Courtesy translation: only the German version is legally binding.

Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data is any data by which you could be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is

Hookain Onlineshop GmbH
Represented by managing director Johannes Heming
Grüner Brunnenweg 146
50827 Köln
Germany

E-mail address: kontakt@hookain.de
Legal notice: www.hookain.de/impressum

The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" and the padlock symbol in your browser bar.

2) Data collected when you visit our website

When you use our website for purely informational purposes, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

The website visited
Date and time of access
Amount of data sent in bytes
Source/reference from which you accessed the page
Browser used
Operating system used
IP address used (where applicable, in anonymised form)

This processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. However, we reserve the right to subsequently review the server log files should concrete indications of unlawful use come to our attention.

3) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted again after you close your browser (so-called "session cookies"), while others remain on your device for longer and enable the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage period in the overview of the cookie settings of your web browser.

If personal data is also processed by individual cookies used by us, the processing takes place either pursuant to Art. 6(1)(b) GDPR for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the visit to the site.

You can set your browser so that you are informed when cookies are set and decide individually whether to accept them, or exclude the acceptance of cookies for certain cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

4) Contacting us

4.1 When you contact us (e.g. via contact form or e-mail), personal data is processed – exclusively for the purpose of processing and responding to your enquiry, and only to the extent required for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter in question has been conclusively clarified, and provided that no statutory retention obligations preclude deletion.

4.2 WhatsApp Business

We offer visitors to our website the opportunity to contact us via the messaging service WhatsApp, operated by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called "Business version" of WhatsApp.

If you contact us via WhatsApp in connection with a specific transaction (for example, an order placed), we store and use the mobile phone number you use with WhatsApp as well as – if provided – your first and last name pursuant to Art. 6(1)(b) GDPR in order to process and respond to your enquiry. On the basis of the same legal basis, we may ask you via WhatsApp to provide further data (order number, customer number, address or e-mail address) in order to be able to assign your enquiry to a specific matter.

If you use our WhatsApp contact for general enquiries (e.g. regarding our range of services, availability, or our website), we store and use the mobile phone number you use with WhatsApp as well as – if provided – your first and last name pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the efficient and timely provision of the requested information.

Your data is always used solely to respond to your enquiry via WhatsApp. It is not disclosed to third parties.

Please note that WhatsApp Business is granted access to the address book of the mobile device we use for this purpose, and automatically transmits phone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account, we use a mobile device whose address book contains exclusively the WhatsApp contact details of those users who have also contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact details are stored in our address book has already, upon first using the app on their device, consented pursuant to Art. 6(1)(a) GDPR – by accepting WhatsApp's terms of use – to the transmission of their WhatsApp phone number from the address books of their chat contacts. A transmission of data of users who do not use WhatsApp and/or who have not contacted us via WhatsApp is thereby excluded.

Please refer to WhatsApp's privacy notice for the purpose and scope of data collection and the further processing and use of data by WhatsApp, as well as your related rights and settings options to protect your privacy: https://www.whatsapp.com/legal/?eea=1#privacy-policy

5) Data processing when opening a customer account

Pursuant to Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the extent required in each case if you provide it to us when opening a customer account. You can find out which data is required to open an account from the input form on our website.

Your customer account can be deleted at any time by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via the account have been fully processed, no statutory retention periods preclude deletion, and we no longer have a legitimate interest in continued storage.

6) Comment function

As part of the comment function on this website, in addition to your comment, information on the time the comment was created and the commenter name you chose are also stored and published on this website. Furthermore, your IP address is stored for security reasons, in order to enable identification of the author in the event of unlawful comments. Your e-mail address is stored so that we can contact you should a third party object to your published content as unlawful.

The legal bases for storing your data are Art. 6(1)(b) and (f) GDPR. We reserve the right to delete comments if they are objected to by third parties as unlawful.

7) Use of customer data for direct marketing

7.1 Registration for our e-mail newsletter

If you register for our e-mail newsletter, we regularly send you information about our offers. The only mandatory information for sending the newsletter is your e-mail address. The provision of further data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending the newsletter, which ensures that you only receive the newsletter once you have expressly confirmed your consent to receiving it by clicking a verification link sent to the e-mail address provided

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. In doing so, we store the IP address assigned by your Internet Service Provider (ISP) as well as the date and time of registration, in order to be able to trace any possible misuse of your e-mail address at a later date. The data collected by us when registering for the newsletter is used strictly for the specific purpose.

You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter, or by sending a corresponding message to the controller named at the beginning. Following unsubscription, your e-mail address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data, or we reserve the right to use the data in a manner that goes beyond this and is permitted by law, about which we inform you in this policy.

7.2 Sending the e-mail newsletter to existing customers

If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to regularly send you offers by e-mail for similar goods or services from our range to those already purchased. Pursuant to Section 7(3) of the German Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG), we are not required to obtain separate consent from you for this. In this respect, the data processing is carried out solely on the basis of our legitimate interest in personalised direct marketing pursuant to Art. 6(1)(f) GDPR. If you initially objected to the use of your e-mail address for this purpose, we will not send you any e-mails.

You are entitled to object at any time, with effect for the future, to the use of your e-mail address for the aforementioned marketing purpose by sending a message to the controller named at the beginning. You will only incur transmission costs according to the basic rates. Upon receipt of your objection, the use of your e-mail address for marketing purposes will be discontinued without delay.

7.3 Sendinblue

Our e-mail newsletters are sent via the following provider: Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany

On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided when registering for the newsletter to this provider pursuant to Art. 6(1)(f) GDPR, so that it can carry out the newsletter mailing on our behalf.

Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also carries out a statistical evaluation of the success of newsletter campaigns using web beacons or tracking pixels in the e-mails sent, which can measure open rates and specific interactions with the newsletter content. In doing so, device information (e.g. time of access, IP address, browser type and operating system) is also collected and evaluated, but is not merged with other data.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects the data of our website visitors and prohibits disclosure to third parties.

7.4 SMS marketing

On our website, you have the option to register for SMS notifications about current offers, promotions, and information regarding orders placed.

The only mandatory information for sending SMS notifications is your mobile phone number. The provision of further data is voluntary and is used to address you personally.

The so-called double opt-in procedure is used for sending SMS messages, which ensures that promotional SMS messages are only sent to you once you have expressly confirmed your consent to receiving SMS messages by clicking a verification link sent to the mobile phone number provided.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. When registering for SMS delivery, the date and time of registration are also stored, in order to be able to trace any possible misuse of your mobile phone number at a later date. The data collected upon registration is used exclusively for the purposes of promotional communication by way of SMS messages.

You can unsubscribe from SMS delivery at any time by sending a corresponding message to the controller named at the beginning, thereby revoking your consent with effect for the future. Following unsubscription, your mobile phone number will be deleted from the distribution list without delay, unless you have expressly consented to further use of your data, or we reserve the right to use the data in a manner that goes beyond this and is permitted by law, about which we inform you in this policy.

7.5 WhatsApp newsletter

If you register for our WhatsApp newsletter, we regularly send you information about our offers via WhatsApp. The only mandatory information for sending the newsletter is your mobile phone number.

To receive the newsletter, you add the mobile phone number we provide to the contacts on your mobile device and send us the message "Start" via WhatsApp. By sending this WhatsApp message, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR for the purpose of sending the newsletter. We then add you to our newsletter distribution list.

The data collected by us when registering for the newsletter is processed exclusively for the purposes of promotional communication by way of the newsletter. You can unsubscribe from the newsletter at any time by sending us the message "Stop" via WhatsApp. Following unsubscription, your mobile phone number will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data, or we reserve the right to use the data in a manner that goes beyond this and is permitted by law, about which we inform you in this policy.

Please note that WhatsApp is granted access to the address book of the mobile device we use for sending the newsletter, and automatically transmits phone numbers stored in the address book to a server of Facebook in the USA.

For the distribution of our WhatsApp newsletter, we therefore use a mobile device whose address book contains exclusively the WhatsApp contact details of our newsletter recipients. This ensures that every person whose WhatsApp contact details are stored in our address book has already, upon first using the app on their device, consented pursuant to Art. 6(1)(a) GDPR – by accepting WhatsApp's terms of use – to the transmission of their WhatsApp phone number from the address books of their chat contacts. A transmission of data of users who do not use WhatsApp and/or who have not contacted us via WhatsApp is thereby excluded.

7.6 Product availability notification by e-mail

For temporarily unavailable items, you can register to receive e-mail product availability notifications. In this case, we send you a one-off e-mail message about the availability of the item you have selected. The only mandatory information for sending this notification is your e-mail address. The provision of further data is voluntary and may be used to address you personally. We use the so-called double opt-in procedure for sending the e-mail, which ensures that you only receive a notification once you have expressly confirmed your relevant consent by clicking a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. In doing so, we store the IP address assigned by your Internet Service Provider (ISP) as well as the date and time of registration, in order to be able to trace any possible misuse of your e-mail address at a later date. The data collected by us when registering for our e-mail notification service for product availability is used strictly for the specific purpose.

You can unsubscribe from the availability notifications at any time by sending a corresponding message to the controller named at the beginning. Following unsubscription, your e-mail address will be deleted from the distribution list set up for this purpose without delay, unless you have expressly consented to further use of your data, or we reserve the right to use the data in a manner that goes beyond this and is permitted by law, about which we inform you in this policy.

7.7 If you abandon your shopping with us before completing your order, you have the option to be reminded once by e-mail of the contents of your virtual shopping cart.

The only mandatory information for sending this reminder is your e-mail address. The provision of further data is voluntary and may be used to address you personally. We use the so-called double opt-in procedure for sending the e-mail, which ensures that you only receive a notification once you have expressly confirmed your relevant consent by clicking a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR for sending a shopping cart reminder. In doing so, we store the IP address assigned by your Internet Service Provider (ISP) as well as the date and time of registration, in order to be able to trace any possible misuse of your e-mail address at a later date. The data collected by us when registering for our e-mail notification service is used strictly for the specific purpose.

You can unsubscribe from the shopping cart reminders at any time by sending a corresponding message to the controller named at the beginning. Following unsubscription, your e-mail address will be deleted from the distribution list set up for this purpose without delay, unless you have expressly consented to further use of your data, or we reserve the right to use the data in a manner that goes beyond this and is permitted by law, about which we inform you in this policy.

8) Data processing for order fulfilment

8.1 To the extent necessary for contract performance for delivery and payment purposes, the personal data collected by us is disclosed to the commissioned transport company and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

Where we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact details you provided when placing the order (name, address, e-mail address) in order to personally inform you, within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR, of upcoming updates via a suitable means of communication (e.g. by post or e-mail) within the period stipulated by law. Your contact details are used strictly for the specific purpose of notifications about updates owed by us, and are processed by us for this purpose only to the extent necessary for the respective information.

To process your order, we also work together with the following service provider(s), who support us fully or partially in performing the contracts concluded. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Use of specialised fulfilment service providers

8.3 JTL

We use the following provider for order processing: JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven, Germany

Name, address and, where applicable, further personal data are disclosed to the provider pursuant to Art. 6(1)(b) GDPR exclusively for the purpose of processing the online order. Your data is disclosed only to the extent that this is actually necessary for the processing of the order.

8.4 Disclosure of personal data to shipping service providers

8.5 Deutsche Post

We use the following provider as a transport service provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

We disclose your e-mail address and/or telephone number to the provider prior to delivery of the goods pursuant to Art. 6(1)(a) GDPR for the purpose of coordinating a delivery date or for delivery notification purposes, provided that you have given your express consent to this during the order process. Otherwise, for the purpose of delivery, we only disclose the recipient's name and the delivery address to the provider pursuant to Art. 6(1)(b) GDPR. Disclosure only takes place to the extent necessary for delivery of the goods. In this case, prior coordination of the delivery date with the provider or a delivery notification is not possible.

Consent can be revoked at any time with effect for the future, either vis-à-vis the controller named above or vis-à-vis the provider.

8.6 DHL

We use the following provider as a transport service provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

Consent can be revoked at any time with effect for the future, either vis-à-vis the controller named above or vis-à-vis the provider.

Location search for Packstations and post offices: Provided the function is enabled in the respective shop, you can search for a DHL Packstation or post office near you when entering a delivery address in Germany. For this purpose, we use the location search ("Location Finder") of Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany. Only once you start a search does our server transmit the postcode you entered (and, if applicable, the town and street), the country and the types of location searched for to the provider. The request is made exclusively via our server; your IP address is not transmitted to the provider, no content from the provider is loaded in your browser, no cookies are set and your device location is not requested. The search results are not stored on our server. If you select a location, we use it (including the postal customer number you entered) as the delivery address; this is passed on to DHL for delivery as described above. Using the location search is voluntary. The legal basis is Art. 6(1)(b) GDPR and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in the simple and correct entry of Packstation and post office addresses.

8.7 Use of payment service providers (payment services)

8.8 Klarna

One or more online payment methods of the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method of the provider under which you make advance payment (e.g. credit card payment), your payment data provided as part of the order process (including name, address, bank and payment card information, currency and transaction number), as well as information about the content of your order, are disclosed to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is disclosed exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method under which the provider makes advance payment (e.g. purchase on account or in instalments, or direct debit), you will also be asked during the order process to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, e-mail address, telephone number, and, where applicable, data relating to an alternative means of payment).

In order to safeguard our legitimate interest in ascertaining the creditworthiness of our customers, this data is forwarded by us to the provider for the purpose of a credit check pursuant to Art. 6(1)(f) GDPR. Based on the personal data you provided as well as further data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment method you selected can be granted with regard to payment and/or default risks.

For the decision within the scope of the application review, in addition to the provider's internal criteria, identity and credit information from the following credit reference agencies may also be taken into account pursuant to Art. 6(1)(f) GDPR:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit information may contain probability values (so-called score values). Insofar as score values are included in the result of the credit information, they are based on a scientifically recognised mathematical-statistical procedure. Among other things, but not exclusively, address data is included in the calculation of the score values.

You can object to this processing of your data at any time by sending us a message or by contacting the provider directly. However, the provider may nevertheless remain entitled to process your personal data, insofar as this is necessary for the contractual processing of payment.

8.9 PayPal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

9) Retargeting/remarketing and conversion tracking

- Google Ads conversion tracking

This website uses the online advertising programme "Google Ads" and, within the scope of Google Ads, the conversion tracking of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use Google Ads to draw attention to our attractive offers on external websites by means of advertising materials (so-called Google AdWords). In relation to the advertising campaign data, we can determine how successful the individual advertising measures are. In doing so, we pursue the aim of showing you advertising that is of interest to you, making our website more interesting for you, and achieving a fair calculation of the advertising costs incurred.

The cookie for conversion tracking is set when a user clicks on an ad placed by Google. Cookies are small text files that are stored on your device. These cookies generally expire after 30 days and are not used for personal identification. If the user visits certain pages of this website and the cookie has not yet expired, Google and we can recognise that the user clicked on the ad and was redirected to this page. Each Google Ads customer receives a different cookie. Cookies therefore cannot be tracked across the websites of Google Ads customers. The information obtained using the conversion cookie is used to generate conversion statistics for Google Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page tagged with a conversion tracking tag. However, they do not receive any information that could be used to personally identify users. In the course of using Google Ads, personal data may also be transmitted to the servers of Google LLC in the USA.

Details on the processing operations triggered by Google Ads conversion tracking and on how Google handles website data can be found here: https://policies.google.com/technologies/partner-sites

All processing operations described above, in particular the setting of cookies for reading out information on the device used, are only carried out if you have given us your express consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

You can also permanently object to the setting of cookies by Google Ads conversion tracking by downloading and installing the Google browser plug-in available at the following link:

https://www.google.com/settings/ads/plugin?hl=de

Please note that certain functions of this website may not be available, or only to a limited extent, if you have deactivated the use of cookies.

Google's privacy policy can be viewed here: https://www.google.de/policies/privacy/

10) Tools and other services

10.1 Cookie consent tool

This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications requiring consent. The "cookie consent tool" is displayed to users when the page is accessed, in the form of an interactive user interface on which consent for certain cookies and/or cookie-based applications can be given by ticking a box. By using the tool, all cookies/services requiring consent are only loaded once the respective user has given the relevant consent by ticking a box. This ensures that such cookies are only set on the user's device if consent has been given.

The tool sets technically necessary cookies to store your cookie preferences. As a general rule, no personal user data is processed in this process.

If, in an individual case, personal data (such as the IP address) is nevertheless processed for the purpose of storing, assigning, or logging cookie settings, this processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies, and thus in a legally compliant design of our website.

A further legal basis for the processing is also Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user's consent.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorised disclosure to third parties.

Further information about the operator and the settings options of the cookie consent tool can be found directly in the corresponding user interface on our website.

10.2 Doofinder

This website uses the search technology service of the following provider: DooFinder S.L., Madrid 28037, Rufino González 23 bis, 1º 1, Spain

In order to provide the search function for items via the search field and for navigation and filters, the provider collects and stores certain user information (such as the user or session ID) in anonymised form.

Insofar as personal data is also processed in this context, the processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing a fault-tolerant search for items, and thus in the optimal marketing of our range.

10.3 Shopware Analytics

Purpose of the processing: Together with our shop software service provider, under joint controllership, we evaluate certain information from our customer base (e.g. the customer group, pages visited, click paths, date and time of the visit, information about the device used (resolution, resolution density, operating system), referrer URL, information about the browser used, locale, search queries, and the time zone). This information is processed by an external service provider and forwarded to us in near real time, so that we can monitor the use of our website and improve our offers. Legal basis: Art. 6(1)(f) GDPR. Categories of data: derivations from master and contact data (the customer group, no individual customer data), usage data, connection data. Recipients of the data: shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany (as joint controller), IT service providers. The essence of the joint controllership: the joint controllership exists between us and shopware AG; the data is collected on our shop and then transmitted to the servers of shopware or its service providers; with the exception of obtaining your consent for the use of cookies or comparable technologies, and the fulfilment of these information obligations, all obligations, in particular the implementation of data subject rights, are incumbent on shopware AG, which you can contact at legal@shopware.com. You can also assert your data subject rights with us; we will then forward your request to shopware AG accordingly. shopware AG can derive behavioural patterns on our store from the data collected, but cannot attribute this data to you as a person. Intended transfer to third countries: None. Do we store personal data on your device, or read out such data, on the basis of your consent? Yes, see Consent Management for details.

10.4 OAuth login provider

By using the "Log in with [...]" button, you agree to the privacy policy of the provider used for matching the e-mail address for the login.

10.5 Google reCAPTCHA

To protect our forms against misuse and spam, in particular against automated entries by programs ("bots"), we use the "reCAPTCHA v3" service of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

reCAPTCHA is used for the following forms: registration of a customer account (including registration during checkout), the contact form, newsletter sign-up, the submission of product reviews and the back-in-stock notification. The reCAPTCHA script is loaded on pages that contain one of these forms.

reCAPTCHA v3 works in the background, without puzzles or any other interaction. Based on various characteristics, the service checks whether an entry was made by a human or by an automated program and returns a score. For this purpose, the following data in particular are processed: IP address, browser and device information (e.g. browser type and version, operating system, language settings, screen resolution), referrer URL and the page visited, date and time of access, information about your behaviour on the page (e.g. mouse movements, keystrokes, time spent on the page) and cookies or comparable information stored on your device. When you submit a form, our server transmits the verification token generated by reCAPTCHA together with your IP address to Google and receives a score in return. We use this score solely to decide whether to accept the form and do not store it permanently.

The legal basis for the processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website, our customer accounts and our communication channels against abusive automated use and spam. Storing information on your device or accessing information already stored there in connection with reCAPTCHA is based on Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), as it is strictly necessary to provide the form functions you have expressly requested. In our assessment, consent is therefore not required; reCAPTCHA is accordingly listed among the technically necessary cookies in the cookie notice. If you prefer not to use reCAPTCHA, you can also contact us by e-mail at kontakt@hookain.de.

In the course of using reCAPTCHA, personal data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For the USA, there is an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework, Art. 45 GDPR) under which Google LLC is certified. In addition, the transfer is safeguarded by standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

On our website, the cookie "_GRECAPTCHA" is set as soon as you make a choice in the cookie notice (including "Only necessary"). It only contains the value "1", enables reCAPTCHA to be used in the forms mentioned and is deleted after 30 days. When reCAPTCHA is loaded, Google may also set or read its own cookies on Google domains, including a cookie named "_GRECAPTCHA" with a storage period of up to six months. We have no influence on the processing and the storage period at Google.

Further information can be found in Google's privacy policy at https://policies.google.com/privacy?hl=en and in Google's terms of service at https://policies.google.com/terms?hl=en.

In addition, the forms mentioned contain a field that is invisible to you (a so-called "honeypot"). If this field is filled in – typically by an automated program – the entry is rejected. This check takes place exclusively on our server; no data is transmitted to third parties and no cookies are set in the process.

10.6 Google Places (address suggestions)

To make it easier for you to enter your delivery and billing address during checkout and to avoid typing errors in addresses, we offer – provided the function is enabled in the respective shop – a search field with address suggestions. For this purpose, we use the "Places API" of the Google Maps Platform of the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Using the search field is voluntary; you can always enter your address in the usual address fields without suggestions. Only once you enter at least three characters in the search field does our server request matching addresses from Google. The request is made exclusively via our server; no content or scripts from Google are loaded in your browser and no cookies are set or read. Google therefore receives neither your IP address nor any information about your browser or device.

Only the following data are transmitted to Google: the text you enter in the search field (e.g. parts of the street, house number, postcode or town), the countries to which the respective shop delivers, the language of the page, a randomly generated identifier of the respective search (for billing by Google) and, when you select a suggestion, its identifier ("Place ID") in order to retrieve the complete address. Your name, your e-mail address or other order data are not transmitted to Google. The selected address is transferred to the address fields and processed by us in the same way as an address entered manually; we do not store the Place ID or the search identifier with your address or order. The suggestions provided by Google are not stored on our server.

The legal basis for the processing is Art. 6(1)(b) GDPR, insofar as it serves to record your address for the implementation of pre-contractual measures or the performance of the purchase contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in fast and error-free address entry and thus in avoiding failed deliveries.

In the course of using the Places API, the data mentioned may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For the USA, there is an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework, Art. 45 GDPR) under which Google LLC is certified. In addition, the transfer is safeguarded by standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

Further information can be found in Google's privacy policy at https://policies.google.com/privacy?hl=en and in the Google Maps Platform terms of service at https://cloud.google.com/maps-platform/terms.

11) Rights of the data subject

11.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the cited legal basis for the respective requirements for exercising these rights:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent given, pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF, WITHIN THE FRAMEWORK OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

12) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of the processing and, where applicable, additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

If statutory retention periods exist for data that is processed within the scope of contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods expire, provided that it is no longer required for the performance of the contract or the initiation of a contract, and/or we no longer have a legitimate interest in its continued storage.

When processing personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

When processing personal data for the purposes of direct marketing on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise indicated by other information in this policy regarding specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.