Privacy Policy

A. General Information

1. Responsible body and contact details Responsible for these websites:

EKO-Punkt GmbH & Co. KG

Waltherstraße 49-51

51069 Köln

Further company details can be found in the Imprint Contact details of our data protection officer:

EKO-Punkt GmbH & Co. KG 

c/o REMONDIS GmbH Co. KG

-Datenschutzbeauftragte/r-

Robert-Bosch-Straße 20-22

50769 Köln, Deutschland

datenschutz-rheinland@remondis.de

2. Declaration of joint responsibility 

EKO-Punkt GmbH & Co. KG and its subsidiaries and associated companies exercise joint responsibility in many areas in accordance with § 26 of the GDPR. Services and supplies are generally provided by the subsidiaries of our Group, which use the central data processing system in our Group for this purpose. The joint responsibility extends in particular to the following areas:

• Customer databases
• Application management & recruiting

Within the framework of joint responsibility, EKO-Punkt GmbH & Co. KG and its subsidiaries and associated companies have agreed which of them is responsible for which duties under data protection law (in particular information duties in accordance with Art. 13, 14 GDPR). Within the scope of joint responsibility, EKO-Punkt GmbH & Co. KG and the subsidiary or associated company concerned are jointly obliged to provide the information required under Art. 13, 14 GDPR. The companies shall provide the respective requested company with the necessary information from their area of activity. The companies shall inform each other without delay of the legal positions asserted by data subjects and provide each other with all information necessary to respond to requests for information. Data protection rights can be asserted against all companies involved.

In addition, some processing operations may give rise to joint responsibility between REMONDIS companies or with third parties. These are dealt with in the context of the respective processing (Part B).

3. Data categories, purposes and legal basis of data processing

We process your personal data in accordance with the provisions of the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) as well as all other applicable legal provisions. The collection and processing of data is determined by the service or information you have chosen. 

In general, we collect the following information:

• Last name, first name, salutation
• E-mail address
• Communication data (IP address, device information)
• Usage data (web pages visited, access times, interest in content)
• Address
• Telephone number

The specific data collection and processing can be found in the individual processing operations (Part B) as well as in the respective provisions of our contractual documents.  

4. Data recipients

We only transfer your personal data to third parties in the following cases:

• The transfer takes place in compliance with a legal requirement under which we are obliged to report or pass on the data.
• The transfer of data takes place to external companies that act as order processors on our behalf or that act on our behalf (this concerns, for example, courier and logistics companies, call centres, external computer centres, EDP and IT applications, website management, auditing services, credit institutions, data disposal, etc.).
• The transmission of data to third parties takes place on the basis of your consent.
• Data is transferred for the purpose of processing a contractual relationship with you pursuant to Art. 6 para. 1 s. 1 lit. b GDPR (e.g. to an affiliated company within the group (cf. item 2) or a subcontractor or to a logistics company)

5. Deletion of data and duration of storage

In principle, we process and store your data only for the duration of our business relationship, including the initiation and execution of the contract as well as the statutory retention periods.

If the data is no longer required for the fulfilment of contractual or legal obligations and rights, it is regularly deleted, unless its – temporary – further processing is necessary for the fulfilment of the purposes listed above for an overriding legitimate interest.

Insofar as individual processing of personal data requires other deletion periods, these are mentioned in the description of the individual processing operations under section B.

6. Processing of your data in a third country

Data is only transferred to bodies in third countries (states outside the European Union (EU) or the European Economic Area

(EEA)) if it is necessary for the execution of an order/contract from or with you, if it is required by law (e.g. reporting obligations under tax law), if appropriate data protection levels exist or if you have given us your consent.

The processing of your data in a third country may also be carried out in connection with the involvement of service providers as part of commissioned processing. If there is no EU Commission decision on an adequate level of data protection for the country in question, we will ensure through appropriate contracts that your rights and freedoms are adequately protected and guaranteed. For more detailed information, please refer to the individual descriptions of the processing operations under section B.

Information on the appropriate or adequate safeguards and on the possibility of obtaining a copy from you can be obtained from the Data Protection Officer upon request.

 7. Your rights as a data subject

Upon request, we will provide you with written or electronic information as to whether and which of your personal data is stored with us (Art. 15 GDPR) and we will check your entries for deletion (Art. 17 GDPR), correction (Art. 16 GDPR), restriction of processing (Art. 18 GDPR) and transfer (Art. 20 GDPR) of your personal data and execute them if the conditions are met.

For this purpose, please contact:

EKO-Punkt GmbH & Co. KG 

c/o REMONDIS GmbH Co. KG

-Datenschutzbeauftragte/r-

Robert-Bosch-Straße 20-22

50769 Köln, Deutschland

datenschutz-rheinland@remondis.de

Insofar as you are of the opinion that the processing of your personal data is carried out unlawfully, you may lodge a complaint with a supervisory authority (Art. 77 GDPR). A list of the data protection officers and their contact details can be found under the following link: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html.

8. Information on the right to object

Insofar as the processing of your personal data is carried out on the basis of Art. 6 para. 1 s. 1 lit. f GDPR (data processing based on a balance of interests) or on the basis of Art. 6 para. 1 sentence 1 lit. e GDPR (data processing in the public interest), you have the right to object to the processing at any time.

We will then in any case no longer process the personal data for the purposes of direct marketing or related profiling and furthermore not for other purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims. In this case, you must provide reasons for the objection that arise from your particular situation.

If possible, you should send your objection to the following contact address: datenschutz-rheinland@remondis.de

The same applies if you have given your consent to the collection or use of personal data and wish to revoke it. You can revoke such consent at any time with effect for the future by e-mail or letter 

B. Individual processing

1. Logging

When using the website, certain connection data and data provided by your Internet browser are temporarily stored. The following data is logged for the operation of the website:  

• IP address of the retrieving computer
• Operating system of the retrieving computer
• Browser version of the retrieving computer
• Name of the retrieved file
• Date and time of retrieval
• Amount of data transferred
• Referring URL
• Connection logging

The data collection and processing of the log file information is based on our legitimate interest and for the purpose of securing our online offer. The log file information is stored anonymously after the session has ended. 

2. Contact form/ requests for information

In the interest of communication with customers and interested parties, we offer a contact form on our website where you can request information about our products or contact us in general. In addition to the voluntary information and the content of your message, we require the following information from you:

• Company
• Form of address
• Last name
• Email address

We need this information to process your request, to contact you correctly and to send you an answer. Requests received via the contact form are stored as emails and regularly checked to see whether data can be deleted. Should data no longer be required in the context of a relationship with a customer or interested party, or should the customer have a contrary interest, we will delete the data concerned not later than after 180 days, provided that this does not conflict with statutory retention obligations. The legal basis for this data processing is Art. 6 para. 1 lit. f) GDPR. Insofar as contact is made to initiate contractual relations, the legal basis is Art. 6 para.1 lit. b) GDPR.

3. Personal contact If you have given your consent to be contacted personally, we will process the following personal data about you:

• Salutation 
• Surname 
• First name 
• E-mail address 
• Address 
• Telephone number

If you revoke your consent or the data is no longer required as part of a customer or prospective customer relationship or if the customer's conflicting interests outweigh this, we will delete the data in question after 180 days at the latest, provided there are no legal retention obligations to the contrary. The legal basis for this data processing is Article 6 Paragraph 1 Letter a GDPR. If contact is made to initiate contractual relationships, the legal basis is Article 6 (1) (b) GDPR.

If possible, you should send your objection to the following contact address: datenschutz-rheinland@remondis.de

4. Newsletter-Abonnement

You have the option of subscribing to our newsletter on our website. We send newsletters and electronic notifications with promotional information only with the consent of the recipients or a legal permission. Newsletters contain information about our services and our companies as well as news in the industry.

Registration for our newsletter takes place in a so-called double opt-in procedure: After registration, you will receive an e-mail in which you canWelche E-Mails per Newsletter zugestellt wurden und ob die Zustellung nicht erfolgreich war (sog.

"bounces" = Rückläufer-E-Mails)

The newsletter is sent by the US shipping service provider Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA

98109-5210, USA. You can view the data protection regulations of the shipping service provider

here:https://aws.amazon.com/de/compliance/germany-data-protection/

The shipping service provider is based on our legitimate interests in sending the newsletter securely in accordance with Article 6 Paragraph 1 Letter f of the GDPR and an order processing contract in accordance with Article 28 Paragraph. 3 S. 1 GDPR used.

The newsletter is sent based on the consent of the recipient in accordance with Article 6 Paragraph 1 Letter a, Article 7

GDPR in conjunction with Section 7 Paragraph 2 No. 3 UWG or on the basis of legal permission in accordance with Section

7 Paragraph. 3 UWG. The registration process is logged on the basis of our legitimate interests in accordance with Article 6 Paragraph 1 Letter f of the GDPR. Our interest is in using a user-friendly and secure newsletter system that serves our business interests, meets the expectations of users and also allows us to provide evidence of consent.

You can revoke your consent to receive our newsletter at any time. You will find a link to unsubscribe from the newsletter at the end of each newsletter. We can store the unsubscribed email addresses for up to three years based on our legitimate interests before deleting them in order to be able to prove that consent was previously given. The processing of this data is limited to the purpose of possible defense against claims.

5. Matomo

On our websites we use a version of Matomo implemented on our own servers. This is open source analysis software for the purpose of statistical evaluation of visitor access. Using this evaluation, we would particularly like to understand which of our pages are accessed and how often, but not who accesses them. The implementation of Matomo on our server does not use cookies. We only store anonymized user data to collect general statistical values, without comprehensively analyzing user behavior. A comprehensive analysis of user behavior is also not possible due to the anonymized data collected. The IP address transmitted in the server log-in is anonymized and replaced by a random IP address before being transmitted to the Matomo installation on our server. It is not possible to track the IP address using the anonymized data because time entries are randomized during the Matomo installation.

The purpose of the processing is the statistical analysis of user behavior in order to optimize the functionality of our websites. Our legitimate interest lies in improving our website.

The legal basis for the use of Matomo is Article 6 Paragraph 1 Sentence 1 Letter f of the GDPR.

6. Google Services

We use various services from Google Ireland Ltd on our websites. (hereinafter "Google"), Gordon House, Barrow Street, Dublin 4, Ireland, parent company: Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA. You can find further information about the individual Google services that we use on our websites in the additional data protection declaration.

Google may collect information (including personal data) and process it. It cannot be ruled out that Google will also transmit the information to a server in a third country, including the USA. Google has joined the Trans-Atlantic Data Privacy Framework (TDPF; data protection agreement between the EU and the USA), so that an appropriate level of data protection is guaranteed for data processing. Google also guarantees that it will comply with the so-called Standard Contractual Clauses (SCC) in accordance with Directive 95/46/EC for the transfer of personal data to third countries.

Further information on how Google processes data can be found here: https://policies.google.com/privacy/frameworks?hl=de

Our company has no influence and no conclusive information about what data Google actually collects and processes. The following data (including personal data) may be collected and processed as specified by Google: 

• Log data (especially the IP address)
• Location-related information
• Cookies and similar technologies
• Unique application numbers

If you have a Google account and are logged in there while you are on our websites, Google can store and, if necessary, assign the processed information according to your account settings. According to Google, depending on your account settings, activities on other websites and apps may be linked to your personal data in order to improve Google's services and the advertising displayed by Google. Further information can be found at:

https://policies.google.com/technologies/partner-sites?gl=de

You can prevent this data from being directly linked by logging out of your Google account or changing the relevant account settings in your Google account. Furthermore, you can revoke your consent at any time without giving reasons under the “Cookie Settings” on our website. Further information about Google account settings can be found at:

https://privacy.google.com/take-control.html

Further information can be found in Google's data protection information, which you can access here:https://policies.google.com/privacy

6.1 Google Maps

We use the services of “Google Maps” from the provider Google on our websites to integrate the maps from this service.

By integrating these services, which are located on Google's servers, information about the user (including the IP address) is processed by Google so that the requested content can be sent to the browser. Furthermore, Google Maps can also use socalled web beacons (invisible graphics). These cookies and web beacons can be used to collect and analyze information such as visitor traffic on websites or information about the user device. The information generated by cookies and web beacons (including the user's IP address) is transmitted to a Google server, possibly in the USA or other third countries, and stored there. This information may be passed on by Google to Google's contractual partners.

By integrating Google Maps, we aim to make our locations easier to find and to give you a better overview of our offers. The legal basis for the processing of personal data described here is Article 6 Paragraph 1 Letter a) GDPR, provided we have asked you for your consent to use the services of Google Maps. Detailed information about Google Maps can be found on the websites https://policies.google.com/privacy. 

Further information on data processing by Google when using Google services can be found in Section 5. Google Services.

In particular, the following personal data is processed by Google Maps:  

• IP addresses
• User location data
• Google processes the data to display and trigger the services on our website. Google may, if necessary, transfer this information to third parties if this is required by law or if third parties process this data on behalf of Google.

Widerspruchsrecht:

You can revoke your consent at any time without giving reasons under the “Cookie Settings” on our website.

You can also prevent the integration of Google Maps services by activating the Google Opt-Out Plugin: https://tools.google.com/dlpage/gaoptout?

It is possible that if you deactivate it, only limited use of our website will be possible. If the legal basis for processing by Google Maps is our legitimate interest in accordance with Article 6 Paragraph 1 Sentence 1 GDPR, you have the right to object in accordance with Article 21 GDPR. You can inform us of your objection by post or email: datenschutzrheinland@remondis.de

The information processed will only be stored for as long as necessary for the intended purpose or as required by law. The provision of personal data is not mandatory and is neither required by law nor contract or necessary for the conclusion of a contract.

6.2 Google Tag Manager

We use Google Tag Manager on our websites. Google Tag Manager is a service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland, US parent company Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA.

Using Google Tag Manager, various data and services can be integrated into our website in an organized and simplified manner. The Google Tag Manager implements the various tags. When you activate a tag, Google may store and process information (including personal data). It cannot be ruled out that Google will also transmit the information to a server in a third country.

By integrating the Google Tag Manager, our aim is to simplify the integration of various services and to optimize loading times through the integration. The legal basis for the processing of personal data described here is Article 6 Paragraph 1 Letter a) GDPR .

Detailed information about the Google Tag Manager can be found on the websites https://www.google.com/analytics/terms/tag-manager/ and https://policies.google.com/privacy under the section “Information we obtain as a result of your use of our Services”. Further information on data processing by Google when using Google services can be found in Section 5. Google Services.

In particular, the following personal data is processed by Google Tag Manager:

• Online- und Cookie-Kennzeichnungen
• IP-Adresse

Google processes the data on our behalf to display and trigger the services on our website. Google may, if necessary, transfer this information to third parties if this is required by law or if third parties process this data on behalf of Google. If you have deactivated individual tracking services (e.g. by setting an opt-out cookie), the deactivation remains in effect for all affected tracking tags that are integrated by the Google Tag Manager.

Right to object:

You can revoke your consent at any time without giving reasons under the “Cookie Settings” on our website. You can also prevent the integration of the Google Tag Manager by deactivating the Google Tag cookie in your browser.

It is possible that if you deactivate it, only limited use of our website will be possible.

The information processed will only be stored for as long as necessary for the intended purpose or as required by law. The provision of personal data is not mandatory and is neither required by law nor contract or necessary for the conclusion of a contract.

6.3 Google Ads und Conversion-Tracking

This website uses the online advertising program “Google Ads” and conversion tracking as part of Google Ads. Google Ads and Google Conversion Tracking are online advertising services provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland.

The conversion tracking cookie is set when a user clicks on an ad placed by Google. Cookies are small text files that are stored on your computer system. These cookies expire after 30 days and are not used for personal identification. If the user visits certain pages on this website and the cookie has not yet expired, Google and we can recognize that the user clicked on the ad and was redirected to this page. All Google Ads customers receive different cookies that can be tracked across the websites. The information collected using the conversion cookie is used to create conversion statistics for Ads customers who have opted for conversion tracking. Customers learn the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, you will not receive any information that can be used to personally identify users. Further information on data processing by Google when using Google services and on data transfer to the USA can be found in Section 5. Google Services.

By using Google Ads and conversion tracking, we aim to bring interest-based advertisements to your attention. The legal basis for the use of Google Ads and conversion tracking is Art. 6 Para. 1 lit a) GDPR.

Right to object:

You can revoke your consent at any time without giving reasons under the “Cookie Settings” on our website. You can also prevent the integration of Google Ads by deactivating the Google Ads cookie in your browser.

It is possible that if you deactivate it, only limited use of our website will be possible.

The information processed will only be stored for as long as necessary for the intended purpose or as required by law. The provision of personal data is not mandatory and is neither required by law nor contract or necessary for the conclusion of a contract.

You can find further information about Google's data protection regulations at the following Internet addresses https://policies.google.com/privacy and the information about Google's privacy settings https://privacy.google.com/take-control.html?categories_activeEl=sign-in.

6.4 Google Analytics

We use Google Analytics on our websites, a web analysis service provided by Google Ireland Limited ("Google"), Gordon

House, Barrow Street, Dublin 4, Ireland. Google Analytics uses text files that are stored on your device and that analyze the use of the website Websites you visit enable so-called “cookies”. Furthermore, Google Analytics can also use so-called web beacons (invisible graphics). These cookies and web beacons allow information such as visitor traffic on websites to be collected and analyzed. The information generated by cookies and web beacons about the use of our website (including the user's IP address) is transmitted to a Google server, possibly in the USA or other third countries, and stored there. This information may be passed on by Google to Google's contractual partners.

By integrating Google Analytics, we pursue the purpose of analyzing and adapting user behavior on our websites in order to improve our offering as needed.

The legal basis for the processing of personal data described here is Article 6 Paragraph 1 Letter a) GDPR.

Detailed information about the information processed can be found at https://privacy.google.com/businesses/adsservices/ and at https://www.google.com/intl/de/policies/privacy/#infocollect under “Information we receive from your use of our services”.

Further information about data processing by Google when using Google services and about Google's Privacy Shield certification can be found in the section on general information about Google services.

In particular, the following data is processed by Google Analytics:

• Device identifiers
• Online identifiers (including cookie identifiers)
• IP address

We only use Google Analytics with activated IP anonymization (“anonymize IP”). As a result, your IP address will be shortened by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

Google processes the data on our behalf to evaluate the use of our websites and present them in reports as well as to provide services related to website use. Google may transfer this information to third parties if required to do so by law or if third parties process this data on Google's behalf.

In addition, through the order processing agreement with us, Google is entitled to commission certain subcontractors and possibly send them data. You can find a list of these subcontractors here:https://privacy.google.com/businesses/subprocessors/.

7. Cookiebot / "CookieConsent", "CookieConsentBulkTicket"

We use the Cookiebot consent management service provided by Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark (Cybot). This enables us to obtain and manage the consent of website users for data processing. The processing is necessary to fulfill a legal obligation (Art. 7 Para. 1 GDPR) to which we are subject (Art. 6 Para. 1 S. 1 lit. c GDPR). For this purpose, the following data is processed using cookies:

Your IP address (the last three digits are set to '0'). Date and time of consent. Browser information URL from which consent was sent. A randomly generated key of the end user's consent, as proof of consent

The key and the consent status are stored in the browser for 12 months using the cookie “CookieConsent”. This will preserve your cookie preference for subsequent page requests. With the help of the key, your consent can be proven and traced.

If you enable the Service's "Bulk Consent" feature to enable consent for multiple websites through a single end-user consent, the Service will additionally store a separate, random, unique ID with your consent. If all of the following criteria are met, this key will be stored in encrypted form in the third-party cookie "CookieConsentBulkTicket" in your browser: You enable the bulk consent feature in the service configuration. You allow third-party cookies via browser settings. You turned off Do Not Track through your browser settings. You accept all or at least certain types of cookies if you give your consent.

The functionality of the website cannot be guaranteed without the processing.

Cybot is the recipient of your personal data and acts as a processor for us.

The processing takes place in the European Union. Further information on objection and removal options against Cybot can be found at: https://www.cookiebot.com/de/privacy-policy/

Your personal data will be deleted continuously after 12 months or immediately after termination of the contract between us and Cybot.

Please note our general information about deleting and deactivating cookies above.

C. Cookie overview

Cookies are small text files that are stored on your hard drive by your browser. We also use so-called session cookies. These serve to establish a clear connection between you and our website. All that is saved is a random number. The session cookie is automatically removed when the browser is closed. If you do not want to allow cookies on your computer (or other device), you can deactivate them in your internet browser. However, this may affect the usability and functionality of the website. The legal basis for data processing through cookies for the purpose of operating the website is Article 6 (1) (f)

GDPR.

Our website uses the following cookies:

1. Notwendige Cookies

Operational cookies that are necessary to provide the basic functions of the shop and therefore cannot be deactivated.

__csrf_token-1

Validation of customer information

allowCookie

Storage of cookie settings

cookiePreferences

Storing cookie preferences in a serialized string

csrf

Validation of form entries for technical security of the shop (including against XSS or cross-site scripting)

phpsessid

Identification between browser and server to show whether the respective user has an active shopping cart and is logged in

session-1

Identification of the current session, the user and their shopping cart

slt

Recognition of the customer when returning to the shop (including after the session has ended)

sw-cache-hash / sw-states

Technical cookie for cache functionality

timezone

Storage of the time zone (e.g. for time information in emails)

x-ua-device:

Determination of the device used (e.g. for the correct display of the shop)

Data Policy

2. Funktionale Cookies

Cookies to optimize and personalize your user experience and to provide additional features.

sUniqueID

Assignment of the watch list and activation when using the watch list

Statistik & Tracking

Analytical cookies to improve the performance of our shop and carry out business-relevant evaluations.

As of October 18th, 2023