Privacy policy

1. CONTROLLER
The controller responsible for the processing of personal data on this website and in our online shop is:

OAKBARRELS.SHOP
Owner: Mirko Rudnik
An der Steinkaute 19
63225 Langen
Germany

Telephone: +49 (0)6103-2702275
Email: shop@oakbarrels.shop

2. GENERAL INFORMATION
We take the protection of your personal data very seriously. We process personal data confidentially and in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, business contact details, billing and delivery addresses, telephone numbers, email addresses, IP addresses, as well as order and communication data.

This Privacy Policy explains which personal data we collect, the purposes for which we use it, the legal basis on which it is processed and the rights available to data subjects.

Our services are intended exclusively for entrepreneurs within the meaning of Section 14 of the German Civil Code (BGB), legal entities under public law and special funds under public law. Nevertheless, personal data may be processed relating in particular to sole proprietors, managing directors, employees, contact persons and other representatives of our business customers.

3. LEGAL BASES FOR PROCESSING
We process personal data in particular on the following legal bases:

Article 6(1)(a) GDPR, where you have given us your consent;
Article 6(1)(b) GDPR, where processing is necessary in order to take steps at your request prior to entering into a contract or for the performance of a contract with you;
Article 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation;
Article 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not override those interests.

When communicating and processing contracts with contact persons, employees or representatives of a business customer, processing is generally based on Article 6(1)(f) GDPR. Our legitimate interest lies in initiating, conducting and managing our business relationships.

4. PROVISION OF THE ONLINE SHOP
We use external hosting, platform and IT service providers to provide and operate our online shop. These providers supply the technical infrastructure required to display our products, manage customer accounts, process orders and ensure the secure operation of the online shop.

When you visit and use our online shop, the following data in particular may be processed:

IP address;
information about your browser, operating system and device;
date and time of access;
pages and products viewed;
referrer URL;
shopping cart contents;
search and usage data;
customer account and login data;
name and business contact details;
billing and delivery addresses;
company and VAT information;
order, transaction and communication data;
information provided by you in connection with an order or product configuration.

The data is processed to provide a secure and functional online shop, to take steps prior to entering into a contract, to process contracts, to prevent fraud and to comply with legal obligations.

The legal bases are Article 6(1)(b), (c) and (f) GDPR. Our legitimate interest lies in the secure, stable and commercially efficient operation of our online shop.

Where the service providers we use process personal data on our behalf, this is carried out on the basis of appropriate data processing agreements in accordance with Article 28 GDPR.

5. SERVER LOG FILES AND TECHNICAL ACCESS DATA
When you access our online shop, the technical infrastructure used automatically collects information and stores it in server log files. This may include in particular:

IP address of the accessing device;
date and time of access;
page or file accessed;
amount of data transferred;
previously visited page;
browser type and browser version;
operating system used;
device and network information;
access status and error messages.

The data is processed to provide the online shop technically, ensure its stability and security, identify technical errors and prevent abusive or fraudulent access.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of our online shop.

The data is deleted or anonymised as soon as it is no longer required for these purposes, unless statutory retention obligations or security considerations require it to be stored for a longer period.

6. COOKIES AND SIMILAR TECHNOLOGIES
Our online shop uses cookies and similar technologies. Cookies are small files that are stored on or read from your device.

Technically necessary cookies are used to provide essential functions of the online shop. In particular, they are required for page navigation, the shopping cart, checkout, language selection, login, fraud prevention, security and the storage of your privacy preferences.

The storage of or access to technically necessary information is based on Section 25(2) TDDDG. The subsequent processing of personal data is based on Article 6(1)(b) and (f) GDPR.

If non-essential cookies or comparable technologies are used in the future, they will generally only be used with your prior consent in accordance with Section 25(1) TDDDG and Article 6(1)(a) GDPR.

You may withdraw or modify your consent at any time with effect for the future using the privacy settings provided in the online shop. The lawfulness of processing carried out before consent was withdrawn remains unaffected.

You may also configure your browser to block, restrict or delete cookies. Disabling technically necessary cookies may restrict certain functions of the online shop.

7. CUSTOMER ACCOUNT
You may use a customer account in our online shop. When a customer account is created, accessed and used, the following data in particular may be processed:

name;
business email address;
telephone number;
company details;
billing and delivery addresses;
login and authentication data;
order history;
account settings;
communications relating to the customer account.

Login may take place using a single-use login code or login link sent to the email address registered with the account.

The data is processed to provide and manage the customer account, authenticate users, display previous and current orders and simplify future orders.

The legal bases are Article 6(1)(b) and (f) GDPR. Our legitimate interest lies in the secure and efficient management of the business relationship.

You may request the deletion of your customer account at any time. Statutory retention obligations applicable to order, contract, invoice and payment data remain unaffected. In this case, the relevant data will be restricted from processing for other purposes and deleted once the statutory retention period has expired.

8. ORDERS AND CONTRACT PROCESSING
If you place an order, request a quotation or enter into a contract with us, we process the data you provide. This may include in particular:

first and last name;
company name and legal form;
business address;
billing and delivery address;
email address and telephone number;
VAT identification number;
order details and requested product configurations;
delivery and shipping information;
invoice, payment and accounting data;
contents of business communications.

The data is processed to handle your enquiry or order, verify your status as an entrepreneur, prepare quotations and invoices, process the contract, deliver the ordered goods, handle complaints and comply with obligations under tax and commercial law.

The legal bases are Article 6(1)(b) and (c) GDPR. Where contact persons or representatives of a company are concerned, processing is also carried out on the basis of Article 6(1)(f) GDPR.

The provision of the data required for an order is necessary to enter into and perform the contract. Without this data, we may be unable to process or fulfil an order.

9. PRODUCT CONFIGURATIONS
When configuring our products, the information you select or enter may be processed and stored together with your order. This may include information concerning the type of wood, size, processing, toasting or charring level, labelling, laser engraving or other individual product specifications.

Please do not enter any personal data in free-text fields or upload functions unless it is necessary for the requested product configuration.

The data is processed to handle your product selection, manufacture individually configured products and fulfil your order.

The legal bases are Article 6(1)(b) and (f) GDPR.

10. PAYMENT BY BANK TRANSFER
Payments in our online shop are generally made by bank transfer. When a bank transfer is made, the financial institutions involved process the data required to handle the payment.

This may include in particular:

name or company name of the account holder;
IBAN and, where applicable, BIC;
payment amount;
payment reference;
invoice and order number;
date of payment.

The data is processed to execute and allocate the payment and to comply with statutory accounting and documentation obligations.

The legal bases are Article 6(1)(b) and (c) GDPR.

11. DELIVERY AND DISCLOSURE TO TRANSPORT SERVICE PROVIDERS
To deliver ordered goods, we disclose the data required for this purpose to the respective service providers commissioned with transportation, freight forwarding, storage, customs clearance or delivery.

This may include in particular:

name and company name of the recipient;
delivery address;
email address;
telephone number;
order and shipment data;
information concerning delivery dates and local delivery conditions;
customs, import and company information required for international deliveries.

The disclosure is limited to the data necessary to prepare, carry out and track the delivery and, where applicable, complete customs clearance.

The legal basis is Article 6(1)(b) GDPR. Where contact persons or employees of a business customer are concerned, processing is also carried out on the basis of Article 6(1)(f) GDPR.

For deliveries to countries outside the European Economic Area, personal data may be transferred to transport, customs or logistics service providers and authorities located in those countries where this is necessary to perform the contract, complete import procedures or deliver the goods. The legal basis for this is, in particular, Article 49(1)(b) or (c) GDPR.

12. CONTACTING US
If you contact us by email, telephone, contact form or by any other means, we process the data you provide in order to handle and respond to your enquiry.

This may include in particular:

name;
company name;
business contact details;
content and time of the enquiry;
associated order, quotation or contract details;
other information provided voluntarily.

If the contact relates to a specific order, contract or steps prior to entering into a contract, the data is processed on the basis of Article 6(1)(b) GDPR.

In other cases, the data is processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in properly handling and responding to business enquiries.

The data will be deleted as soon as it is no longer required to handle the enquiry and there are no statutory retention obligations or legitimate interests requiring continued storage.

13. NEWSLETTER
Our online shop provides a link that allows you to subscribe to our newsletter. The newsletter is distributed using a newsletter service provider.

The following data in particular may be processed when you subscribe to the newsletter:

email address;
name and company name, if provided;
IP address;
date and time of registration;
record of consent;
where applicable, areas of interest or language preferences selected by you.

Registration generally takes place using a double opt-in procedure. After registering, you will receive an email asking you to confirm your subscription. The registration process is logged in order to demonstrate that valid consent was given.

The legal basis for sending the newsletter is your consent in accordance with Article 6(1)(a) GDPR. The consent record is processed on the basis of Article 6(1)(c) and (f) GDPR.

Newsletters sent using the newsletter service may contain technologies that make it possible to determine whether a message has been opened and which links contained in it have been clicked. This evaluation is used for statistical analysis and to improve our newsletters and is carried out on the basis of your consent in accordance with Article 6(1)(a) GDPR.

The data stored for the newsletter is generally retained until you unsubscribe. Once you have unsubscribed, your data will be removed from the active newsletter distribution list. Where necessary to demonstrate that consent was previously given, certain data may subsequently be stored on a suppression list.

You may withdraw your consent at any time with effect for the future. To do so, you may use the unsubscribe link provided at the end of every newsletter or contact us at shop@oakbarrels.shop.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. Unsubscribing from the newsletter has no effect on the processing of your data for orders, contracts or customer accounts.

14. RECIPIENTS OF PERSONAL DATA
Within our company, personal data is accessible only to those persons who require it to perform their duties.

In addition, personal data may be disclosed, to the extent necessary, to the following categories of recipients in particular:

shop, hosting and IT service providers;
newsletter and communication service providers;
banks and financial institutions;
transport, freight forwarding, storage and logistics service providers;
customs authorities, customs agents and other parties involved in importing or exporting goods;
tax advisers, accounting and auditing service providers;
legal advisers and debt collection service providers;
authorities, courts and other public bodies, where there is a legal obligation to make such a disclosure.

Data is disclosed for other purposes only where this is permitted by law or where you have given your consent.

15. TRANSFERS TO THIRD COUNTRIES
Due to the international nature of our shop and deliveries, it may be necessary to process personal data outside the European Union or the European Economic Area.

Data will only be transferred where the applicable legal requirements have been met. In particular, a transfer may be based on an adequacy decision by the European Commission, appropriate safeguards pursuant to Article 46 GDPR, binding corporate rules or an exemption pursuant to Article 49 GDPR.

In the case of international orders, data may be transferred in particular to transport, logistics, customs and import service providers and to the competent authorities in the respective destination country.

16. RETENTION PERIOD
We retain personal data only for as long as is necessary for the respective processing purpose or for as long as statutory retention obligations apply.

Data relating to enquiries that do not subsequently result in a contract is generally deleted once the enquiry has been fully processed and there are no legitimate interests requiring continued storage.

Contracts, orders, invoices, payment records and business documents are retained in accordance with the statutory retention periods under commercial and tax law. Depending on the type of document, these periods may be six, eight or ten years in particular.

Data held in customer accounts is generally retained for the duration of the business relationship. Deletion of the customer account may be requested at any time. Data that is subject to statutory retention obligations will be restricted until the applicable retention period expires and will then be deleted.

Data processed on the basis of consent is generally retained until consent is withdrawn, unless another legal basis or retention obligation applies.

17. DATA SECURITY
We take appropriate technical and organisational measures to protect personal data against loss, destruction, manipulation, unauthorised access and unauthorised disclosure.

Our online shop uses SSL or TLS encryption. An encrypted connection can be identified in particular by the address bar in your browser beginning with “https://”.

Please note that completely risk-free transmission of data over the internet cannot be guaranteed.

18. RIGHTS OF DATA SUBJECTS
Subject to the applicable statutory requirements, you have the following rights:

right of access pursuant to Article 15 GDPR;
right to rectification pursuant to Article 16 GDPR;
right to erasure pursuant to Article 17 GDPR;
right to restriction of processing pursuant to Article 18 GDPR;
right to data portability pursuant to Article 20 GDPR;
right to object pursuant to Article 21 GDPR;
right to withdraw consent pursuant to Article 7(3) GDPR;
right to lodge a complaint with a data protection supervisory authority pursuant to Article 77 GDPR.

To exercise your rights, you may contact us at shop@oakbarrels.shop.

Before processing a request, we may require appropriate proof of your identity where this is necessary to prevent the unauthorised disclosure of personal data.

19. RIGHT TO OBJECT
WHERE WE PROCESS PERSONAL DATA ON THE BASIS OF ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

WHERE PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA FOR SUCH MARKETING. FOLLOWING AN OBJECTION, THE RELEVANT DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES.

20. WITHDRAWAL OF CONSENT
You may withdraw any consent you have given at any time with effect for the future. In particular, consent may be withdrawn by sending an email to shop@oakbarrels.shop.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

21. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
If you believe that the processing of your personal data infringes data protection regulations, you have the right to lodge a complaint with a data protection supervisory authority.

In particular, you may contact the data protection supervisory authority responsible for our registered place of business or the supervisory authority responsible for your habitual residence or place of work.

22. AUTOMATED DECISION-MAKING
We do not use solely automated decision-making, including profiling within the meaning of Article 22 GDPR, that produces legal effects concerning you or similarly significantly affects you.

23. EXTERNAL LINKS
Our online shop may contain links to external websites. Once you click such a link, any processing of personal data is carried out by the respective operator of the external website. Such processing is governed by the privacy policy of the respective provider.

24. AMENDMENTS TO THIS PRIVACY POLICY
We reserve the right to amend this Privacy Policy if the applicable legal requirements, our online shop, the service providers used or the nature of the data processing change.

The version published in the online shop at the relevant time shall apply.