Last updated: 31 August 2026

 

1. Data Controller

The controller responsible for the processing of personal data on this website is:

cool down germany
Proprietor: Michael Senn
Graubergen 9
21218 Seevetal
Germany

Phone: +49 151 540 78 990
Email: info@cooldowngermany.com

 

2. General Information on Data Processing

We process personal data only to the extent necessary to operate our online shop, process and fulfil orders, communicate with customers, comply with legal obligations, or carry out the analytics, review and marketing activities described below.

Depending on the processing activity, we rely in particular on the following legal bases:

• Article 6(1)(a) GDPR – consent
• Article 6(1)(b) GDPR – taking steps prior to entering into a contract or performance of a contract
• Article 6(1)(c) GDPR – compliance with a legal obligation
• Article 6(1)(f) GDPR – pursuit of legitimate interests

Where special categories of personal data, in particular health data, are processed, the requirements of Article 9 GDPR also apply.

Where cookies or similar technologies store information on your device or access information already stored on your device, the provisions of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG) also apply.

We generally use non-essential analytics, marketing and advertising technologies only after you have given your consent.

 

3. Categories of Personal Data

Depending on how you use our online shop, we may process the following categories of personal data in particular:

• first and last name
• billing and delivery address
• email address
• telephone number, where provided
• company and business customer information
• customer account and login data
• order, contract, payment and return data
• communications and customer support content
• product, batch, complaint and incident data
• reviews and review content
• photographs or other files voluntarily provided by you
• IP address and technical connection information
• browser, device and operating system information
• pages viewed and functions used
• product views and search activity
• shopping cart, checkout and purchase events
• cookie, consent and marketing information
• newsletter subscriptions and interaction data

 

4. Technical Provision of the Website

When you access our website, technically necessary data is processed in order to deliver the website to your device and to ensure secure, stable and functional operation.

This may include in particular:

• IP address
• date and time of access
• requested page or file
• browser type and browser version
• operating system used
• referrer URL
• device information
• technical error and security information

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, functional and uninterrupted operation of our online shop and in detecting and preventing misuse and attacks.

Storage of or access to information on your device that is strictly necessary for technical purposes is carried out on the basis of Section 25(2) TDDDG.

4.1 Cloudflare

To ensure the secure, reliable and efficient delivery of our online shop, we use services provided by:

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

Cloudflare provides functions in particular for the delivery of website content, improvement of loading performance, and protection against attacks, automated abuse and malicious traffic.

The following information may be processed in particular:

• IP address
• browser and device information
• date and time of requests
• requested content and resources
• technical network data
• security and log data

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and efficient provision of our online shop and in protecting it against attacks and misuse.

Where technically necessary information is stored on or accessed from your device, this is carried out on the basis of Section 25(2) TDDDG.

4.2 jsDelivr

For the technical delivery of certain software libraries and website resources, we use jsDelivr, a service provided by:

Volentio JSD Limited
United Kingdom

jsDelivr provides technical files via a content delivery network (CDN). When such resources are retrieved, your browser may establish a connection to servers or CDN infrastructure used by jsDelivr.

The following information may be processed in particular:

• IP address
• browser and device information
• requested resource
• referrer information
• date and time of access
• technical connection data

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in the reliable, fast and technically efficient delivery of the software libraries and resources required for our online shop.

4.3 BugSnag

To detect, analyse and resolve technical errors and disruptions, we use BugSnag, a service provided by:

SmartBear Software, Inc.
USA

BugSnag helps us identify technical errors in our online shop, understand their causes and improve the stability and functionality of our website.

Depending on the technical configuration and the particular error, the following information may be processed in particular:

• information about errors that have occurred
• pages or URLs accessed
• browser and device information
• operating system
• technical session and request data
• error and diagnostic data
• technical identifiers
• IP address, where applicable

The processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in detecting and resolving technical disruptions and ensuring the secure, stable and reliable operation of our online shop.

We do not use BugSnag for advertising or marketing purposes.

4.4 Google Tag Manager

For the technical management and control of the tags used on our website, we use Google Tag Manager.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Tag Manager enables us to centrally manage other services and tags and to trigger them in accordance with the respective consent decision.

The analytics and marketing services implemented through Google Tag Manager are described separately in this Privacy Policy.

Where consent is required for a service managed through Google Tag Manager, that service is only executed in accordance with the consent granted for that purpose. The legal basis for the respective processing depends on the purpose and legal basis of the service implemented through Google Tag Manager.

Our Google setup is also controlled by the Google Consent Mode described in this Privacy Policy.

 

5. Shopify

Our online shop is operated using the Shopify e-commerce platform.

For merchants in the European Economic Area, the relevant entity is in particular:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Our shop is hosted by Shopify. Shopify processes personal data in particular for:

• providing and displaying the online shop
• managing products and customers
• providing the shopping cart and checkout
• managing customer accounts
• processing and documenting orders
• supporting payment processing
• performing security and fraud checks
• providing communication, analytics and marketing functions
• technical maintenance and further development of the platform

This may involve the processing of contact, order, payment, transaction, usage, device, cookie and consent data.

Where Shopify processes personal data on our behalf, such processing is carried out on the basis of a data processing agreement. For certain Shopify services, Shopify may also process personal data under its own responsibility.

Shopify may also share information with Shopify group companies and other service providers, including in other countries, where this is necessary to provide its services.

Further information:

Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/customers

Shopify Privacy Portal:
https://privacy.shopify.com/

 

6. Shopify Network Intelligence

Shopify Network Intelligence is enabled in our Shopify shop.

Shopify may use customer data together with information from interactions with our shop, other Shopify merchants and Shopify itself to provide so-called “Enhanced Services”.

These may serve in particular the following purposes:

• improving and personalising Shopify services
• improving shop performance
• security and fraud prevention
• improving analytics functions
• improving marketing and advertising functions
• improving audience selection

Depending on the relevant function, customer, contact, order, usage, device, cookie and interaction data may be processed.

According to Shopify, other Shopify merchants do not receive direct access to our customer data.

For visitors from the European Economic Area, Shopify takes the relevant consent decision into account for non-essential purposes where a consent solution is properly connected to the Shopify Customer Privacy API.

Shopify Network Intelligence is also required for certain Shopify functions, including Shopify Messaging.

 

7. Orders and Contract Processing

When you place an order with us, we process the data required to process and fulfil your order.

This includes in particular:

• first and last name
• billing and delivery address
• email address
• telephone number, where provided
• company information for business customers
• products and quantities ordered
• order number and order date
• payment method and payment status
• shipping information
• return and refund information

The processing is carried out for the purpose of taking steps prior to entering into a contract and performing the purchase contract in accordance with Article 6(1)(b) GDPR.

We also process order, invoice, payment and accounting data where necessary to comply with tax, commercial and other statutory documentation and retention obligations in accordance with Article 6(1)(c) GDPR.

Without the information marked as mandatory, we may be unable to process your order properly.

 

8. Customer Account

If you create or use a customer account, we may process in particular:

• name and contact details
• login and authentication information
• saved addresses
• order history
• return information
• account settings

The processing is carried out to provide and manage the customer account in accordance with Article 6(1)(b) GDPR.

You may request deletion of your customer account. Order, invoice, payment and contract information that must be retained by law will remain unaffected.

 

9. Payment Processing

To process your order, we process the personal data required for the payment method selected by you and, where necessary, transfer it to the participating payment service providers, payment processors, card networks and financial institutions.

The following data may be processed in particular:

• name
• billing address and, where applicable, delivery address
• email address
• telephone number, where required or provided
• order number
• products ordered
• order amount and currency
• payment method and payment status
• transaction identifiers
• IP address
• device and security information
• account, card or other payment information, depending on the payment method

The processing of data required for payment processing is carried out in accordance with Article 6(1)(b) GDPR for the performance of the purchase contract.

Where data is processed to prevent fraud, secure payment transactions or prevent misuse, the processing may additionally be based on Article 6(1)(f) GDPR. Our legitimate interest is the secure processing of payments and the prevention of fraud and financial loss.

Where statutory tax, anti-money laundering, sanctions-related or other verification and retention obligations apply, processing may also be based on Article 6(1)(c) GDPR.

Complete card or other payment instrument details are generally processed directly by the participating payment service providers and are normally not fully visible to us.

9.1 Shopify Payments

We use Shopify Payments.

Provider:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

We currently offer the following payment methods through Shopify Payments:

• Visa
• Mastercard
• American Express
• Maestro
• UnionPay
• Shop Pay
• Apple Pay
• Google Pay
• Klarna

In connection with Shopify Payments, contact, billing, order, payment, transaction, device, IP and security information may be processed.

Shopify Payments works with payment processors, card networks, banks and other financial service providers to process payments. These parties may process data under their own responsibility to the extent necessary.

9.2 Credit and Debit Cards

Through Shopify Payments, we currently accept:

• Visa
• Mastercard
• American Express
• Maestro
• UnionPay

When you pay by card, the data required to authorise and process the payment is transferred to Shopify Payments and the relevant payment processors, card networks, card-issuing institutions and other financial institutions.

We generally do not receive your complete card details, but only the information required to manage the order and payment.

9.3 Shop Pay

We offer Shop Pay as an accelerated checkout method provided by Shopify.

Shop Pay allows customers to use certain shipping, billing and payment information stored with Shopify for faster future checkouts.

When an order is placed through our shop using Shop Pay, we receive the information required to process and fulfil the order.

9.4 Apple Pay

We offer Apple Pay through Shopify Payments.

When Apple Pay is used, the information required to process the payment is handled between your device, Apple, the card issuer or payment network and the participating payment service providers.

According to Apple, the actual credit or debit card number is not provided to us as the merchant when Apple Pay is used on websites. However, information authorised by you, such as delivery, billing or contact information, may be transferred for the purpose of processing your order.

Further information is available in Apple’s privacy information relating to Apple Pay.

9.5 Google Pay

We offer Google Pay through Shopify Payments.

For users in the European Economic Area, the entity generally responsible for personal data relating to Google Payments is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Payments may process payment profile, payment, transaction, account, device, security and fraud-prevention information.

The information required for your order is transferred to us and the participating payment service providers to the extent necessary.

9.6 Klarna

We offer Klarna within Shopify Payments as a local payment method.

The relevant payment service provider is:

Klarna Bank AB (publ)
Sweden

Depending on availability and the requirements of the individual transaction, Klarna may offer payment options such as immediate payment, payment at a later date or by invoice, or instalment payments.

When you select a Klarna payment method, the following information may be processed or transferred to Klarna in particular:

• name
• contact details
• billing and delivery address
• order information
• order amount
• payment information
• IP address
• technical and security-related information

Klarna may process personal data under its own responsibility, in particular to provide the selected payment method, process payments, carry out risk and fraud checks and comply with its own legal obligations.

Further information is available in Klarna’s privacy notices.

9.7 PayPal

In addition to Shopify Payments, we use PayPal as a separately integrated payment service provider.

Provider for customers in the European Union:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
Luxembourg

If you select PayPal, the information required to process the payment is transferred to PayPal.

This may include in particular:

• name
• email address
• billing and, where applicable, delivery address
• order information
• order amount and currency
• transaction information
• IP address
• device and security information

PayPal processes payment, account, identity, device and financial information partly under its own responsibility, in particular to provide its payment services, carry out identity, security and risk checks and comply with legal obligations.

 

10. Shipping with DHL

For the delivery of your order, we transfer the necessary information to:

DHL Paket GmbH
Charles-de-Gaulle-Straße 20
53113 Bonn
Germany

The following data may be transferred in particular:

• recipient’s name
• delivery address
• order and shipment information
• email address, where required for shipment information
• telephone number, where required for delivery or provided by you

The transfer of data required for delivery is carried out in accordance with Article 6(1)(b) GDPR for the performance of the purchase contract.

Where additional voluntary shipment notifications or delivery options are offered, the processing of the relevant contact data is carried out on the legal basis applicable to the respective function.

 

11. Contact, Customer Service, Returns and Complaints

If you contact us by email, telephone, contact form or another method, we process the information you provide in order to handle your enquiry.

This may include in particular:

• name
• email address
• telephone number
• order number
• content of your message
• information relating to products, deliveries, returns or complaints
• photographs and other attachments

Where your enquiry relates to an order, a contract or pre-contractual measures, the processing is carried out in accordance with Article 6(1)(b) GDPR.

For other enquiries, processing is generally based on Article 6(1)(f) GDPR. Our legitimate interest is the proper handling and documentation of customer enquiries.

 

12. Health Data and Information Relating to Medical Devices

Complaints, returns or reports relating to medical devices may contain information about injuries, illnesses, symptoms, side effects or other health-related circumstances.

Health data constitutes a special category of personal data under Article 9 GDPR.

Please provide only such health information as is necessary to process your enquiry or a possible incident.

Depending on the specific matter, processing may be based in particular on:

• your explicit consent pursuant to Article 9(2)(a) GDPR,
• the necessity for the establishment, exercise or defence of legal claims pursuant to Article 9(2)(f) GDPR, or
• where the statutory requirements are met, applicable legal provisions relating to the safety of medical devices in conjunction with Article 9 GDPR.

As a distributor of a medical device, we may in particular be required to forward complaints or reports concerning suspected incidents without delay to the manufacturer and, where applicable, its authorised representative and importer, and to maintain a register of complaints, non-conforming devices, recalls and withdrawals.

These obligations arise in particular from Article 14(5) of Regulation (EU) 2017/745 on medical devices (MDR).

Where the processing of ordinary personal data is necessary to comply with such legal obligations, it is carried out in particular pursuant to Article 6(1)(c) GDPR.

We do not use health data to create advertising profiles and do not transfer health data as health data to Google, Meta, TikTok or other advertising platforms for advertising purposes.

 

13. Email Marketing with Shopify Messaging

We use Shopify Messaging to send email marketing communications, for example newsletters, product information, offers and marketing automations.

We do not use Shopify Messaging for SMS marketing.

The following data may be processed in particular:

• name
• email address
• subscription status
• date, time and source of subscription
• proof of consent
• sending and delivery status
• opens and clicks, where relevant tracking is enabled
• campaign interactions
• sessions and orders attributed to campaigns
• unsubscribes
• undeliverable emails
• spam complaints

Marketing emails are generally sent on the basis of your consent pursuant to Article 6(1)(a) GDPR and in compliance with Section 7 of the German Unfair Competition Act (UWG).

Where all requirements of the existing-customer exception under Section 7(3) UWG are met, an email address obtained in connection with a sale may also be used for direct marketing of our own similar goods or services.

You may withdraw your consent or object to the use of your email address for advertising purposes at any time with effect for the future:

• by using the unsubscribe link in the relevant email, or
• by emailing info@cooldowngermany.com.

Following an unsubscribe request, we may store your email address on a suppression list to the extent necessary to ensure that your objection is permanently respected.

 

14. Product Reviews with Judge.me

We use Judge.me to collect, manage and display product reviews and, where applicable, shop reviews.

Provider:

Judge.me Ltd
c/o Buckworths
2nd Floor
1–3 Worship Street
London EC2A 2AB
United Kingdom

The following data may be processed in connection with Judge.me:

• name
• email address
• order information
• order number
• products purchased
• star rating
• review content
• review date
• voluntarily provided photographs or videos
• information linking a review to an actual purchase
• technical device, browser and usage information

Judge.me may receive certain order and customer information from Shopify, in particular to associate review requests with orders and verify reviews from actual purchasers.

Where Judge.me processes personal data on our behalf, it acts as our service provider or processor.

The provision and display of the review system is generally based on Article 6(1)(f) GDPR. Our legitimate interest lies in transparently presenting customer experiences, improving our products and assisting other customers in making purchasing decisions.

If you voluntarily submit a review, we process the information provided by you for the purpose of reviewing and publishing the review.

Where review request emails qualify as advertising, they are sent only in accordance with the applicable legal requirements for electronic advertising.

 

15. Sternify

We use the Shopify app Sternify to design and optimise our online shop.

Depending on the modules activated in our shop, Sternify may provide functions relating to shop sections, product displays, bundles, upsells, social proof, reviews, shopping cart functions and other conversion-related features.

Depending on the function used, the following data may be processed in particular:

• product information
• order information
• interactions with shop elements
• technical device and browser information
• IP address
• usage information
• where applicable, customer and contact data

Where processing is necessary to provide a shop function requested by you or to perform a contract, the processing is carried out depending on the relevant purpose in particular pursuant to Article 6(1)(b) or Article 6(1)(f) GDPR.

Where Sternify uses non-essential analytics, engagement, conversion or other tracking functions, the corresponding processing takes place only in accordance with your consent decision pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

 

16. Cookies and Similar Technologies

Our website uses cookies and comparable technologies. These may include:

• cookies
• pixels
• tags
• local storage technologies
• online identifiers
• server-side event transmissions

We distinguish in particular between:

• technically necessary technologies
• functional technologies
• analytics and statistics technologies
• marketing and advertising technologies

We use technically necessary technologies in particular for the shopping cart, checkout, customer account, security, payment processing and consent management.

Where storage of or access to information on your device is strictly necessary to provide a digital service expressly requested by you, no consent is required pursuant to Section 25(2) TDDDG.

Non-essential analytics, marketing and advertising technologies are generally used only after your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.

An overview of the specific services and technologies used on our website can be found in our Cookie Policy: https://www.cool-down.online/pages/cookie-richtlinie

17. Consent Management with Consentmo

We use Consentmo to manage and document your consent decisions.

Provider:

iSense Ltd., trading as Consentmo
4 Prof. Georgi Bradistilov St.
Entrance A, 4th Floor
Sofia
Bulgaria

Consentmo enables you in particular to:

• consent to non-essential technologies
• reject non-essential technologies
• select individual categories
• change or withdraw a decision at a later date

The following information may be processed in particular:

• consent status
• accepted or rejected categories
• date and time of the decision
• consent ID or technical identifier
• technical browser and device information
• language or region
• IP address or technical information derived from it

The processing serves to implement and document your consent decision.

The processing is carried out in particular to comply with our accountability and evidentiary obligations pursuant to Article 6(1)(c) GDPR in conjunction with Articles 5(2) and 7(1) GDPR and, where additionally necessary, pursuant to Article 6(1)(f) GDPR on the basis of our legitimate interest in proper and verifiable consent management.

Technically necessary storage used exclusively to save or implement your privacy choices is carried out pursuant to Section 25(2) TDDDG.

Consentmo may transmit your consent decision to Shopify and connected services through the Shopify Customer Privacy API.

Consentmo generally retains consent records for twelve months, unless a different retention period has been agreed or configured.

You may change or withdraw your decision at any time through the permanently accessible Cookie Settings on our website.

 

18. Google Consent Mode – Basic Mode

We use Google Consent Mode in the Basic implementation.

The following consent signals may be relevant in particular:

• analytics_storage
• ad_storage
• ad_user_data
• ad_personalization

In Basic Consent Mode, the relevant Google analytics and advertising tags are blocked until you have made a decision through our cookie banner and granted the corresponding consent.

If you do not grant the relevant consent, the affected Google tags are not executed. In Basic Consent Mode, no cookieless pings or consent status are transmitted to Google through those tags in this case.

Only after the relevant consent has been granted can the corresponding Google tags be loaded and data processed in accordance with the respective Google service.

You may change or withdraw your consent at any time with effect for the future through our Cookie Settings.

 

19. Google Analytics 4

We use Google Analytics 4 to analyse the use of our online shop.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The following information may be processed in particular:

• cookie and online identifiers
• client IDs
• device and browser information
• operating system
• technical device information
• approximate geographical information
• pages viewed
• referral sources
• time and duration of visits
• product views
• searches
• shopping cart and checkout events
• purchases
• order values
• transaction identifiers

Google Analytics is used to analyse website usage, prepare reports and improve our online shop.

Due to our Basic Consent Mode configuration, Google Analytics is executed only after the relevant analytics consent has been granted.

The processing is based on Article 6(1)(a) GDPR and Section 25(1) TDDDG.

The retention period for user-level and event-level data in our Google Analytics property is set to 14 months.

Google Signals is disabled in our Google Analytics property.

According to Google, IP addresses are not logged or stored in Google Analytics 4.

 

20. Google Ads and Conversion Tracking

We use Google Ads to display advertisements and measure the effectiveness of our advertising activities.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

After you have given your consent, conversion tracking may record whether you carried out certain actions after interacting with a Google advertisement.

These may include, for example:

• viewing product pages
• searches
• shopping cart actions
• beginning checkout
• purchases
• order value and currency

Online identifiers, information relating to advertising interactions, browser and device information, conversion time, order value and transaction identifiers may be processed.

Due to our Basic Consent Mode configuration, the relevant Google Ads tags are executed only after the required consent has been granted.

The processing is based on Article 6(1)(a) GDPR and Section 25(1) TDDDG.

 

21. Enhanced Conversions for Google Ads

We use the Google Ads function Enhanced Conversions.

This may involve the use of first-party data provided by you in connection with an order, in particular:

• email address
• first and last name
• telephone number, where provided
• address

This data is hashed using SHA-256 before or during transmission to Google.

Google may compare these hash values with data relating to signed-in Google users in order to attribute conversions to previous advertising interactions.

The processing takes place only after the required marketing or advertising consent has been granted pursuant to Article 6(1)(a) GDPR.

Where information is stored on or accessed from your device, Section 25(1) TDDDG also applies.

 

22. Meta Pixel and Meta Conversions API

We use the Shopify sales channel Facebook and Instagram by Meta, including the Meta Pixel and Meta Conversions API.

Provider:

Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland

Our Shopify data-sharing setting for Meta is set to “Maximum”.

With this setting, Shopify uses both the browser-based Meta Pixel and the server-side Meta Conversions API and may update the integration with current Meta advertising technologies.

Depending on the interaction, the following data may be processed or transferred to Meta in particular:

• IP address
• cookie, browser and device identifiers
• browser and device information
• pages viewed
• searches
• product views
• shopping cart actions
• checkout events
• purchase events
• order value and currency
• name
• email address
• telephone number, where provided
• location and address information

Contact information may be transferred in hashed or otherwise protected form for matching with Meta users.

The processing serves in particular to:

• measure advertising campaigns
• attribute purchases to advertisements
• create campaign reports
• optimise our advertising
• create and improve advertising audiences
• display personalised advertising

Where consent is required, processing takes place only in accordance with your marketing consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

For certain collection and transfer activities, we and Meta may act as joint controllers. Meta is generally independently responsible for the subsequent processing of data received by Meta.

 

23. TikTok Pixel

We use the TikTok Pixel to measure and optimise our TikTok advertising activities.

Provider for users in the European Economic Area:

TikTok Technology Limited
10 Earlsfort Terrace
Dublin, D02 T380
Ireland

Our data-sharing setting within the Shopify TikTok integration is set to “Standard”.

With the Standard setting, the TikTok Pixel is used. Advanced Matching is not enabled at this level, and the Events API and advanced matching of customer information belong to higher data-sharing levels.

The TikTok Pixel may process in particular:

• IP address
• browser and device information
• cookie and online identifiers
• pages viewed
• product views
• searches
• shopping cart actions
• checkout events
• purchase events
• order value and currency
• information relating to interactions with TikTok advertisements

The TikTok Pixel is used only in accordance with your marketing consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

 

24. Microsoft Clarity

We use Microsoft Clarity to analyse the use of our online shop and improve usability.

Provider:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

Microsoft Clarity enables in particular:

• heatmaps
• click analysis
• scroll analysis
• usage analysis
• session recordings or technical reconstructions of browsing sessions

Session recordings are not conventional video recordings of a person, but technical reconstructions of website elements and user interactions.

The following data may be processed in particular:

• IP address
• browser and device information
• operating system
• pages viewed
• time and duration of the visit
• clicks and scrolling movements
• interactions with website elements
• technical identifiers
• cookie or user identifiers
• navigation information

Due to our implementation through Consentmo, Microsoft Clarity is only loaded after you have given your analytics consent. Without consent, no Clarity scripts are executed and no Clarity cookies are set.

The processing takes place after you have given your consent on the basis of Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, on the basis of Section 25(1) TDDDG.

Microsoft currently specifies the following retention periods:

• playback data: 30 days
• click data: up to 9 months
• heatmap data: up to 9 months
• labelled or favourited sessions: up to 9 months

You may withdraw your analytics consent at any time through our Cookie Settings.

 

25. Recipients of Personal Data

Depending on how our online shop is used, personal data may be transferred in particular to the following recipients or categories of recipients:

• Shopify and service providers used by Shopify
• consent management providers
• payment service providers and payment processors
• banks, card networks and other financial institutions
• shipping and logistics service providers
• IT, hosting, security, maintenance and support providers
• email marketing service providers
• review providers
• shop and conversion optimisation providers
• analytics providers
• marketing and advertising platforms
• tax and legal advisers
• insurers
• manufacturers, authorised representatives and importers in connection with product or medical-device reports
• authorities and courts where a legal basis exists

Data is transferred only where a legal basis permits or requires such transfer.

 

26. Transfers of Personal Data to Third Countries

Some of the service providers we use, or their subprocessors, may process personal data outside the European Union or European Economic Area.

This may apply in particular to Shopify, Google, Meta, Microsoft, TikTok, Judge.me and participating payment or IT service providers.

Transfers to third countries are carried out in accordance with Articles 44 et seq. GDPR.

Depending on the recipient and destination country, the following mechanisms may be used in particular:

• an adequacy decision by the European Commission
• an applicable adequacy mechanism or certification
• Standard Contractual Clauses issued by the European Commission
• binding corporate rules
• supplementary technical and organisational safeguards
• statutory exceptions applicable to individual cases

Further information about the safeguards used in a particular case and, where applicable and available, a copy of the relevant safeguards may be requested by emailing info@cooldowngermany.com.

 

27. Data Retention

We generally retain personal data only for as long as necessary for the relevant processing purpose or for as long as statutory retention, documentation, evidentiary or limitation periods apply.

The following criteria apply in particular:

• contract, order, invoice, payment and accounting data is retained in accordance with applicable tax and commercial-law retention periods;
• customer account data is generally stored until the customer account is deleted, unless statutory retention obligations apply;
• contact, support, return and complaint data is deleted after the matter has been fully handled unless it is required for contractual documentation, legal defence or compliance with statutory obligations;
• marketing data is generally processed until consent is withdrawn, an objection is made or the subscription is cancelled;
• evidence of consent, withdrawal and unsubscribe requests may be retained for longer where necessary to demonstrate compliance with legal requirements;
• Consentmo generally retains consent records for twelve months unless a different retention period has been agreed or configured;
• user-level and event-level data in our Google Analytics property is retained for 14 months;
• Microsoft Clarity playback data is generally retained for 30 days, while certain click, heatmap and labelled or favourited session data may be retained for up to nine months;
• reviews are generally retained or published for as long as necessary for the review function, unless deletion is requested or legal reasons require further retention;
• data relating to complaints, suspected incidents or safety reports concerning medical devices is retained in accordance with applicable statutory documentation, product-safety and limitation requirements.

Once the processing purpose no longer applies and the applicable retention periods have expired, personal data is deleted or anonymised unless another legal basis permits or requires further processing.

 

28. Automated Risk Assessments and Fraud Prevention

Shopify and participating payment service providers may use automated systems for fraud detection, identity verification and risk assessment.

These systems may take into account in particular:

• payment and transaction information
• billing and delivery address
• IP address
• device information
• order value
• order frequency
• unusual or suspicious transaction patterns

Orders may be subject to additional checks on the basis of such indicators.

As a rule, we ourselves do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Payment service providers may carry out additional automated risk, fraud, identity or credit assessments under their own responsibility. Further information can be found in the privacy notices of the relevant payment service provider.

 

29. Your Data Protection Rights

Subject to the applicable statutory requirements, you have in particular the following rights:

• right of access under Article 15 GDPR
• right to rectification under Article 16 GDPR
• right to erasure under Article 17 GDPR
• right to restriction of processing under Article 18 GDPR
• right to data portability under Article 20 GDPR
• right to object under Article 21 GDPR
• right to withdraw consent under Article 7(3) GDPR
• right to lodge a complaint with a supervisory authority under Article 77 GDPR

You may withdraw consent at any time with effect for the future.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

 

30. Right to Object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons. This also applies to profiling related to direct marketing.

Following such an objection, your personal data will no longer be processed for direct marketing purposes.

 

31. Withdrawal of Cookie and Tracking Consent

You may change or withdraw consent given through our cookie banner at any time with effect for the future.

To do so, you can open the permanently accessible Cookie Settings on our website and change your selection.

Rejecting non-essential analytics and marketing technologies does not generally prevent you from using the functions of our online shop that are technically necessary for making a purchase.

 

32. Right to Lodge a Complaint with a Supervisory Authority

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

The authority generally responsible for our place of business is:

The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hanover
Germany

Postal address:
Postfach 221
30002 Hanover
Germany

Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de

 

33. Data Relating to Minors

Our online shop is not specifically directed at children.

If we become aware that a child’s personal data has been processed without a sufficient legal basis, we will delete the relevant data unless a statutory obligation requires continued retention.

 

34. Data Security

We use appropriate technical and organisational measures to protect personal data in particular against:

• loss
• alteration
• unauthorised access
• unlawful disclosure
• destruction
• other forms of misuse

Depending on the relevant processing activity, these measures may include encrypted data transmission, access and authorisation controls, security and fraud checks, data backups and technical updates.

However, complete security of data transmission over the internet cannot be guaranteed.

 

35. Changes to this Privacy Policy

We may update this Privacy Policy where our processing activities, service providers, technical settings or legal requirements change.

The current version is available on our website.

 

36. Contact for Data Protection Enquiries

For access, rectification or deletion requests, withdrawals of consent, objections or other data protection enquiries, please contact:

cool down germany
Proprietor: Michael Senn
Graubergen 9
21218 Seevetal
Germany

Email: info@cooldowngermany.com
Phone: +49 151 540 78 990