1. Privacy at a glance
General information
The following information gives a simple overview of what happens to your personal data when you visit this website or order from us. Personal data is any data that can be used to identify you personally. You will find detailed information in the privacy policy below.
Who is responsible for collecting data on this website?
Data on this website is processed by the website operator. You will find the operator's contact details in the section "Responsible party".
How do we collect your data?
Some data is collected when you provide it to us, for example when you place an order or use the contact form.
Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data (e.g. web browser, operating system or time of the page request).
What do we use your data for?
Part of the data is collected to ensure the website works without errors and to process your orders. Other data may be used, with your consent, to analyse how visitors use the website.
What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you can withdraw it at any time with effect for the future. In certain circumstances you also have the right to request that the processing of your personal data be restricted. You also have the right to lodge a complaint with the competent supervisory authority.
You can contact us at any time about this or any other questions on data protection.
2. General information and mandatory information
Data protection
We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
Please note that data transmitted over the internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.
Responsible party
The party responsible for data processing on this website is:
Sandalenwerkstatt Freiburg, Thilo & Tsukinowa GbR, represented by Andreas Thilo and Norihiko Tsukinowa, Talstraße 9a, 79102 Freiburg, Germany
Phone: +49 761 70 11 77, email: info@sandalenwerkstatt.de
The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, email addresses).
Storage period
Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose for processing it no longer applies. If you make a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law). In the latter case, the data will be deleted once these reasons no longer apply.
General information on the legal basis for data processing
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR if special categories of data under Art. 9(1) GDPR are processed. If you have expressly consented to the transfer of personal data to third countries, the processing is also based on Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device, the processing is additionally based on Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act). Consent can be withdrawn at any time. If your data is required to fulfil a contract or to carry out pre-contractual measures, we process it on the basis of Art. 6(1)(b) GDPR. We also process your data where this is necessary to fulfil a legal obligation, on the basis of Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. The following sections explain which legal basis applies in each case.
Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the processing carried out until the withdrawal remains unaffected.
Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)
If data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. This also applies to profiling based on these provisions. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims (objection under Art. 21(1) GDPR).
If your personal data is processed for direct marketing, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing (objection under Art. 21(2) GDPR).
Right to lodge a complaint with the competent supervisory authority
In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged breach. This right is without prejudice to any other administrative or judicial remedies.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done if it is technically feasible.
Information, deletion and correction
Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing, and, if applicable, a right to have this data corrected or deleted. You can contact us at any time about this or any other questions about personal data.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time. The right to restriction of processing exists in the following cases:
If you dispute the accuracy of the personal data we hold about you, we usually need time to verify this. For the duration of the review, you have the right to request the restriction of processing.
If the processing of your personal data was or is unlawful, you can request the restriction of processing instead of deletion.
If we no longer need your personal data but you need it to exercise, defend or establish legal claims, you have the right to request the restriction of processing instead of deletion.
If you have lodged an objection under Art. 21(1) GDPR, your interests and ours must be weighed. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of processing.
If you have restricted the processing of your personal data, this data may (apart from its storage) only be processed with your consent or to establish, exercise or defend legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the address line of your browser starting with "https://" and by the lock symbol in your browser bar. When encryption is active, the data you send to us cannot be read by third parties.
Objection to advertising emails
We hereby object to the use of the contact details published as part of our legal notice for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.
3. Data collection on this website
External hosting
This website is hosted by Hetzner. The provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. For details, see Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy/
Hetzner is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. We have concluded a data processing agreement with Hetzner, which ensures that Hetzner only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.
Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically sends to us. This includes:
browser type and version
operating system used
referrer URL
host name of the accessing computer
time of the server request
IP address
This data is not combined with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the technically error-free presentation and optimisation of our website, for which the server log files must be recorded.
Contact form
If you send us enquiries via the contact form, your details from the form, including the contact details you provide there, will be stored by us to process the enquiry and in case of follow-up questions. We do not pass on this data without your consent.
This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effectively handling the enquiries sent to us (Art. 6(1)(f) GDPR).
The data you enter in the contact form remains with us until you ask us to delete it or the purpose for storing it no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.
Enquiries by email, phone or fax
If you contact us by email, phone or fax, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. The legal basis and storage period are the same as for the contact form.
Web analytics with Umami
This website uses Umami, a privacy-friendly, self-hosted web analytics software. Umami does not use cookies and does not store any personal data. The data collected (e.g. page views, referrer, browser type and operating system) is recorded anonymously and is used exclusively for statistical evaluation to improve our offer. This includes how often promotions such as our gift promotions are used.
It is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the anonymous analysis of user behaviour in order to improve our website. As no personal data is collected and no cookies are set, consent is not required.
4. Online shop and orders
Processing of data for orders
When you order from our online shop, we process the data required to process your order: name, billing and delivery address, email address, phone number if provided, the ordered items with your measurements, and the payment method. For your shopping cart we store a technically necessary cookie so that your selection is kept while you browse.
The processing is based on Art. 6(1)(b) GDPR, as it is necessary to fulfil the purchase contract. We retain order and invoice data due to obligations under commercial and tax law (Art. 6(1)(c) GDPR), usually for ten years, and delete it afterwards.
Body weight for orders
When you order sandals or mules online, we ask for your body weight. We need it to make the sole and construction to suit you. We use this information only for your order (Art. 6(1)(b) GDPR). We store it with your order data and delete it once the statutory retention periods have expired.
Gift cards
When you buy a gift card, we generate a gift card code and send it to the email address given with the order. We store the code and the remaining balance so that the gift card can be redeemed. The processing is based on Art. 6(1)(b) GDPR.
Payment service providers
We work with payment service providers for payments in the online shop. Depending on the payment method you choose, we pass the data required for the payment (e.g. name, amount, order number, email address) to the respective provider. You enter your payment details (e.g. card number) directly with the payment service provider; we do not receive them. The transfer is based on Art. 6(1)(b) GDPR.
Mollie: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. Privacy policy: https://www.mollie.com/privacy
Stripe: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Privacy policy: https://stripe.com/privacy
If you pay by bank transfer, no data is passed to a payment service provider.
Shipping
To ship your order, we pass your name and delivery address to the shipping company we use, usually DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany. The transfer is based on Art. 6(1)(b) GDPR. DPD's privacy policy: https://www.dpd.com/de/en/data-protection/
5. Consent, analytics and embedded content
Cookie banner
On your first visit, a banner asks for your consent to analytics services and embedded content. We store your choice in your browser so that we do not have to ask again on every visit. You can change or withdraw your consent at any time via the "Manage consent" link at the bottom of the page.
Google Tag Manager and Google Analytics
With your consent, we use Google Tag Manager and Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager loads Google Analytics. Google Analytics records how visitors use our website (e.g. pages viewed, time spent, origin, device and browser) and sets cookies for this. Google Analytics 4 does not store full IP addresses.
It is used exclusively on the basis of your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time. Data may also be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy?hl=en
YouTube
On some pages we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The videos are only loaded once you agree. Only then is a connection to YouTube's servers established, and YouTube may set cookies and collect data about your use.
It is used on the basis of your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. More information: https://policies.google.com/privacy?hl=en
6. External services
Mailgun
To send emails, for example order confirmations, shipping notifications, gift cards and messages from the contact form, we use the Mailgun service of Mailgun Technologies, Inc., 112 E Pecan St #1135, San Antonio, TX 78205, USA. Your name, your email address and the content of the message are transmitted to Mailgun and processed there to enable delivery.
The processing is based on Art. 6(1)(b) GDPR where it concerns your order or enquiry, and otherwise on our legitimate interest in reliable communication (Art. 6(1)(f) GDPR). More information: https://www.mailgun.com/legal/privacy-policy/
Sentry
We use the Sentry service of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, to monitor the technical stability of our website and to analyse errors. Sentry processes technical information about your device and your visit, such as browser type, operating system, time of access and, in the event of an error, information about the error. Personal data is only processed insofar as this is technically necessary.
It is used on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the stable and secure provision of our website and the rapid correction of errors. More information: https://sentry.io/privacy/
Laravel Nightwatch
We use Laravel Nightwatch, a service of Laravel Holdings Inc., to monitor the technical stability, performance and security of our website and to analyse and fix technical errors. This may involve processing information about server requests, error messages, application performance data, database queries and technical log data. Personal data is only processed insofar as this is technically necessary for error analysis and secure operation.
It is used on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and error-free operation of our website. More information: https://nightwatch.laravel.com/legal/privacy
Cloudflare R2
We use Cloudflare R2, a service of Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA, to store media files and backups. Storage takes place exclusively in storage areas that are not publicly accessible. The files are retrieved exclusively server-side by our website. Cloudflare may process technically necessary connection data (e.g. the server's IP addresses, timestamps and log data).
It is used on the basis of Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of media content and backups). More information: https://www.cloudflare.com/privacypolicy/
Data transfers to the USA
Where personal data is transferred to the USA by Mailgun, Sentry, Laravel Nightwatch, Cloudflare or Google, this is done on the basis of the EU-US Data Privacy Framework, where the provider is certified, or on the basis of the European Commission's standard contractual clauses (Art. 46 GDPR).
Google Web Fonts (local hosting)
This site uses web fonts provided by Google for the uniform display of fonts. The fonts are installed locally on our server. No connection to Google's servers is made.
