Data protection

Controller responsible for data processing:

EXIM Welt GmbH

Hauptstr. 61 a
16348 Wandlitz
Germany

Tel: +49 3052015150
office@tommermann.de

We appreciate your interest in our online shop. Protecting your privacy is very important to us. Below, we provide you with detailed information about how we handle your data.

1. Access Data and Hosting

You can visit our website without providing any personal information. Each time a webpage is accessed, the web server automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, date and time of access, transferred data volume, and the requesting provider (access data). This log file documents the access.

This access data is analyzed solely for the purpose of ensuring a smooth operation of the website and improving our services. This is done in accordance with Art. 6(1)(f) of the GDPR to protect our legitimate interests, which prevail in the context of a balancing of interests, in the proper presentation of our offer. All access data is deleted no later than seven days after your visit to the site.

Hosting Services by a Third Party

As part of data processing on our behalf, a third-party provider provides services for hosting and website display. All data collected as described below through the use of this website or in designated forms in the online shop is processed on its servers. Processing on other servers only takes place as explained within this framework.
This service provider is located within a country of the European Union or the European Economic Area.

2. Cookies and Web Analysis

To make our website more attractive, enable certain functions, display suitable products, and conduct market research, we use so-called cookies on various pages. This serves to protect our legitimate interests in an optimized presentation of our offer in accordance with Art. 6(1)(f) of the GDPR. Cookies are small text files that are automatically stored on your device.

Some of the cookies we use are deleted at the end of your browser session (so-called session cookies). Other cookies remain on your device and allow us to recognize your browser on your next visit (persistent cookies). The storage duration of these cookies can be found in the cookie settings of your web browser.

You can configure your browser to inform you about the setting of cookies and decide individually whether to accept them or exclude the acceptance of cookies for specific cases or in general. Each browser manages cookie settings differently. This is described in the help menu of each browser, which explains how you can change your cookie settings.

If you do not accept cookies, the functionality of our website may be limited.

3. Data Collection and Use for Contract Processing, Contact Requests, and Customer Account Creation

We collect personal data when you voluntarily provide it to us in the context of an order, a contact request (e.g., via contact form or email), or when creating a customer account. Required fields are marked as such, as we need this data to process contracts or handle your contact request. Without this information, you cannot complete your order or send a contact request. The specific data collected is evident from the respective input forms.

We use the data you provide in accordance with Art. 6(1)(b) of the GDPR for contract processing and handling your inquiries.

If you have given your consent in accordance with Art. 6(1)(a) of the GDPR by choosing to create a customer account, we use your data for customer account creation.

After the contract has been fully executed or your customer account has been deleted, your data will be restricted for further processing and deleted after the expiration of tax and commercial retention periods, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this, as permitted by law and as explained in this policy. You can delete your customer account at any time by sending a message to the contact details below or using the function provided in the customer account.

4. Data Sharing

In order to fulfill the contract in accordance with Art. 6(1)(b) GDPR, we share your data with the shipping company responsible for delivering your order, to the extent necessary for the delivery of ordered goods. Depending on the payment service provider you select during the ordering process, we transfer the payment data collected for payment processing to the bank handling the payment, as well as to any payment service providers we have engaged or the selected payment service. In some cases, the selected payment service providers may also collect this data themselves if you create an account with them. In such cases, you must log in to the payment service provider during the ordering process using your login credentials. The privacy policy of the respective payment service provider applies.

The same applies to the transfer of data to our manufacturers or wholesalers in cases where they handle the shipping on our behalf (drop shipping).

Data Transfer to Shipping Service Providers

If you have given us your explicit consent during or after your order, we will forward your email address and telephone number to the selected shipping service provider in accordance with Art. 6(1)(a) GDPR. This allows them to contact you before delivery for the purpose of announcing or coordinating the shipment.

You can withdraw your consent at any time by sending a message to the contact information provided below. After revocation, we will delete your data unless you have expressly consented to further use of your data or we are legally permitted to retain it, as explained in this policy.

5. Customer Account

The user can register with us by providing personal data, which is transmitted and stored. The data provided during registration, as well as the IP address, date, and time of registration, are stored. Registration is necessary to provide certain content and services and serves as the basis for fulfilling our contract with the user.

As soon as the data is no longer required for its intended purpose, it will be deleted. If the registration was made without entering into a contract, this occurs when the customer account is deleted. Otherwise, personal data will be deleted after the mutual contractual obligations arising from any additional agreements have been fully fulfilled.

The processing of the aforementioned data is based on Art. 6(1)(b) GDPR in the context of contract fulfillment or initiation, or on Art. 6(1)(f) GDPR. The legitimate interest of the data controller is to provide certain content and services to users.

Right to Object and Deletion Option

The user can delete or modify their customer account at any time by notifying the contact specified in Section I. If the registration was necessary for the establishment or execution of a contractual relationship, there is no right to object or delete the data. In such cases, only the account itself can be deleted. The deletion of the account follows the steps mentioned above.

6. Email Newsletter

Email Marketing with Newsletter Subscription

If you subscribe to our newsletter, we will use the data necessary for this purpose or separately provided by you to regularly send you our email newsletter based on your consent in accordance with Art. 6(1)(a) GDPR.

You can unsubscribe from the newsletter at any time by sending a message to the contact details below or via the unsubscribe link provided in the newsletter. After unsubscribing, we will delete your email address from the recipient list unless you have expressly consented to further use of your data, or we reserve the right to use the data beyond this, as legally permitted and explained in this policy.

Email Marketing Without Newsletter Subscription & Right to Object

If we receive your email address in connection with the sale of a product or service and you have not objected, we reserve the right to send you regular offers via email for similar products from our range, based on § 7(3) of the German Unfair Competition Act (UWG). This serves to safeguard our legitimate interest in direct marketing, which outweighs other interests in the context of a balancing of interests.

You can object to this use of your email address at any time by sending a message to the contact details below or via the unsubscribe link provided in the promotional email. No costs will be incurred other than the basic transmission costs.

The newsletter is sent by a service provider acting on our behalf, to whom we pass on your email address for this purpose. This service provider is located within a country of the European Union or the European Economic Area.

7. Google Ads

We use Google Ads (formerly Google AdWords) provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to draw attention to our offers on external websites. Ad server cookies are used to measure certain success parameters, such as ad impressions or user clicks.

If you reach our website via a Google ad, Google Ads places a cookie on your device. These cookies typically expire after 30 days and are not intended to personally identify you. The cookie usually stores analysis values such as the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions), and opt-out information (indicating that the user does not wish to be targeted).

These cookies enable Google to recognize your internet browser. If a user visits certain pages of an Ads customer’s website and the cookie stored on their device has not expired, Google and the customer can recognize that the user clicked on the ad and was redirected to that page. Each Ads customer receives a different cookie. According to Google, cookies cannot be tracked across the websites of different Ads customers.

We do not process any personal data through these advertising measures. We only receive statistical reports from Google, which help us determine which advertising measures are particularly effective. We do not receive further data from these ads, and we cannot identify users based on this information.

Due to the marketing tools used, your browser automatically establishes a direct connection with Google’s servers. We have no influence on the extent and further use of the data collected by Google through this tool and inform you according to our current knowledge: By integrating Ads Conversion, Google receives information that you have accessed the relevant part of our website or clicked on one of our ads. If you are registered with a Google service, Google can associate the visit with your account. Even if you are not registered with Google or not logged in, it is possible that the provider may obtain and store your IP address.

For more information on Google Ads and Google’s privacy policy, please visit:
Google Ads Policies
Google Privacy Policy

The validity period of the cookie is 30 days and it will be deleted after expiration unless you delete it manually earlier—either through appropriate browser settings or manually.

The processing is based on Art. 6(1)(a) GDPR and only occurs with prior consent.

Right to Object and Deletion Option

You can block the use of cookies on your device or in the displayed cookie banner, or delete cookies after they have been used. Instructions on how to block or delete stored cookies can be found in your browser’s software guide. However, please note that in this case, some website functions may not be fully usable.

8. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google Analytics uses “cookies,” which are text files stored on the user’s device to analyze website usage. The information generated by the cookie about website usage is usually transferred to a Google server in the USA and stored there.

Due to IP anonymization being activated on this website, Google truncates the user’s IP address within member states of the European Union or in other states party to the Agreement on the European Economic Area before transmission. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and then truncated. On behalf of the website operator, Google will use this information to evaluate website usage, compile reports on website activity, and provide other services related to website and internet usage.

According to Google, the IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data unless you are logged into your Google account at the time of access.

For more information about Google’s privacy policies, please visit:
Google Privacy Policy

Once the data is no longer required for its intended purpose, it is deleted. This occurs when anonymization, which happens within the European Union, is completed—this process takes less than a second.

Data sent by us and associated with cookies, user identifiers (e.g., User-ID), or advertising IDs is automatically deleted after 14 months. Data whose retention period has expired is automatically deleted once a month.

For further information, please refer to:
Google Analytics Terms
Google Policies

The processing is based on Art. 6(1)(a) GDPR and § 15(3) TMG and occurs only with prior consent.

Right to Object and Deletion Option

You can block the use of cookies on your device or in the displayed cookie banner, or delete cookies after they have been used. Instructions on how to block or delete stored cookies can be found in your browser’s software guide. However, please note that in this case, some website functions may not be fully usable.

9. Payment Services

To facilitate ordering and payment processing, we use the following third-party tools:

PayPal Express, a service provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
For more information on PayPal’s privacy policy, please visit:
PayPal Privacy Policy

When accessing the shopping cart, these providers check via integrated scripts on our website whether the user is a customer of the respective provider and is logged in. This is done by matching cookies stored by the provider in the user’s browser.

For this purpose, the user’s IP address, browser, operating system, and the accessed page are transmitted to the third-party provider. We only collect data when a customer uses a third-party service, which then transfers the user’s stored data—specifically their order and billing address—to us. If applicable, the payment process is carried out in accordance with the terms of the service the customer is contracting with.

We only process the data transmitted to us by the third-party provider for the purpose of contract fulfillment. The retention period of this data follows the principles outlined in the “Contract Fulfillment” section above.

If the third-party providers process data on behalf of the data subjects, the retention period is determined by their respective privacy policies, which can be accessed via the links provided.

The legal basis for processing is Art. 6(1)(b) GDPR, as the data is necessary for contract execution via our website. Additionally, for payment services, storage is based on Art. 6(1)(c) GDPR, as the collected data is relevant for taxation purposes and necessary to fulfill our legal tax obligations. Furthermore, processing is justified under Art. 6(1)(f) GDPR, as it serves our legitimate interest in enabling customers to use the services of their contract partners and ensuring smooth and efficient payment processing.

Right to Object and Deletion Option

Since legal retention periods apply, and the data must be stored and processed for contract execution, objection or deletion is not possible.

10. Contact Options and Your Rights

As a data subject, you have the following rights:

• Right to Access (Art. 15 GDPR): You have the right to request information about the personal data we process about you.

• Right to Rectification (Art. 16 GDPR): You have the right to request the immediate correction of inaccurate or incomplete personal data stored by us.

• Right to Erasure (Art. 17 GDPR): You have the right to request the deletion of your stored personal data unless further processing is necessary:

– for exercising the right to freedom of expression and information;

– for compliance with a legal obligation;

– for reasons of public interest; or

– for the establishment, exercise, or defense of legal claims.

• Right to Restriction of Processing (Art. 18 GDPR): You have the right to request the restriction of processing of your personal data if:

– you contest the accuracy of the data;

– the processing is unlawful, but you oppose its deletion;

– we no longer need the data, but you require it for the establishment, exercise, or defense of legal claims; or

• You have objected to processing under Art. 21 GDPR.

• Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data that you provided to us in a structured, commonly used, and machine-readable format or request its transfer to another controller.

• Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. Typically, you can contact the supervisory authority of your habitual residence, workplace, or our company’s registered office.