The German text is legally binding.

Privacy Policy / Information on Data Protection

GDPR GERMAN / GDPR ENGLISH

Data Controller Information

The party responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Alexandra Burger

Holzheimer Str. 8

73037 Göppingen, Germany

Phone: +49 (0) 7161 / 2906740

Email: shop@woolandforest.de

Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about how your personal data is handled when you use our website. Personal data includes all data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is: Alexandra Burger

Alexandra Burger Wool and Forest

Alfons-Feifel-Str. 59

73037 Göppingen, Germany

Phone: +49 (0) 1577 3808036

Email: woolandforest@gmail.com

The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

2) Data Collection When Visiting Our Website

2.1 If you use our website purely for informational purposes—meaning you do not register or otherwise transmit information to us—we only collect data that your browser transmits to the web server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

• Our visited website

• Date and time at the time of access

• Amount of data sent in bytes

• Source/reference from which you reached the page

• Browser used

• Operating system used

• IP address used (where applicable, in anonymized form)

Data processing is carried out pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to review the server log files retrospectively if there are concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries sent to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string "https://" and the lock symbol in your browser address bar.

3) Hosting & Content Delivery Networks (CDN)

3.1 Cloudflare

For hosting our website and displaying site content, we use the services of:

Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.

All data collected on our website is processed on the provider's servers. We have concluded a Data Processing Agreement (DPA) with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has certified under the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

3.2 Shopify

For hosting our website and displaying site content, we use the services of:

Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify").

Data is also transmitted to:

Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected on our website is processed on the provider's servers. We have entered into a Data Processing Agreement (DPA) with the provider, ensuring the protection of visitor data and prohibiting unauthorized disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies—small text files that are stored on your end device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), while others remain on your device longer and allow settings to be saved (so-called "persistent cookies"). In the latter case, you can find the retention period in the cookie settings overview of your web browser.

If personal data is also processed by individual cookies implemented by us, processing takes place in accordance with:

• Art. 6(1)(b) GDPR for the execution of a contract,

• Art. 6(1)(a) GDPR in the case of granted consent, or

• Art. 6(1)(f) GDPR to safeguard our legitimate interests in optimal website functionality and a user-friendly, effective site visit.

You can set your browser so that you are informed about the setting of cookies and decide individually on their acceptance, or exclude the acceptance of cookies for specific cases or generally. Please note that if cookies are not accepted, the functionality of our website may be restricted.

5) Contacting Us

When you contact us (e.g., via contact form or email), personal data is processed exclusively for the purpose of handling and answering your request and only to the extent necessary.

The legal basis for processing this data is our legitimate interest in answering your request pursuant to Art. 6(1)(f) GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided no statutory retention obligations prevent this.

6) Data Processing When Opening a Customer Account

Pursuant to Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the required extent if you provide it to us when opening a customer account. The data required for account opening can be seen from the input mask of the corresponding form on our website.

You can delete your customer account at any time by sending a message to the controller's address listed above. Following deletion of your customer account, your data will be deleted, provided all contracts concluded through it have been completely processed, no statutory retention periods conflict, and no legitimate interest in continued storage remains on our part.

7) Use of Customer Data for Direct Marketing

Stock Availability Notifications via Email

For temporarily unavailable items, you can sign up to receive email notifications regarding stock availability. In this case, we will send you a single email notifying you about the availability of your selected item. The only mandatory entry for receiving this notification is your email address. Providing additional data is voluntary and may be used to address you personally.

We use the so-called double opt-in procedure for sending emails, which ensures that you only receive a notification after you have explicitly confirmed your consent by clicking a verification link sent to the provided email address.

By activating the confirmation link, you grant us consent to use your personal data in accordance with Art. 6(1)(a) GDPR. We store your IP address registered by the Internet Service Provider (ISP), as well as the date and time of registration, to trace any possible misuse of your email address at a later point. The data collected by us when subscribing to our availability notification service is used strictly for its designated purpose.

You can unsubscribe from availability notifications at any time by notifying the controller specified at the beginning. Upon unsubscription, your email address will be promptly removed from our distribution list, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this as permitted by law and detailed in this privacy policy.

8) Data Processing for Order Execution

8.1 Insofar as necessary for contract fulfillment, shipping, and payment purposes, personal data collected by us will be passed on to the commissioned transport company and credit institution in accordance with Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or digital products based on a corresponding contract, we process the contact data you submitted when ordering to inform you personally within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details will be used strictly for communications regarding owed updates and only processed to the extent necessary for providing that information.

8.2 Disclosure of Personal Data to Shipping Service Providers

• Deutsche Post

  • Provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany.

  • Pursuant to Art. 6(1)(a) GDPR, we share your email address and/or phone number prior to delivery for delivery scheduling or notification purposes if you expressly consented during checkout. Otherwise, pursuant to Art. 6(1)(b) GDPR, we pass on only the recipient’s name and delivery address for delivery purposes. Consent may be revoked at any time with future effect.

• DHL

  • Provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.

  • Terms and consent conditions match those stated above for Deutsche Post.

• DHL Express

  • Provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany.

  • Terms and consent conditions match those stated above for Deutsche Post.

• DHL Express Austria

  • Provider: DHL Express (Austria) GmbH, Am Europlatz 2 (Objekt G), 1120 Vienna, Austria.

  • Terms and consent conditions match those stated above for Deutsche Post.

• Hermes

  • Provider: Hermes Logistik Gruppe Deutschland GmbH, Essener Straße 89, 22419 Hamburg, Germany.

  • Terms and consent conditions match those stated above for Deutsche Post.

• Österreichische Post

  • Provider: Österreichische Post Aktiengesellschaft, Rochusplatz 1, 1030 Vienna, Austria.

  • Terms and consent conditions match those stated above for Deutsche Post.

• UPS

  • Provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany.

  • Terms and consent conditions match those stated above for Deutsche Post.

8.3 Use of Payment Service Providers

• Apple Pay

  • Provider: Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

  • Payment processing is carried out via your iOS, watchOS, or macOS device charging a saved payment card. Verification occurs via a device code, Face ID, or Touch ID. Your order details and payment info are encrypted and transmitted to Apple. Processing is conducted solely for payment execution pursuant to Art. 6(1)(b) GDPR.

• Google Pay

  • Provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

  • For payment processing, your order and payment details are passed to Google. Google generates a one-time transaction token transmitted to the website. Processing occurs pursuant to Art. 6(1)(b) GDPR. Legitimate interest evaluations (e.g., verifying transaction data) occur under Art. 6(1)(f) GDPR.

• PayPal

  • Provider: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

  • Transaction data (name, address, payment details, amount) is passed on pursuant to Art. 6(1)(b) GDPR. If selecting payment methods where we make advance performance, credit checks may be conducted pursuant to Art. 6(1)(f) GDPR using mathematical-statistical scoring methods.

• Shopify Payments

  • Provider: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

  • Transaction data is passed on strictly for payment processing pursuant to Art. 6(1)(b) GDPR.

• Stripe

  • Provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

  • Transaction data is transmitted strictly for payment processing pursuant to Art. 6(1)(b) GDPR.

• SumUp

  • Provider: SumUp Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland D02 K580.

  • Transaction data is transmitted strictly for payment processing pursuant to Art. 6(1)(b) GDPR.

8.4 Sanctions List Screening

In initiating business relationships and executing orders, we reserve the right to cross-reference personal data against sanctions lists of the European Union and/or its member states. Data processing occurs pursuant to Art. 6(1)(c) GDPR to comply with statutory obligations preventing the provision of economic resources to sanctioned individuals or entities.

8.5 Electronic Right of Withdrawal Function for Distance Contracts

Consumers entering into contracts on this website with a statutory right of withdrawal can submit their revocation via an electronic withdrawal tool.

• Provider: 401layers UG, Dorothea-Erxleben-Straße 1a, 40721 Hilden, Germany.

• Processing occurs under Art. 6(1)(f) GDPR for user-friendly execution, and under Art. 6(1)(b) & (c) GDPR to comply with statutory requirements for consumer distance contracts.

9) Web Analytics Services

Shopify Analytics

• Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (and Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada).

• Uses cookies, pixels, and device fingerprinting to create pseudonymized user profiles and evaluate site usage.

• Processing occurs strictly based on explicit consent pursuant to Art. 6(1)(a) GDPR. Consent can be revoked at any time via our Consent Tool. Data transfers to Canada are covered under an EU adequacy decision.

10) Website Functionalities

10.1 Google Maps

This site uses the Google Maps online map service from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") to visually display geographic information and show our location.