Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

KiBoPal, Owner: Katarzyna Bracht
Bei den Linden 5
21449 Radbruch
Germany

Phone: +49 (0) 4178 8995920
Email: info@kibopal.de

2. General Information

The protection of your personal data is important to us. We treat your personal data confidentially and in accordance with the statutory data protection regulations, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

This privacy policy informs you about:

  • which personal data we collect,
  • for which purposes we process it,
  • on which legal basis this is done,
  • how long we store your data,
  • which rights you are entitled to.

Personal data is any information that can be used to identify you personally.

3. Scope

This privacy policy applies to all content and functions of the website https://www.kibopal.de as well as to all services and functions offered through it, in particular:

  • visiting our website,
  • using our online shop,
  • registering a customer account,
  • orders via WooCommerce,
  • contacting us via our contact form,
  • using our wishlist function,
  • consenting to cookies and similar technologies.

4. SSL/TLS Encryption

To protect the transmission of confidential content, this website uses state-of-the-art SSL/TLS encryption.

You can recognize an encrypted connection by the fact that the address bar of your browser starts with “https://” and a lock symbol is displayed.

Encryption prevents data you transmit to us from being read by unauthorized third parties.

5. Hosting

Our website is hosted by SiteGround Hosting Ltd.

For the purpose of providing the website, the hosting provider processes personal data that is technically necessary when visiting the website. This includes in particular:

  • IP address
  • date and time of access
  • browser type and version
  • operating system
  • referrer URL
  • pages visited
  • amount of data transferred
  • status codes

Processing is based on Art. 6(1)(f) GDPR due to our legitimate interest in a secure, stable and high-performance provision of our website.

A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider.

6. Server Log Files

When you visit our website, information is automatically collected and stored in so-called server log files. This data includes in particular:

  • IP address
  • date and time
  • browser information
  • operating system
  • requested URL
  • referrer
  • HTTP status code
  • amount of data transferred

This data is not merged with other data sources.

Processing is carried out in accordance with Art. 6(1)(f) GDPR to ensure trouble-free operation of the website, for error analysis and to guarantee IT security.

The log data is deleted as soon as it is no longer required for the purpose for which it was collected, unless statutory retention obligations require otherwise.

7. Cookies and Consent Management

Our website uses cookies and comparable technologies to enable the use of certain functions, to ensure the security of the website, to improve user-friendliness and to carry out statistical analyses.

Cookies are small text files that are stored on your device and contain certain information.

Not all cookies are required for the operation of the website. Insofar as technically non-essential cookies or comparable technologies are used, they are stored or read exclusively with your express consent in accordance with Section 25(1) TDDDG.

The subsequent processing of personal data is based on Art. 6(1)(a) GDPR.

Technically necessary cookies are stored on the basis of Section 25(2) TDDDG. Personal data is processed in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the technically error-free and secure provision of our online services.

8. Borlabs Cookie

We use Borlabs Cookie to manage cookie consents.

Borlabs Cookie makes it possible to obtain, manage and document visitors’ consent to the use of certain cookies and services. The following information, among others, is processed:

  • your consent or refusal
  • time of the decision
  • browser information
  • anonymized IP address (where technically necessary)
  • cookie ID
  • consent history

The data serves exclusively to fulfil our statutory documentation obligations pursuant to Art. 7 GDPR.

Legal bases:

  • Section 25(2) TDDDG (technically necessary storage)
  • Art. 6(1)(c) GDPR (fulfilment of legal obligations)
  • Art. 6(1)(f) GDPR (legitimate interest in legally compliant documentation)

The storage period is determined by the statutory retention obligations or the storage period defined in the consent tool.

9. Categories of Cookies Used

Depending on your selection, cookies from the following categories may be used on our website:

Technically necessary cookies

These cookies are required to provide the basic functions of the website. They include in particular:

  • storage of cookie settings
  • shopping cart function
  • login to customer accounts
  • checkout
  • website security
  • load balancing
  • protection against misuse

These cookies cannot be deactivated.

Statistics cookies

Statistics cookies help us to understand how visitors use our website. They allow us, for example, to see:

  • which pages are visited particularly often,
  • which content should be improved,
  • through which sources visitors reach our website.

Analysis takes place exclusively with your consent.

Marketing cookies

Marketing cookies make it possible to measure advertising campaigns and to display advertisements in a more targeted manner. They allow us, for example, to determine:

  • whether a Google ad led to an order,
  • which marketing measures are successful,
  • which campaigns should be optimized.

Marketing cookies are set exclusively with your express consent.

10. Withdrawal of Your Consent

You can withdraw or change your consent at any time with effect for the future. The cookie settings of our website are available to you at any time for this purpose.

The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent up to the time of withdrawal.

11. Legal Bases of Data Processing

Insofar as we process personal data, this is done exclusively on the basis of a statutory permission. In particular, the following legal bases apply:

  • Art. 6(1)(a) GDPR: consent of the data subject
  • Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR: fulfilment of legal obligations
  • Art. 6(1)(f) GDPR: protection of the legitimate interests of our company, unless your interests or fundamental rights prevail

In addition, the storage of and access to information on your device is carried out in accordance with the provisions of the German Telecommunications Digital Services Data Protection Act (TDDDG).

12. Google Tag Manager

Our website uses Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used exclusively for managing and deploying website tags. The tool itself does not store any personal data and does not set its own cookies. It merely ensures that other services can be technically integrated and managed on our website.

If further services are loaded via Google Tag Manager, they are used exclusively in accordance with your selection in the cookie banner and on the relevant legal basis.

Insofar as personal data is processed, this is done exclusively with your consent in accordance with Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Further information: https://policies.google.com/privacy

13. Google Analytics 4

If you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited.

Google Analytics enables us to statistically analyze the use of our website. In particular, the following data may be processed:

  • IP address (shortened or anonymized where technically provided)
  • device information
  • browser information
  • operating system
  • screen resolution
  • language settings
  • pages visited
  • time spent on pages
  • click behaviour
  • scroll behaviour
  • entry and exit pages
  • origin of visitors
  • approximate location
  • date and time of the visit

We use Google Analytics exclusively to improve our website and to optimize user-friendliness. According to our current state of knowledge, no customer-specific or personal profile data is merged with Google Analytics.

Processing is based exclusively on your consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings.

Google processes data partly on servers outside the European Union. For these data transfers, Google uses the standard contractual clauses approved by the European Commission as well as other suitable guarantees pursuant to Art. 46 GDPR.

Further information: https://support.google.com/analytics and https://policies.google.com/privacy

14. Google Ads Conversion Tracking

With your consent, our website uses Google Ads conversion tracking.

This service enables us to understand whether visitors reached our website via a Google ad and carried out certain actions, for example:

  • contacting us
  • purchasing a product
  • completing an order

Each Google Ads customer receives a different cookie, so that individual visitors cannot be personally identified. In particular, the following information is processed:

  • cookie ID
  • time of the conversion
  • technical device information
  • browser information
  • referrer
  • pages visited

Processing is based exclusively on your consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via our cookie banner.

Further information: https://policies.google.com/privacy

15. Data Transfers to Third Countries

When using Google services, it cannot be ruled out that personal data may also be transferred to Google servers outside the European Union, in particular in the United States of America.

Google bases these data transfers on an adequacy decision of the European Commission under the EU-US Data Privacy Framework, insofar as the respective service is certified under it. Where necessary, standard contractual clauses pursuant to Art. 46 GDPR are additionally used.

Despite these measures, it cannot be completely ruled out that government authorities in the third country may access personal data under the legal requirements applicable there.

16. Storage Period for Google Services

Personal data is only stored for as long as is necessary for the respective processing purposes or as long as statutory retention obligations exist.

Analytics and marketing data is processed or deleted in accordance with the storage periods defined in the respective services. Consents given can be withdrawn at any time with effect for the future.

17. Use of Our Online Shop

We offer an online shop based on WooCommerce on our website.

When you place an order, we process the personal data required for the performance and processing of the purchase contract. This includes in particular:

  • first and last name
  • billing address
  • delivery address
  • company (if provided)
  • email address
  • phone number (if provided)
  • order data
  • payment information
  • delivery information
  • communication data in connection with the order

Processing is carried out for the performance of pre-contractual measures and for the fulfilment of the purchase contract in accordance with Art. 6(1)(b) GDPR.

In addition, we process data to fulfil statutory retention obligations in accordance with Art. 6(1)(c) GDPR and to protect our legitimate interests, for example for fraud prevention or the enforcement of legal claims, in accordance with Art. 6(1)(f) GDPR.

18. Customer Account

You have the option of creating a customer account on our website. The following data in particular is processed:

  • name
  • address
  • email address
  • encrypted password
  • order history
  • delivery addresses
  • billing addresses

The customer account serves to:

  • simplify future orders,
  • view order histories,
  • manage delivery addresses,
  • process orders more quickly.

Processing is based on Art. 6(1)(b) GDPR.

You can have your customer account deleted at any time. Statutory retention obligations for orders already completed remain unaffected.

19. Guest Orders

Orders are also possible without registration.

In this case, only the personal data required for the performance of the purchase contract is processed. No permanent storage in a customer account takes place.

Processing is carried out in accordance with Art. 6(1)(b) GDPR.

20. Wishlist Function

Our website offers the option of saving products to a personal wishlist. The following data in particular may be processed:

  • user identifier
  • wishlist contents
  • date of saving
  • device information (where technically necessary)

The wishlists serve exclusively to improve user-friendliness.

The legal basis is Art. 6(1)(b) GDPR for registered customers or Art. 6(1)(f) GDPR based on our legitimate interest in a user-friendly design of our online shop.

21. Contact Form

If you use our contact form, we process the personal data you enter. This includes in particular:

  • name
  • email address
  • phone number (if provided)
  • subject
  • message
  • time of transmission
  • IP address (where technically necessary)

Processing is carried out exclusively to handle your enquiry. The legal basis is:

  • Art. 6(1)(b) GDPR, if your enquiry is aimed at the conclusion or performance of a contract,
  • Art. 6(1)(f) GDPR for general enquiries, based on our legitimate interest in efficient communication.

The data is deleted as soon as your enquiry has been conclusively processed and no statutory retention obligations require otherwise.

22. Communication in Connection with Orders

In connection with orders, we use your contact details to inform you about the status of your order. This includes in particular:

  • order confirmations
  • payment information
  • shipping information
  • queries regarding the order
  • complaints
  • returns

This communication is based on Art. 6(1)(b) GDPR.

23. Storage of Contract Data

Contract-related data is stored in accordance with statutory commercial and tax retention obligations.

The storage period is generally up to ten years after the end of the calendar year in which the respective business transaction was completed, unless longer statutory retention periods apply.

24. Payment Processing via Mollie

We use the payment service provider Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands, to process payments.

If you select one of the payment methods offered, the personal data required for payment processing is transmitted to Mollie. This includes in particular:

  • name
  • billing address
  • delivery address
  • email address
  • order number
  • order amount
  • currency
  • payment information
  • IP address (where necessary)
  • technical transaction information

The data is transmitted exclusively for the purpose of processing the payment and for fraud prevention.

The legal basis for processing is Art. 6(1)(b) GDPR.

Further information: https://www.mollie.com/de/privacy

25. Available Payment Methods

Depending on the selection made during the ordering process, the following payment methods may be offered:

  • PayPal
  • credit card
  • Apple Pay
  • Google Pay
  • invoice

Depending on the selected payment method, the privacy policies of the respective payment service provider may also apply.

Processing is carried out exclusively for payment processing and for the fulfilment of the purchase contract.

26. Shipping of Goods

For the delivery of the ordered goods, we pass on the personal data required for delivery to the commissioned shipping service provider. This includes in particular:

  • name
  • delivery address
  • phone number (where required)
  • email address (where required)
  • order information

Processing is carried out exclusively for the performance of the purchase contract in accordance with Art. 6(1)(b) GDPR.

27. Freight Forwarding

For goods delivered by freight forwarder, additional personal data is processed as required for scheduling and delivery. This includes in particular:

  • name
  • delivery address
  • phone number
  • email address
  • delivery instructions
  • order information

The data is passed on exclusively for the purpose of carrying out the delivery. The legal basis is Art. 6(1)(b) GDPR.

28. Invoicing and Accounting

To fulfil commercial and tax obligations, we process personal data in the context of invoicing and our accounting. This includes in particular:

  • name
  • address
  • invoice data
  • order data
  • payment information
  • VAT information (where required)

Processing is based on Art. 6(1)(c) GDPR. Retention is governed by the statutory commercial and tax retention periods.

29. Credit Checks

We currently do not carry out any independent credit checks on our customers.

Should a credit check become necessary in the future for individual payment methods or financing offers, this will be done exclusively on the basis of the statutory provisions and separate information in the ordering process.

30. Fraud Prevention

To ensure a secure ordering process, certain technical information may be processed in order to detect fraudulent orders and to ensure the security of our online shop. In particular, the following may be processed:

  • IP address
  • device information
  • browser information
  • times of orders
  • technical connection data

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is to detect attempted fraud, to protect the online shop from misuse and to ensure the security of payment processing.

31. Storage of Payment Data

We do not store complete credit card or payment data ourselves.

Payment processing is carried out by the commissioned payment service provider. Only the information required to document the order, for invoicing and to fulfil legal obligations is stored.

32. Cloudflare Turnstile

To protect our website against abusive automated access (e.g. by bots or spam), we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

Cloudflare Turnstile serves to distinguish between human users and automated access without using classic CAPTCHA queries. In particular, the following information may be processed:

  • IP address
  • browser information
  • operating system
  • device information
  • referrer URL
  • time of the page view
  • technical connection information
  • mouse and interaction data, insofar as required for bot detection

Processing is based exclusively on your consent in accordance with Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, insofar as consent is required. Insofar as Turnstile is used exclusively to protect the website against attacks and only technically necessary information is processed for this purpose, processing is based on our legitimate interest in accordance with Art. 6(1)(f) GDPR.

Further information: https://www.cloudflare.com/privacypolicy/

33. Wordfence Security

To protect our website against cyber attacks, malware and unauthorized access, we use Wordfence Security from Defiant Inc., USA.

Wordfence serves in particular to detect and defend against:

  • brute force attacks
  • malware
  • automated attacks
  • unauthorized login attempts
  • suspicious network activity

The following data, among others, may be processed:

  • IP address
  • browser information
  • operating system
  • requested URLs
  • time of the request
  • technical security logs
  • information about suspicious access

Processing is based on our legitimate interest in accordance with Art. 6(1)(f) GDPR in ensuring the security, integrity and availability of our website.

Insofar as data is transferred to servers outside the European Union, this is done in compliance with the requirements of Art. 44 et seq. GDPR.

Further information: https://www.wordfence.com/privacy-policy/

34. Google Reviews via Trustindex

We embed Google reviews on our website via the Trustindex service. Reviews are loaded live from Google.

When you visit the relevant pages, a connection to Google and/or Trustindex servers may be established. In particular, the following information may be processed:

  • IP address
  • browser information
  • device information
  • referrer URL
  • date and time of the page view

The purpose of the processing is to display current customer reviews and to provide transparent information about the experiences of other customers.

The legal basis is your consent in accordance with Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, insofar as technically non-essential cookies or comparable technologies are used.

Further information: https://www.trustindex.io/privacy-policy/ and https://policies.google.com/privacy

35. Performance Optimization

We use various optimization measures to improve the loading speed and stability of our website. These include in particular:

  • WP Rocket
  • SiteGround Speed Optimizer
  • server-side caching technologies
  • image optimization
  • compression of static content
  • browser caching
  • minification of CSS and JavaScript files

These measures serve exclusively the technical optimization of our website. Insofar as personal data is processed, this is done on the basis of our legitimate interest in accordance with Art. 6(1)(f) GDPR in a secure, fast and economical provision of our online services.

36. Self-Hosted Fonts

The fonts used on our website are provided locally on our own web server.

No connection to the servers of Google Fonts or other external font providers is established when you visit our website. As a result, no personal data is transmitted to external providers in connection with the display of the fonts used.

37. Technical Optimization Services

To improve the stability, security and user-friendliness of our website, technical information may be processed insofar as this is necessary for the operation of the website. This includes in particular:

  • browser type
  • operating system
  • screen resolution
  • language settings
  • device information
  • date and time of access
  • technical connection data

This data serves exclusively for the provision, optimization and error analysis of our website. The legal basis is Art. 6(1)(f) GDPR.