1Controller

The operator of this online shop is responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR). Full details can be found at the end of this privacy policy (section "Responsible party and contact") as well as in the legal notice.

A data protection officer has not been appointed, as there is no legal requirement to do so.

2Hosting and server log files

Our website is hosted by Hostinger International Ltd. When you access the website, technically necessary data (IP address, date and time, page accessed, browser and operating system, referrer) is stored in server log files. The legal basis is Art. 6 para. 1 lit. f GDPR (secure and stable operation). A data processing agreement is in place with the host. [DO WERYFIKACJI: server location / DPA]

3Cookies and consent

We use technically necessary cookies (e.g. for the basket, login and your cookie preferences). These are permitted without consent under § 25 (2) TDDDG; the legal basis is Art. 6 (1) (b) and (f) GDPR. Functional cookies (e.g. recently viewed products, wish list) are only set with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can change or withdraw your selection at any time via the 'Cookie settings' link in the footer.

4Orders and customer account

When you place an order or create a customer account, we process the data you provide (name, address, email, phone number, company and VAT ID if applicable, order and payment details) for contract fulfilment (Art. 6 para. 1 lit. b GDPR) and to meet legal record-keeping obligations (Art. 6 para. 1 lit. c GDPR). The shop is based on WordPress and WooCommerce and is hosted on our own server.

5Disclosure to shipping service providers

For delivery, we pass your name, delivery address and – if required for delivery notification – email address and phone number to the contracted shipping company (Art. 6 para. 1 lit. b GDPR). [TO DECIDE: carriers DE – e.g. DHL, DPD, GLS, UPS]

6Payment service providers

Depending on your chosen payment method, we pass on the data required for payment processing to the relevant payment service provider (Art. 6 para. 1 lit. b GDPR). The provider’s privacy policy applies to their processing. [TO BE DECIDED: payment operators DE – e.g. PayPal, Stripe/cards, Klarna]

7Sign in with Google

You can optionally sign in with your Google account. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) will share your name, email address and, if applicable, your profile picture with us. The legal basis is Art. 6 para. 1 lit. a and b GDPR. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework.

8Contact, messages and chat assistant

If you contact us by email, form, or via the message area in your customer account, we process your details to handle your enquiry (Art. 6 para. 1 lit. b or f GDPR). For the chat assistant on our website, we use an AI service from OpenAI, L.L.C. (USA); the texts you enter in the chat are sent to OpenAI for a response. Please do not enter sensitive data there. Data may be transferred to the USA based on the EU-US Data Privacy Framework or standard contractual clauses. [TO VERIFY: is AI chat staying on DE]

9Newsletter

If you subscribe to our newsletter, we’ll use your email address based on your consent (Art. 6 para. 1 lit. a GDPR) to send you offers and news. Subscription uses a double opt-in process. You can unsubscribe at any time via the link in every email. [TO VERIFY: double opt-in in DE system]

10Reviews

After a purchase, we may email you to request a product review (Art. 6(1)(f) GDPR or § 7(3) UWG). You can opt out at any time.

11Maps and external content

For map displays we use OpenStreetMap (OpenStreetMap Foundation, United Kingdom); the Leaflet map library is loaded via cdnjs (Cloudflare, Inc.). Your IP address will be transmitted to these providers (Art. 6 para. 1 lit. f GDPR). Fonts are loaded locally from our server. [TO VERIFY: Google Fonts / maps in DE]

12Share buttons

Our sharing links to Facebook, Pinterest and other networks are simple links. Data is only transferred when you click on such a link.

13Retention period

We only store personal data for as long as necessary for the respective purpose or as required by statutory retention periods (e.g. up to 10 years for tax and commercial law).

14Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to withdraw any consent given at any time with effect for the future. You may also lodge a complaint with a data protection supervisory authority, in particular in the Member State of your place of residence.

15Responsible party and contact

Karol Brzuszek Crates Station, ul. Lotników 74/2, 38-400 Krosno, Poland
E-mail: kontakt@holzkistenhaus.de