Privacy Policy

This privacy policy informs you about the nature, scope and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offering and the associated websites, functions and content, as well as external online presences such as our social media profiles (hereinafter collectively referred to as the “online offering”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

1. Information on the collection of personal data and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data is any data that can be used to personally identify you.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Alexo GbR, Eversbuschstr. 171, 80999 Munich, Tel.: +49 (0) 1577 1818140, Email: hello@streetsoup.shop. The controller for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the “https://” prefix and the padlock symbol in your browser's address bar.

2. Data collection when visiting our website

When you use our website purely for informational purposes, i.e. when you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The website you visited
• Date and time of access
• Amount of data sent in bytes
• Source/referrer from which you accessed the page
• Browser used
• Operating system used
• IP address used (where applicable, in anonymised form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used for any other purpose. However, we reserve the right to review the server log files retrospectively should there be concrete indications of unlawful use.

3. Cookies

To make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your device and enable us or our partner companies (third-party cookies) to recognise your browser the next time you visit (persistent cookies). If cookies are set, they collect and process certain user information to a varying extent, such as browser and location data as well as IP address values. Persistent cookies are automatically deleted after a specified period, which can vary depending on the cookie.

Some cookies are used to simplify the ordering process by storing settings (e.g. remembering the contents of a virtual shopping basket for a later visit to the website). Insofar as personal data is also processed by individual cookies we have implemented, this processing is carried out either in accordance with Art. 6(1)(b) GDPR to perform the contract, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

We may work with advertising partners who help us make our online offering more interesting for you. For this purpose, cookies from partner companies are also stored on your hard drive when you visit our website (third-party cookies). If we work with the aforementioned advertising partners, you will be informed individually and separately about the use of such cookies and the scope of the information collected in each case within the following paragraphs.

Please note that you can set your browser so that you are informed when cookies are set and can decide individually whether to accept them, or you can exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings.

Please note that if you do not accept cookies, the functionality of our website may be limited.

4. Contact

When you contact us (e.g. via contact form, email, telephone or social media), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your enquiry or for making contact and the associated technical administration. The legal basis for processing the data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted once your enquiry has been finally dealt with, which is the case when it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided no statutory retention obligations apply.

5. Data processing when opening a customer account and for contract processing

We process our customers' data as part of the ordering process in our online shop in order to enable them to select and order the chosen products and services, as well as their payment and delivery, or performance.

The data processed includes master data, communication data, contract data, payment data, and the data subjects affected by the processing include our customers, prospective customers and other business partners. Processing is carried out for the purpose of providing contractual services within the scope of operating an online shop, billing, delivery and customer services. We use session cookies to store shopping basket contents and persistent cookies to store login status.

Processing is carried out on the basis of Art. 6(1)(b) (performance of orders) and (c) (statutorily required archiving) GDPR. The details marked as required are necessary to establish and fulfil the contract. We only disclose the data to third parties within the scope of delivery, payment or within the scope of statutory permissions and obligations towards legal advisors and authorities. The data is only processed in third countries if this is necessary for the performance of the contract.

Users can optionally create a user account. As part of registration, users are informed of the required mandatory details. User accounts are not public. If users have terminated their user account, their data will be deleted, subject to retention where necessary for commercial or tax law reasons in accordance with Art. 6(1)(c) GDPR.

The IP address is stored during registration and login on the basis of our legitimate interests in protecting against misuse (Art. 6(1)(f) GDPR).

6. Use of your data for direct marketing

6.1 Signing up for our email newsletter

If you sign up for our email newsletter, we will regularly send you information about our offers. The only mandatory detail is your email address. We use the double opt-in procedure for sending the newsletter. By activating the confirmation link, you give us your consent to use your data pursuant to Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time.

6.2 Sending the email newsletter to existing customers

If you provided us with your email address when making a purchase, we reserve the right to regularly send you offers for similar goods by email (Section 7(3) UWG [German Act Against Unfair Competition]; Art. 6(1)(f) GDPR). You can object to this use at any time.

6.3 Newsletter distribution via Omnisend

Our email newsletter is sent via the technical service provider Omnisend, to whom we pass on the data you provided when signing up for the newsletter (Art. 6(1)(f) GDPR). Please note that your data is generally transferred to and stored on an Omnisend server in the USA.

Omnisend uses this information for sending and for statistical evaluation. The data is collected exclusively in pseudonymised form.

To protect your data in the USA, we have concluded a Data Processing Agreement with Omnisend based on the European Commission's standard contractual clauses. Omnisend is also certified under the EU-U.S. Data Privacy Framework (DPF), which ensures compliance with the European level of data protection. Omnisend's privacy policy can be found at: https://www.omnisend.com/privacy/

6.4 Advertising by post

On the basis of our legitimate interest in personalised direct marketing, we reserve the right to store your name and postal address (pursuant to Art. 6(1)(f) GDPR) and to use them to send you offers of interest by post. You can object to this storage at any time.

7. Data processing for order fulfilment

7.1 To process your order, we work with service providers (e.g. transport companies and payment service providers) (Art. 6(1)(b) and (f) GDPR). For payment transactions, we refer to the terms and conditions and privacy notices of the respective providers.

7.2 We pass on your name and delivery address exclusively for the purpose of delivering goods to a shipping partner (Art. 6(1)(b) GDPR).

7.3 Use of specialist order-processing service providers

Shipping is carried out via “LSM Fulfillment GmbH” (Straßäcker 2, 94330 Salching). Disclosure is made in accordance with Art. 6(1)(b) GDPR. (Privacy policy: https://www.fulfillment-ecommerce.de/datenschutz/)

7.4 Disclosure to shipping service providers (DHL / UPS)

Provided you have given your express consent (Art. 6(1)(a) GDPR), we pass on your email address for delivery notification purposes to DHL (Deutsche Post AG) or UPS (United Parcel Service Deutschland Inc. & Co. OHG). Otherwise, we only pass on your name and delivery address (Art. 6(1)(b) GDPR). Consent can be withdrawn at any time.

7.5 Use of payment service providers

Amazon Pay: payment processing via Amazon Payments Europe s.c.a. (Art. 6(1)(b) GDPR). Privacy policy: https://pay.amazon.com/de/help/201751600

PayPal: payment processing via PayPal (Europe) S.a.r.l. et Cie, S.C.A. (Art. 6(1)(b) GDPR). For certain payment methods, PayPal reserves the right to obtain a credit report (Art. 6(1)(f) GDPR). Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Klarna (purchase on account): transmission of contact and order data to Klarna to assess payment options. Privacy policy: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy

8. Use of social media: social plugins

8.1 Facebook as a standard plugin

Our website uses social plugins from the social network Facebook. The provider for users in the EU is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The parent company is Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

When you visit a page that contains a plugin, your browser establishes a connection to Meta's servers. Through this integration, Meta receives the information that you have accessed the page, even if you do not have a profile. This information is transmitted directly to a Meta server in the USA.

Data processing is carried out in accordance with Art. 6(1)(f) GDPR (or Art. 6(1)(a) GDPR where consent has been given) to design the service to meet demand.

Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF), which ensures compliance with the level of data protection applicable in the EU for data transfers to the USA.

Meta's (Facebook's) privacy notices: http://www.facebook.com/policy.php

8.2 Instagram as a standard plugin

Our website uses social plugins from the Instagram service. The provider for the EU is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (parent company: Meta Platforms, Inc., USA).

By integrating the plugin, Meta receives the information that your browser has accessed the page. This information is transmitted to a server in the USA. Processing is carried out in accordance with Art. 6(1)(f) GDPR (or Art. 6(1)(a) GDPR).

Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF), which guarantees an appropriate level of data protection.

Instagram's privacy notices: https://help.instagram.com/155833707900388/

9. Online marketing (Google Ads conversion tracking)

This website uses the online advertising programme “Google Ads” (formerly AdWords) and the conversion tracking of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

The conversion tracking cookie is set when a user clicks on an advertisement placed by Google (validity: generally 30 days). The information collected is used to compile conversion statistics. We use Google Ads on the basis of our legitimate interest in targeted advertising pursuant to Art. 6(1)(f) GDPR (or pursuant to Art. 6(1)(a) GDPR where consent has been given).

Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF), which ensures compliance with the European level of data protection.

Further information: http://www.google.de/policies/privacy/

10. Web analysis services (Google Analytics 4)

This website uses Google Analytics 4, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics 4 uses “cookies”. The information generated is generally transferred to and stored on a Google server in the USA. Google Analytics 4 does not process full IP addresses; IP addresses are shortened and anonymised by default before being stored.

Processing is carried out on the basis of our legitimate interest (Art. 6(1)(f) GDPR) or, where obtained, on the basis of your consent (Art. 6(1)(a) GDPR).

Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF), thereby ensuring an appropriate level of data protection for data transfers to the USA.

You can prevent collection by Google Analytics by installing the browser add-on to disable Google Analytics: http://tools.google.com/dlpage/gaoptout?hl=de

Users' personal data is generally deleted or anonymised after 14 months.

11. Retargeting / remarketing / referral advertising

11.1 Meta (Facebook) Custom Audiences via the pixel method

We use the so-called “Meta Pixel” for analysis and optimisation purposes. The provider for users in the EU is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Meta Platforms, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework (DPF), thereby providing a guarantee that it complies with European data protection law.

With the help of the Meta Pixel, we can track the effectiveness of Facebook/Instagram advertisements and deliver targeted advertising (Custom Audiences). Processing is carried out within the scope of Meta's Data Policy: https://www.facebook.com/policy.php

You can object to the collection and use of your data here: https://www.facebook.com/settings?tab=ads

11.2 Meta (Facebook) Messenger Chat

If you write to us via Messenger, we will inform you about news with your permission. If you use this channel for support, we only exchange the data required. Please note that Meta (Meta Platforms Ireland Limited) gains access to this data. Privacy notices: https://www.facebook.com/about/privacy/

11.3 Google Ads remarketing

We use the remarketing services of Google Ireland Limited (or Google LLC, USA). Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF).

These services allow us to display advertisements for and on our website in a more targeted way (Art. 6(1)(f) or (a) GDPR). For this purpose, codes are executed and remarketing tags that store a cookie are integrated when you access our website. Users' data is processed pseudonymously.

You can object to interest-based advertising here: http://www.google.com/ads/preferences

12. Rights of the data subject

12.1 Applicable data protection law grants you comprehensive data subject rights against the controller (Art. 15 et seq. GDPR):

• Right to access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

12.2 RIGHT TO OBJECT

If we process your data on the basis of our overriding legitimate interest, you have the right to object to this processing at any time, with effect for the future, on grounds arising from your particular situation.

If your data is processed in order to carry out direct marketing, you have the right to object to this processing for the purposes of such advertising at any time.

13. Duration of storage of personal data

The data we process is deleted or its processing restricted in accordance with Art. 17 and 18 GDPR as soon as it is no longer required for its intended purpose and no statutory retention obligations apply (e.g. 10 years for tax-relevant documents pursuant to the German Fiscal Code/Commercial Code, 6 years for commercial correspondence).

14. Administration, financial accounting, office organisation

We process data as part of administrative tasks, financial accounting and compliance with statutory obligations (Art. 6(1)(c) and (f) GDPR). In doing so, we disclose or transmit data to the tax authorities, advisors (e.g. tax advisors) and payment service providers. We generally store business-related data of business partners permanently.

15. Business analysis and market research

In order to identify market trends and customer wishes, we analyse available data (Art. 6(1)(f) GDPR). Insofar as these analyses or profiles are personal in nature, they are deleted or anonymised when the user's account is terminated, otherwise generally two years after the contract is concluded.

16. Changes to the privacy policy and contact

We may update our privacy policy from time to time. We will inform you of any changes by publishing the new privacy policy on this page. If you have any questions about this privacy policy, you can contact us by email: hello@streetsoup.shop