Privacy Policy
This is a courtesy translation. The German version of this policy is the legally binding one.
1) Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Katharina Eberius
Kathienchen Yarns
Zur Schafstränke 15
01705 Freital
Germany
Phone: +49 163 4573215
Email: kathi@kathienchen.de
No data protection officer has been appointed; the conditions of Art. 37 GDPR and § 38 BDSG are not met.
2) Hosting, server log files and backups
2.1 This website runs on our own server infrastructure, rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.
2.2 On every visit, the server automatically collects data transmitted by your browser that is technically necessary to deliver the page and secure its operation: IP address, date and time of access, page or file requested, volume of data transferred, notification of successful retrieval, referrer URL, and browser type, browser version and operating system.
2.3 The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically faultless operation and the security of the website. Log files are rotated regularly and deleted after three months at the latest, unless they are needed longer to investigate a specific security incident.
2.4 To protect against data loss, we create a nightly backup of the shop database and of uploaded files. These backups also contain customer and order data as well as shipping documents. They are stored with Google Cloud Storage, a service of Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. The storage location is set to the European Union; the backups are held exclusively in data centres within the EU and are deleted automatically after 90 days. Access is restricted to us. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is in being able to restore the data after a failure. Access by Google or its sub-processors from outside the EU, for instance in the course of support and maintenance, cannot be entirely ruled out; Google bases such cases on the European Commission’s standard contractual clauses under Art. 46 GDPR.
3) Encryption
The website uses TLS encryption throughout, recognisable by “https://” and the padlock symbol in your browser, so that your entries cannot be read in transit.
4) Cookies
4.1 The shop sets no cookies for advertising, tracking or analytics purposes.
4.2 Only technically necessary cookies are set, and only once you use the basket or log in. They serve session management and protection against form abuse. These cookies are exempt from consent under § 25(2) no. 2 TDDDG because they are strictly necessary for the service you have expressly requested. The legal basis for the associated processing is Art. 6(1)(b) and (f) GDPR.
4.3 No consent banner is used, because no technologies requiring consent are in operation.
5) Audience measurement with Matomo
5.1 To improve the shop, we analyse anonymously which pages are viewed and how often. For this we use Matomo, an open-source analytics application that we operate on our own server. No data is transmitted to third parties; the data does not leave our infrastructure.
5.2 Our Matomo is configured so that no cookies are set, your IP address is truncated and thus anonymised before storage, and no cross-device recognition or profiling takes place.
5.3 The data recorded is essentially: pages viewed, time of access, referring page, approximate location based on the truncated IP address, device type and browser.
5.4 The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is in designing the shop to meet actual demand. As no information is stored on or read from your device, consent under § 25 TDDDG is not required.
5.5 You may object to this analysis at any time (Art. 21 GDPR). To do so, enable the “Do Not Track” setting in your browser — Matomo respects this setting — or simply send us a message at kathi@kathienchen.de.
6) Customer account
You can order without creating a customer account. If you create one, we store the data you provide (form of address, name, email address, password in encrypted form, address) and your order history. The legal basis is Art. 6(1)(b) GDPR. You can have your customer account deleted at any time; the retention obligations under section 12 remain unaffected.
7) Order processing
7.1 To process your order we handle master and contract data: name, billing and delivery address, email address, items ordered, order date, payment method and payment status. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR insofar as we are legally obliged to retain data.
7.2 Payment methods. For advance bank transfer, no payment data is transmitted to third parties; processing takes place via our bank.
Where you pay via PayPal, we pass the data required for payment processing to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Payments by direct debit, credit card, giropay and Sofortüberweisung are also processed through PayPal without a PayPal account being required. PayPal is itself responsible under data protection law for its own processing and may carry out a creditworthiness check for fraud prevention and for payment methods with deferred payment. Privacy information: paypal.com
The legal basis in each case is Art. 6(1)(b) GDPR.
7.3 Shipping. For delivery we transmit your name and delivery address to the shipping company engaged: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn (parcel shipping) or Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn (Warenpost for small consignments). Where you provide us with your email address or telephone number for delivery notifications, we pass these on only with your consent (Art. 6(1)(a) GDPR). Otherwise the legal basis is Art. 6(1)(b) GDPR.
7.4 For deliveries to countries outside the EU, we transmit the information required for the customs declaration to the competent customs authorities (Art. 6(1)(c) GDPR).
8) Contacting us
8.1 If you write to us via the contact form or by email, we process your email address, your message and — if provided — the order number in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR.
8.2 To protect the form against automated submissions we use ALTCHA. Your browser solves a small computational task; no cookies are set and no data is transmitted to third parties, as ALTCHA runs on our own server.
8.3 We delete your enquiry once it has been dealt with conclusively and no retention obligations stand in the way.
9) Sending emails
To send order, account and service emails we use the email service mailbox.org, operated by Heinlein Support GmbH, Schwedter Str. 8/9b, 10119 Berlin, Germany. Your email address and the content of the message in question pass through this provider’s servers; those servers are located in Germany. The legal basis is Art. 6(1)(b) GDPR where the message serves the performance of the contract, and otherwise Art. 6(1)(f) GDPR.
10) Newsletter
10.1 For our newsletter we use Brevo, a service of Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany.
10.2 Sign-up does not take place in our shop but through a form hosted by Brevo, to which we merely link. Data is transmitted to Brevo only once you follow that link and complete the form there. Simply visiting our pages creates no data at Brevo.
10.3 Sign-up uses the double opt-in procedure: you receive a confirmation email and are only added to the list once you have confirmed. Brevo maintains the recipient list and sends the newsletter on our behalf.
10.4 The legal basis is your consent under Art. 6(1)(a) GDPR. You can unsubscribe at any time using the unsubscribe link in every email or by sending us a message; the lawfulness of processing carried out until then remains unaffected.
11) Online withdrawal
For withdrawal from a contract we provide an online function, which we are required to offer under § 356a of the German Civil Code. In doing so we process the details you enter (name, email address, order reference, content of the withdrawal declaration) together with the date and time of receipt, in order to send you the legally required confirmation of receipt and to process the withdrawal. The legal basis is Art. 6(1)(c) and (b) GDPR.
12) Recipients, third countries and retention
12.1 Beyond the parties named above, we pass personal data only to our tax advisers and, where necessary, to tax authorities, to our bank for payment processing, and to legal advisers or authorities where this is necessary for legal proceedings or due to a legal obligation.
12.2 We ourselves transfer data to countries outside the EU or the EEA only when transmitting delivery data for international consignments under section 7.4. The backups under section 2.4 are stored exclusively within the EU. Insofar as PayPal or Google transfer data to third countries in the course of their own processing, they do so under their own responsibility on the basis of the safeguards stated there, in particular standard contractual clauses under Art. 46 GDPR.
12.3 We store personal data only for as long as is necessary for the stated purposes or as long as statutory retention periods apply. The relevant periods are in particular eight years for invoices and accounting vouchers (§ 147(3) AO, § 14b(1) UStG) and six years for business letters received and sent (§ 147(3) AO). Each period begins at the end of the calendar year in which the last entry was made or the document was created.
13) Your rights
13.1 You have the right to information (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).
13.2 Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out until withdrawal remains unaffected.
13.3 An informal message to kathi@kathienchen.de is sufficient to exercise these rights.
13.4 You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Saxon Data Protection Commissioner (Die Sächsische Datenschutzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany.
14) No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. Any creditworthiness check in connection with PayPal payment methods is carried out under PayPal’s sole responsibility.
15) Changes to this privacy policy
We update this privacy policy when the legal situation or the services used in the shop change.