Privacy policy
1. Privacy at a Glance
General Information
The following information provides a simple overview of what happens to your personal data when you visit this website or use our online store. Personal data is any data that can be used to personally identify you.
Detailed information on data protection can be found in the Privacy Policy set out below.
Data Collection on This Website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. The operator's contact details can be found in the section "Information on the Controller" in this Privacy Policy.
How do we collect your data?
Some data is collected when you provide it to us. This may, for example, include data that you enter into a contact form, provide when placing an order, store in your customer account, or send to us by email.
Other data is collected automatically or after you have given your consent when you visit the website. This primarily includes technical data such as your IP address, internet browser, operating system, device information, or the time at which a page was accessed.
What do we use your data for?
Some data is processed to ensure the technically correct and secure operation of the website.
If you place an order through our website, the data you provide is processed for the purpose of handling your order, processing payment, shipping, invoicing, and performing the contract concluded with you.
Other data may – where an appropriate legal basis exists – be processed to analyze the use of our website or to improve our services and products.
What rights do you have regarding your data?
Within the scope of the applicable legal requirements, you have the right to obtain information about your stored personal data and to request the correction or deletion of this data.
If you have given consent to data processing, you may withdraw this consent at any time with effect for the future.
Under the statutory requirements, you also have the right to restrict processing, to data portability, and to object to certain forms of processing.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
You may contact us at any time if you have further questions about data protection.
2. Hosting and E-Commerce Platform
Shopify
We use Shopify as the e-commerce platform for operating our online store.
The provider for users and merchants in the European Economic Area is:
Shopify International Limited
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Shopify provides the technical infrastructure required to operate our online store. In this context, Shopify may process IP addresses, device and browser information, information about the use of our online store, as well as customer, order, and contract data.
If you place an order, Shopify may process, in particular, your name, email address, telephone number where applicable, billing and shipping addresses, information about the products ordered, payment and shipping information, and other data associated with your order.
Where processing by Shopify serves to provide and secure our online store, processing is based on our legitimate interest in the secure, reliable, and economical operation of our online services pursuant to Art. 6(1)(f) GDPR.
Where Shopify is used to process your order and perform the contract concluded with you, processing is based on Art. 6(1)(b) GDPR.
Where non-essential cookies or similar technologies are used, processing takes place only on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw or change your consent at any time using the cookie settings available on our website.
Shopify may also process personal data outside the European Economic Area. Personal data of users from the European Economic Area is initially processed by Shopify International Limited in Ireland and may subsequently be transferred to other companies within the Shopify group or to service providers used by Shopify, including in Canada and the United States.
For intra-group transfers of personal data, Shopify uses, among other safeguards, approved Binding Corporate Rules (BCR). Where required, appropriate safeguards such as the European Commission's Standard Contractual Clauses may be used for transfers to other service providers.
Further information on the processing of personal data by Shopify can be found in Shopify's privacy information.
3. General Information and Mandatory Information
Data Protection
We take the protection of your personal data seriously. We treat your personal data confidentially and in accordance with the applicable data protection laws and this Privacy Policy.
When you use this website, various types of personal data are processed. This Privacy Policy explains what data we process, for what purposes it is processed, and on what legal basis the processing is carried out.
Please note that data transmission over the internet, for example when communicating by email, may be subject to security risks. Complete protection of data against access by third parties cannot be guaranteed.
Information on the Controller
The controller responsible for data processing on this website is:
Intend Bicycle Components GmbH
Schwarzwaldstraße 1
79117 Freiburg im Breisgau
Germany
Email: simons.lab.info (at) gmail.com
SIMONS.LAB is an independently operated business division of Intend Bicycle Components GmbH.
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
Storage Period
Unless a more specific storage period is stated in this Privacy Policy, we store personal data only for as long as necessary for the respective processing purpose.
If you submit a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted unless there are other legally permissible grounds for continued storage.
These may include, in particular, statutory commercial and tax retention obligations or the retention of data for the establishment, exercise, or defense of legal claims.
The data will be deleted once the respective reason for storage no longer applies.
General Information on the Legal Bases for Data Processing
Where you have consented to the processing of your personal data, processing is based on Art. 6(1)(a) GDPR.
Where special categories of personal data within the meaning of Art. 9(1) GDPR are processed and explicit consent is required, processing is based on Art. 9(2)(a) GDPR.
Where personal data is required for the performance of a contract with you or in order to take steps at your request prior to entering into a contract, processing is based on Art. 6(1)(b) GDPR.
Where processing is necessary for compliance with a legal obligation, it is based on Art. 6(1)(c) GDPR.
Processing may also be based on our legitimate interests pursuant to Art. 6(1)(f) GDPR.
Where information is stored on or accessed from your terminal equipment, the permissibility of such access is additionally governed by Section 25 TDDDG. Unless a statutory exemption applies, such processing is based on your consent.
The relevant legal bases are explained in more detail in the following sections.
Recipients of Personal Data
In the course of our business activities, we cooperate with external companies and service providers.
Personal data is transferred only where this is necessary for the performance of a contract, where we are legally obliged to do so, where we have a legitimate interest in the transfer, where you have given your consent, or where another legal basis permits the transfer.
Recipients may include, in particular, IT and hosting service providers, payment service providers, shipping and logistics companies, inventory management and accounting service providers, tax advisors, and public authorities.
Where service providers process personal data exclusively on our behalf, they are engaged as processors in accordance with the applicable statutory requirements.
Withdrawal of Your Consent to Data Processing
Where processing is based on your consent, you may withdraw consent at any time with effect for the future.
The lawfulness of processing carried out before the withdrawal remains unaffected.
Right to Object Pursuant to Art. 21 GDPR
Where your personal data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation.
If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing is required for the establishment, exercise, or defense of legal claims.
Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such purposes. Following your objection, your personal data will no longer be used for direct marketing.
Right to Lodge a Complaint with a Supervisory Authority
In the event of an infringement of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority.
This applies in particular to a supervisory authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
Right to Data Portability
Under the statutory requirements, you have the right to receive personal data that we process automatically on the basis of your consent or for the performance of a contract in a structured, commonly used, and machine-readable format, or to request that such data be transmitted to another controller.
Direct transmission to another controller will take place only where technically feasible.
Access, Rectification, and Erasure
Within the scope of the applicable statutory provisions, you have the right to request information about the personal data stored concerning you.
You also have the right, subject to the statutory requirements, to request the rectification of inaccurate data and the erasure of your personal data.
Right to Restriction of Processing
Under the statutory requirements, you have the right to request restriction of the processing of your personal data.
This applies in particular:
-
if you contest the accuracy of the personal data stored by us and we require time to verify its accuracy;
-
if the processing is unlawful and you request restriction of processing instead of erasure;
-
if we no longer require your personal data but you require it for the establishment, exercise, or defense of legal claims;
-
if you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether our legitimate grounds override yours.
SSL or TLS Encryption
For security reasons and to protect the transmission of confidential content, in particular orders and enquiries, this website uses SSL or TLS encryption.
You can recognize an encrypted connection, among other things, by the fact that the address line of your browser begins with "https://".
Objection to Promotional Emails
We object to the use of contact details published as part of statutory information requirements for the purpose of sending unsolicited advertising and informational materials.
We reserve the right to take legal action in the event of unsolicited promotional information being sent, in particular by spam email.
4. Data Collection on This Website
Cookies and Similar Technologies
Our website uses cookies and similar technologies. Cookies are small data records that are stored on your device or may allow access to information already stored on your device.
Some cookies and similar technologies are technically necessary for the proper functioning of the website and online store. These include, for example, functions used to manage the shopping cart, checkout, certain settings, or the security of the online store.
Where the storage of information on your device or access to information already stored on it is strictly necessary to provide a digital service expressly requested by you, no consent is required pursuant to Section 25(2) TDDDG.
Subsequent processing of personal data is based, depending on the respective purpose, in particular on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
Other cookies and similar technologies, for example for statistics, analytics, personalization, or marketing, are used only where you have given your consent. In these cases, the legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
You can change or withdraw your consent at any time with effect for the future using the "Cookie Preferences" or cookie settings available on our website.
You may also configure your browser to notify you when cookies are being set, permit cookies only in individual cases, prevent cookies in certain cases or generally, or automatically delete cookies when closing the browser. Disabling cookies entirely may restrict certain functions of our online store.
Contact Form
If you contact us using the contact form available on this website, we process the information you provide for the purpose of handling your enquiry.
This includes, in particular, your email address, your message, and your name where provided.
Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract.
In all other cases, processing is based on our legitimate interest in efficiently handling enquiries addressed to us pursuant to Art. 6(1)(f) GDPR or, where consent has been requested, on Art. 6(1)(a) GDPR.
The data submitted as part of a contact enquiry will be deleted once the purpose of the processing no longer applies and no statutory retention obligations or other legal grounds require further storage.
Contact by Email or Telephone
If you contact us by email or telephone, we process your enquiry, including the associated personal data, for the purpose of handling your request.
Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures.
In all other cases, processing is based on our legitimate interest in efficiently handling enquiries pursuant to Art. 6(1)(f) GDPR or on your consent pursuant to Art. 6(1)(a) GDPR where such consent has been requested.
Customer Account
Where you create or use a customer account in our online store, we process the personal data required for this purpose.
This may include, in particular, your name, email address, billing and shipping addresses, and information relating to your orders.
Processing is carried out for the purpose of providing and managing your customer account and facilitating contract processing on the basis of Art. 6(1)(b) GDPR.
If you request deletion of your customer account, the data stored in the account will be deleted unless statutory retention obligations or other legal grounds prevent deletion.
Data Processing for Orders and Contract Performance
When you place an order through our online store, we process the personal data required to process the order and perform the contract.
This includes, in particular, your name, billing and shipping address, email address, telephone number where applicable, as well as information about the products ordered, the selected shipping and payment method, and the respective payment status.
Where you provide additional information as part of the order or product configuration, for example information regarding the requested product configuration or individual setup, this data is also processed for the purpose of handling your order and preparing an appropriate product recommendation or configuration.
Processing takes place for the purpose of handling your order, performing the contract, delivering the ordered goods, processing payments, issuing invoices, and, where applicable, handling returns, warranty claims, and other contract-related enquiries.
The legal basis for this processing is Art. 6(1)(b) GDPR where processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.
Where we are required to process or retain certain data under commercial, tax, or other statutory provisions, processing is additionally based on Art. 6(1)(c) GDPR.
For the performance of the contract, the required data may be transferred to service providers and contractual partners used by us. These include, in particular, payment service providers, shipping and logistics companies, as well as service providers and systems used by us for operating the online store, inventory management, invoicing, and accounting.
Data collected in connection with an order is generally stored for the duration of the contractual relationship and contract processing. Where statutory commercial or tax retention obligations apply, the relevant data will additionally be stored for the respective statutory retention period. The data will be deleted after these periods have expired unless further legal grounds justify continued storage.
Payment Processing
We use various payment methods and payment service providers to process payments. Depending on the payment method selected by you, the data required for payment processing is transferred to the respective payment service provider.
The transfer takes place on the basis of Art. 6(1)(b) GDPR where it is necessary to perform the contract concluded with you and to process the payment. Where payment service providers process personal data under their own responsibility, their respective privacy policies additionally apply.
Shopify Payments
We offer payments via the Shopify Payments payment service.
The provider is:
Shopify International Limited
Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland
When you select a payment method offered via Shopify Payments, the data required to process the payment is transferred to Shopify and to the payment service providers and payment processors used for the respective payment method.
This may include, in particular, your name, billing address, payment information, order amount, currency, and transaction data.
The data is processed for the purposes of payment processing, fraud prevention, and compliance with statutory requirements relating to payment services.
Further information on the processing of personal data can be found in Shopify's privacy information and in the privacy information of the respective payment service providers.
PayPal
We offer payment via PayPal on this website.
The provider of this payment service is:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
If you select PayPal as your payment method, the data required to process the payment is transferred to PayPal.
This may include, in particular, your name, address, email address, invoice amount, and information relating to the relevant transaction.
The transfer is carried out for the purpose of processing the payment and is therefore based on Art. 6(1)(b) GDPR.
PayPal may additionally process personal data under its own responsibility, in particular for fraud prevention, identity verification, and compliance with legal obligations.
Further information on the processing of personal data by PayPal can be found in PayPal's Privacy Policy.
Bank Transfer
If you choose to pay by bank transfer, the data required to process the payment is processed by the financial institutions involved.
In connection with the payment, we receive, in particular, information about the account holder, the amount transferred, the payment reference, and, where applicable, other transaction data transmitted by your financial institution.
Processing is carried out for the purpose of allocating the payment and performing the contract on the basis of Art. 6(1)(b) GDPR.
Shipping and Delivery
For the delivery of your order, we transfer the personal data required for delivery to the shipping or logistics company commissioned with the delivery.
This includes, in particular, your name and shipping address and, where necessary for delivery or requested by you, additional contact details.
The transfer takes place for the purpose of performing the contract on the basis of Art. 6(1)(b) GDPR.
For shipping, we use in particular services provided by DHL and/or companies of the DHL Group.
Where additional contact details such as your email address or telephone number are transferred to the shipping service provider in order to provide you with shipment notifications or further delivery information, such transfer takes place only where an appropriate legal basis exists.
For deliveries to countries outside the European Union, data may also be transferred to foreign shipping service providers as well as customs and tax authorities where this is necessary to carry out the delivery or comply with legal obligations.
Inventory Management, Invoicing, and Accounting
For order processing, inventory management, invoicing, and compliance with our commercial and tax obligations, we process customer, order, invoice, and payment data in the IT and inventory management systems used by us for these purposes.
Personal data may in particular be processed in our inventory management system and, where required for accounting and tax processing, transferred to accounting service providers, tax advisors, or corresponding accounting systems used by us.
Where processing directly serves contract performance, it is based on Art. 6(1)(b) GDPR.
Where processing is required to comply with statutory accounting, tax, or retention obligations, it is based on Art. 6(1)(c) GDPR.
The relevant data is stored for the duration of the applicable statutory retention periods and subsequently deleted unless another legal basis justifies continued storage.
5. Social Media
Our website contains a link to our profile on the Instagram social network.
The provider of this service for users in the European Economic Area is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
The Instagram link used on our website is a simple link to an external service. Merely visiting our website does not establish a connection to Instagram through this link.
Only when you click the Instagram link do you leave our website, and personal data may then be processed by Meta or Instagram.
This may include, in particular, your IP address, information about your device and browser, and information relating to your access to Instagram.
If you are logged into your Instagram account, Instagram may associate your visit with your user account.
We have no influence over the nature and extent of the subsequent data processing carried out by Instagram.
Further information can be found in the privacy information provided by Instagram and Meta.
6. Newsletter
Newsletter Data
If you subscribe to a newsletter offered by us, we process your email address and, where applicable, other data voluntarily provided by you for the purpose of sending the newsletter.
Processing is based on your consent pursuant to Art. 6(1)(a) GDPR.
You may withdraw your consent to receive the newsletter at any time with effect for the future, for example by using the unsubscribe link contained in each newsletter.
The lawfulness of processing carried out before withdrawal remains unaffected.
Data stored for the purpose of sending the newsletter is generally retained until you unsubscribe and will subsequently be deleted from the newsletter distribution list unless another legal basis requires further storage.
After you unsubscribe, your email address may be stored in a suppression list where this is necessary to ensure that you do not receive further newsletters.
Processing for this purpose is based on our legitimate interest in complying with your unsubscribe request and applicable legal requirements pursuant to Art. 6(1)(f) GDPR.
Data stored by us for other purposes independently of the newsletter, for example in connection with an order, remains unaffected.
7. Plugins and External Content
YouTube
Our website may contain embedded videos from the YouTube service.
The provider for users in the European Economic Area is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
When an embedded YouTube video is loaded or played, a connection may be established with servers operated by Google or YouTube.
In this context, your IP address, information about your device and browser, the page you visited, and information about your use of the video may be processed.
YouTube may also use cookies or similar technologies and process information relating to your use of the embedded video.
If you are logged into your Google or YouTube account at the same time, Google may be able to associate your use of the video with your user account.
Where information is stored on or accessed from your device in connection with the YouTube integration and such processing is not strictly necessary for providing the service expressly requested by you, this takes place on the basis of your consent pursuant to Section 25(1) TDDDG.
The related processing of personal data is based on your consent pursuant to Art. 6(1)(a) GDPR.
You may change or withdraw your consent at any time with effect for the future via the cookie settings available on our website.
Google may also process personal data outside the European Economic Area, in particular in the United States.
Further information about the processing and transfer of personal data and your data protection rights can be found in Google's privacy information.
Source: eRecht24 – adapted and translated version