Privacy policy
Privacy Policy
Last updated: 8 September 2026
1. Controller
The controller within the meaning of the General Data Protection Regulation (“GDPR”) and other applicable data protection laws is:
KAFFANERO GmbH
Jagdweg 1–3
Entrance: Rosenstraße 92
01159 Dresden
Germany
Managing Director: Tobias Heppner
Phone: +49 (0) 351 48618818
Email: info@kaffanero.de
2. General Information on Data Processing
We take the protection of your personal data seriously. Personal data means any information relating to an identified or identifiable natural person, for example your name, email address, postal address, IP address, order data or online identifiers.
We process personal data only where there is a legal basis for doing so.
Depending on the processing activity, the following legal bases may apply in particular:
Art. 6(1)(a) GDPR – Consent:
where you have expressly given us your consent, in particular for analytics, marketing or newsletter purposes.
Art. 6(1)(b) GDPR – Performance of a contract and pre-contractual measures:
where processing is necessary for an order, subscription, seminar booking, customer account or another service requested by you.
Art. 6(1)(c) GDPR – Legal obligation:
where we are required to process or retain data by law.
Art. 6(1)(f) GDPR – Legitimate interests:
where processing is necessary for the purposes of our legitimate interests or those of a third party, provided that your interests, fundamental rights and freedoms do not override those interests. This includes, in particular, the secure and efficient provision of our online shop, fraud prevention, customer service and the improvement of our services.
Where information is stored on your device or information stored on your device is accessed, we additionally comply with Section 25 of the German Telecommunications-Digital-Services Data Protection Act (TDDDG). Non-essential cookies, pixels and comparable technologies are generally used only after your prior consent.
3. Retention Period
We retain personal data only for as long as necessary for the respective processing purpose.
Where statutory retention obligations apply, particularly under commercial or tax law, the relevant data will be retained for the period required by law. After expiry of the applicable retention period, the data will be deleted unless another legal basis exists for further storage.
Different retention periods may apply to individual services. These depend in particular on our settings with the respective service and the legal and contractual requirements of the relevant provider.
4. Recipients and Processors
We use external service providers to operate our online shop and provide our services.
These providers receive personal data only to the extent necessary to provide their respective services. Where service providers process personal data solely on our instructions, this is carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR.
Other recipients, in particular payment service providers or certain advertising platforms, may process personal data under their own data protection responsibility.
5. Transfers of Data to Third Countries
Some of the providers we use, or their subprocessors, are located outside the European Union or the European Economic Area.
Personal data is transferred to a third country only in compliance with Arts. 44 et seq. GDPR.
Where the European Commission has adopted an adequacy decision for the respective third country, the transfer may be based on that decision. For transfers to the United States, this may in particular include the EU-U.S. Data Privacy Framework, provided the respective recipient is certified accordingly.
Otherwise, in particular the European Commission’s Standard Contractual Clauses and, where appropriate, additional technical and organisational safeguards may be used as appropriate safeguards.
6. Provision of the Online Shop via Shopify
We operate our online shop using the e-commerce platform Shopify.
For merchants in Europe, the primary contractual partner is generally:
Shopify International Limited, Ireland
Shopify provides us with the technical infrastructure for the online shop, product pages, shopping cart, checkout, customer accounts, order management and various other shop functions.
The following data may be processed in particular:
IP address, device and browser information, pages visited, date and time of access, shopping cart contents, customer number, name, email address, telephone number, billing and delivery address, order information, payment information or payment references, and other data entered in connection with an order.
Depending on the specific process, processing is carried out in particular on the basis of Art. 6(1)(b) GDPR for the processing of orders and Art. 6(1)(f) GDPR for the secure and reliable operation of our online shop.
Shopify may use affiliated companies and subprocessors located outside the EEA to provide its services. Data relating to persons in the EEA is initially processed by Shopify International Limited in Ireland. For subsequent international transfers, Shopify states that it uses the transfer mechanisms provided for under applicable data protection law.
7. Content Delivery Network and Technical Delivery
Shopify uses a globally distributed Content Delivery Network (“CDN”) to provide the online shop quickly and securely.
In this context, the IP address of your device may in particular be processed in order to deliver content through a technically suitable server and to detect attacks or technical disruptions.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the fast, stable and secure provision of our online shop.
8. Cookies, Local Storage and Similar Technologies
Our website uses cookies and similar technologies such as Local Storage, pixels and web storage technologies.
We use technically necessary technologies where required, for example to provide the shopping cart, login, checkout, security settings or your privacy choices.
Consent pursuant to Section 25(2) TDDDG is not required for the storage or reading of technically essential information.
Non-essential analytics, personalisation and marketing technologies, however, are used only after your prior consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
An up-to-date overview of the cookies and technologies used, their providers, purposes and retention periods can be found in the cookie settings on our website.
9. Consent Management with Consentmo
We use Consentmo GDPR Compliance to manage your cookie and privacy choices.
Provider:
iSense Ltd., Sofia, Bulgaria, together with iSense LLC under the Consentmo brand.
Consentmo enables us to record and implement your decision regarding which non-essential technologies may be used on our website.
In this context, information regarding your consent choices, the time of your decision and technical information such as IP address, browser information and device information may in particular be processed.
According to Consentmo, personal data relating to our website visitors is generally processed on our behalf.
The processing is necessary to implement and document your privacy choices.
The legal bases are Art. 6(1)(c) GDPR in conjunction with statutory documentation obligations and, additionally, Art. 6(1)(f) GDPR. Where technically necessary information is stored on your device, Section 25(2) TDDDG applies.
You can change or withdraw your decision at any time via the Cookie Settings on our website.
10. Server Log Data
When you visit our online shop, technically necessary information is processed.
This may include:
IP address, date and time of access, requested page or file, referrer URL, browser type and version, operating system, device information and technical status or error data.
The processing is carried out in order to ensure the operation, stability and security of our website and to detect attacks or technical errors.
The legal basis is Art. 6(1)(f) GDPR.
11. Contact
If you contact us by email, telephone or via our contact form, we process the information you provide in order to respond to your enquiry.
This may include in particular your name, email address, telephone number and the content of your message.
If your enquiry relates to an existing or potential contract, processing is carried out on the basis of Art. 6(1)(b) GDPR.
For other enquiries, processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to be able to respond to enquiries from customers and interested parties.
12. Customer Account
You may create a customer account in our online shop.
In this context, we may process in particular your name, email address, postal address, telephone number, order history, saved addresses and other account information provided by you.
The customer account is used in particular to manage orders and provide you with access to functions of our online shop.
The legal basis is Art. 6(1)(b) GDPR.
You may request deletion of your customer account at any time, provided that no statutory retention obligations prevent deletion.
13. Orders in the Online Shop
If you place an order in our online shop, we process the data required to fulfil the order.
This may include in particular your name, billing and delivery address, email address, telephone number, products ordered, order value, payment method, shipping method, discount information, customer number and further order information.
The legal basis is Art. 6(1)(b) GDPR.
Where we are required to retain invoice and order data due to statutory obligations, further processing is carried out on the basis of Art. 6(1)(c) GDPR.
14. Merchandise Management and Order Processing with WeClapp
We use WeClapp for the internal processing of customer, order, merchandise management and invoice data.
Provider:
weclapp GmbH
Friedrich-Ebert-Straße 28
97318 Kitzingen
Germany
In this context, customer master data, contact details, billing and delivery addresses, order information, product data, invoices and information relating to order and shipping processing may in particular be processed.
The processing is carried out for the fulfilment of your order and to comply with commercial and tax law obligations.
The legal bases are Art. 6(1)(b) and Art. 6(1)(c) GDPR.
15. Payment Processing
Depending on the payment method selected at checkout, we use external payment service providers to process payments.
These may include in particular:
PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
Klarna Bank AB (publ), Sweden
Shopify Payments and/or Shop Pay
Stripe Payments Europe Ltd., Ireland, where Stripe is used for the selected payment method.
When you select a payment method, the data necessary for payment processing is transmitted to the relevant payment service provider. This may include in particular your name, address, email address, order amount, currency, transaction data, payment information and technical information.
The payment service providers may process further data for payment execution, fraud prevention, authentication and compliance with statutory obligations.
Processing is generally carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.
Where the relevant payment service provider processes personal data for its own statutory or regulatory purposes, it acts as an independent controller for such processing.
Which payment service providers actually receive data depends on the payment method selected by you.
16. Shipping with DHL and DPD
We use DHL and DPD, in particular, for the delivery of our goods.
For delivery purposes, we transmit the data necessary for shipping to the respective shipping provider. This includes in particular your name, delivery address and, where necessary, further information required for delivery.
Where required for shipping notifications or coordination of the delivery and where requested by you, your email address or telephone number may additionally be transmitted.
The legal basis for the shipping process itself is Art. 6(1)(b) GDPR.
17. Newsletter and Email Marketing with Klaviyo
We use Klaviyo for newsletters, automated emails and email marketing.
Provider:
Klaviyo, Inc., Boston, Massachusetts, USA.
If you subscribe to our newsletter, we process in particular your email address as well as, where applicable, your name and other information you provide voluntarily.
The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future, in particular using the unsubscribe link contained in every marketing email.
Where the statutory requirements of Section 7(3) of the German Act Against Unfair Competition (UWG) are met, we may also inform existing customers by email about our own similar goods and services. The data protection legal basis for this is Art. 6(1)(f) GDPR. You may object to this use of your email address at any time.
Newsletter Performance Measurement
Where you have given your consent, Klaviyo may be used to measure whether newsletters are opened and which links are clicked.
In this context, information such as your email address, open and click data, the time of interaction and device-, browser- and IP-related data may be processed.
This analysis is carried out on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
Klaviyo Tracking in the Online Shop
Where you have consented to the Marketing category, Klaviyo may also collect information regarding your behaviour in the online shop and combine it with an existing customer or newsletter profile.
This may include in particular page views, product views, shopping cart actions, orders, referrer data, device information and pseudonymous identifiers.
Access to your device is based on your consent pursuant to Section 25(1) TDDDG. Subsequent processing of personal data is based on Art. 6(1)(a) GDPR.
Klaviyo also processes data in the United States. According to Klaviyo, it participates in the EU-U.S. Data Privacy Framework and uses Standard Contractual Clauses for transfers not covered by that framework.
18. Coffee Subscription with Seal Subscriptions
We use the Shopify app Seal Subscriptions for our coffee subscription service.
Provider:
Seal Subscriptions
Podutiška cesta 94
1000 Ljubljana
Slovenia
Seal Subscriptions enables the management of recurring orders, delivery intervals, subscription products, changes, pauses and cancellations of subscriptions.
In this context, personal data such as your name, email address, billing and delivery address, customer number, product and subscription information and order and payment references may be processed.
In connection with recurring payments, the provider states that limited card information such as card type, expiry date and the last four digits of the card may also be processed. Full card details are not stored by us.
The processing is necessary to set up and manage your subscription and is carried out on the basis of Art. 6(1)(b) GDPR.
Seal Subscriptions states that data may be processed on servers in Canada, among other locations. Where the European Commission’s adequacy decision for Canada applies to the relevant recipient, the transfer may be based on that decision; otherwise, appropriate safeguards pursuant to Art. 46 GDPR are required.
19. Loyalty and Rewards Programme with BLOY Loyalty
We use BLOY Loyalty Points & Rewards for our online loyalty programme.
If you participate in the loyalty programme, the following data may in particular be processed:
customer ID, name, email address, telephone number, address, order history, products purchased, order values, points earned and redeemed, discounts used, credit balances and information about actions within the loyalty programme.
This data is used to calculate points, assign them to your customer account, provide rewards and credit balances and manage redemptions.
The processing is necessary for the provision of the loyalty programme you use and is generally carried out on the basis of Art. 6(1)(b) GDPR.
Where technical data is processed for security or functionality purposes, processing may additionally be based on Art. 6(1)(f) GDPR.
The Shopify app is offered under the BLOY brand. According to the provider’s privacy notices, it is associated with BSS Commerce. The provider states that customer and usage data is stored on servers in the United States.
Where data is processed outside the EEA, the transfer is carried out in accordance with Arts. 44 et seq. GDPR.
20. Product Reviews with Judge.me
We use Judge.me to collect and display product reviews.
Provider:
Judge.me Ltd
c/o Buckworths
2nd Floor, 1–3 Worship Street
London EC2A 2AB
United Kingdom
If you submit a review, the following data may in particular be processed:
your name or the display name provided, email address, review text, rating, product reference, order information and technical data.
The processing serves to collect genuine customer reviews, verify their authenticity and display reviews on our website.
The legal basis is generally Art. 6(1)(f) GDPR. Our legitimate interest is to provide transparent information about our customers’ experiences with our products.
If we send you a review request by email, this is done only in accordance with the applicable statutory requirements.
The United Kingdom is currently covered by an adequacy decision of the European Commission, meaning that personal data can generally be transferred there on that basis.
Where Judge.me uses cookies or similar technologies for non-essential analytics or tracking purposes, these are used only after the relevant consent has been obtained.
21. Coffee Quiz with RevenueHunt
We use Product Recommendation Quiz by RevenueHunt for our interactive coffee quiz and the resulting product recommendations.
Provider:
Durian Capital Inc.
Intershore Chambers
Road Town, Tortola
British Virgin Islands
Within the quiz, we process your answers in order to recommend suitable coffees or other products based on the information you provide.
In this context, quiz answers, product preferences, result and recommendation data, technical usage data, IP address, browser information and a quiz or session identifier may in particular be processed.
If you additionally enter contact details such as your email address or telephone number during the quiz, these data may also be processed and, depending on the integration configured by us, transferred to Shopify or Klaviyo.
The processing of your quiz answers is carried out in order to provide the product recommendation expressly requested by you on the basis of Art. 6(1)(b) GDPR or, where no contractual relationship is established, on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR in providing voluntarily requested product advice.
The use of quiz data for newsletters or other marketing purposes takes place only if separate consent has been obtained. In that case, the legal basis is Art. 6(1)(a) GDPR.
Where non-essential tracking technologies are used, they are activated only after your consent pursuant to Section 25(1) TDDDG.
RevenueHunt is operated by Durian Capital Inc. in the British Virgin Islands. According to the provider, its servers are located in the United States. RevenueHunt provides contractual data protection mechanisms, including Standard Contractual Clauses, for international data transfers.
The product recommendations generated by the quiz do not constitute a decision based solely on automated processing within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you.
22. Seminar and Event Bookings with Appointo
For bookings of our seminars, roastery tours and, where applicable, other events, we use Appointment Booking App ointo / Appointo.
Provider:
Sidepanda Services LLP
HD 104, Salarpuria Magnificia
Bangalore 560016
India
When you book an appointment or seminar through our website, the following data may in particular be processed:
name, email address, telephone number, booked event or service, date and time, number of participants, order information and any other information you provide during the booking process.
The data is processed in order to manage your booking, plan capacities and send booking confirmations and, where applicable, reminders.
The legal basis is Art. 6(1)(b) GDPR.
Appointo is provided by a company based in India. According to the provider, technical hosting providers such as AWS and Heroku are used. This may result in transfers of data to countries outside the EEA. Such transfers may only take place in accordance with the requirements of Arts. 44 et seq. GDPR.
23. Affiliate Programme with GoAffPro
We use GoAffPro for our affiliate and referral programme.
Provider:
GoAffPro
16, Sector 20, Part 1, HUDA
Sirsa, Haryana 125055
India
GoAffPro enables us to determine whether a purchase was generated via an affiliate link or a discount code associated with an affiliate in order to calculate the applicable commission.
In this context, the following data may in particular be processed:
affiliate identifier, referrer, time of access, pseudonymous visitor or session identifier, pages visited, order information, order value, discount code and technical device and browser information.
According to GoAffPro, the identifiers or cookies ref, gfp_v_id and gfp_v_expires are used in particular for visitors who reach our website via an affiliate link.
Where information is stored on or read from your device for this purpose, this takes place only after your consent pursuant to Section 25(1) TDDDG. The legal basis for subsequent processing of personal data is Art. 6(1)(a) GDPR.
For the management of our affiliate partners themselves, name, email address, contact details, payment details and commission data may additionally be processed. This processing is carried out for the performance of the affiliate relationship pursuant to Art. 6(1)(b) GDPR.
GoAffPro states that it uses data centres in Falkenstein and Nuremberg in Germany as well as in Virginia in the United States. The provider itself is also based in India.
Where data is processed outside the EEA, the transfer is carried out in accordance with Arts. 44 et seq. GDPR.
24. Google Analytics
We use Google Analytics, a web analytics service provided by:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics helps us understand how visitors use our website.
The following information may in particular be processed:
pages viewed, page views, clicks and other interactions, session duration, referrer, approximate geographical information, device used, browser and operating system as well as pseudonymous user and session identifiers.
The analysis enables us in particular to evaluate the reach, usage and technical performance of our website and to improve our services.
Google Analytics is activated only if you have consented to the relevant category in our consent banner.
The legal bases are Section 25(1) TDDDG for storing or accessing information on your device and Art. 6(1)(a) GDPR for the subsequent processing of personal data.
You may withdraw your consent at any time via our Cookie Settings.
Google may use affiliated companies and technical service providers outside the EEA. International transfers are carried out in accordance with the legal transfer mechanisms used by Google for this purpose.
The retention period for data collected via Google Analytics depends on the settings configured by us in Google Analytics and the applicable legal requirements.
25. Meta Pixel for Facebook and Instagram Advertising
We use the Meta Pixel for advertising on Facebook and Instagram.
The provider for users in the European region is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
The Meta Pixel enables us to determine whether visitors perform certain actions on our website after clicking on or viewing an advertisement.
The following events may in particular be processed:
page and product views, shopping cart actions, start of checkout, purchases, order value, currency as well as technical information about browser, device, IP address, referrer and online identifiers.
Meta may use this information to measure conversions, create audiences for advertising campaigns and optimise advertisements.
The Meta Pixel is activated only if you have previously consented to the Marketing category.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future via our Cookie Settings.
Meta may link this information to existing Facebook or Instagram accounts and process it for its own purposes in accordance with Meta’s privacy terms.
For certain processing activities involving the Meta Business Tools, Meta and we may act as joint controllers or as separate independent controllers. Meta is generally independently responsible for subsequent processing of personal data within its own services.
Meta may also process data outside the EEA. Transfers are carried out in accordance with the applicable data protection transfer mechanisms.
26. ChatGPT Ads Conversion Tracking / OpenAI Pixel
We use conversion tracking for ChatGPT Ads provided by OpenAI.
For data relating to individuals in the European Economic Area, processing within the OpenAI Ad Tools is carried out by:
OpenAI Ireland Limited, Ireland.
The OpenAI Pixel enables us to determine whether visitors perform certain actions on our website after clicking on an advertisement displayed in ChatGPT.
The following events may in particular be processed:
page and product views, adding a product to the shopping cart, start of checkout, completed orders, order value and currency as well as technical information related to the visit.
When a user clicks on a ChatGPT advertisement, OpenAI may also append a click reference referred to as oppref to the URL of the landing page. The OpenAI Pixel may collect this click reference and store it in a first-party cookie in order to attribute subsequent conversion events to an advertising click.
The processing is carried out for the measurement, attribution and optimisation of our advertising campaigns on ChatGPT Ads.
The OpenAI Pixel is activated only if you have previously consented to the Marketing category.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
You may withdraw your consent at any time via our Cookie Settings.
OpenAI and we may each act as independent controllers for certain processing activities within the OpenAI Ad Tools.
According to OpenAI, OpenAI Ireland Limited processes data relating to individuals in the European Economic Area and uses appropriate transfer mechanisms where data needs to be transferred onwards to countries without an adequate level of data protection. OpenAI uses technical infrastructure and service providers both within and outside the EEA for its Ad Tools.
27. Embedded YouTube Videos
Where we embed videos from YouTube on our website, this service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When an embedded video is loaded, your IP address, browser and device information, pages visited and information regarding your interaction with the video may in particular be transmitted to Google.
If you are simultaneously logged into your Google or YouTube account, Google may be able to associate your use with your account.
YouTube content is loaded only where the required consent has been granted.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
28. Google Fonts
We use fonts from Google Fonts.
According to our current technical configuration, Google Fonts are hosted locally on our website. Therefore, merely loading the fonts does not establish a connection to Google servers.
If this technical integration changes in the future, this Privacy Policy will be updated accordingly.
29. Social Media Profiles
We operate company profiles on social networks, in particular on:
Facebook, Instagram and YouTube.
If you simply follow a link on our website to one of our social media profiles, data is generally processed by the respective platform provider only after you visit that platform.
If you interact with us there, for example by sending us a message, commenting on a post or otherwise contacting us, we process the information you provide in order to handle your enquiry and communicate with you.
Depending on the content of the enquiry, the legal basis is Art. 6(1)(b) or Art. 6(1)(f) GDPR.
The platform providers may independently process extensive usage, device and profile data for their own purposes.
Facebook and Instagram
The provider for users in the European region is Meta Platforms Ireland Limited, Ireland.
In connection with certain statistical analyses of our Facebook and Instagram company pages, we may be jointly responsible with Meta for certain processing activities.
YouTube
The provider for users in the EEA is Google Ireland Limited, Ireland.
For processing carried out by the respective platform provider after you access its platform, the privacy terms of that platform provider additionally apply.
30. Withdrawal of Consent and Cookie Settings
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
The lawfulness of processing carried out prior to the withdrawal remains unaffected.
You may in particular change or withdraw consent for analytics, marketing and similar technologies via the Cookie Settings that are available at any time on our website.
Newsletter consent may additionally be withdrawn using the unsubscribe link contained in our emails.
31. Right to Object to Processing
Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right under Art. 21 GDPR to object to such processing at any time on grounds relating to your particular situation.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons.
You may exercise your right to object, for example, by sending an email to info@kaffanero.de.
32. Your Data Protection Rights
Subject to the statutory requirements, you have the following rights in particular:
Right of access pursuant to Art. 15 GDPR:
You may request information regarding which personal data we process about you.
Right to rectification pursuant to Art. 16 GDPR:
You may request correction of inaccurate data or completion of incomplete data.
Right to erasure pursuant to Art. 17 GDPR:
You may request deletion of your personal data subject to the statutory requirements.
Right to restriction of processing pursuant to Art. 18 GDPR:
Under certain circumstances, you may request that processing of your data be restricted.
Right to data portability pursuant to Art. 20 GDPR:
Where the statutory requirements are met, you may receive personal data in a structured, commonly used and machine-readable format or request that it be transmitted to another controller.
Right to object pursuant to Art. 21 GDPR:
You may object to processing under the statutory requirements.
Right to withdraw consent pursuant to Art. 7(3) GDPR:
Any consent given may be withdrawn at any time with effect for the future.
To exercise your rights, you may contact us at info@kaffanero.de.
33. Right to Lodge a Complaint with a Supervisory Authority
Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority.
The authority particularly competent for us is:
Sächsische Datenschutz- und Transparenzbeauftragte
Maternistraße 17
01067 Dresden
Germany
You may generally also contact a data protection supervisory authority at your place of residence or habitual residence.
34. Obligation to Provide Certain Data
For purely informational use of our website, you generally do not have to actively provide personal data.
However, certain data is required if you wish, for example, to place an order, use a customer account, enter into a coffee subscription, participate in the loyalty programme or book a seminar.
Without the respective required data, we may not be able to provide the requested service.
Consent to analytics or marketing tracking is voluntary and is not a condition for placing an order in our online shop.
35. Data Security
We implement appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and unlawful disclosure.
Our website is generally transmitted using TLS/SSL encryption.
Despite appropriate security measures, absolute protection cannot be guaranteed when data is transmitted over the internet.
36. Changes to this Privacy Policy
We may update this Privacy Policy if our website, the services we use or the applicable legal requirements change.
The version currently published on our website applies.
Last updated: 8 September 2026