Privacy Policy and Consent to Data Usage

1. General Information on Data Protection

The security of your data is very important to us, and data protection has high priority. We have therefore implemented technical and organizational measures to prevent attacks, misuse, loss, and improper alteration of personal data, as well as unauthorized third-party access (Art. 32 GDPR).

We collect, use, and store your personal data exclusively within the scope of European and national data protection laws. Below we inform you about the type, scope, and purpose of data collection and usage within our online offering as well as your rights under data protection law.

Name and Address of the Controller

Knüppel Verpackung GmbH & Co. KG
Tonlandstraße 2
34346 Hann. Münden

Represented by:
Knüppel Verpackung Betriebsführungsgesellschaft mbH

Managing Directors:
Gerhard Hahn and Ernst Hahn

Contact:
Phone: +49 5541 706-0
Fax: +49 5541 706-111
info(at)Knueppel.de
 

Data Protection Officer

Data Protection Officer
Tonlandstraße 2
34346 Hann. Münden
datenschutz(at)knueppel.de

Type, Scope and Purpose of Data Processing

We only process data to the extent necessary to provide our content, contractual and pre-contractual services, and a secure and functional online presence to customers, prospective customers, suppliers, visitors, and users of our online services. This includes data you actively enter and transmit (e.g. registrations, orders, inquiries) as well as automatically collected and logged data (e.g. access times, device information, IP addresses). Connection data is stored only as long as necessary to fulfill business processes or comply with legal obligations.

Legal Basis for Data Processing

Insofar as we have your consent to process your data, Art. 6 para. 1 lit. a) GDPR serves as the legal basis. If the data processing takes place in order to fulfil a contract with you or to carry out pre-contractual measures, Art. 6 para. 1 lit. b) GDPR is the legal basis. If it serves to fulfil a legal obligation, the data processing is carried out on the basis of Art. 6 para. 1 lit. c) GDPR. Finally, it is possible that the processing of your data serves to safeguard our legitimate interests and does not outweigh your interests or fundamental rights and freedoms that require the protection of personal data. In this case, Art. 6 para. 1 lit. f) GDPR serves as the legal basis.

Duration of Data Storage and Data Deletion

The processed data will be deleted as soon as the purpose for storing it no longer applies and no legal, regulatory, or contractual retention obligations require continued storage. These may include statutory warranty obligations, proper bookkeeping requirements, and the prevention or investigation of misuse or fraud.

Revocation of Consent

You can revoke your consent at any time. The easiest way to do this is by sending an email to datenschutz(at)knueppel.de. In this case, your stored personal data will be deleted if it is no longer needed for the intended purpose—unless laws, regulations, or agreements require continued retention.
Please note: Data relevant for billing or accounting is not affected by such a revocation.

Data Transfer to Third Countries

If data is processed in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), this will only take place if it can be based on one of the above-mentioned legal bases. The data will only be processed in accordance with the provisions of Art. 44 et seq. GDPR. This means that processing only takes place in compliance with officially recognised special contractual obligations (so-called ‘standard contractual clauses’).

However, we would like to point out that the same level of data protection does not generally apply in third countries as in the EU. For example, US companies may be obliged to disclose personal data to US security authorities without you or us being able to do anything about it.

2. Log Files and Server Data

Description of the Processed Data

For technical system-related and statistical reasons, we automatically collect data and information from your Internet browser or computer system each time you visit our website. Specifically, the following data is collected

• URL of the subpage of our website that you visit
• Amount of data transferred
• Your IP address
• Browser type and current version
• Operating system of the device used to access our website
• Date and time of the page view
• Referrer URL

The data in the log files is not stored together with other personal data.

Purpose of Data Processing

The data is processed in our legitimate interest for technical functionality. The contents of our website can only be displayed correctly if the technical capabilities of the end device are taken into account. In addition, errors in content transmission can be more easily identified and corrected.

Legal Basis for Data Processing

Our legitimate interests pursuant to Art. 6(1)(f) GDPR form the legal basis for the storage of server data and log files.

Duration of Data Storage

The log files are automatically deleted after 6 weeks.

Objection

The processing of log files is essential for the proper functioning of our website. Therefore, there is no possibility for objection in this case.

3. Google Tag Manager

We use the Google Tag Manager on our website. Within the European region, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for all Google services. The Tag Manager is a service that facilitates the integration and management of our tags. Tags refer to small sections of code that we use to measure visitor numbers and behavior as well as advertising effectiveness and to optimize our website accordingly. The Tag Manager itself does not process any user data. Nevertheless, you can prevent the use of the Google Tag Manager by adjusting your cookie settings.

4. Use of Cookies

Cookies are used on our website. Cookies typically contain data about the website visited, which the web browser stores while browsing. If the user accesses our website again via the corresponding server, the user's browser sends back the previously received cookie to our website. This allows the server to evaluate the received information and facilitate navigation on the website or control advertising display.

On our online offering, we distinguish between technically necessary cookies and marketing and analysis cookies.

When accessing our online offering for the first time, you are asked about your preferences regarding cookies. You can change your decision about which cookies you accept and which you do not at any time by calling up the cookie settings again. However, technically necessary cookies cannot be deselected in the cookie settings.

By configuring your internet browser – i.e. the program you use to open or display websites (such as Microsoft Edge, Internet Explorer, Mozilla Firefox, Opera, Google Chrome or Safari) – the use of cookies can generally be disabled. In this case, certain functions of our online offering that are essential for proper use of the website may no longer be available.

4.1 Technically Necessary Cookies

Description of the Processed Data 

In the category of technically necessary cookies, we distinguish between the so-called session cookie and the consent cookie. The session cookie stores only the so-called session ID, which allows our system to recognize a user after a page change. The consent cookie is placed when you make your choice regarding cookie usage via the consent banner on your first visit to our online presence. This choice is stored in the consent cookie.

Purpose of Data Processing

It is in our legitimate interest to provide users with a technically flawless online offering. Technically necessary cookies are used to enable core functions of our website in the first place. With their help, for example, logging in with a user account or filling a shopping cart can be implemented in such a way that the function remains intact even after a page change. It is also in our legitimate interest and that of our users that the consent banner is not displayed again on every visit. Therefore, we store users' decisions in the consent cookie. Users can still change their choice at any time by manually accessing the consent banner.

Legal Basis for Data Processing

Our legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR form the legal basis for the processing of data in connection with technically necessary cookies.

Duration of Data Storage

Session cookies are automatically deleted after one hour, consent cookies after one year.

4.2 Google Analytics

Description of the Processed Data

We use Google Analytics on our online offering. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA (“Google”). If you have consented to the use of analysis cookies by making a selection in the “We use cookies” banner, we use Google Analytics to obtain information about your use of our website.

Google Analytics uses cookies that are usually transmitted to a Google server in the USA and stored there. On our website, the “anonymizeIP” function is activated. This means that your IP address is anonymised by Google as soon as the data enters the Analytics data collection network and before it is stored or processed.

The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google, provided that you are not logged into a Google service while using our website. Google Analytics is configured in such a way that no user IDs are generated.

As part of Google Analytics, we also use the Google Signals extension, which enables us to generate cross-device statistics. Signals only provides us with data if you are logged into your Google account while using our online offering and have also activated the “personalised ads” option in your account. Google Signals is also used only with IP anonymisation enabled. We therefore do not receive any personal data, only aggregated and anonymised data.

During your visit to our online offering, the following data is collected, among others:

• your anonymised IP address
• date and time of your visit
• all pages you visited on our website
• your browsing behaviour (e.g. clicks, time spent, form submissions)
• technical information about the device used, browser, operating system, etc.
• your approximate location
• the website URL from which you accessed our website (referrer URL)

Purpose of data processing

On our behalf, Google uses this data to evaluate your use of our website, to compile reports on website activity and to provide us, the website operator, with other services related to website and internet usage. We have concluded a data processing agreement with Google for this purpose. We use the Analytics reports and evaluations to understand how visitors use our website and to tailor it as closely as possible to users' needs.

Legal basis for data processing

The legal basis for the data processing is your consent in accordance with Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. You can revoke this consent at any time by changing the cookie settings.

Duration of data storage

Google Analytics is configured on our website in such a way that data linked to cookies is automatically deleted after 14 months.

Objection

You can prevent the storage of cookies by changing your cookie settings.

4.3 Google Ads

Description of the Processed Data

We use Google Ads to prominently present our online offering to interested users within the Google network. Our advertisements appear within the Google search engine as well as on third-party websites. In this context, we use Google Conversion Tracking on our online offering. This is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA (“Google”). Conversion tracking enables us to tailor our advertisements and online offering as effectively as possible to the needs of our customers and prospective customers. When you click on a Google Ads advertisement, a cookie is set for conversion tracking.

In addition, we use the Enhanced Conversions feature, which enables more accurate conversion tracking by supplementing conversion data with user data from our online offering, provided that you are logged into your Google account while using our online services. Before being transmitted to Google, the user data is converted into a hashed string. Google compares the hashed user data with the also-hashed data from your Google account and can, if matching, assign the conversions more precisely.

Among others, the following data is processed:

• IP address
• Device information
• Browser history
• Demographic data
• Location data
• Search terms
• Interactions with ads and content
• Visited websites
• Apps used
• Click behavior
• Conversion data
• Unique user IDs

Google processes data, among other places, in the USA. Google participates in the EU-US Data Privacy Framework, which ensures the secure exchange of personal data between the EU and the USA. Additionally, Google relies on the so-called Standard Contractual Clauses of the EU for data transfers to the USA.

More information on Google Ads and Google Conversion Tracking can be found in Google’s Privacy Policy: https://policies.google.com/privacy?hl=de

Purpose of Data Processing

By using Google Ads and Conversion Tracking, we are able to advertise within the Google network and thus gain new prospective customers. Additionally, we can measure the effectiveness of our advertising and take steps to improve and target it more precisely.

Legal Basis for Data Processing

The basis for data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. You can revoke this consent at any time by adjusting your cookie settings.

Duration of Data Storage

The cookies have different storage durations. The maximum storage duration is 13 months.

Objection

You can prevent the storage of cookies by adjusting your cookie settings.

4.4 Microsoft Advertising

Description of the Processed Data

We use Microsoft Advertising to prominently present our online offering to interested users within the Microsoft Advertising network. Our ads thus appear in the Microsoft search engine Bing as well as on third-party websites. In this context, we use Microsoft Advertising Universal Event Tracking on our website. Microsoft Advertising and Universal Event Tracking are services provided by Microsoft Corporation, One Microsoft Way, Redmond, WA, 98052-6399, USA (“Microsoft”). As soon as a user clicks on a Microsoft Advertising ad, cookies are set on the user’s device.

Among others, the following data is processed:

• Time of visit
• Device properties
• Browser properties
• IP address (encrypted
• Data regarding the use of our website

Microsoft also processes data in the USA, among other places. Microsoft participates in the EU-US Data Privacy Framework, which ensures the secure exchange of personal data between the EU and the USA. In addition, Microsoft bases data transfers to the USA on the so-called Standard Contractual Clauses of the EU.

Purpose of Data Processing

By using Microsoft Advertising and Universal Event Tracking, we are able to advertise within the Microsoft network and thereby gain new interested parties and customers. We can also measure the effectiveness of our advertising and take measures to improve and better target our ads.

Legal Basis for Data Processing

The basis for data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. You can revoke this consent at any time by adjusting your cookie settings.

Duration of Data Storage

The Microsoft Advertising cookies have different storage durations. The maximum storage period is 13 months.

Objection

You can prevent the storage of cookies by adjusting your cookie settings.

4.5 LinkedIn Ads

Description of the Processed Data 

Our website integrates the Insight Tag from LinkedIn Corporation. Within the European region, the responsible entity is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Tags are small code snippets that can be used to measure visitor traffic and behavior as well as the effectiveness of advertising. The Insight Tag sets cookies for visitors to our website and can, among other things, recognize when such a user logs into their LinkedIn profile.

Through the Insight Tag and its cookies, the following data, among others, is processed:

• URL
• Referrer URL
• Device properties
• Browser properties
• IP address

LinkedIn also processes data in the USA. LinkedIn participates in the EU-US Data Privacy Framework, which ensures the secure exchange of personal data between the EU and the USA. In addition, LinkedIn bases data transfers to the USA on the so-called Standard Contractual Clauses of the EU.

For the data processing carried out via the Insight Tag, there is joint controllership between LinkedIn and Knüppel Verpackung in accordance with Art. 26 GDPR. The agreement on joint controllership can be found here: https://legal.linkedin.com/pages-joint-controller-addendum

Purpose of Data Processing

Integration of the Insight Tag enables us to use LinkedIn’s conversion tracking and retargeting features. This allows us to display personalized advertising on LinkedIn to visitors of our website who are logged into their LinkedIn account. In addition, we receive anonymized reports on the success of our LinkedIn advertising.

Legal Basis for Data Processing

The basis for data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR and § 25 para. 1 TTDSG. You can revoke this consent at any time by adjusting your cookie settings.

Duration of Data Storage

The cookies used by the Insight Tag have different storage durations. Most are deleted after 30 days. The maximum storage period of the remaining cookies is 2 years.

Objection

You can prevent the storage of cookies by adjusting your cookie settings. In addition, you may object to the processing of your data for direct marketing purposes at any time pursuant to Art. 21 para. 2 GDPR.

4.6 Teads

Description of the Processed Data 

We use Teads on our website to recognize users who have visited our online offering and to target them with advertising on other web services. Teads sets cookies on the user’s device for this purpose. In the process, the following data, among others, is processed:

• Time of visit
• Device properties
• Browser properties
• IP address
• Location data
• Data on the use of our website

Teads is a service provided by Teads Deutschland GmbH, Poststraße 6, 20354 Hamburg (“Teads”). Teads is headquartered in the USA. Therefore, data processing in the USA cannot be ruled out. Teads relies on the so-called Standard Contractual Clauses of the EU for data transfers to the USA.

Purpose of Data Processing

By using Teads, we are able to recognize users who have visited our website and target them with advertising on other platforms. This allows us to remind potential customers of the benefits of our company and products.

Legal Basis for Data Processing

The basis for data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. You can revoke this consent at any time by adjusting your cookie settings.

Duration of Data Storage

The data is subject to varying retention periods. Most data is deleted after 4 months. The maximum storage period is 1 year.

Objection

You can prevent the storage of cookies by adjusting your cookie settings.

5. Customer Account / Registration

Description of the Processed Data

We offer users of our online offering the option to create a customer account. To do so, you must enter a series of data in the designated registration form. Specifically, this includes:

• Company address (company name, street, house number, postal code, city, country
• Company phone and fax numbers
• Commercial register and tax number of the company
• Contact person (first name, last name, salutation)
• Email address of the contact person
• Self-chosen password

In addition to the data you actively enter, the date and time of your registration as well as the date and time of each login to your customer account are stored.

To submit the registration data, you will be asked to consent to the processing of the information you provided.

When you log in to your customer account after registering, the following data is also processed:

• Subpages and articles viewed
• Your wish list
• Items in your shopping cart
• Your past orders

Purpose of Data Processing

Registration enables you to purchase products in our online shop or to add them to a wish list for later. A wish list you create is permanently stored in your account. A filled shopping cart can be retrieved later to complete the order. You can access past orders in your customer account at any time. Based on the subpages and articles you visit, we may also provide recommendations. These shop features are intended to simplify your shopping experience and help with orientation. Logging the time of each login and subsequent browsing of subpages is in our legitimate interest to protect against misuse and unauthorized access.

Legal Basis for Data Processing

Art. 6 para. 1 lit. a) GDPR serves as the legal basis for the processing of your registration data. Since registration is required to place an order in our online shop, it also constitutes a pre-contractual measure, and thus Art. 6 para. 1 lit. b) GDPR is also applicable. Art. 6 para. 1 lit. f) GDPR is the legal basis where processing serves our legitimate interest in protecting against misuse and unauthorized use.

Duration of Data Storage

Your customer account and all data collected during registration will be manually deleted by us, unless legal or fiscal retention obligations require otherwise, in accordance with Art. 6 para. 1 lit. c) GDPR, once you inform us that you wish to close your account.

Revocation

You can revoke your consent to the processing of your customer account data at any time with effect for the future by requesting the deletion of your account via email to: shop@knueppel.de.

6. Orders in the Online Shop

Description oft he Processed Data

In the context of placing orders in our online shop, additional data beyond the registration information is collected and processed. Specifically, this includes:

• Delivery and billing address data and contact persons that differ from the customer account data
• Recipient email addresses for order confirmation, shipping confirmation, and/or invoice, if different from the customer account email address
• A customer order number

This data is manually entered by you in the designated input fields during the checkout process in the online shop.

Purpose of Data Processing

The data is primarily processed for order fulfillment. Specifically, we use it for the following processes:

• Product delivery
• Invoicing, payment processing, reminders, and enforcement of claims against you
• Communication with you
• Returns management
• Clarification of warranty and liability issues

Furthermore, data processing is carried out in our legitimate interest for general customer data management, statistical and marketing purposes, and to store past orders in your customer account for reuse in future orders.

Legal Basis for Data Processing

As the data processing primarily serves to fulfill the purchase contract concluded during the online shop order process, Art. 6 para. 1 lit. b) GDPR serves as the legal basis. For the additional processing activities mentioned, Art. 6 para. 1 lit. f) GDPR applies.

Duration of Data Storage

Your customer account, including all recorded order data, will be manually deleted by us—subject to retention obligations arising from commercial or tax law in accordance with Art. 6 para. 1 lit. c) GDPR—once you inform us that you wish to close your account.

Revocation

You may revoke your consent to data processing in connection with all orders placed via your customer account at any time with effect for the future by requesting the deletion of your account via email to: shop@knueppel.de.

7. Social Media

7.1 LinkedIn

We operate a company profile on the social media platform LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). The LinkedIn privacy policy, including contact options, can be found at: https://www.linkedin.com/legal/privacy-policy.

For certain processing activities in connection with our LinkedIn profile—especially when using LinkedIn Page Insights, LinkedIn Lead Gen Forms, and the LinkedIn Insight Tag for advertising campaigns—there is joint controllership under Art. 26 GDPR between LinkedIn and us.

The corresponding agreement on joint controllership (“Page Insights Joint Controller Addendum”) can be found at:
https://legal.linkedin.com/pages-joint-controller-addendum

Further information about the processing of personal data by LinkedIn and your rights as a data subject can also be found in the privacy policy linked above.

LinkedIn is a U.S.-based company. It therefore cannot be ruled out that your personal data will also be processed outside the European Union (EU). LinkedIn participates in the EU-US Data Privacy Framework.

7.2 Xing

We operate a company profile on the social media platform XING (New Work SE, Dammtorstraße 30, 20354 Hamburg, Germany). The XING privacy policy, including contact options, can be found at: https://privacy.xing.com/en.

For the processing of personal data on the platform, only XING (New Work SE) is regarded as the controller in the sense of the GDPR.
There is no joint controllership under Art. 26 GDPR, as there is no coordinated determination of purposes or means between XING and Knüppel Verpackung.

Knüppel Verpackung is solely responsible for the content published via the company profile (e.g. posts, images, or information).

8. Data Transfer to Third Parties

In the course of order processing, customer data management and sales processes, and to make your visit to our website as convenient and informative as possible, it may be necessary to transfer data to third parties. This primarily concerns processes related to customer data management, payment processing, product delivery, and the integration of third-party content. Data transfers are always limited to the minimum required. If necessary, data transfer to and processing by third parties is based on a data processing agreement concluded with those third parties.

8.1 Product Delivery

Description of the Processed Data

Fulfilling our obligations to customers includes delivering the ordered goods on time to the requested delivery location. For this, we work with various transport service providers and/or suppliers.

The selection and commissioning of the responsible transport provider or supplier is made on a case-by-case and material-specific basis. The following data is provided to the delivery partners for the purpose of shipment:

• Delivery address
• Special delivery instructions
• If necessary: internal company contact person and their contact details

Purpose of Data Processing

Data processing is required to fulfill our obligation under the purchase contract concluded via our online shop: timely delivery of the ordered goods to the requested address. In some cases, communication between the transport provider and the responsible contact person at the ordering company is necessary.

Legal Basis for Data Processing

Data processing is directly related to fulfilling the purchase contract concluded through the online order process. Therefore, the legal basis is Art. 6 para. 1 lit. b) GDPR.

Duration of Data Storage

Our data processing agreement stipulates that the commissioned delivery providers must delete the received data after delivery is complete, unless legal or fiscal retention obligations apply in accordance with Art. 6 para. 1 lit. c) GDPR.

Objection

You may object to the processing of your data by our commissioned delivery providers at any time with effect for the future by sending an email to shop(at)knueppel.de. In this case, product delivery based on your online orders may no longer be possible.

8.2 Credit Checks and Scoring

Description of the Processed Data

If we provide goods or services in advance—for example, in the case of purchase on account—we may carry out a credit check. This check is based on the customer number of a company in our system and the previous payment history of that company from past business transactions. If this internal assessment is insufficient, we may request a credit report from Creditreform Braunschweig Göttingen Bruns und Harland GmbH & Co. KG, Willi-Eichler-Str. 11, 37079 Göttingen, Germany.

For this purpose, the following data may be transmitted:

• Company address (including company name, legal form, street, house number, postal code, and city)
• If applicable: telephone number
• If applicable: VAT ID
• If applicable: tax number

We use the information received on the statistical probability of payment default to make a balanced decision regarding the initiation, execution, or termination of the contractual relationship. The credit report may include probability values (score values) that indicate the likelihood of a customer meeting their payment obligations. The score values are based on scientifically recognized mathematical and statistical procedures.

Purpose of Data Processing

Data processing takes place in our legitimate interest to protect ourselves against payment defaults. Furthermore, the credit check is part of the processing of a purchase contract arising from an online order.

Legal Basis for Data Processing

The legal basis for data processing is our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR.

Duration of Data Storage

Your customer account, related business transactions and payment processes, as well as credit information obtained from Creditreform, will be manually deleted by us—subject to statutory or fiscal retention requirements in accordance with Art. 6 para. 1 lit. c) GDPR—once you notify us that you no longer wish to use your customer account.

Revocation

You may revoke your consent to data processing related to all orders placed through your customer account at any time with effect for the future by requesting deletion of your account via email to: shop(at)knueppel.de.

8.3. PayPal

Description of the Processed Data

When placing an order in our online shop, you have the option to select PayPal as a payment method, among others. PayPal is a service that enables online payments to third parties. The service is provided by PayPal (Europe) S.à r.l. et Cie, S.C.A.

If you choose this payment method, data will be transmitted to PayPal for the purpose of processing the payment.

Please note that PayPal may collect, process, and, if necessary, share additional data with third parties when you access or use their service. For detailed information on PayPal’s data processing, please refer to:
www.paypal.com/de/webapps/mpp/ua/privacy-full

We have no influence over which data PayPal processes, how, where, how long, and to what extent the processing occurs, or to whom PayPal may transfer data. If you wish to prevent PayPal from processing your data, please select an alternative payment method. The payment option “advance bank transfer” is always available to you.

8.4. Trusted Shops

Description of the Processed Data

Our online shop includes the Trusted Shops Trustbadge. Trusted Shops GmbH is located at Subbelrather Straße 15C, 50823 Cologne, Germany. When the Trustbadge is accessed, the web server automatically stores the following data in a log file:

• IP address
• Date and time of access
• Transferred data volume
• Requesting provider

If you use one of the buyer protection services offered by Trusted Shops, additional data—especially order-related data—will be transmitted to Trusted Shops GmbH. Whether you are already registered as a buyer is verified using a neutral parameter derived from a cryptologically one-way hashed version of your email address. The email address is converted into this hash value, which cannot be decrypted by Trusted Shops. After checking for a match, the parameter is automatically deleted.

More information on data protection at Trusted Shops can be found at:
https://www.trstd.com/en-eu/imprint/#user-privacy-policy

Purpose of Data Processing

Our partnership with Trusted Shops provides our customers with orientation and security during their online shopping experience, while also serving as a marketing tool that builds trust. By integrating the Trusted Shops Trustbadge into our online shop, we display a quality seal to customers. The partnership with Trusted Shops also gives customers the option to participate in the Trusted Shops buyer protection program. The display of customer reviews collected via the Trustbadge provides orientation regarding the reliability and trustworthiness of our shop.

Legal Basis for Data Processing

A transparent rating of our shop and a secure online shopping experience are in both our legitimate interest and that of our customers. Therefore, the legal basis for displaying the Trustbadge and storing access data in the log file is Art. 6 para. 1 lit. f) GDPR. The legal basis for the processing of data when customers use Trusted Shops products is the contractual relationship between the customer and Trusted Shops.

Duration of Data Storage

Log files are automatically deleted no later than 90 days after they are created. The hashed parameter used to check registration with Trusted Shops products is deleted immediately after the check.

Revocation

You may revoke your consent to data processing in connection with the Trusted Shops Trustbadge at any time with effect for the future by sending an email to: shop(at)knueppel.de.

8.5 YouTube

Description of the Processed Data

We embed videos hosted on YouTube into our online services. YouTube is a service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA, 94043, USA.

However, the videos are only loaded once you have accepted the YouTube cookies. You can do this in one of the following two ways:

• In the cookie consent banner that appears during your first visit to our website
• If you initially declined cookies in the banner, you will see a preview on subpages containing embedded videos, where you will be prompted to accept cookies if you wish to view the video.

No data is exchanged with YouTube until you have given your consent. Only after consent is given will a cookie be placed in your web browser. The data collected by this cookie is usually transmitted to a Google server in the USA and stored there.

If you are logged into your YouTube or other Google account while watching a video on our website, it is possible that Google may link this data with other personal information.

Further information on data protection at YouTube can be found here:
https://policies.google.com/privacy

We have no control over which data YouTube processes, how long, where, or to what extent, or to whom YouTube may transfer data. If you wish to prevent YouTube from processing data, you should not activate video playback.

8.6 LinkedIn Lead Gen Forms:

Description of the Processed Data

To generate leads on LinkedIn, we use LinkedIn Lead Gen Forms provided by LinkedIn Corporation. Within the European region, the responsible entity is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Leads are potential business contacts who voluntarily submit their contact details for further communication. LinkedIn forms are used for this purpose and vary depending on the specific campaign. In all cases, contact details of the individual and company data are collected. When a user fills out such a form on LinkedIn, personal data is processed by LinkedIn and transmitted to us.

There is joint controllership between LinkedIn and Knüppel Verpackung for the processing of Lead Gen Forms. The agreement on joint controllership can be found at:
https://legal.linkedin.com/pages-joint-controller-addendum

Purpose of Data Processing

Lead generation is very important to us for initiating new business relationships and acquiring new customers. Since LinkedIn is a professional business network, it is ideally suited for this purpose. Forms in which potential business contacts enter their contact details provide an effective basis for follow-up communication.

Legal Basis for Data Processing

The basis for data processing is your consent pursuant to Art. 6 para. 1 lit. a) in conjunction with Art. 7 GDPR. After the data is transferred into our CRM system, further processing is additionally based on Art. 6 para. 1 lit. b) and f) GDPR.

Duration of Data Storage

Your personal data will be manually deleted by us—subject to legal retention obligations in accordance with Art. 6 para. 1 lit. c) GDPR—if you inform us that you no longer agree to data processing. Data transferred into our CRM system will also be manually deleted, unless retention is required by law, once you object to continued use by sending us an email.

Revocation / Objection

You may revoke your consent to the processing of your data at any time with effect for the future by emailing: datenschutz(at)knueppel.de. In addition, you may object to the use of your data for advertising purposes at any time in accordance with Art. 21 para. 2 GDPR.

8.7. Salesforce

Description of the Processed Data

We use Salesforce to manage our customer data and sales processes, as well as for lead management and marketing automation. In Germany, the responsible entity is salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich. Personal data from LinkedIn campaigns, Lead Gen Forms, and interactions—as well as from customer registrations, online shop orders, newsletter subscriptions, and general contact inquiries—is stored and processed in our CRM system Salesforce. Individual employees also use LinkedIn as part of their professional activities to initiate business contacts and maintain relationships. If LinkedIn contact data is transferred to Knüppel, it will also be processed further in the CRM system.

Customer data is stored on Salesforce servers. Since Salesforce is headquartered in the USA, data processing in the USA cannot be ruled out. Salesforce participates in the EU-US Data Privacy Framework, which ensures the secure exchange of personal data between the EU and the USA. In addition, Salesforce relies on the so-called Standard Contractual Clauses of the EU for data transfers to the USA.

Purpose of Data Processing

Using Salesforce enables us to efficiently manage customer data and our sales processes (Salesforce Sales Cloud), and to effectively carry out and analyze marketing activities (Salesforce Marketing Cloud).

Legal Basis for Data Processing

The basis for processing is our legitimate interest in efficiently managing customer data and sales processes. The legal basis is therefore Art. 6 para. 1 lit. f) GDPR. If we ask for specific consent, data processing is also based on Art. 6 para. 1 lit. a) GDPR. If the processing is necessary to fulfill a contract or to carry out pre-contractual measures, the legal basis is Art. 6 para. 1 lit. b) GDPR.

Revocation / Objection

You may revoke your consent to the processing of your data at any time with effect for the future by sending an email to: datenschutz(at)knueppel.de. Additionally, you may object to the processing of your data for marketing purposes at any time in accordance with Art. 21 para. 2 GDPR.

9. Contact

Description of the Processed Data

We offer you various ways to contact us: contact form, email, telephone, etc. If you contact us, all data that you transmit to us in the course of your inquiry will be processed.

Purpose of Data Processing

The data from your contact request is processed solely for the purpose of communicating with you and addressing your inquiry.

Legal Basis for Data Processing

It is in both your and our legitimate interest that we are able to respond to your inquiry. Therefore, the legal basis is Art. 6 para. 1 lit. f) GDPR. If you contact us via the contact form, Art. 6 para. 1 lit. a) GDPR also applies. If your inquiry is aimed at the conclusion of a contract, Art. 6 para. 1 lit. b) GDPR is the relevant legal basis.

Duration of Data Storage

We process your data only for as long as it is necessary to maintain our business relationship with you. As long as you do not object, we will use your data to maintain and enhance our trusted business relationship for the mutual benefit of both parties. If you request the deletion of your data, we will delete it immediately, unless legal retention obligations prevent us from doing so.

Objection

You may object to the processing of your data in connection with your contact inquiry at any time by emailing datenschutz[at]knueppel.de. Please note that in such cases, further communication with you may no longer be possible.

10. Newsletter and Event-Based EMails

Description of the Processed Data

On our website, you have the option to register for our free newsletter. To do so, you must provide the email address to which the newsletter should be sent. We also store the date and time of your newsletter registration.

To complete registration, you must actively consent to the processing of your data by checking the appropriate box below the registration form.

Registration takes place via a double opt-in procedure. After registering, you will receive a confirmation email containing a link that you must click to finalize your registration. This prevents misuse, such as the registration of third-party or unauthorized email addresses.

We also use your name and the email address that you provided when registering in our online shop to send you occasion-based emails related to your activities in our shop.

Purpose of Data Processing

Your email address is processed in order to send you the newsletter. Additional data processing serves documentation purposes and to prevent misuse of the newsletter or your email address.

With respect to event-based emails, we use your name and email address to provide product recommendations based on items you have viewed, ordered, or placed in your shopping cart.

Legal Basis for Data Processing

Art. 6 para. 1 lit. a) GDPR is the legal basis for processing data related to the newsletter, as your active subscription constitutes consent. In addition, Art. 6 para. 1 lit. f) GDPR applies for storage beyond the subscription period, as we have a legitimate interest in being able to prove prior consent.

The legal basis for sending event-based emails is § 7 para. 3 UWG (German Act Against Unfair Competition).

Duration of Data Storage

The data from your newsletter subscription will be stored not only during your active subscription, but also thereafter to serve as proof of prior consent.

Your customer account and all registration-related data will be deleted—subject to commercial or tax-related retention obligations under Art. 6 para. 1 lit. c) GDPR—once you inform us that you wish to close your account.

Revocation

You can unsubscribe from the newsletter at any time by using the unsubscribe link provided in each email. Alternatively, you can notify us of your wish to unsubscribe by sending an email to: shop(at)knueppel.de. You may also request the deletion of your subscription data by emailing shop(at)knueppel.de at any time.

11. Surveys

Description of the Processed Data

From time to time, we conduct surveys targeted at our customers. For this purpose, we use the open-source survey software LimeSurvey, provided by LimeSurvey GmbH. The software and the individual surveys are hosted on our own servers. There is no data exchange with LimeSurvey GmbH.

Depending on the survey, you may be asked to provide personal data. The specific data requested can vary from survey to survey.

Participation in surveys is always voluntary. To take part in a survey, you must actively consent to the processing of your data by checking the appropriate box below the survey form.

Purpose of Data Processing

The surveys are generally conducted for market research purposes. The goal is usually to better understand certain aspects of our customers’ purchasing behavior. The exact purpose depends on the individual survey.

Legal Basis for Data Processing

Since data is only processed after a customer has voluntarily participated in a survey, Art. 6 para. 1 lit. a) GDPR serves as the legal basis for processing.

Duration of Data Storage

As the data collected in the surveys about our customers’ purchasing behavior is generally of long-term interest to us, it is only deleted at the explicit request of survey participants.

Objection

You can avoid data processing by simply not participating in a survey. If you have already taken part and wish to object to further data processing or request deletion of your data, please contact us via email at: datenschutz(at)knueppel.de.

12. Rights of the Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

12.1 Right of Access

You have the right to obtain confirmation from us as to whether personal data concerning you is being processed. If such processing is taking place, you have the right to access this personal data and the information listed in Art. 15 GDPR.

You also have the right to be informed whether personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

12.2 Right to Rectification

You have the right to obtain from us the rectification and/or completion of your personal data if the data processed concerning you is incorrect or incomplete. We will carry out the correction without undue delay.

12.3 Right to Restriction of Processing

Under the conditions set out in Art. 18 GDPR, you may request the restriction of the processing of your personal data.

If processing has been restricted, such data—apart from storage—may only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been lifted under Art. 18 GDPR, you will be informed accordingly.

12.4 Right to Erasure

You have the right to request that personal data concerning you be erased without undue delay, and we are obliged to erase such data immediately where one of the following grounds applies:

1. The personal data concerning you is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
2. You withdraw your consent on which the processing is based according to Art. 6 para. 1 lit. a) or Art. 9 para. 2 lit. a) GDPR, and there is no other legal ground for the processing.
3. You object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR.
4. The personal data concerning you has been unlawfully processed.
5. The personal data concerning you must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.
6. The personal data was collected in relation to the offer of information society services referred to in Art. 8 para. 1 GDPR.

Information to Third Parties

If we have made the personal data concerning you public and are obliged pursuant to Art. 17 para. 1 GDPR to erase it, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replications of, that personal data.

Exceptions

The right to erasure does not apply where processing is necessary:

1. For exercising the right of freedom of expression and information
2. For compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority
3. For reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h) and i) and Art. 9 para. 3 GDPR
4. For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in (1) is likely to render impossible or seriously impair the achievement of the objectives of that processing
5. For the establishment, exercise or defense of legal claims

12.5 Right to Notification

If you have exercised your right to rectification, erasure or restriction of processing, we are obliged to inform all recipients to whom your personal data has been disclosed about this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.
You have the right to be informed about these recipients.

12.6 Right to Data Portability

Under the conditions of Art. 20 GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transmit that data to another controller without hindrance from us.

You also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

12.7 Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 para. 1 lit. e) or f) GDPR, including profiling based on those provisions.

We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

You have the option to exercise your right to object in connection with the use of information society services—regardless of Directive 2002/58/EC—by means of automated procedures using technical specifications.

12.8 Right to Withdraw Consent under Data Protection Law

You have the right to withdraw your data protection consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

12.9 Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing—including profiling—which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

1. Is necessary for entering into or performing a contract between you and us
2. Is authorized by Union or Member State law and includes suitable measures to safeguard your rights and freedoms and legitimate interests
3. Is based on your explicit consent

Such decisions must not be based on special categories of personal data referred to in Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a) or g) GDPR applies and suitable measures have been taken to safeguard your rights and freedoms and legitimate interests.

In the cases referred to in (1) and (3), we shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention, to express your point of view, and to contest the decision.

12.10 Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority—especially in the Member State of your residence, place of work, or place of the alleged infringement—if you believe that the processing of personal data relating to you infringes the GDPR.

The supervisory authority with which the complaint has been lodged shall inform you of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

13. Changes and Updates to the Privacy Policy

If we introduce new services, products, or features, adjust online processes, or as internet and IT security technologies evolve, we will update this privacy policy accordingly. We therefore reserve the right to make changes to this policy as necessary.

Any updates will be published here.
We therefore recommend that you check this section regularly to stay informed about the current version of the privacy policy.

Last updated: 07/2025