1. Data Protection at a Glance

General Information

This privacy notice informs you about the personal data we process when you visit our MARELD online shop, place orders, contact us, and use our supplementary review function. Personal data is information relating to an identified or identifiable person.

Who processes your data?

Pixelbox15 UG (limited liability) is the data controller. You can find our full contact details under “3. General Information and Mandatory Disclosures”. The online shop is hosted by Shopify. The supplementary proprietary review application at sync.mareld.de is operated on a STRATO server.

What data is collected and for what purpose?

We receive data that you provide to us, for example when placing an order, signing up for a newsletter, contacting us, or submitting a product review. We also process technical data required to transmit and display content, ensure security, and provide the functions you request. Analytical and marketing services are used in accordance with the legal bases explained below and your consent decisions.

What rights do you have?

In particular, you have the right to access, rectification, erasure, restriction of processing, and data portability. You can withdraw your consent at any time for the future. You can object to certain processing activities. You can also lodge a complaint with a data protection supervisory authority. Further details can be found in Section 3.

2. Hosting and Technical Service Providers

Shopify: Hosting and Operation of the Online Shop

Our online shop is provided via Shopify. Our shop provider is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland.

Shopify processes data required to provide the shop and its functions. This includes, in particular, IP addresses, browser and device information, technical usage data, and, for orders, contact, order, delivery, billing, and payment information. The specific data processed in each case depends on the functions used.

Processing for the purpose of fulfilling orders and providing contractually agreed functions is based on Art. 6(1)(b) GDPR. The technical provision and security of our website are based on Art. 6(1)(f) GDPR. We have a legitimate interest in maintaining a functional and secure online shop. Analytical and marketing processing requiring consent is based on Art. 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG.

Shopify’s data processing agreements apply to the processing of customer data on our behalf. For certain additional services, Shopify also processes data under its own data protection responsibility. Further details are set out in the relevant Shopify privacy notices.

Shopify may use affiliated companies and service providers outside the European Union and the European Economic Area, particularly in Canada and the United States. The conditions described in Section 3 apply to such transfers.

Further information: Shopify Privacy Notice, Shopify Privacy Notice for Consumers and Shopify Data Processing Agreement.

STRATO: Supplementary Review Application and Email Infrastructure

Domain management with STRATO is separate from the hosting of the online shop with Shopify. We use the services of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, for our proprietary product review application at sync.mareld.de and our corporate email infrastructure.

When you access the review function, technically necessary connection data is transmitted to the review server. The data described in the “Product Reviews” section is also processed there. When you communicate with us by email, messages and associated communication data are processed using the email infrastructure we use.

Depending on the purpose, the legal bases are Art. 6(1)(b) GDPR for contract-related communication, Art. 6(1)(f) GDPR for the secure technical provision and processing of other requests, and Art. 6(1)(a) GDPR for the processing of reviews based on consent. Further information: STRATO Privacy Notice.

3. General Information and Mandatory Disclosures

Data Controller

Pixelbox15 UG (limited liability)
Gewerbehof 4
18107 Elmenhorst/Lichtenhagen
Germany

Telephone: +49 173 8578900
Email: info@mareld.de

Legal Bases

We process personal data in particular on the following bases:

• Art. 6(1)(a) GDPR, where you have consented to a specific processing activity;
• Art. 6(1)(b) GDPR, insofar as processing is necessary to fulfill a contract with you or to take pre-contractual steps at your request;
• Art. 6(1)(c) GDPR, insofar as we are subject to a legal obligation;
• Art. 6(1)(f) GDPR to protect legitimate interests, unless your interests or fundamental rights and freedoms override them.

The provisions of the TDDDG also apply to the storage of or access to information on your device. We explain the details for each processing activity.

Recipients and Data Processing

Personal data may be transmitted to the extent necessary to technical service providers, hosting and email providers, shipping and logistics companies, suppliers, payment service providers, and entities involved in accounting and tax or legal advice. Authorities receive data only where a legal obligation exists.

Where a service provider processes data on our behalf, it does so in accordance with Art. 28 GDPR. Other recipients, such as payment service providers or delivery companies, may process data under their own responsibility.

Data Transfers to Third Countries

For certain services, personal data may be processed in countries outside the European Union and the European Economic Area. Transfers are carried out under the conditions set out in Art. 44 et seq. GDPR, for example on the basis of an applicable adequacy decision by the European Commission or on the basis of appropriate safeguards such as EU Standard Contractual Clauses.

An adequacy decision for certified companies, such as under the EU-US Data Privacy Framework, applies only insofar as the specific recipient and the processing concerned are covered by it. You can obtain information about the transfer bases and safeguards from us and through the linked privacy notices of the respective providers.

Retention Period

We only store personal data for as long as is necessary for the respective purpose. In particular, the relevant factors are the duration of contract fulfillment, outstanding inquiries, existing warranty or legal claims, and statutory retention obligations. When processing is based on your consent, we take its withdrawal into account. Information about special storage purposes can be found in the respective sections.

Once the basis for storage no longer exists, we delete or anonymize the data. Where data is still required to fulfill legal obligations or to assert, exercise, or defend legal claims, its processing is restricted to these purposes.

Withdrawal of Consent

You can withdraw your consent at any time with effect for the future. To do so, use the option provided for the respective service, such as the cookie settings or the unsubscribe link in the newsletter, or contact info@mareld.de. The lawfulness of processing up to the point of withdrawal remains unaffected.

Right to Object under Art. 21 GDPR

If we process your personal data on the basis of Art. 6(1)(e) or (f) GDPR, you can object at any time for reasons arising from your particular situation. This also applies to profiling based on such processing. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if the processing is necessary to assert, exercise, or defend legal claims.

If your personal data is processed for direct marketing, you can object to this processing at any time. This also applies to related profiling. Once you have objected, the data concerned will no longer be processed for direct marketing.

Access, Rectification, Erasure, and Restriction

Subject to statutory requirements, you have the right to access your personal data and receive a copy of this data, to have inaccurate data rectified or incomplete data completed, and to have data erased and processing restricted.

Restriction is particularly applicable if you dispute the accuracy of the data, request restriction instead of erasure in the case of unlawful processing, require data to pursue legal claims, or if a final decision has not yet been made on an objection.

Data Portability

Subject to the conditions of Art. 20 GDPR, you have the right to receive data you have provided to us and which we process automatically based on your consent or a contract in a structured, commonly used, and machine-readable format. Where technically feasible, you can request the direct transmission of this data to another controller.

Right to Lodge a Complaint

You can lodge a complaint with a data protection supervisory authority, in particular in the Member State where your habitual residence or place of work is located, or in the place where the alleged infringement occurred. Other administrative or judicial remedies remain unaffected.

Encrypted Transmission

We use HTTPS or TLS encryption to protect data transmission. This applies in particular to orders, communications, review forms, and payment processes. Encrypted transmission protects data in transit; it does not replace the security measures of the systems involved.

Objection to Unsolicited Advertising

We object to the use of our published contact details for sending unsolicited advertising. We reserve the right to take legal action against unsolicited advertising.

4. Data Collection on This Website

Cookies and Similar Technologies

We use cookies and similar storage or access technologies. Session cookies generally last for one browser session. Other entries are stored until they expire or you delete them. They may come from us or from integrated service providers.

For storage and access that are strictly necessary to provide a service expressly requested by you, Section 25(2) No. 2 TDDDG applies. This includes, for example, necessary cart, security, and form functions. The subsequent processing of personal data is based, depending on the purpose, in particular on Art. 6(1)(b) or (f) GDPR.

Storage or access that is not strictly necessary, particularly for analytical and marketing purposes, generally requires your consent under Section 25(1) TDDDG. The corresponding processing of personal data is based on Art. 6(1)(a) GDPR. Simply optimizing the offer does not make an analytical or marketing cookie technically necessary.

You can make your choices and change or withdraw your given consents for the future via the cookie settings. You can also manage and delete cookies in your browser. Blocking technically necessary cookies may affect individual functions.

Consent Management with beeclever

We use the GDPR Legal Cookie app by beeclever. The provider is beeclever GmbH, Friedrich-Mohr-Straße 1, 56070 Koblenz, Germany.

The application manages and documents your consent decisions. For this purpose, it processes, in particular, your selection, the time it was made, and technical information about the browser and the assignment of the decision. Your IP address may be transmitted to the provider. A required storage entry allows your selection to be taken into account on subsequent visits.

Processing to fulfill and document our data protection consent obligations is based on Art. 6(1)(c) GDPR; the storage on your device that is strictly necessary for this purpose is based on Section 25(2) No. 2 TDDDG. We store records of consent insofar as they are required to take your decision into account and provide the necessary proof. Deleting a browser cookie does not automatically remove a previously stored record.

Further information: GDPR Legal Cookie in the Shopify App Store.

Technical Connection Data and Server Logs

When you access our shop and our supplementary server functions, technical data is processed. This may include your IP address, browser type and version, operating system, requested address, time, amount of data transmitted, and the status of the access, as well as the previously visited page, if applicable.

The processing is used to deliver content, analyze errors, and detect or prevent attacks. The legal basis is Art. 6(1)(f) GDPR. The data is retained only as long as necessary for these purposes; in the event of a specific security incident, a longer retention period may be required for investigation or prosecution.

Contact Form and Communication

If you contact us via a form, by email, or by telephone, we process your details and the contact data transmitted thereby to handle your inquiry and any follow-up questions. For contract-related inquiries, Art. 6(1)(b) GDPR is the legal basis. We process other inquiries based on our legitimate interest in orderly communication pursuant to Art. 6(1)(f) GDPR; a separately granted consent is based on Art. 6(1)(a) GDPR.

We store the inquiry until it has been fully processed and beyond only insofar as this is necessary to fulfill statutory retention obligations or to properly preserve legal claims.

Back-in-Stock Notification

If you request a notification when an item or variant becomes available again, we process your email address and the association with the desired item or variant. This is used to provide the notification you requested.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this at any time with effect for the future by contacting info@mareld.de. Signing up for a back-in-stock notification is not a sign-up for our general newsletter. The data is only required as long as your request remains active and the notification is still outstanding, unless a separate storage basis exists. Our email service providers are integrated for technical email transmission.

Product Reviews

You can review items purchased from MARELD using a personal review link. Participation is voluntary and has no effect on your order or your statutory rights. The technical provision is handled through our proprietary review application on the STRATO server described in Section 2.

We process your chosen display name, your overall review, the headline and review text, and, if applicable, your voluntary information about fit, material, and workmanship. We also store the purchased variant, the time of submission, your confirmation to publish, and an internal association with the order and order item. During the review process, a processing status and internal moderation notes may be created.

Before creating the review link, we check the relevant item against a genuine, paid Shopify order. The personal link allows for a one-time submission for this order item and is generally valid for 90 days. The order association is used to verify the purchase and protect against multiple submissions. The legal basis for this verification and security measure is our legitimate interest in verifiable reviews pursuant to Art. 6(1)(f) GDPR.

After verification, we publish your display name, the review, the date, and the purchased variant on the respective product page. This information is publicly accessible on the internet. A response from MARELD may also be displayed. Internal order associations, access keys, and moderation notes are not published. Please do not provide confidential information or contact details in the display name or review text.

The processing of your voluntary review information for verification and publication is based on your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw this at any time with effect for the future, for example by contacting info@mareld.de. The lawfulness of processing up to that point remains unaffected. Consent to publication is not consent to advertising or review requests by email.

When you open the form, a technically necessary session cookie is set. The public display of already published reviews does not require a session cookie from the review system. To limit abusive form access and submissions, the application temporarily processes verification values derived from IP addresses. These are not used for advertising or analyzing your shopping behavior. The legal bases are Art. 6(1)(f) GDPR and, for the required session cookie, Section 25(2) No. 2 TDDDG.

We store reviews and the required internal mapping for as long as they are needed for publication and management. In the event of a withdrawal or a justified request for deletion, we remove the review and delete the associated personal data, unless a separate legal basis requires or permits further storage. The expiration of an unused review link does not automatically result in the deletion of the internal mapping. We also delete the internal mapping and review notes when they are no longer required for the stated purposes.

Backups are used exclusively for restoration and security. In the event of a restoration, deletions that have already been taken into account must be reapplied before review data is made public again. The same purpose-bound deletion and access restrictions apply to backups.

5. Social Media

Links and sharing functions for Facebook and Instagram

Our shop contains links to social networks and functions for sharing product pages. A mere link does not establish a connection to the servers of the linked network by itself. You only leave our shop or open an offer from the respective provider when you access the link or use a corresponding sharing function.

Facebook and Instagram are offered in the European Economic Area by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. When using these offers, Meta processes technical data in particular and, if you are registered there, data related to your user account, if applicable. Processing may also take place outside the European Economic Area.

Information on processing by Meta can be found in the Facebook Privacy Notice and the Instagram Privacy Notice. The display of our own inspirational images in the shop is to be distinguished from content loaded directly from Meta.

6. Analytics Tools and Advertising

Consent-Based Services

For the consent-based analytics and marketing processing described below, you can make your selection via the cookie settings and revoke it for the future. The legal bases are Art. 6(1)(a) GDPR and, where storage or access to your device takes place, § 25(1) TDDDG. Consent to these optional purposes is not a prerequisite for placing an order.

Google Tag Manager

We use Google Tag Manager to manage website tags. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The Tag Manager is used for the technical implementation and management of embedded services. It is to be distinguished from the analytics or advertising services embedded thereby and can process technical connection data including your IP address when accessed. Processing via the Tag Manager used for analytics and marketing purposes is subject to your consent pursuant to Art. 6(1)(a) GDPR. For the services performed thereby, the respectively described purposes and consent requirements also apply.

More information: Google Privacy Notice.

Google Analytics

We use Google Analytics for the statistical evaluation of the use of our shop. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

In particular, pages visited, interactions, session and device information, as well as an approximate geographic location are processed. Cookies or comparable identifiers may be used for this purpose. The evaluations help us understand which content and functions are used and how we can improve the shop.

According to Google, IP addresses of users from the European Union are not logged or stored in Google Analytics 4. They are used to derive an approximate geographic location and are then discarded. This technical handling of the IP address does not automatically make the remaining usage data anonymous.

Google may also process data outside the European Economic Area. The requirements for third-country transfers described in Section 3 apply. The retention of analytics information is subject to the evaluation purpose and the data retention period specified in the analytics service used.

More information: Privacy in Google Analytics and Data collection in the EU. In addition to revoking via our cookie settings, Google offers a browser add-on for deactivation .

Google Ads

We use Google Ads for advertising and evaluating its effectiveness. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

If the corresponding measurement or marketing functions are activated and consented to, information about ad contacts, clicks, and subsequent actions in our shop may be processed. Cookies or other identifiers may be used for this purpose. The processing serves to measure success and improve our advertising. Depending on the use of its services and your settings, Google may associate this data with further information.

Measurements requiring consent and re-identification for advertising purposes are subject to your selection in the cookie settings. Data may also be processed in third countries; the requirements described in Section 3 apply here.

More information: Google Privacy Notice and Privacy Terms for Google Advertising Services.

7. Newsletter

Sending via Shopify Email

For our newsletter, we use the email marketing function of Shopify, known as Shopify Email or Shopify Email and now as part of Shopify Messaging. The provider is Shopify International Limited, mentioned in Section 2.

When signing up, we process your email address as well as the information required to confirm and verify your registration. This may include the time of registration, confirmation status, the registration form used, and technical verification data. Further information, such as your name, is only required insofar as it is marked accordingly in the form.

We use the data to send you the subscribed information about MARELD, products, and promotions, and to document your consent. Registration and sending are based on your consent pursuant to Art. 6(1)(a) GDPR and § 7(2) No. 2 UWG. If proof of the consent given remains required after an unsubscription, its limited retention is based on Art. 6(1)(f) GDPR to safeguard our legal position.

Evaluation of Newsletter Campaigns

The sending function used may provide technical measurement functions for delivery, opens, link clicks, and subsequent actions. Depending on the activated functions, times, device information, IP addresses, and recipient assignments may be processed in particular. Personal success measurement is to be distinguished from mere delivery processing and requires a viable legal basis for this purpose. If consent is required for this, it must also cover this evaluation; a mere agreement to receive emails does not automatically replace a separately required tracking consent.

Unsubscription and Retention Period

You can unsubscribe from the newsletter at any time via the unsubscribe link in any newsletter email or by sending a message to info@mareld.de. The revocation applies to the future and does not affect the lawfulness of previous processing.

Your newsletter data is generally stored for sending until unsubscription or until the purpose of sending no longer exists. After that, only data may remain that is required for a necessary proof of consent or to comply with your unsubscription. A blocking marker used for this purpose serves exclusively to prevent unwanted resending. Data from other processing, such as an order, remains unaffected.

The data is processed by Shopify in the context of sending. For international processing and the data protection legal bases, see Section 2 as well as the linked Shopify Privacy Notices there.

8. eCommerce and Payment Providers

Orders and Contract Processing

We process the data required to initiate and execute orders. This includes, in particular, name, contact, billing and delivery data, ordered items and variants, prices, payment and shipping status, as well as communication regarding the order, withdrawal, return, or complaint. For digital vouchers, recipient details required for the selected delivery may also be processed.

The legal basis is Art. 6(1)(b) GDPR. Statutory retention requirements, such as for tax-relevant documents, are based on Art. 6(1)(c) GDPR. Retention required for processing or defending claims may be based on Art. 6(1)(f) GDPR. After completion of processing and the expiration of corresponding obligations or purposes, the data will be deleted or its processing restricted to the remaining purposes.

Customer Account

If you create or use a customer account, we process the information required to set up, log in, and provide the account functions. This includes, in particular, your email address, your name if applicable, and order and address information associated with the account. Technical provision is provided via Shopify.

Processing to provide the requested account and manage your orders is based on Art. 6(1)(b) GDPR. Necessary security measures serve our legitimate interest in protecting customer accounts pursuant to Art. 6(1)(f) GDPR. In the event of account deletion, order data will only be retained insofar as it is still required for separate purposes such as statutory retention obligations.

Delivery and Dropshipping

For delivery, we transmit the required data to the commissioned shipping and logistics companies. Part of our assortment is shipped directly by our suppliers. For this purpose, they receive, in particular, your name, your delivery address, and the order information required to assign the shipment. A telephone number is only transmitted insofar as it is required for the specific delivery.

Our dropshipping suppliers include:

• Matterhorn – Grupa Modne Zakupy Sp. z o.o., ul. Słowiańska 14, 75-846 Koszalin, Poland;
• Yehwang Wholesale, Galvanistraat 90, 6716 AE Ede, Netherlands.

The disclosure necessary for delivery takes place pursuant to Art. 6(1)(b) GDPR. Additional disclosure of your email address for optional electronic shipping notifications takes place based on your consent pursuant to Art. 6(1)(a) GDPR, insofar as such a notification is not already part of the service you commissioned. You can revoke consent granted for this at any time for the future.

Payment Processing

Depending on the payment method you select at checkout, the involved payment service providers process the data required to execute, secure, and settle the payment. This may include name, billing address, amount, currency, transaction identifiers, and payment instrument data. Involved banks, card issuers, and payment networks may also process data.

The legal basis for processing required for payment is Art. 6(1)(b) GDPR. Statutory verification and retention obligations are subject to Art. 6(1)(c) GDPR. Fraud prevention measures may be based on legitimate interests pursuant to Art. 6(1)(f) GDPR. For additional consent-based functions, Art. 6(1)(a) GDPR applies.

Shopify Payments, Shop Pay, and Cards

For payments processed via Shopify Payments, Shopify International Limited, mentioned in Section 2, is our embedded provider. Shopify uses additional service providers for technical and financial payment processing, which, depending on the payment method, may include companies from the Stripe group. Shop Pay offers accelerated payment using the information stored with Shopify for this purpose.

For card payments, the respective card organizations, such as Visa, Mastercard, American Express, or UnionPay, as well as your card-issuing bank are also embedded. The actually selected payment method and the conditions displayed at checkout are decisive.

More information: Shopify Privacy Notice, Shop Pay and Shopify Consumer Services as well as Stripe Privacy Notice.

PayPal

The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. When PayPal is selected, the data required for payment processing is transmitted to PayPal. PayPal may perform its own security and credit checks and include further recipients according to its terms and privacy notice.

More information: PayPal Privacy Notice.

Klarna

When paying with Klarna, the data required to execute the selected payment method is transmitted to Klarna. The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.

In particular with payment methods such as invoice payment or installment payment, Klarna may perform credit and identity checks and involve credit reporting agencies for this purpose. Decisions regarding the availability of individual payment methods may be made automatically by Klarna. Information about the data used, the credit reporting agencies involved, and your rights can be found in the Klarna Privacy Notice.

More information: Klarna Privacy Notice.

Apple Pay and Google Pay

If you use Apple Pay or Google Pay, the data required for the selected wallet payment is processed via the respective wallet service and the involved payment service providers. In particular, payment or device identifiers and tokenized payment information are used. The terms and privacy notice of the respective provider also apply to the underlying Apple or Google account.

Information about the responsible Apple company in your region can be found in the Apple Privacy Notice and under Apple Pay and Privacy. Google Pay is provided for users in the European Economic Area by the respective Google companies pursuant to the Google Payments Privacy Notice ;the Google Privacy Notice also applies.

International data processing may take place with the mentioned payment services. The requirements explained in Section 3 as well as the supplementary information of the respectively selected payment provider apply here.