Privacy Policy

Protecting your privacy when processing personal data is our highest priority. We therefore process personal data only when this is necessary and economically appropriate for the use of our services. Naturally, we always comply with the provisions of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Below, we inform you about which data is processed, how, and by which entities when you visit our online shop at www.pammys.com visit.

I. The controller responsible for data processing is:

dieseo GmbH
Gaardener Ring 11
24143 Kiel
Germany
Email: hallo@pammys.com

II.    Personal data

(1) Personal data is information relating to you personally that can be used to identify you. This includes, among other things, your name, address, email address, location data, payment information, and other comparable details. In principle, you can visit our website without providing personal data. In certain cases, however, we require such data in order to provide you with the services you request on our website. If you use one of our services that requires you to provide personal data, we collect only the information necessary for this purpose—and generally only with your consent.

III.    Visiting our website

A.    General use

(1)    When you visit our website, our web servers routinely store the IP address assigned by your internet service provider, the website from which you visit us, the websites you visit on our site, and the date and duration of your visit. Processing this information is essential for the technical transmission of the websites, the convenient use of our services, and secure server operation. Our legitimate interest arises from Art. 6(1)(f) GDPR.
(2)    It is not possible to directly infer your identity from this information, nor will we do so. The information is stored and automatically deleted once the aforementioned purposes have been achieved. The standard deletion periods are based on the criterion of necessity.

1.    Automatically stored data (server log files)

(1) The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us.
These are:
• date and time of the request
• name of the requested file
• page from which the file was requested
• access status (file transferred, file not found, etc.)
• web browser used and operating system used
• full IP address of the requesting computer
• transmitted data volume

(2) This data is not combined with other data sources. Processing is carried out pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

(3) For technical security reasons, particularly to defend against attempted attacks on our web server, we store this data for a short time. It is not possible for us to draw conclusions about individual persons based on this data. After no more than seven days, the data is anonymized by shortening the IP address at domain level, so that it is no longer possible to establish a connection with the individual user. In anonymized form, the data is also processed for statistical purposes; it is not compared with other data sets or disclosed to third parties, even in extracts.

2. Cookies, Tracking Pixels and Tools

(1) When you visit our websites, we may store information on your computer in the form of cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a string of characters that enables websites and servers to assign the cookie to the specific web browser in which it was stored. This allows the websites and servers visited to distinguish the individual browser of the data subject from other web browsers containing different cookies. A specific web browser can be recognized and identified through its unique cookie ID. An overview of the cookies we use can be found here.

(2) By using session cookies, the controller can provide users of this website with a user-friendly service that would not be possible without setting cookies. Without consent, we use only technically necessary cookies on the legal basis of legitimate interest pursuant to Art. 6 (1) (f) GDPR.

(3)    We use personal cookies to improve our website or for marketing/advertising purposes only with your consent. On your first visit, you may voluntarily consent to tracking or analysis via the displayed cookie banner. Where applicable, your data may be shared with partners or third-party providers. These cookies are stored only if you explicitly consent to this; the legal basis is then your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can change your cookie preferences here at any time.

3.    Social Plugins from Facebook, Pinterest, Instagram, and YouTube

(1)    Social buttons from social networks are used on our website. These are integrated into the page solely as HTML links, meaning that no connection to the servers of the respective provider is established when you access our website. If you click one of the buttons, the website of the respective social network opens in a new browser window. There, you can, for example, click the Like or Share button.

4.    Consent Management

(1)    When using cookies, a distinction must be made between strictly necessary cookies and cookies used for additional purposes (measuring access figures and advertising purposes). Through our consent manager, you generally have the option of accepting or rejecting all or some of the non-essential cookies. If you choose the latter option, you may not be able to use our services in full. You can manage and withdraw this consent through our consent management system (also known as the “cookie banner” or “cookie settings”).

B.    Online Presence and Service Optimization

1.    Shopify

(1)    We host our website with Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter “Shopify”). Shopify is a tool for creating and hosting e-commerce websites. When you visit our website, Shopify collects your IP address and information about the device and browser you use. Shopify also analyzes visitor numbers, visitor sources, and customer behavior, and creates user statistics. If you make a purchase on our website, Shopify also collects your name, email address, delivery and billing addresses, payment details, and other data related to the purchase (e.g., telephone number, amount of sales made, and similar information). For the analyses, Shopify stores cookies in your browser. For details, please refer to Shopify’s privacy policy: https://www.shopify.de/legal/datenschutz

(2)    Shopify is used on the basis of Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG, insofar as the consent covers the storage of cookies or access to information on the user's end device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent may be revoked at any time. We have concluded a data processing agreement (DPA) pursuant to Art. 28 GDPR with the aforementioned provider. This is a contract required under data protection law that ensures that the provider processes our website visitors' personal data only in accordance with our instructions and in compliance with the GDPR.

2.    Google reCAPTCHA

(1)    We also use Google's reCAPTCHA function on this website, provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter referred to as “Google”). This function is primarily used to distinguish whether an input is made by a natural person or abusively through machine-based and automated processing. The service involves sending the IP address and, where applicable, other data required by Google for the reCAPTCHA service to Google and is carried out pursuant to Art. 6 para. 1 lit. a GDPR on the basis of your consent, provided that you have given us this consent via the consent banner. As data protection is very important to us and we want to keep the associated interference as low as possible for you, we do not use Google's service continuously, but only in certain situations. When using Google reCAPTCHA, personal data may also be transferred to the servers of Google LLC. in the USA.

(2)    In the event that personal data is transferred to Google LLC., based in the USA, Google LLC. has certified itself under the EU-U.S. data protection agreement “Privacy Shield,” which ensures compliance with the level of data protection applicable in the EU. A current certificate can be viewed here: https://www.privacyshield.gov/list

(3)    Further information about Google reCAPTCHA and Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/

C.    Tools and services for analysis, statistical data collection, and marketing

1.    Google Tag Manager
(1)    We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

(2)    Google Tag Manager is a tool that enables us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies, or conduct any independent analyses. It is used solely to manage and deploy the tools integrated through it. However, Google Tag Manager collects your IP address, which may also be transferred to Google’s parent company in the United States.

(3)    The use of Google Tag Manager is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the fast and straightforward integration and management of various tools on its website. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and   Section 25 para. 1 TTDSG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent may be withdrawn at any time.

2.    Google Analytics (4)

(1)    This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

(2)    Google Analytics enables the website operator to analyze the behavior of website visitors. In this context, the website operator receives various usage data, such as page views, time spent on the site, operating systems used, and the user’s origin. This data is combined in a user ID and assigned to the respective device of the website visitor.

(3)    Furthermore, Google Analytics may record, among other things, your mouse and scrolling movements and clicks. Google Analytics also uses various modeling approaches to supplement the data sets collected and employs machine learning technologies in data analysis. Google Analytics uses technologies that enable users to be recognized for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The information collected by Google about your use of this website is generally transferred to and stored on a Google server in the United States. This service is used on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG. Consent may be withdrawn at any time.

(4)    Data transfers to the United States are based on the European Commission’s standard contractual clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/

3.    Browser Plugin

(1)    You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. More information on how Google Analytics handles user data can be found in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.

4.    Google Signals

(1)    We use Google signals. When you visit our website, Google Analytics collects, among other things, your location, search history, and YouTube history, as well as demographic data (visitor data). This data may be used for personalized advertising with the help of Google signals. If you have a Google account, Google signals links the visitor data to your Google account and uses it for personalized advertising messages. The data is also used to create anonymized statistics on our users’ behavior. 

5.    Google Analytics E-Commerce Measurement

(1)    This website uses the “E-Commerce Measurement” function of Google Analytics. With the help of e-commerce measurement, the website operator can analyze website visitors’ purchasing behavior to improve its online marketing campaigns. This includes collecting information such as orders placed, average order values, shipping costs, and the time from viewing a product to purchasing it. Google may combine this data under a transaction ID assigned to the respective user or their device.

6.    Google Ads

(1)    The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

(2)    Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms into Google (keyword targeting). Targeted advertisements can also be displayed based on user data available to Google (e.g. location data and interests) (audience targeting). As website operators, we can evaluate this data quantitatively by analyzing, for example, which search terms led to our advertisements being displayed and how many advertisements resulted in corresponding clicks.

(3)    This service is used on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG. Consent may be withdrawn at any time. Data transfer to the USA is based on the EU Commission’s standard contractual clauses. Details can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/

7.    Google AdSense

(1)    This website uses Google AdSense, a service for embedding advertisements. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

(2)    We use Google AdSense in “non-personalized” mode. Unlike personalized mode, the advertisements are therefore not based on your previous user behavior, and no user profile is created for you. Instead, so-called “contextual information” is used when selecting advertisements. The advertisements selected then depend, for example, on your location, the content of the website you are visiting, or your current search terms. More information about the differences between personalized and non-personalized targeting with Google AdSense can be found at: https://support.google.com/adsense/answer/9007336

(3)    Please note that even when Google AdSense is used in non-personalized mode, cookies or comparable recognition technologies (e.g., device fingerprinting) may be used. According to Google, these are used to combat fraud and misuse.

(4)    This service is used on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG. You may withdraw your consent at any time.

(5)    The transfer of data to the USA is based on the European Commission's standard contractual clauses. Details here: https://business.safety.google/adscontrollerterms/sccs/

(6)    You can adjust your advertising settings independently in your user account. To do so, click the following link and log in: https://accounts.google.com/InteractiveLogin/signinchooser

(7)    Further information about advertising technologies can be found here: https://policies.google.com/technologies/ads and https://pammys.com/pages/datenschutz

8.    Google Campaign Manager

(1)    This website also uses Google's Campaign Manager online marketing tool, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

(2)    Campaign Manager uses cookies to display ads relevant to users, improve campaign performance reports, or prevent a user from seeing the same ads more than once. Using a cookie ID, Google records which ads are displayed in which browser and can thus prevent them from being displayed multiple times. In addition, Campaign Manager can use cookie IDs to record so-called conversions related to ad requests. This is the case, for example, when a user sees a Campaign Manager ad and later uses the same browser to visit the advertiser’s website and makes a purchase there. 

(3)    Due to the marketing tools used, your browser automatically establishes a direct connection with Google’s server. We have no influence over the scope or further use of the data collected by Google through the use of this tool and therefore provide information based on our current knowledge: By integrating Campaign Manager, Google receives information that you have accessed the relevant section of our website or clicked on one of our ads. If you are registered with a Google service, Google may associate the visit with your account. Even if you are not registered with Google or are not logged in, it is possible that Google may learn and store your IP address.

(4)    In addition, the Campaign Manager cookies used (e.g. referred to as DoubleClick or Floodlight) enable us to understand whether you perform certain actions on our website after viewing or clicking one of our display/video ads on Google or another platform via Campaign Manager (conversion tracking). Campaign Manager uses this cookie to understand the content with which you interacted on our websites in order to send you targeted advertising later. 

(5)    This service is used on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG. Consent may be revoked at any time. Further information about Campaign Manager can be found at https://marketingplatform.google.com/about/enterprise/ and about data protection at Google in general at: https://www.google.de/intl/de/policies/privacy Google has submitted to the Data Privacy Framework Program and is certified: https://www.dataprivacyframework.gov/s/

9.    Google Display & Video 360

(1) On this website, we use the Display & Video 360 tool provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, which collects data for analysis, marketing, and optimization purposes and thereby helps us improve our marketing activities and our website.

(2) Display & Video 360 uses the collected data to link advertising contacts and clicks on advertisements with subsequent use of our website. This enables us to determine whether internet users who have seen our advertisements visit our website or which products they are interested in. This helps us use our advertising budget more efficiently. We may also use the collected data to deliver advertising based on your interests (e.g. products viewed).

(3) Pseudonymous online identification numbers (such as cookie IDs or IP addresses) are used to collect the data. No unique user-related data, such as names or addresses, is stored. All IDs we use merely enable recognition of your device and internet browser. Without your separate consent, we do not use the collected data to personally identify you as a user of our website.

(4) We would like to point out that Google may link visits to this website with the registered data of users who have registered with Google. You can find out exactly how Google handles your data on Google’s privacy pages by clicking the following link: https://privacy.google.de/intl/de/take-control.html?categories_activeEl=sign-in

(5) This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG. Consent may be withdrawn at any time. Google has committed to the Data Privacy Framework Program and is certified: https://www.dataprivacyframework.gov/s/ 

10. Microsoft Advertising

(1) We use the technologies of Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”) described below. Data processing is based on an agreement between joint controllers pursuant to Art. 26 GDPR. The information automatically collected by Microsoft technologies about your use of our website is generally transmitted to and stored on a server operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. There is no adequacy decision by the European Commission for the USA. Our cooperation is based on the European Commission’s standard data protection clauses.

(2) Further information about data processing by Microsoft can be found in Microsoft’s privacy notice: https://privacy.microsoft.com/de-de/privacystatement.

(3) For advertising purposes in Bing, Yahoo, and MSN search results and on third-party websites, the so-called Microsoft Advertising remarketing cookie is set when you visit our website. It enables interest-based advertising automatically through the collection and processing of data (IP address, time of visit, device and browser information, and information about your use of our website), using a pseudonymous cookie ID and based on the pages you have visited.

(4) To analyze the website and track events, we use Microsoft Advertising Universal Event Tracking (UET) to measure your subsequent usage behavior if you reached our website via a Microsoft Advertising ad, and create usage profiles using pseudonyms. Cookies may be used for this purpose, and data (IP address, time of visit, device and browser information, and information about your use of our website based on events specified by us, such as visiting a webpage or subscribing to a newsletter) may be collected, from which usage profiles are created using pseudonyms.

(5) If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG, insofar as the consent includes the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent may be revoked at any time.

11. Facebook Pixel

(1) This website uses Facebook visitor action pixels to measure conversions. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. According to Facebook, however, the data collected is also transferred to the USA and other third countries. This makes it possible to track the behavior of visitors to the site after they have been redirected to the provider’s website by clicking on a Facebook advertisement. This allows the effectiveness of Facebook advertisements to be evaluated for statistical and market research purposes and future advertising measures to be optimized.

(2) The data collected is anonymous to us as the operator of this website; we cannot draw any conclusions about the users' identities. However, the data is stored and processed by Facebook, making it possible to associate it with the respective user profile, and Facebook may use the data for its own advertising purposes in accordance with Facebook's Data Policy. This enables Facebook to serve advertisements on Facebook pages as well as outside Facebook. We, as the operator of the page, cannot influence this use of the data.

(3) Use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and §25 para. 1 TTDSG. Consent may be revoked at any time. Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum und https://de-de.facebook.com/help/566994660333381

(4) As far as personal data is collected on our website using the tool described here and forwarded to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Art. 26 GDPR). This joint responsibility is limited exclusively to the collection of the data and its forwarding to Facebook. The subsequent processing by Facebook after the data has been forwarded is not part of the joint responsibility. The obligations incumbent on us jointly have been set out in an agreement on joint processing. You can find the text of the agreement at: https://www.facebook.com/legal/controller_addendum According to this agreement, we are responsible for providing the data protection information when using the Facebook tool and for implementing the tool securely in accordance with data protection law on our website. Facebook is responsible for the data security of Facebook products. You can assert data subject rights (e.g. requests for information) regarding data processed by Facebook directly with Facebook. If you assert your data subject rights against us, we are obliged to forward them to Facebook. Further information on protecting your privacy can be found in Facebook's privacy information: https://de-de.facebook.com/about/privacy/

(5) You can also deactivate the “Custom Audiences” remarketing function in the Ad Preferences section at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen. You must be logged in to Facebook to do so.

D. Contact form

(1) When you contact us (e.g., via the contact form, email, telephone, or social media), the data sent by the person making the inquiry is processed insofar as this is necessary to respond to the contact inquiries and any requested measures, and is stored on our servers as part of data security. We use your data exclusively to process your request. Your data is treated as strictly confidential. It is not disclosed to third parties.

(2) Responding to contact inquiries in the context of contractual or pre-contractual relationships is carried out to fulfill our contractual obligations or to respond to (pre-)contractual inquiries and, otherwise, on the basis of our legitimate interests in responding to the inquiries.

(3) Categories of data processed: Master data (e.g., names, addresses), contact data (e.g., email addresses, telephone numbers), content data (e.g., information entered in online forms).

(4) Data subjects: Communication partners.

(5) Purposes of processing: Contact inquiries and communication

(6) Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

E. Customer account

(1)    Contractual partners can create an account within our online offering (e.g., a customer or user account, briefly referred to as a “customer account”). If registration for a customer account is required, contractual partners will be informed of this, as well as of the information required for registration. Customer accounts are not public and cannot be indexed by search engines. During registration and subsequent logins and use of the customer account, we store customers’ IP addresses together with the access times in order to verify the registration and prevent any misuse of the customer account.

(2)    When customers cancel their customer account, the data relating to the customer account will be deleted, unless its retention is required for legal reasons. Customers are responsible for securing their data when canceling their customer account.

F.    Shop and E-Commerce

(1)    We process our customers’ data to enable them to select, purchase, or order the products, goods, and related services they have chosen, as well as to pay for and have them delivered or provided. If required to fulfill an order, we use service providers, in particular postal, freight forwarding, and shipping companies, to deliver or provide the goods or services to our customers. We use the services of banks and payment service providers to process payment transactions. The required information is identified as such during the ordering or comparable purchasing process and includes the information required for delivery or provision and billing, as well as contact information so that we can contact customers if necessary.

(2)    Categories of data processed: Master data (e.g., names, addresses), payment data (e.g., bank details, invoices, payment history), contact data (e.g., email addresses, telephone numbers), contract data (e.g., subject matter of the contract, term, customer category), usage data (e.g., websites visited, interest in content, access times), metadata/communication data (e.g., device information, IP addresses).

(3)    Data subjects: Prospects, business and contractual partners, customers.

(4)    Purposes of processing: Provision of contractual services and customer service, handling contact requests and communication, office and organizational procedures, administration and responding to inquiries, security measures, conversion measurement (measuring the effectiveness of marketing measures), interest-based and behavior-based marketing, profiling (creating user profiles).

(5) Legal bases: Performance of a contract and pre-contractual inquiries (Art. 6 (1) sentence 1 lit. b. GDPR), legal obligation (Art. 6 (1) sentence 1 lit. c. GDPR), legitimate interests (Art. 6 (1) sentence 1 lit. f. GDPR).

1. Purchase of Goods

(1) If you are already a customer and have to interrupt the process during another order or are unable to complete your purchase, after a certain period of time we will remind you by email or SMS about the items you have added to your shopping cart so that you do not have to assemble them again (“Abandoned Cart”), or we will send you a message with the items you viewed (“Abandoned Browse”). We use cookies for this purpose. Further information on the use of cookies can be found under Section 3.1.2 (“Cookies, Tracking Pixels and Tools”).

(2) The legal basis for sending the notifications is Section 7 (3) UWG. You may object to receiving the notifications at any time, for example by contacting us via the corresponding link in the email you received.

G. Direct Advertising

1. Customer Information

(1) Unless you have objected, we use the email address and mobile phone number you provided when purchasing goods or services to send electronic advertising for our own goods or services that are similar to those you have already purchased from or used with us. For this purpose, we use your email address, mobile phone number, name, and order history to provide you with information about products that may interest you based on your recent orders. The legal bases for data processing are Art. 6 (1) lit. F GDPR and Section 7 (3) UWG.

(2) You may object to this processing at any time pursuant to Art. 21 (2) GDPR, for example by contacting us via the corresponding link in the email you received or by sending an email to hallo@pammys.com write. 

2. Newsletter

(1) On our website, we offer the option to subscribe to our newsletter. After registering, we will regularly inform you by email and SMS about news regarding our offers (e.g., promotions, new products, restocks, and competitions).

(2) Furthermore, after a certain period of time, we will remind you by email and SMS about the items you have added to your shopping cart but whose order you had to interrupt or whose purchase you were unable to complete.

(3) A valid email address or mobile phone number is required to subscribe to the newsletter. To verify your email address, you will first receive a registration email, which you must confirm via the link. To verify your mobile phone number, you will receive a registration SMS, which you must confirm via the link (double opt-in). When you subscribe to the newsletter on our website, we process personal data such as your email address and mobile phone number based on your consent. The legal basis for the processing is Art. 6(1), first subparagraph, point (a) GDPR.

(4) You can unsubscribe from our newsletter at any time, for example by contacting us via the relevant link in the email you received or by writing an email to hallo@pammys.com.

3. Typeform
(1) We use Typeform from TYPEFORM SL, C/Bac de Roda, 163 (Local), 08018 Barcelona, Spain (Typeform) for registering for our B2B newsletter and for the customer challenge. This enables us to provide you with an easy way to contact us. For this purpose, we transmit the following personal data to Typeform: email address

(2) Typeform is the recipient of your personal data and acts as our data processor. The processing of the data specified in this section is neither legally nor contractually required. Without your consent and the transmission of your personal data, we cannot provide you with a newsletter. The data is stored exclusively for the purpose of subscribing to the newsletter.

(3) In addition, Typeform collects the following personal data using cookies: information about your device (IP address, device information, operating system, browser settings). Usage data is also collected, such as the date and time when you used the form. Typeform requires this data to ensure proper display and functionality. Further information can be found at: https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-dat

(4) The legal basis for this processing is your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent to the processing of your personal data at any time. You can withdraw your consent using the contact details provided. Your data will be processed for as long as the corresponding consent remains in place. Withdrawing your consent does not affect the lawfulness of the processing carried out up to that point.

4. Service providers

(1) We use Klaviyo to send customer information and newsletters and integrate its components into our website. The provider is Klaviyo, Inc., 125 Summer St Floor 6, Boston, MA 02111, United States (hereinafter “Klaviyo”). Klaviyo provides marketing automation software for marketing services and products, including SEO and content creation, lead management, newsletters, email and SMS marketing, and web analytics.

(2) Klaviyo uses cookies and other browser technologies to analyze user behavior and identify users. This information is used, among other things, to compile reports on website activity and send customers personalized communications (e.g., reminders about incomplete purchases, information about products customers have viewed, etc.). In addition, Klaviyo is used to store and transmit data entered in forms using cookies, including your IP address. In this case, your data is transmitted to Klaviyo.

(3) The data you enter for the purpose of receiving the newsletter (e.g., email address) is stored on Klaviyo’s servers in the United States.

(4) The data you provide to us for the purpose of receiving the service will be stored by us until you unsubscribe from our service or from the service provider, and will be deleted from the distribution list after you unsubscribe. Data stored by us for other purposes remains unaffected.

(5) When you open an email sent with Klaviyo, a file contained in the email (known as a web beacon) connects to Klaviyo’s servers in the United States. This makes it possible to determine whether a newsletter message was opened and which links, if any, were clicked. Technical information is also collected (e.g., the time of retrieval, IP address, browser type, and operating system). This information cannot be attributed to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. Further information on data analysis by Klaviyo is available at: https://www.klaviyo.com/features/reporting Data transfers to the United States are based on the European Commission’s standard contractual clauses. Details can be found here: https://www.klaviyo.com/legal/dpa

(6) Data processing is carried out on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You may withdraw this consent at any time by unsubscribing from the newsletter. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.

(7) After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider on a blacklist if this is necessary to prevent future mailings. The data on the blacklist is used only for this purpose and is not merged with other data. This serves both your interests and our interest in complying with the statutory requirements for sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). Storage on the blacklist is not time-limited. You may object to the storage if your interests outweigh our legitimate interest. For more information, please refer to Klaviyo's privacy policy at https://www.klaviyo.com/legal/privacy-notice

(8) We have concluded a data processing agreement (DPA) pursuant to Art. 28 GDPR with the provider named above. This is a data protection agreement required by law, which ensures that the provider processes our website visitors' personal data only in accordance with our instructions and in compliance with the GDPR.

(9) This analytics tool is used on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website offering and its advertising. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG, insofar as the consent covers the storage of cookies or access to information in the user's terminal device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent may be withdrawn at any time.

5. Postal advertising

(1) We use your address in compliance with all statutory requirements to send postal advertising (direct mail).

(2) The legal basis for this is our legitimate interest in direct advertising pursuant to Art. 6 para. 1 lit. f in conjunction with Recital 47 GDPR. If we have obtained your express consent, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; consent given may be withdrawn at any time. Where applicable, more specific provisions may be communicated to you when the data is collected; in case of doubt, these provisions shall take precedence over this regulation.

(3) We will retain your address for as long as the purpose of data processing continues to exist. As soon as this purpose no longer applies, or you submit a legitimate request for erasure or withdraw your consent to postal advertising, your data will be deleted—unless there are other legally permissible reasons for continued storage (e.g., retention obligations under tax or commercial law). In this case, deletion will take place once these reasons no longer apply.

H. Review requests

(1)    If you have ordered a product from our shop, we will ask you by email and SMS about your satisfaction with your order and the products, unless you have previously objected. To send you this request, we use the email address and mobile phone number you provided. We also process your name, IP address, the IP geolocation used, and information about your order. The customer satisfaction survey and the data processing described above are based on the legal basis of Section 7 para. 3 UWG in conjunction with Art. 6 para. 1 lit. f) GDPR. This processing serves direct marketing.

(2)    You may object at any time to the processing and, in particular, the use of your email address and mobile phone number for this purpose pursuant to Art. 21 para. 2 GDPR by using the objection option in our emails or by emailing the address specified in our legal notice, without incurring any costs other than the transmission costs at the basic rates.

I.    Payment service providers

(1)    In the context of contractual and other legal relationships, due to statutory obligations, or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, for this purpose, use payment service providers in addition to banks and credit institutions (collectively, "payment service providers").

(2)    The data processed by the payment service providers includes master data, such as name and address; bank details, such as account numbers or credit card numbers; passwords, TANs and checksums; as well as contract-related, amount-related, and recipient-related information. This information is required to carry out the transactions. However, the data entered is processed and stored only by the payment service providers. In other words, we do not receive any account- or credit-card-related information, but only information confirming or rejecting the payment. Under certain circumstances, the payment service providers may transmit the data to credit reference agencies. This transmission serves to verify identity and creditworthiness. In this regard, we refer you to the payment service providers' terms and conditions and privacy notices.

(3)    For payment transactions, the terms and conditions and privacy notices of the respective payment service providers apply, which can be accessed on the respective websites or transaction applications. We also refer you to these for further information and for exercising rights of withdrawal, access, and other data subject rights.

J.    Payment service providers

(1)    For the purpose of delivering ordered goods, we work with logistics service providers/transport companies and/or shipping partners, to whom the following data is transmitted for the purpose of delivering the ordered goods or announcing the shipment: first name, last name, postal address, and, where applicable, email address and, where applicable, telephone number. The legal basis for processing is Art. 6 paragraph 1 letter b) GDPR.

K. Security

(1) We have implemented both technical and organizational measures to protect your personal data against loss, destruction, manipulation, or unauthorized access. All employees and service providers commissioned by us (processors) are required to comply with the applicable data protection regulations.

(2) Whenever we collect and process personal data, it is always transmitted in encrypted form. This ensures that misuse of your data by third parties is prevented. Our security measures are continuously being developed, and our privacy policies are also updated regularly. Please therefore ensure that you always use the current version.

IV.    Online presence on social media

(1)    Where you have given your consent to the respective social media operator pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, when you visit our online presences on our social media channels, your data is automatically collected and stored for market research and advertising purposes, from which usage profiles are created using pseudonyms. These may be used to display advertisements within and outside the platforms that are presumed to correspond to your interests. Cookies are generally used for this purpose. For detailed information on the processing and use of data by the respective social media operator, as well as contact options and your related rights and settings for protecting your privacy, please refer to the providers’ linked privacy notices on their websites. If you still need assistance in this regard, you can contact us.

V.    Data subject rights

(1)    You have the right at any time to access, correct, delete, or restrict the processing of your stored data, the right to object to processing, and the right to data portability and to lodge a complaint in accordance with the requirements of data protection law.
•    Right of access: You may request information from us about whether and to what extent we process your data.
•    Right to rectification: If we process your data, which is incomplete or inaccurate, you may request that we rectify or complete it at any time.
•    Right to erasure: You may request that we erase your data if we process it unlawfully or if the processing disproportionately infringes your legitimate interests worthy of protection. Please note that there may be reasons preventing immediate erasure, e.g. in the case of legally prescribed retention obligations. Regardless of whether you exercise your right to erasure, we will erase your data promptly and completely unless a contractual or statutory retention obligation prevents this. Right to restriction of processing: You may request that we restrict the processing of your data if you dispute the accuracy of the data, for a period enabling us to verify the accuracy of the data; the processing of the data is unlawful, but you refuse erasure and instead request restriction of data use; we no longer need the data for the intended purpose, but you still need it to assert or defend legal claims; or you have objected to the processing of the data.
•    Right to data portability: You may request that we provide you with the data you have provided to us in a structured, commonly used and machine-readable format and that you may transmit this data to another controller without hindrance from us, provided that we process this data on the basis of consent given by you, which may be withdrawn, or for the performance of a contract between us, and that this processing is carried out by automated means. Where technically feasible, you may request that we transmit your data directly to another controller.
•    Right to object: If we process your data on the basis of a legitimate interest, you may object to this data processing at any time; this would also apply to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the assertion, exercise or defense of legal claims. You may object to the processing of your data for the purpose of direct marketing at any time without stating reasons.
• Right to lodge a complaint: If you believe that we have violated German or European data protection law when processing your data, we ask you to contact us so that we can clarify any questions. You also, of course, have the right to contact the supervisory authority responsible for you, namely the relevant state data protection supervisory authority.

(2) If you wish to assert any of the aforementioned rights against us, please contact our Data Protection Officer. In cases of doubt, we may request additional information to confirm your identity.

VI. Changes to this Privacy Policy

(1) We reserve the right to amend this Privacy Policy if this becomes necessary due to the use of new technologies. Please ensure that you always review the latest version. If material changes are made to this Privacy Policy, we will inform you on our website.

(2) If you wish to exercise any of the rights set out in this statement against us, please contact our Data Protection Officer. In cases of doubt, we reserve the right to request additional information to verify your identity.

Behavior, Language, and Public Communication

The Creator undertakes to interact with Pammys and its employees, partners, customers, and other Creators respectfully, objectively, and appropriately. This applies in particular to communication within and outside the Pammys Affiliate Club, as well as to public statements on social media platforms and other communication channels.

Insulting, disrespectful, derogatory, defamatory, or business-damaging statements about Pammys, its employees, products, or business partners are not permitted. Also prohibited are deliberately inciting or provoking other Creators, fomenting conflicts within the community, knowingly spreading false information, and any other conduct that could significantly undermine trust in Pammys or cohesion within the Affiliate Program.

In the event of a breach of these provisions, Pammys is entitled to terminate its cooperation with the Creator with immediate effect and exclude the Creator from the Affiliate Program. In this case, any outstanding commissions may be forfeited in accordance with the applicable provisions of these Terms and Conditions and will not be paid out. Pammys’ further claims remain unaffected.