4) Contacting us
When you contact us, for example via the contact form or by email, personal data is processed exclusively for the purpose of handling and responding to your request and only to the extent necessary for this purpose.
The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Article 6(1)(f) GDPR. If you contact us regarding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR. Your data will be deleted when the circumstances indicate that the matter in question has been conclusively resolved and provided that no statutory retention obligations prevent deletion.
5) Data processing when opening a customer account
Pursuant to Article 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide it to us when opening a customer account. The data required to open the account can be found in the input form on the corresponding form on our website.
You may delete your customer account at any time by sending a message to the above-mentioned address of the data controller. After your customer account has been deleted, your data will be deleted provided that all contracts concluded through the account have been fully completed, no statutory retention periods prevent deletion, and we have no legitimate interest in continuing to store the data.
6) Use of customer data for direct advertising
Subscribe to our email newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to send the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending the newsletter, which ensures that you will not receive newsletters until you have expressly confirmed your consent to receive them by clicking a verification link sent to the email address provided.
By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. For this purpose, we store the IP address registered by your Internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later time. The data we collect when you register for the newsletter is used strictly for the specified purpose.
You can unsubscribe from the newsletter at any time using the designated link in the newsletter or by sending an appropriate message to the controller named above. After unsubscribing, your email address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are legally permitted and about which we inform you in this statement.
7) Data processing for order processing
7.1 To the extent necessary for the performance of the contract for delivery and payment purposes, the personal data we collect will be disclosed pursuant to Art. 6(1)(b) GDPR to the commissioned transport company and the commissioned credit institution.
If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided when placing your order to inform you personally as part of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details are used strictly for the purpose of notifying you about updates owed by us and are processed by us only to the extent necessary for the respective information.
To process your order, we also work with the service provider(s) listed below, who support us in whole or in part in carrying out concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.
7.2 Use of payment service providers (payment services)
- Apple Pay
If you choose the “Apple Pay” payment method provided by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing takes place via the “Apple Pay” function on your device running iOS, watchOS, or macOS by charging a payment card stored in “Apple Pay”. Apple Pay uses security features integrated into your device’s hardware and software to protect your transactions. To authorize a payment, you must therefore enter a code previously set by you and verify it using the “Face ID” or “Touch ID” function on your device.
For payment processing purposes, the information you provide during the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then encrypts this data again using a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay to process the payment. The encryption ensures that only the website where the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.
If personal data is processed in the transfers described, the processing is carried out exclusively for the purpose of processing payments pursuant to Art. 6(1)(b) GDPR.
Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was completed successfully. Anonymization completely rules out any link to an individual. Apple uses the anonymized data to improve “Apple Pay” and other Apple products and services.
If you use Apple Pay on your iPhone or Apple Watch to complete a purchase you made through Safari on your Mac, the Mac and the authorization device communicate via an encrypted channel on Apple’s servers. Apple does not process or store any of this information in a format that can identify you. You can disable the option to use Apple Pay on your Mac in your iPhone settings. Go to “Wallet & Apple Pay” and disable “Allow Payments on Mac”.
Further information on data protection for Apple Pay can be found at the following website address: https://support.apple.com
- Google Pay
If you choose the “Google Pay” payment method provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), payment processing takes place through the “Google Pay” application on your mobile device, which runs at least Android 4.4 (“KitKat”) and has NFC functionality, by charging a payment card stored in Google Pay or a payment system verified there (e.g., PayPal). To authorize a payment through Google Pay exceeding €25, you must first unlock your mobile device using the verification method configured for it (such as facial recognition, a password, fingerprint, or pattern).
For the purpose of processing the payment, the information you provided during the ordering process, together with information about your order, is transmitted to Google. Google then transmits your payment information stored in Google Pay to the originating website in the form of a one-time transaction number, which is used to verify that payment has been made. This transaction number contains no information whatsoever about the actual payment details of the payment methods stored in your Google Pay account; instead, it is created and transmitted as a one-time numerical token. For all transactions through Google Pay, Google acts solely as an intermediary for processing the payment. The transaction is carried out exclusively between the user and the originating website by charging the payment method stored in Google Pay.
If personal data is processed in the transfers described, the processing is carried out exclusively for the purpose of processing payments pursuant to Art. 6(1)(b) GDPR.
Google reserves the right to collect, store, and analyze certain transaction-specific information for every transaction made through Google Pay. This includes the date, time, and amount of the transaction, the merchant's location and description, a description of the goods or services purchased provided by the merchant, photos you have attached to the transaction, the name and email address of the seller and buyer or sender and recipient, the payment method used, your description of the reason for the transaction, and, where applicable, the offer associated with the transaction.
According to Google, this processing is carried out exclusively pursuant to Art. 6(1)(f) GDPR on the basis of the legitimate interest in proper accounting, verifying transaction data, and optimizing and maintaining the functionality of the Google Pay service.
Google also reserves the right to combine the transaction data processed with additional information collected and stored by Google when using other Google services.
The Google Pay Terms of Service can be found here:
https://payments.google.com
Further information on data protection for Google Pay can be found at the following web address:
https://payments.google.com
- Klarna
One or more online payment methods from the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden
If you select a payment method offered by the provider for which you pay in advance (such as credit card payment), your payment details provided during the ordering process (including your name, address, bank and payment card information, currency, and transaction number) as well as information about the contents of your order will be transmitted to the provider pursuant to Art. 6 para. 1 lit. b GDPR. In this case, your data will be transmitted solely for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.
When selecting a payment method in which the provider pays in advance (such as payment by invoice or installments, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, where applicable, details of an alternative payment method).
In order to safeguard our legitimate interest in determining our customers' ability to pay, we transmit this data to the provider for the purpose of a credit check pursuant to Art. 6 para. 1 lit. f GDPR. Based on the personal data you provide and other data (such as shopping cart contents, invoice amount, order history, and payment history), the provider checks whether the payment method you selected can be granted with regard to the risks of payment default and/or non-payment of claims.
For the decision as part of the application review, in addition to the provider's internal criteria pursuant to Art. 6 para. 1 lit. f GDPR, identity and creditworthiness information from the following credit agencies may also be taken into account:
https://cdn.klarna.com
The credit report may contain probability values (so-called score values). Where score values are included in the credit report results, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of score values includes, among other things, but not exclusively, address data.
You may object to this processing of your data at any time by notifying us or the provider. However, the provider may continue to be entitled to process your personal data if this is necessary to process the payment in accordance with the contract.
- PayPal
One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
When selecting a payment method provided by the provider that requires you to pay in advance, your payment details communicated to the provider during the ordering process (including your name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be disclosed to the provider in accordance with Art. 6 para. 1 lit. b GDPR. In this case, your data will be disclosed exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.
When selecting a payment method for which we pay in advance, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, where applicable, details of an alternative payment method).
To safeguard our legitimate interest in determining your ability to pay in such cases, we will forward this data to the provider for the purpose of a credit assessment pursuant to Art. 6 para. 1 lit. f GDPR. Based on the personal data you provide and other data (such as shopping cart contents, invoice amount, order history, and payment history), the provider checks whether the payment method you selected can be granted with regard to payment and/or default risks.
The credit report may contain probability values (so-called score values). Where score values are included in the credit report results, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of score values includes, among other things, but not exclusively, address data.
You may object to this processing of your data at any time by notifying us or the provider. However, the provider may continue to be entitled to process your personal data if this is necessary to process the payment in accordance with the contract.
- Shopify Payments
One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
If you select a payment method offered by the provider for which you pay in advance (such as credit card payment), your payment details provided during the ordering process (including your name, address, bank and payment card information, currency, and transaction number) as well as information about the contents of your order will be transmitted to the provider pursuant to Art. 6 para. 1 lit. b GDPR. In this case, your data will be transmitted solely for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.
- Sofort bank transfer
One or more online payment methods from the following provider are available on this website: Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden
If you select a payment method offered by the provider for which you pay in advance (such as credit card payment), your payment details provided during the ordering process (including your name, address, bank and payment card information, currency, and transaction number) as well as information about the contents of your order will be transmitted to the provider pursuant to Art. 6 para. 1 lit. b GDPR. In this case, your data will be transmitted solely for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.
7.3 Electronic revocation function for distance contracts
Consumers who enter into contracts on this website for which a statutory right of withdrawal exists have the option of declaring their withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.
When using the withdrawal function, in addition to information identifying the contract to be withdrawn, further personal information, such as the consumer's first and last name and email address, must be provided or confirmed.
The collection of this information and its transmission to us takes place pursuant to Art. 6(1)(b) GDPR and only insofar as it is necessary for the proper processing of the withdrawal. The personal data provided are also used on the basis of Art. 6(1)(b) GDPR to confirm receipt of the withdrawal declaration by email. An additional legal basis for the processing is Art. 6(1)(c) GDPR. We are legally required to provide an electronic withdrawal function for distance contracts with consumers that are subject to payment.
8) Data subject rights
8.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data; the applicable legal basis is indicated for the respective conditions for exercising these rights:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to be informed pursuant to Art. 19 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to withdraw consent pursuant to Art. 7(3) GDPR;
- Right to lodge a complaint pursuant to Art. 77 GDPR.
8.2 RIGHT TO OBJECT
IF, AS PART OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE AFFECTED DATA. HOWEVER, FURTHER PROCESSING MAY CONTINUE IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA TO CARRY OUT DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSES OF SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
9) Retention period for personal data
The retention period for personal data is determined by the respective legal basis, the purpose of processing and—where applicable—in addition by the respective statutory retention period (e.g., retention periods under commercial and tax law).
When personal data is processed on the basis of explicit consent pursuant to Art. 6 para. 1 lit. a GDPR, the data concerned will be stored until you withdraw your consent.
If statutory retention periods apply to data processed in the context of contractual or contract-like obligations on the basis of Art. 6 para. 1 lit. b GDPR, this data will routinely be deleted after the retention periods expire, provided that it is no longer required for contract performance or contract initiation and/or we no longer have a legitimate interest in retaining it.
When personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR, this data will be stored until you exercise your right to object under Art. 21 para. 1 GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.
When personal data is processed for direct marketing purposes on the basis of Art. 6 para. 1 lit. f GDPR, this data will be stored until you exercise your right to object under Art. 21 para. 2 GDPR.
Unless otherwise specified by the other information in this statement regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.