Privacy Policy

This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as ‘data’) within our online offering and the websites, functions and content connected with it, as well as external online presences such as our social media profiles (hereinafter collectively referred to as the ‘online offering’). With regard to the terminology used, such as ‘processing’ or ‘controller’, we refer to the definitions in Art. 4 of the General Data Protection Regulation (DSGVO).

Controller

NUXOA GmbH Hauptstraße 20A 82216 Maisach kontakt@nuxoa.de Managing Directors: Maximilian Dallmair, Richard Reibert Legal notice: https://nuxoa.de/impressum

Types of Data Processed

– Master data (e.g. names, addresses). – Contact data (e.g. email, telephone numbers). – Content data (e.g. text entries, photographs, videos). – Usage data (e.g. websites visited, interest in content, access times). – Meta/communication data (e.g. device information, IP addresses).

Categories of Data Subjects

Visitors to and users of the online offering (hereinafter we also refer to the data subjects collectively as ‘users’).

Purpose of Processing

– Provision of the online offering, its functions and content. – Responding to contact inquiries and communicating with users. – Security measures. – Reach measurement/marketing.

Terminology Used

‘Personal data’ means any information relating to an identified or identifiable natural person (hereinafter ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

‘Processing’ means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically every form of handling data.

‘Pseudonymization’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures ensuring that the personal data is not attributed to an identified or identifiable natural person.

‘Profiling’ means any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

‘Controller’ means the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data.

‘Processor’ means a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

Applicable Legal Bases

In accordance with Art. 13 DSGVO, we inform you of the legal bases for our data processing. Where the legal basis is not stated in this Privacy Policy, the following applies: the legal basis for obtaining consent is Art. 6 Abs. 1 lit. a and Art. 7 DSGVO; the legal basis for processing in order to provide our services, carry out contractual measures and respond to inquiries is Art. 6 Abs. 1 lit. b DSGVO; the legal basis for processing in order to comply with our legal obligations is Art. 6 Abs. 1 lit. c DSGVO; and the legal basis for processing in order to safeguard our legitimate interests is Art. 6 Abs. 1 lit. f DSGVO. Where the vital interests of the data subject or another natural person require the processing of personal data, Art. 6 Abs. 1 lit. d DSGVO serves as the legal basis.

Security Measures

In accordance with Art. 32 DSGVO and taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access, entry, disclosure, availability and separation in relation to the data. We have also established procedures that ensure the exercise of data-subject rights, the erasure of data and a response to risks affecting the data. Furthermore, we take the protection of personal data into account at the development or selection stage for hardware, software and procedures, in accordance with the principles of data protection by design and by default (Art. 25 DSGVO).

Cooperation with Processors and Third Parties

Where, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transfer it to them or otherwise grant them access to the data, this takes place only on the basis of statutory authorization (e.g. where a transfer of data to third parties such as payment service providers is necessary for performance of a contract pursuant to Art. 6 Abs. 1 lit. b DSGVO), where you have consented, where a legal obligation requires it or on the basis of our legitimate interests (e.g. when using contractors, web hosts, etc.).

Where we commission third parties to process data on the basis of a so-called ‘data processing agreement’, this is done on the basis of Art. 28 DSGVO.

Transfers to Third Countries

Where personal data is transferred to a country outside the European Union or the European Economic Area, we comply with the requirements of Art. 44 ff. DSGVO. Such transfers are made in particular on the basis of an adequacy decision by the European Commission, appropriate safeguards such as the Standard Contractual Clauses, or a statutory exemption.

Rights of Data Subjects

In accordance with Art. 15 DSGVO, you have the right to request confirmation as to whether relevant data is being processed and to receive information about this data, as well as further information and a copy of the data.

In accordance with Art. 16 DSGVO, you have the right to request that data concerning you be completed or that inaccurate data concerning you be rectified.

In accordance with Art. 17 DSGVO, you have the right to request that relevant data be erased without undue delay, or alternatively, in accordance with Art. 18 DSGVO, to request restriction of the processing of the data.

In accordance with Art. 20 DSGVO, you have the right to request receipt of the data concerning you that you have provided to us and to request its transmission to other controllers.

Furthermore, pursuant to Art. 77 DSGVO, you have the right to lodge a complaint with the competent supervisory authority.

Right to Withdraw Consent

You have the right to withdraw consent previously granted pursuant to Art. 7 Abs. 3 DSGVO with effect for the future.

Right to Object

You may object at any time to the future processing of data concerning you in accordance with Art. 21 DSGVO. In particular, an objection may be made against processing for direct marketing purposes.

Cookies and the Right to Object to Direct Marketing

‘Cookies’ are small files stored on users' computers. Different information may be stored within cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after a visit to an online offering. Temporary cookies, also known as ‘session cookies’ or ‘transient cookies’, are cookies that are deleted after a user leaves an online offering and closes the browser. Such a cookie may, for example, store the contents of a shopping cart in an online shop or a login status. Cookies that remain stored even after the browser is closed are referred to as ‘permanent’ or ‘persistent’. For example, the login status may be stored when users return after several days. Such a cookie may likewise store users' interests for reach measurement or marketing purposes. ‘Third-party cookies’ are cookies offered by providers other than the controller operating the online offering (where only the controller's own cookies are involved, these are referred to as ‘first-party cookies’).

We may use temporary and permanent cookies and provide information about this within our Privacy Policy.

If users do not want cookies to be stored on their computer, they are asked to disable the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may restrict the functionality of this online offering.

A general objection to the use of cookies for online marketing purposes can be declared for many services, particularly in the case of tracking, via the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/. Cookies can also be prevented from being stored by disabling them in the browser settings. Please note that, in this case, not all functions of this online offering may be available.

Erasure of Data

The data we process is erased or its processing restricted in accordance with Art. 17 and 18 DSGVO. Unless expressly stated otherwise in this Privacy Policy, data stored by us is erased as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent its erasure. Where data is not erased because it is required for other legally permissible purposes, its processing is restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax-law reasons.

Under statutory requirements in Germany, records are retained in particular for 10 years pursuant to §§ 147 Abs. 1 AO, 257 Abs. 1 Nr. 1 and 4, Abs. 4 HGB (books, records, management reports, accounting documents, commercial books, documents relevant for taxation, etc.) and for 6 years pursuant to § 257 Abs. 1 Nr. 2 and 3, Abs. 4 HGB (commercial correspondence).

Under statutory requirements in Austria, records are retained in particular for 7 years pursuant to § 132 Abs. 1 BAO (accounting documents, receipts/invoices, accounts, records, business papers, statements of income and expenditure, etc.), for 22 years in connection with real property, and for 10 years for documents relating to electronically supplied services, telecommunications, radio and television services provided to non-business customers in EU Member States for which the Mini One Stop Shop (MOSS) is used.

Business-Related Processing

In addition, we process – contractual data (e.g. subject matter of the contract, term, customer category) – payment data (e.g. bank details, payment history) relating to our customers, prospective customers and business partners for the purpose of providing contractual services, service and customer support, marketing, advertising and market research.

Order Processing in the Online Shop and Customer Account

We process our customers' data as part of the ordering processes in our online shop to enable them to select and order the chosen products and services and to arrange their payment and delivery or performance.

The data processed includes master data, communication data, contractual data and payment data; the persons affected by the processing include our customers, prospective customers and other business partners. Processing is carried out for the purpose of providing contractual services in connection with operating an online shop, billing, delivery and customer service. In this context, we use session cookies to store shopping-cart contents and permanent cookies to store login status.

Processing is based on Art. 6 Abs. 1 lit. b (performance of ordering processes) and c (statutory archiving requirements) DSGVO. The information marked as required is necessary to establish and perform the contract. We disclose the data to third parties only in connection with delivery or payment, or within the scope of statutory permissions and obligations toward legal advisers and authorities. The data is processed in third countries only where this is necessary for performance of the contract (e.g. at the customer's request in connection with delivery or payment).

Users may optionally create a user account through which, in particular, they can view their orders. During registration, users are informed of the required mandatory information. User accounts are not public and cannot be indexed by search engines. When users terminate their user account, their data relating to the account is erased, unless retention is necessary for commercial or tax-law reasons pursuant to Art. 6 Abs. 1 lit. c DSGVO. Information in the customer account remains there until the account is erased, followed by archiving where there is a legal obligation. Users are responsible for backing up their data before the end of the contract following termination.

During registration and subsequent logins, and when our online services are used, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests, as well as those of users, in protection against misuse and other unauthorized use. As a rule, this data is not disclosed to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6 Abs. 1 lit. c DSGVO.

Erasure takes place after the expiry of statutory warranty and comparable obligations; the necessity of retaining the data is reviewed every three years. Where statutory archiving obligations apply, erasure takes place after they expire (at the end of the commercial-law (6-year) and tax-law (10-year) retention periods).

External Payment Service Providers

We use external payment service providers through whose platforms users and we can carry out payment transactions (e.g., in each case with a link to the privacy policy: Paypal (https://www.paypal.com/de/webapps/mpp/ua/privacy-full), Klarna (https://www.klarna.com/de/datenschutz/), Skrill (https://www.skrill.com/de/fusszeile/datenschutzrichtlinie/), Giropay (https://www.giropay.de/rechtliches/datenschutz-agb/), paysafecard (https://www.paysafecard.com/de-de/datenschutz/), Visa (https://www.visa.de/datenschutz), Mastercard (https://www.mastercard.de/de-de/datenschutz.html), American Express (https://www.americanexpress.com/de/content/privacy-policy-statement.html)

For the performance of contracts, we use payment service providers on the basis of Art. 6 Abs. 1 lit. b. DSGVO. In other respects, we use external payment service providers on the basis of our legitimate interests pursuant to Art. 6 Abs. 1 lit. b. DSGVO in order to offer our users effective and secure payment options.

The data processed by payment service providers includes master data such as names and addresses; bank data such as account or credit card numbers; passwords, TANs and checksums; and contractual, amount-related and recipient-related information. This information is required to carry out the transactions. However, the data entered is processed and stored only by the payment service providers. This means that we do not receive any account- or credit-card-related information, but only information confirming the payment or reporting its rejection. In some circumstances, payment service providers may transmit the data to credit agencies. The purpose of this transmission is identity and creditworthiness checks. In this regard, we refer to the terms and conditions and privacy notices of the payment service providers.

The terms and conditions and privacy notices of the respective payment service providers, which can be accessed on the relevant websites or transaction applications, apply to payment transactions. We also refer to these for further information and for exercising rights of withdrawal, access and other data-subject rights.

Tracking and Use of Data within Affiliate Systems

Within our online offering, and on the basis of our legitimate interests (i.e. an interest in analyzing, optimizing and commercially operating our online offering) pursuant to Art. 6 Abs. 1 lit. f DSGVO, we use industry-standard tracking measures to the extent necessary for operating the affiliate system. Below, we inform users about the technical background.

The services offered by our contractual partners may also be advertised and linked on other websites (so-called affiliate links or after-buy systems, for example where links or third-party services are offered after a contract is concluded). The operators of the respective websites receive a commission when users follow the affiliate links and subsequently take up the offers.

In summary, our online offering requires us to be able to track whether users who are interested in affiliate links and/or the offers available from us subsequently take up those offers as a result of the affiliate links or our online platform. To this end, certain values are added to the affiliate links and our offers; these values may form part of the link or be set elsewhere, for example in a cookie. The values include, in particular, the originating website (referrer), the time, an online identifier of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, an online identifier of the user, and tracking-specific values such as advertising-material ID, partner ID and categorizations.

The online identifiers of users that we use are pseudonymous values. This means that the online identifiers themselves do not contain personal data such as names or email addresses. They merely help us determine whether the same user who clicked an affiliate link or expressed interest in an offer through our online offering took up that offer, e.g. concluded a contract with the provider. However, the online identifier is personal data to the extent that both the partner company and we possess it together with other user data. Only in this way can the partner company inform us whether that user took up the offer and enable us, for example, to pay out the bonus.

Registration Function

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed on the basis of Art. 6 Abs. 1 lit. b DSGVO for the purpose of providing the user account. The data processed includes, in particular, login information (name, password and an email address). The data entered during registration is used for the purpose of using the user account and for its intended purpose.

Users may be informed by email about information relevant to their user account, such as technical changes. When users terminate their user account, their data relating to the user account is erased, subject to any statutory retention obligation. Users are responsible for backing up their data before the end of the contract following termination. We are entitled to irretrievably erase all of the user's data stored during the term of the contract.

When our registration and login functions and the user account are used, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests, as well as those of users, in protection against misuse and other unauthorized use. As a rule, this data is not disclosed to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6 Abs. 1 lit. c DSGVO. IP addresses are anonymized or erased after no more than 7 days.

Contact

When contacting us (e.g. by contact form, email, telephone or social media), the user's information is processed to handle and respond to the contact inquiry pursuant to Art. 6 Abs. 1 lit. b) DSGVO. User information may be stored in a customer relationship management system (‘CRM system’) or a comparable inquiry-management system.

We erase inquiries when they are no longer required. We review necessity every two years; statutory archiving obligations also apply.

Online Presences on Social Media

We maintain online presences within social networks and platforms in order to communicate with customers, prospective customers and users active there and to inform them about our services. When the respective networks and platforms are accessed, the terms and conditions and data processing policies of their respective operators apply.

Unless stated otherwise in our Privacy Policy, we process users' data where they communicate with us within social networks and platforms, e.g. by publishing posts on our online presences or sending us messages.