Catalog

Brands

New Arrivals

Personal Data Processing Policy User Agreement Cookie Policy

Personal Data Processing Policy

Privacy Policy

Personal data (hereinafter mostly referred to as "data") is processed by us only to the extent necessary and for the purpose of providing a functional and user-friendly website, including its content and the services offered therein.

Pursuant to Art. 4 No. 1 of Regulation (EU) 2016/679, i.e., the General Data Protection Regulation (hereinafter referred to as "GDPR"), "processing" means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

With the following privacy policy, we inform you in particular about the type, scope, purpose, duration, and legal basis of the processing of personal data, insofar as we either alone or jointly with others decide on the purposes and means of processing. Furthermore, we inform you below about the third-party components we use for optimization purposes and to increase the quality of use, insofar as third parties process data on their own responsibility.

Our privacy policy is structured as follows:

I. Information about us as the responsible party

II. Rights of users and data subjects

III. Information on data processing

I. Information About Us as the Responsible Party

The responsible provider of this website in terms of data protection law is:

KOMETAC GmbH Peter Simon Lohmühlenweg 28 63571 Gelnhausen

Email: office@farfalia.com

II. Rights of Users and Data Subjects

With regard to the data processing described in more detail below, users and data subjects have the right

to confirmation of whether data concerning them is being processed, to information about the data being processed, to further information about the nature of the data processing, and to copies of the data (cf. also Art. 15 GDPR);
to rectification or completion of incorrect or incomplete data (cf. also Art. 16 GDPR);
to immediate erasure of data concerning them (cf. also Art. 17 GDPR), or, alternatively, if further processing is required pursuant to Art. 17(3) GDPR, to restriction of processing pursuant to Art. 18 GDPR;
to receive the data concerning them and provided by them and to transmit this data to other providers/controllers (cf. also Art. 20 GDPR);
to lodge a complaint with the supervisory authority if they believe that data concerning them is being processed by the provider in violation of data protection provisions (cf. also Art. 77 GDPR).

In addition, the provider is obliged to notify all recipients to whom data has been disclosed by the provider of any rectification or erasure of data or restriction of processing carried out pursuant to Articles 16, 17(1), 18 GDPR. However, this obligation does not apply insofar as such notification is impossible or involves a disproportionate effort. Notwithstanding this, the user has a right to information about these recipients.

Users and data subjects also have the right to object, pursuant to Art. 21 GDPR, to future processing of data concerning them, insofar as the data is processed by the provider pursuant to Art. 6(1)(f) GDPR. In particular, an objection to data processing for the purpose of direct advertising is permissible.

III. Information on Data Processing

Your data processed when using our website will be deleted or blocked as soon as the purpose for storage no longer applies, provided the deletion of the data is not contrary to any statutory retention obligations and no other information to the contrary is given below regarding individual processing procedures.

Contact Requests / Contact Options

If you contact us via a contact form or email, the data you provide will be used to process your request. Providing the data is necessary for processing and answering your request – without it, we cannot answer your request or can only do so to a limited extent.

The legal basis for this processing is Art. 6(1)(b) GDPR.

Your data will be deleted once your request has been conclusively answered and there are no statutory retention obligations to the contrary, such as in the case of any subsequent contract processing.

Customer Account / Registration Function

If you create a customer account with us via our website, we will collect and store the data you enter during registration (e.g., your name, address, or email address) exclusively for pre-contractual services, for the performance of the contract, or for the purpose of customer care (e.g., to provide you with an overview of your previous orders or to offer you the so-called wishlist function). At the same time, we store the IP address and the date and time of your registration. This data will not be passed on to third parties.

During the further registration process, your consent to this processing will be obtained and reference will be made to this privacy policy. The data we collect will be used exclusively for providing the customer account.

Insofar as you consent to this processing, Art. 6(1)(a) GDPR is the legal basis for processing.

If the opening of the customer account also serves pre-contractual measures or the performance of the contract, the legal basis for this processing is also Art. 6(1)(b) GDPR.

You may revoke the consent given to us for the opening and maintenance of the customer account at any time with effect for the future pursuant to Art. 7(3) GDPR. To do so, you simply need to inform us of your revocation.

The data collected in this regard will be deleted as soon as the processing is no longer necessary. However, we must observe tax and commercial law retention periods.

If you sign up for our free newsletter, the data requested for this purpose, i.e., your email address and, optionally, your name and address, will be transmitted to us. At the same time, we store the IP address of the internet connection from which you access our website, as well as the date and time of your registration. During the further registration process, we will obtain your consent to receive the newsletter, describe the content in concrete terms, and refer to this privacy policy. The data collected is used exclusively for sending the newsletter – it will therefore not be passed on to third parties.

The legal basis for this is Art. 6(1)(a) GDPR.

You may revoke your consent to receive the newsletter at any time with effect for the future pursuant to Art. 7(3) GDPR. To do so, you simply need to inform us of your revocation or click the unsubscribe link contained in each newsletter.

User Contributions, Comments, and Reviews

We offer you the opportunity to publish questions, answers, opinions, or reviews, hereinafter referred to as "contributions," on our website. If you make use of this offer, we will process and publish your contribution, the date and time of submission, and any pseudonym you may use.

The legal basis for this is Art. 6(1)(a) GDPR. You may revoke your consent at any time with effect for the future pursuant to Art. 7(3) GDPR. To do so, you simply need to inform us of your revocation.

In addition, we also process your IP and email address. The IP address is processed because we have a legitimate interest in taking or supporting further steps if your contribution infringes the rights of third parties and/or is otherwise unlawful.

The legal basis in this case is Art. 6(1)(f) GDPR. Our legitimate interest lies in the legal defense that may be necessary.

Credit Check and Scoring

Insofar as we offer you the basic option of payment by invoice as part of our product or service offering and you make use of this, we reserve the right to obtain a credit report from a credit agency (such as Creditreform, Schufa, Bürgel, or infoscore) based on mathematical-statistical methods. For this purpose, your data, insofar as it is relevant to the contract, such as your name and address, will be forwarded to the credit agency. The subsequent information about the statistical probability of a payment default is used by us for our decision on whether to offer you payment by invoice.

The legal basis for this processing is our legitimate interest in the default security of the claim pursuant to Art. 6(1)(f) GDPR.

Server Data

For technical reasons, particularly to ensure a secure and stable website, data is transmitted by your internet browser to us or to our web space provider. These so-called server log files collect, among other things, the type and version of your internet browser, the operating system, the website from which you switched to our website (referrer URL), the website(s) of our website that you visit, the date and time of the respective access, and the IP address of the internet connection from which our website is used.

This data collected is temporarily stored, but not together with other data from you.

This storage takes place on the legal basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the improvement, stability, functionality, and security of our website.

The data is deleted after seven days at the latest, unless further retention for evidentiary purposes is required. Otherwise, the data is exempt from deletion in whole or in part until the final resolution of an incident.

Contract Processing

The data transmitted by you for the purpose of using our product and/or service offerings is processed by us for the purpose of contract processing and is necessary in this respect. The conclusion and execution of the contract is not possible without providing your data.

The legal basis for processing is Art. 6(1)(b) GDPR.

We delete the data upon complete contract processing, but must observe the tax and commercial law retention periods.

As part of the contract processing, we pass on your data to the transport company commissioned with the delivery of goods or to the financial service provider, insofar as the transfer is necessary for the delivery of goods or for payment purposes.

The legal basis for the transfer of data is Art. 6(1)(b) GDPR.

Facebook

To promote our products and services and to communicate with prospects or customers, we maintain a company presence on the Facebook platform.

On this social media platform, we are jointly responsible with Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

Facebook's data protection officer can be reached via a contact form: https://www.facebook.com/help/contact/540977946302970

We have regulated the joint responsibility in an agreement regarding the respective obligations within the meaning of the GDPR. This agreement, from which the mutual obligations arise, is available at the following link: https://www.facebook.com/legal/terms/page_controller_addendum

The legal basis for the resulting processing of personal data as described below is Art. 6(1)(f) GDPR. Our legitimate interest lies in the analysis, communication, and the sale and promotion of our products and services.

The legal basis may also be the user's consent pursuant to Art. 6(1)(a) GDPR vis-à-vis the platform operator. The user may revoke this consent at any time with effect for the future by notifying the platform operator pursuant to Art. 7(3) GDPR.

When accessing our online presence on the Facebook platform, Facebook Ireland Ltd. as the platform operator in the EU processes the user's data (e.g., personal information, IP address, etc.).

This user data is used for statistical information about the use of our company presence on Facebook. Facebook Ireland Ltd. uses this data for market research and advertising purposes and for creating user profiles. Based on these profiles, Facebook Ireland Ltd. can, for example, advertise to users within and outside of Facebook based on their interests. If the user is logged into their Facebook account at the time of the access, Facebook Ireland Ltd. can also link the data to the respective user account.

In the event of the user contacting us via Facebook, the personal data entered on this occasion will be used to process the request. The user's data will be deleted by us once the user's request has been conclusively answered and there are no statutory retention obligations to the contrary, such as in the case of any subsequent contract processing.

Facebook Ireland Ltd. may also set cookies for data processing.

If the user does not agree with this processing, they have the option of preventing the installation of cookies by adjusting their browser settings accordingly. Cookies already stored can also be deleted at any time. The settings for this depend on the respective browser. For Flash cookies, processing cannot be prevented through browser settings, but rather through the appropriate Flash Player settings. If the user prevents or restricts the installation of cookies, this may result in not all Facebook functions being fully usable.

More details about processing activities, their prevention, and the deletion of data processed by Facebook can be found in Facebook's data policy: https://www.facebook.com/privacy/explanation

It cannot be excluded that processing by Meta Platforms Ireland Limited also takes place via Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025 in the USA.

Instagram

To promote our products and services and to communicate with prospects or customers, we maintain a company presence on the Instagram platform.

On this social media platform, we are jointly responsible with Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.

Instagram's data protection officer can be reached via a contact form: https://www.facebook.com/help/contact/540977946302970

When accessing our online presence on the Instagram platform, Facebook Ireland Ltd. as the platform operator in the EU processes the user's data (e.g., personal information, IP address, etc.).

This user data is used for statistical information about the use of our company presence on Instagram. Facebook Ireland Ltd. uses this data for market research and advertising purposes and for creating user profiles. Based on these profiles, Facebook Ireland Ltd. can, for example, advertise to users within and outside of Instagram based on their interests. If the user is logged into their Instagram account at the time of the access, Facebook Ireland Ltd. can also link the data to the respective user account.

In the event of the user contacting us via Instagram, the personal data entered on this occasion will be used to process the request. The user's data will be deleted by us once the user's request has been conclusively answered and there are no statutory retention obligations to the contrary, such as in the case of any subsequent contract processing.

Facebook Ireland Ltd. may also set cookies for data processing.

More details about processing activities, their prevention, and the deletion of data processed by Instagram can be found in Instagram's data policy: https://help.instagram.com/519522125107875

It cannot be excluded that processing by Facebook Ireland Ltd. also takes place via Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025 in the USA.

General Linking to Third-Party Profiles

The provider uses links to the social networks listed below on the website.

The legal basis for this is Art. 6(1)(f) GDPR. The provider's legitimate interest lies in improving the quality of use of the website.

The integration of plugins is done via a linked graphic. Only by clicking on the corresponding graphic is the user redirected to the service of the respective social network.

After the customer is redirected, information about the user is collected by the respective network. Initially, this includes data such as IP address, date, time, and the page visited. If the user is logged into their user account of the respective network during this time, the network operator may be able to assign the collected information from the specific visit to the user's personal account. If the user interacts via a "Share" button of the respective network, this information may be stored in the user's personal account and possibly published. If the user wants to prevent the collected information from being directly assigned to their user account, the user must log out before clicking on the graphic. In addition, there is the option of configuring the respective user account accordingly.

Visitor Analysis and Newsletter via Emarsys

a) Registration

If the user registers for the provider's free newsletter, the data requested in the input form (email address) is processed by a service provider – see Dispatch below. In addition, the IP address and the date and time of registration are stored. During the registration process, the user's consent is obtained and the content is specifically described. At the same time, reference is made to this privacy policy.

b) Dispatch

The provider uses "Emarsys" for sending newsletters. "Emarsys" is a service of Emarsys eMarketing Systems AG, Munich. Further information on data protection at Emarsys: https://www.emarsys.com/de/datenschutzrichtlinie/.

c) Visitor and Newsletter Analysis

The newsletters sent by the provider via "Emarsys" contain technologies that allow the provider to recognize in the analyses whether and when an email was opened and which links in the newsletter were followed by the user.

Emarsys also uses cookies. These cookies are used to recognize the user so that movements on the provider's website can be detected and the success of certain marketing measures can be recorded.

The newsletters sent by the provider via "Emarsys" also contain technologies that allow the provider to recognize in the analyses whether and when an email was opened and which links in the newsletter were followed by the user.

This analysis data is stored by the provider alongside the technical data (system data and IP address) so that the newsletters can be optimally aligned with the wishes and interests of the user. Accordingly, the data collected is used to continuously improve the quality of the newsletters.

d) Legal Basis

The legal basis for sending the newsletter and the analysis is Art. 6(1)(a) GDPR.

e) Revocation

The user may revoke consent to the processing of data in connection with the newsletter registration at any time with effect for the future pursuant to Art. 7(3) GDPR by notifying the provider or by clicking the unsubscribe link in the newsletter.

The user may revoke consent to analysis cookies at any time with effect for the future pursuant to Art. 7(3) GDPR through the settings in the cookie management.

Google Analytics

We use Google Analytics on our website. This is a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google."

The Google Analytics service is used to analyze the usage behavior of our website. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the analysis, optimization, and economic operation of our website.

Usage and user-related information, such as IP address, location, time, or frequency of visits to our website, is transmitted to a Google server in the USA and stored there. However, we use Google Analytics with the so-called anonymization function. This function causes Google to truncate the IP address within the EU or EEA.

The data collected in this way is in turn used by Google to provide us with an evaluation of visits to our website and the usage activities there. This data can also be used to provide further services related to the use of our website and the use of the internet.

Google states that it does not link your IP address to other data. In addition, Google provides further data protection information at https://www.google.com/intl/de/policies/privacy/partners, including options for preventing data use.

In addition, Google offers a so-called deactivation add-on with further information at https://tools.google.com/dlpage/gaoptout?hl=de. This add-on can be installed with the common internet browsers and gives you further control over the data that Google collects when you visit our website. The add-on informs Google Analytics JavaScript (ga.js) that information about the visit to our website should not be transmitted to Google Analytics. However, this does not prevent information from being transmitted to us or to other web analysis services. Whether and which other web analysis services are used by us can also be found in this privacy policy.

Use of PayPal as a Payment Method

If you choose to pay with the online payment service provider PayPal during your order process, your contact data will be transmitted to PayPal as part of the order thus triggered. PayPal is an offering of PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal acts as an online payment service provider and trustee and offers buyer protection services.

The personal data transmitted to PayPal usually includes first name, last name, address, telephone number, IP address, email address, or other data necessary for order processing, as well as data related to the order, such as the number of items, item number, invoice amount, and taxes in percentage, billing information, etc.

This transmission is necessary for processing your order with the payment method you have selected, in particular for confirming your identity, administering your payment, and the customer relationship. Your data is therefore transmitted to PayPal on the basis of Art. 6(1)(b) GDPR.

Please note, however, that PayPal may also pass on personal data to service providers, subcontractors, or other affiliated companies insofar as this is necessary to fulfill the contractual obligations arising from your order or insofar as the personal data is to be processed on behalf.

Depending on the payment method selected via PayPal, e.g., invoice or direct debit, the personal data transmitted to PayPal will be transmitted by PayPal to credit agencies. This transmission serves to verify your identity and creditworthiness in relation to the order you have placed. For information on which credit agencies are involved and what data PayPal generally collects, processes, stores, and passes on, please refer to PayPal's privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Use of Sofortüberweisung (Instant Bank Transfer) as a Payment Method

If you choose to pay with the online payment service provider Sofortüberweisung during your order process, your contact data will be transmitted to Sofortüberweisung as part of the order thus triggered.

Sofortüberweisung is an offering of SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany. Sofortüberweisung acts as an online payment service provider that enables cashless payment for products and services on the internet.

The personal data transmitted to Sofortüberweisung usually includes first name, last name, address, telephone number, IP address, email address, or other data necessary for order processing, as well as data related to the order, such as the number of items, item number, invoice amount, and taxes in percentage, billing information, etc.

Please note, however, that Sofortüberweisung may also pass on personal data to service providers, subcontractors, or other affiliated companies insofar as this is necessary to fulfill the contractual obligations arising from your order or insofar as the personal data is to be processed on behalf.

Under certain circumstances, the personal data transmitted to Sofortüberweisung may be transmitted by Sofortüberweisung to credit agencies. This transmission serves to verify your identity and creditworthiness in relation to the order you have placed.

The data protection principles that Sofortüberweisung applies when processing your data can be found in the data protection notices displayed to you during the payment process by Sofortüberweisung.

If you have further questions about the use of your personal data, you can contact Sofortüberweisung by email (datenschutz@sofort.com) or in writing (SOFORT GmbH, Datenschutz, Theresienhöhe 12, 80339 Munich).