Privacy Policy for the Pikeur Online Shop

We explain how we process personal data when you visit our website, place an order in the online shop, create a customer account, contact us or subscribe to our newsletter. We also provide information about analytics and advertising services, external links and your data protection rights.

1 Controller and data protection contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Pikeur Reitmoden Brinkmann GmbH & Co. KG
Esch 19
33824 Werther
Germany
Email: service.shop@pikeur.de
Telephone: +49 5203 704-0

You can contact our data protection officer at datenschutz-team@audatis.de.

2 Visiting the website and hosting

2.1 Access data

When you access our website, the web server processes access data that is technically necessary. This includes, in particular, your IP address, the date and time of access, the page or file requested, the volume of data transferred, the access status, browser and operating system information and, where applicable, the page previously visited, if your browser transmits this information.

We process this data to provide the website, ensure its secure operation, analyse errors and prevent misuse or attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our online services.

Server log files are deleted after one month. In the event of specific security incidents, individual log records may be retained until the incident has been resolved and, where necessary, for the establishment or defence of legal claims.

2.2 Hosting

Our website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany. Hetzner processes the data required to operate the website on our behalf. Processing takes place on the basis of a data processing agreement pursuant to Article 28 GDPR. Further information: https://www.hetzner.com/de/legal/privacy-policy/.

3 Orders, customer accounts and contacting us

3.1 Orders and performance of the contract

When you place an order, we process the data required for this purpose. This includes, in particular, your name, billing and delivery addresses, email address, the items ordered, order number, payment method and payment status, as well as any other information required for the specific order. Mandatory information is marked during the ordering process. Without this information, we cannot process your order.

We use this data to process and fulfil your order and to handle returns, complaints and warranty claims. The legal basis is Article 6(1)(b) GDPR.

Where documents are subject to statutory retention obligations, we retain them pursuant to Article 6(1)(c) GDPR in conjunction with the applicable provisions of commercial and tax law. Depending on the type of document, the retention periods are six, eight or ten years and generally begin at the end of the calendar year. Data required for the establishment or defence of legal claims may also be retained pursuant to Article 6(1)(f) GDPR until the proceedings have concluded or the relevant limitation period has expired. The data is then deleted.

3.2 Customer account

If you create a customer account, we process your registration, contact and login data, as well as the order information stored in the account, to provide the account and facilitate future orders. The legal basis is Article 6(1)(b) GDPR. You can have your account deleted using the account function or by sending a message to service.shop@pikeur.de. We delete account data unless statutory retention obligations or other lawful grounds for retention prevent this. The required retention of order documents and invoices remains unaffected.

3.3 Contacting us

If you contact us by email, telephone or other means, we process your contact details, the content of your enquiry and the associated correspondence. For enquiries relating to a contract, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries on the basis of Article 6(1)(f) GDPR; our legitimate interest is to respond to your enquiry. We delete the data once the enquiry has been fully dealt with, unless retention obligations or grounds for the establishment or defence of legal claims prevent this.

3.4 Electronic withdrawal function

If you use the electronic withdrawal function in the shop, we process your name, your order or contract details, your email address, your declaration of withdrawal and the time at which it was received. We use this information to process your withdrawal and send you an acknowledgement of receipt. The legal bases are Article 6(1)(b) GDPR for the performance of the contract and Article 6(1)(c) GDPR for compliance with the statutory obligation to provide confirmation. The data is deleted once processing is complete, unless it is required to comply with statutory retention obligations or for the establishment or defence of legal claims.

4 Shipping and delivery notifications

For delivery, we transmit the necessary recipient and shipping data, in particular your name, delivery address and shipment details, to the shipping service provider engaged for this purpose. The legal basis is Article 6(1)(b) GDPR.

We currently use DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany. Privacy notice: https://www.dpd.com/de/de/datenschutz/.

If you have separately consented to delivery notifications or delivery coordination, we also transmit the contact details provided for this purpose, in particular your email address and, where applicable, telephone number, to the shipping service provider. The legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future. Delivery remains possible without this consent.

5 Payment processing and accounts receivable management

5.1 Mollie and the selected payment method

We use Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, for payment processing. Depending on the payment method selected, we transmit the data required for this purpose, in particular your name, contact and billing details, order number, amount, currency and transaction information. Payment data may be collected directly by Mollie or the selected payment provider. We transmit the data for the performance of the contract on the basis of Article 6(1)(b) GDPR.

The payment methods displayed at checkout may be offered through Mollie. Depending on which methods are enabled, these may include credit cards and wallets, PayPal, Klarna and regional payment methods such as EPS, iDEAL, Bancontact, Satispay or TWINT. Only the providers required for your selected payment method are involved.

Mollie processes data as an independent controller when processing payments, in particular to execute the payment, prevent fraud and comply with legal obligations. Further information about recipients, possible transfers to third countries, retention periods and your rights is available at https://www.mollie.com/de/legal/privacy. The privacy notices of any additional payment providers also apply and are made available to you when you select the payment method.

5.2 PayPal

If you select PayPal, payment processing involves PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The order and transaction data required for payment is transmitted via the Mollie integration. The legal basis is Article 6(1)(b) GDPR. PayPal also processes data for its own purposes as a controller, for example to prevent fraud and comply with legal obligations. Privacy notice: https://www.paypal.com/de/legalhub/paypal/privacy-full.

5.3 Klarna

If you select a Klarna payment method, the identity, contact, order and payment data required for this purpose is transmitted via Mollie to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. The legal basis is Article 6(1)(b) GDPR.

Klarna processes this data as an independent controller to provide the selected payment method. Depending on the payment product, Klarna may carry out identity, creditworthiness and fraud checks and involve credit reference agencies. The availability of a payment method may be determined automatically. Details, in particular about credit reference agencies, retention periods and rights relating to automated decisions, are provided in the privacy notice applicable to the selected product: https://www.klarna.com/de/datenschutz/. Selecting Klarna does not constitute general consent under data protection law. If the payment method is not offered, you can select another payment method displayed at checkout.

5.4 Accounts receivable management by PVS

For invoice processing, payment allocation and, where commissioned, payment reminders in connection with orders, we expect to use PVS Fulfillment-Service GmbH, Heinz-Nixdorf-Straße 2, 74172 Neckarsulm. Customer, invoice, order and payment data may be processed to the extent necessary for the commissioned tasks. The legal basis for the performance of the contract is Article 6(1)(b) GDPR; for the enforcement of outstanding claims, it is Article 6(1)(f) GDPR. Our legitimate interest is to assert valid payment claims. Statutory retention obligations are based on Article 6(1)(c) GDPR.

Where PVS provides these services on our behalf, PVS is a processor pursuant to Article 28 GDPR. Where a service provider collects debts in its own name or purchases receivables, it may act as an independent controller for this processing.

6 Newsletter via Mailchimp

6.1 Subscription and sending

If you subscribe to our newsletter, we use your email address and any information you provide voluntarily to send you information about our products and offers. The legal basis is your consent pursuant to Article 6(1)(a) GDPR. Subscription uses a double opt-in procedure. Your subscription is only activated after you confirm the link sent by email.

To provide evidence of your subscription and consent, we store the consent declaration used and the necessary supporting data, in particular the times of registration and confirmation and, where applicable, IP addresses. This serves to demonstrate consent pursuant to Article 7(1) GDPR; the legal basis for the necessary retention is Article 6(1)(f) GDPR. Our legitimate interest is to demonstrate that the newsletter subscription was lawful.

You may withdraw your consent at any time using the unsubscribe link in the newsletter or by sending a message to service.shop@pikeur.de. After unsubscribing, you will receive no further newsletters. Where necessary, we store your email address in a suppression list with restricted access to prevent further mailings. The legal basis is Article 6(1)(f) GDPR. We delete unconfirmed subscriptions after one month. We retain records of consent for as long as necessary for documentation and the defence of potential claims; we regularly review whether suppression list entries remain necessary.

6.2 Mailing service provider and transfers to third countries

We use Mailchimp, a service provided by The Rocket Science Group LLC, USA, to manage newsletter recipients and send newsletters. Mailchimp processes the recipient, subscription and mailing data required for this purpose on our behalf under an agreement pursuant to Article 28 GDPR.

This involves transferring data to the USA. Where the specific transfer is covered by the recipient’s certification under the EU-U.S. Data Privacy Framework, it takes place on the basis of the adequacy decision pursuant to Article 45 GDPR. Mailchimp’s data processing agreement also contains the European Commission’s standard contractual clauses. Information: https://mailchimp.com/gdpr/ and https://mailchimp.com/legal/data-processing-addendum/. Privacy notice: https://mailchimp.com/legal/privacy/.

6.3 Analysis of newsletter opens and link clicks

Newsletter opens and link clicks are not analysed on an individual basis.

7 Cookies and consent management

7.1 Necessary and optional technologies

We use cookies and similar technologies, such as local browser storage and tags. Technically necessary technologies enable, in particular, the shopping cart, login, security and the storage of your privacy settings. Where they are strictly necessary to provide a digital service expressly requested by you, access to your device takes place on the basis of Section 25(2), no. 2 TDDDG. The subsequent processing of personal data is based on Article 6(1)(b), (c) or (f) GDPR, depending on the purpose.

We use analytics and advertising technologies only after you have given your consent. The legal bases are Section 25(1) TDDDG for storing or accessing information on your device and Article 6(1)(a) GDPR for the subsequent processing of personal data. Refusing consent does not prevent you from placing an order in the shop.

The cookie settings provide information about the technologies used, their purposes, the providers involved and how long each technology is stored. You can change your selection or withdraw your consent there at any time. The lawfulness of processing carried out before withdrawal remains unaffected.

7.2 CookieFirst

To obtain, manage and document your consent, we use CookieFirst from Digital Data Solutions B.V., Plantage Middenlaan 42a, 1018 DH Amsterdam, Netherlands, as a processor.

The data processed includes, in particular, your consent choices, the time of your declaration, the version of the consent information, the page accessed, device and browser information and an identifier used to associate your choices with you. Your IP address may be processed for the technical provision of the service; according to the provider, it is anonymised in consent records. Your choices are stored in your browser; consent records are also processed on the provider’s servers.

The legal basis for documenting your consent is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. Section 25(2), no. 2 TDDDG applies to the necessary storage of your choices on your device. Further information: https://cookiefirst.com/legal/privacy-policy/.

8 Google services for analytics and advertising

The provider of the services described below is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Their use may involve processing by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and other Google companies. Information: https://policies.google.com/privacy.

Where a transfer to Google LLC is covered by its certification under the EU-U.S. Data Privacy Framework, it is based on the adequacy decision pursuant to Article 45 GDPR. Standard contractual clauses may apply to other transfers. Information: https://policies.google.com/privacy/frameworks.

8.1 Google Analytics 4

We use Google Analytics 4 to statistically analyse the use of our website and improve our services. After you give your consent, data processed may include, in particular, page views, interactions, the source of the visit, approximate location information and device and browser information. Cookies and similar identifiers may associate visits with a browser or device. This does not automatically make the data anonymous.

Google Analytics 4 processes the IP address to provide the service and derive approximate location information. Google states that it does not log or store the IP addresses of EU users. An agreement pursuant to Article 28 GDPR applies to the processing of analytics data on our behalf.

The legal bases are your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG. User and event data is deleted after 14 months; the lifetimes of Analytics cookies are listed in the cookie settings. Aggregated reports may be retained for longer.

8.2 Google Ads Remarketing

We use Google Ads Remarketing to show visitors to our website interest-based advertisements on other websites and within the Google advertising network. After you give your consent, pages visited, products viewed, technical information and cookie or advertising identifiers may be processed and used to create audiences. Depending on your Google settings, Google may link this information to a Google account and other information and use it across devices.

The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG. Membership of remarketing audiences ends after 30 days; cookie lifetimes are listed in the cookie settings. You may withdraw your consent there at any time. Settings for personalised Google advertising are available at https://myadcenter.google.com/.

8.3 Google Tag Manager

We use Google Tag Manager to manage and deliver the tags used on our website. Tag Manager itself does not analyse website visits. When it is accessed, technical data such as your IP address may be transmitted to Google. The analytics and advertising services integrated through it are described in the preceding sections and are only run with the required consent.

The external Google Tag Manager is loaded only after you have consented to the analytics or advertising services provided through it. The legal basis is Article 6(1)(a) GDPR; Section 25(1) TDDDG applies to access to devices requiring consent. If you refuse analytics or advertising, the corresponding tags are not run and no analytics or advertising pings are sent to Google.

9 Careers portal and job applications

Our website contains links to job vacancies and to the careers portal at bugatti-fashion.dvinci-hr.com. The portal uses the d.vinci applicant management software. Merely displaying an ordinary link does not establish a connection to the portal. Only when you click the link do you navigate to the external website, where the technical data required to access it is processed.

If you apply for a position at Pikeur there, the separate privacy notice of the careers portal applies. The link alone does not transmit any shop or newsletter data to the applicant management system.

10 Social networks and external links

Our website contains links to our social media profiles. With ordinary links, a connection to the relevant provider is only established when you click the link. The platform’s privacy notice applies to processing on the platform subsequently accessed.

11 Your rights

Subject to the statutory requirements, you have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR) and data portability (Article 20 GDPR). You may withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to object

Where we process data on the basis of Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation pursuant to Article 21(1) GDPR. We will then cease processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You may object to the processing of your data for direct marketing at any time without giving reasons. This also applies to profiling insofar as it is related to direct marketing. Following your objection, we will no longer process your data for these purposes.

Complaints and contact

You may lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for our registered office is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia: https://www.ldi.nrw.de/.

To exercise your rights or ask questions about data protection, you can contact us or our data protection officer using the contact details provided above.