Privacy policy

Controller — Verantwortlicher

DUX Lederwaren GmbH
Haderholzstr. 17, 98593 Floh-Seligenthal, Germany
Email: support@duxlederwaren.shop · Telephone: +49 1570910104

We have not appointed a data protection officer, as the statutory thresholds of § 38 BDSG are not met. Data protection enquiries reach us at the address above and are answered by the management.

Principles

We collect the data we need to run a shop and nothing beyond it. We do not sell personal data, we do not build advertising profiles, and we do not use tracking pixels or advertising networks anywhere on this site.

Hosting and server logs

This site is hosted on the infrastructure of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, with delivery from data centres in the European Union. When you open a page, your browser transmits data that the server records in log files: IP address, date and time, the page requested, referrer, browser and operating system version, and the amount of data transferred.

Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is the secure, stable and troubleshootable operation of the shop. Log data is deleted or anonymised after 14 days at the latest. A data processing agreement under Art. 28 GDPR is in place with the hosting provider.

Cookies and local storage

This site sets no advertising or tracking cookies. Strictly necessary storage is used in your browser and never leaves it unless you place an order:

Anything beyond this — reach measurement or any form of analytics — is only activated with your prior consent under § 25 (1) TTDSG and Art. 6 (1)(a) GDPR, and you can withdraw that consent at any time with the same ease with which you gave it. See the cookie policy.

Orders and delivery

To process an order we collect: first and last name, email address, telephone number, delivery address, the items ordered and the resulting amounts. Legal basis: Art. 6 (1)(b) GDPR — performance of a contract or pre-contractual measures.

Your address is passed to the parcel carrier so the goods can be delivered. Your telephone number is passed only where the carrier needs it to arrange delivery. Payment data is processed by the payment service configured by the operator at the point of payment; that service acts as an independent controller for its own processing and provides its own privacy notice at the point of payment.

Invoices and the data on them are kept for the statutory retention periods (see below), on the basis of Art. 6 (1)(c) GDPR in conjunction with § 147 AO and § 257 HGB.

Contact and enquiry forms

When you use the contact form or the bulk enquiry form we process the data you enter in order to answer you. Legal basis: Art. 6 (1)(b) GDPR where the enquiry relates to a contract or pre-contractual step, otherwise Art. 6 (1)(f) GDPR — our legitimate interest in answering enquiries addressed to us.

Forms are protected against automated abuse. Where the operator has activated Cloudflare Turnstile, your IP address and a challenge token are transmitted to Cloudflare for that check only; legal basis Art. 6 (1)(f) GDPR, legitimate interest in preventing spam and abuse.

Newsletter

The measurement letter is sent only after double opt-in: you enter your address, we send a confirmation link, and nothing further is sent until you click it. We store your address, the time of registration and the time of confirmation as proof of consent.

Legal basis: Art. 6 (1)(a) GDPR. Every message contains a one-click unsubscribe link; on unsubscribing your address is deleted, other than a minimal record kept to ensure we do not write to you again.

Recipients and processors

• The hosting provider named above, as a processor under Art. 28 GDPR.
• The parcel carrier, for delivery of your order.
• The database and email service providers configured by the operator, as processors under Art. 28 GDPR.
• The payment service, at the point of payment, as an independent controller.
• Tax advisers and authorities, where statutory retention or reporting duties apply.

We do not pass personal data to anyone else, and we sell no data to third parties.

Transfers outside the EU

We prefer processing inside the European Union. Where a processor is based in the United States, transfers take place on the basis of the EU standard contractual clauses under Art. 46 (2)(c) GDPR and, where applicable, the EU–US Data Privacy Framework adequacy decision, together with supplementary technical measures.

Retention periods

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased where no retention duty applies (Art. 17);
• have processing restricted (Art. 18);
• receive your data in a portable, machine-readable form (Art. 20);
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21);
• withdraw consent at any time with effect for the future (Art. 7 (3)).

Write to support@duxlederwaren.shop and we will answer within one month, as Art. 12 (3) GDPR requires. We may ask you to confirm your identity before releasing data.

Right to complain

You may lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority competent for our registered office is the Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit (TLfDI), Häßlerstraße 8, 99096 Erfurt, Germany.

Changes to this policy

We update this policy when the shop changes or the law does. The current version always applies and carries the date shown at the top of this page.