1. Data protection at a glance

General notes

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. For detailed information, see the sections of this privacy statement below.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator (responsible person):

BOAS GmbH
Humboldtstrasse 62
93053 Regensburg
germany
Web sites: www.dannerflemming.de · shop.dannerflemming.de
Email: shop@dannerflemming.de

How do we collect your information?

  • Straight from you (e.g. entries in the contact form, newsletter subscription, orders without a customer account).
  • Automatically or with consent when you visit the website through our IT systems (e.g. technical data, cookies, comparable technologies). The collection starts automatically as soon as you enter this website.
  • From service providers (e.g. payment services, hosting/shop platforms) to provide individual functions.

What do we use your data for?

Some of the data is collected to ensure error-free provision of the website. Other data can be used to analyze your user behavior. If orders are processed via the website, we also process transmitted data to process the contract (without a customer account).

What are your rights with regard to your data?

You have the right to receive information about the origin, recipient and purpose of your stored personal data free of charge at any time. You also have the right to request that this data be corrected or deleted. If you have given your consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of processing and to object to certain processing operations. You also have the right to lodge a complaint with the competent supervisory authority. Details can be found below in Section 8.

Analytical and third-party tools

When you visit this website, your surfing behavior can be statistically evaluated. This is done primarily with analysis programs. Detailed information about this can be found in Section 4.3 (Google Analytics).

2nd hosting

Webflow

We host the content of this website at Webflow (Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA). When you visit our pages, Webflow processes in particular technical log data such as IP address, time of access, requested content/URLs, referrer, and browser and device characteristics. As far as necessary for delivery and security, absolutely necessary cookies or comparable technologies are used for this purpose. The processing is used for reliable presentation, delivery of content, stability and IT security of the website. The legal basis is Art. 6 para. 1 lit. f DSGVO; insofar as consent is required for non-essential terminal access (e.g. cookies/device fingerprinting), we also process your data on the basis of Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG. A transfer to the USA may take place; Webflow uses, among other things, the EU standard contractual clauses and is subject to EU-U.S. Data Privacy Framework (DPF) certified. There is an order processing contract with Webflow.

3. General information and mandatory information

Data protection

We treat your personal data confidentially and in accordance with legal data protection regulations and this privacy policy. When using this website, various personal data are processed. This statement explains what data we collect, what we use it for and on what basis this is done.

Note on the responsible body

The responsible body is the above-mentioned BOAS GmbH. The responsible body is the natural or legal person who, alone or together with others, decides on the purposes and means of processing personal data.

Storage period

Unless a specific storage period has been specified in this statement, your personal data will remain with us until the purpose for data processing no longer applies. If there are legal storage periods (e.g. commercial/tax law), we delete the data after these periods have expired. If processing is based on consent, we delete it after revocation, unless there are other legal grounds to the contrary.

Legal basis for processing on this website

  • consent (Art. 6 para. 1 lit. a DSGVO; for special data categories, Art. 9 para. 2 lit. a GDPR). With express consent to third-country transfers, in addition Art. 49 para. 1 lit. a GDPR. Section 25 (1) applies to device accesses (e.g. cookies) TDDDG.
  • Contract/preliminary contract (Art. 6 para. 1 lit. b DSGVO), for example for orders or inquiries.
  • Legal obligation (Art. 6 para. 1 lit. c GDPR).
  • Legitimate interest (Art. 6 para. 1 lit. f GDPR).
    The relevant sections of this declaration provide information on the relevant principles in individual cases.

Recipients of personal data

We work with various external parties (e.g. hosting, payment services, shop functions, newsletter delivery). Personal data will only be transferred if there is a legal basis (e.g. contract fulfilment, consent, legal obligation, legitimate interest). There are AVVs with contract processors; in the event of joint responsibility, appropriate agreements are concluded.

Withdrawal of your consent to data processing

Many processing operations are only possible with your express consent. You can withdraw your consent at any time with effect for the future. The lawfulness of the processing carried out up to the time of revocation remains unaffected.

Right to object (Art. 21 GDPR)

For reasons arising from your particular situation, you have the right to object at any time to processing based on Article 6 (1) (e) or (f) GDPR; this also applies to profiling. If personal data is processed for direct marketing, you have the right to object to processing for the purpose of such advertising at any time.

SSL/TLS encryption

This site uses SSL/TLS encryption for security reasons and to protect the transmission of sensitive content. You can recognize an encrypted connection by “https://” and the lock icon in the browser.

4. Data collection on this website

4.1 Cookies

Our websites use cookies, i.e. small text files which, depending on the type, are only stored on your device for the duration of a session or permanently; some of them come from third parties. Necessary cookies enable basic functions such as secure page display, shopping cart/checkout or form protection. In addition, convenience, statistical or marketing cookies may be used — with your consent. The legal basis for necessary cookies is Art. 6 para. 1 lit. f DSGVO; for optional cookies, Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 applies TDDDG. You can manage cookies in your browser (e.g. have them informed, allow/reject them in individual cases, activate automatic deletion) and control optional categories at any time via our consent banner.

4.2 Server log files (informational use)

With pure informational use of our website — i.e. if you do not actively submit any information to us — our server or hosting system automatically processes personal and technical data to ensure the stability and security of the website. This is our legitimate interest (Art. 6 (1) (f) GDPR). In particular, the following are covered: IP address, Date and time of request, Time zone difference to GMT, Content of the request/requested page, Access status/HTTP status code, Each amount of data transferred, Website/referrer from which the request comes, browsers, Operating system and its interface as well as language and version of the browser software. This information is also included in log files saved and — if no longer required — deleted after 14 days at the latest. There is no merging with other data sources.

4.3 Google Analytics (GA4)

We set Google Analytics 4 of the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze the use of our website. Google processes the resulting usage data on our behalf. When you visit our pages, page views and interactions (e.g. clicks, scroll behavior, length of stay), approximate location (country/city), an abbreviated IP address, technical information about the browser and device, and the source of origin (referrer/campaigns) may be recorded. Processing is only carried out with your consent (Art. 6 para. 1 lit. a DSGVO; terminal access in accordance with § 25 para. 1 TDDDG). A transfer to the USA may take place for support purposes; this includes EU standard contractual clauses and — where applicable — certifications under the EU-U.S. DPF. User-related data is usually processed after 14 months deleted; aggregated evaluations may be available for a longer period of time. You can withdraw your consent at any time via the consent banner; Google optionally provides a browser add-on for deactivation.

4.4 Request via email, telephone or contact form

When you contact us, we process the information you provide (e.g. name, contact details, content of your message and, if applicable, metadata and file attachments) to process your request and communicate with you. Insofar as your request is related to a contract or serves to initiate it, the legal basis is Art. 6 para. 1 lit. b GDPR; otherwise, we process your data on the basis of our legitimate interest in efficient communication (Art. 6 para. 1 lit. f DSGVO) or on the basis of your consent (Art. 6 para. 1 lit. a GDPR), provided that we obtain it. We will delete the data as soon as your request has been resolved, unless this is precluded by legal storage obligations. To protect our forms from abusive automated use, we use Google reCAPTCHA one (provider: Google Ireland Limited; access by Google LLC, USA, if applicable). Depending on the configuration, processing is based on our legitimate interest in preventing misuse (Art. 6 para. 1 lit. f DSGVO) or on your consent to the required terminal device access (Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG), unless the use is absolutely necessary from a technical point of view. Transfer to the USA is possible; Google uses, among other things, EU standard contractual clauses and — where applicable — the EU-U.S. DPF.

5th newsletter (Shopify Email)

We send out our newsletters via Shopify Email. When signing up, we use the Double‑Opt‑In, log the time of registration and confirmation, the IP address and the consent text and can — if you agree — evaluate interactions such as openings and clicks to improve our content. The legal basis for sending is your consent (Art. 6 para. 1 lit. a DSGVO in conjunction with § 7 UWG). The recipient of order processing is Shopify (Shopify International Ltd. and affiliated companies). Transfers to third countries (e.g. Canada/USA) are possible and are secured in particular by EU standard contractual clauses and — where applicable — certifications in accordance with the EU-U.S. DPF. You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every email. We store login data until revocation and log the double opt‑in up to three years for verification purposes.

6. e‑commerce features — without customer account

Orders are placed on our website without customer account processed as a guest checkout. Depending on the process, we process in particular master and address data, order and billing information, payment and shipping information, communication and technical transaction data. The processing is used to process and process your order, to organize shipping and customer communication, as well as to prevent fraud and IT security (Art. 6 para. 1 lit. b, lit. c and lit. f GDPR). We generally store data relevant to tax and commercial law six to ten years.

Shopify (shop features). For shopping cart, checkout and other shop functions, we use Shopify one. Shopify processes the data required for this to operate the shop infrastructure and to provide the contractually owed services on our behalf; in some cases — depending on the process, for example in the case of payments or fraud checks — the Shopify Group can process itself. Submissions in third countries (in particular Canada/USA) are possible and are used in particular via EU standard contractual clauses and — where applicable — certifications in accordance with EU-U.S. Data Privacy Framework (DPF) secured.

Smootify (integration). The technical integration of Shopify features into our Webflow website is carried out via Smootify. Smootify processes the data required for integration and presentation (e.g. technically necessary usage/transaction data) in our mission. Insofar as Smootify in turn uses services on the Shopify platform, the above notes on international transfers apply accordingly.

payments. We use the following services to process payments; the providers' respective privacy policies apply (depending on the service, independent processing — e.g. identity/credit checks and transfers to third countries such as Canada/USA — is possible and is provided with appropriate guarantees such as EU standard contractual clauses and possibly DPF secured):

  • PayPal (Europe) S.à r.l. et Cie, S.C.A. — Payment processing; fraud/risk assessments, if applicable.
  • Klarna Bank AB (publ) — Payment processing; identity and credit check, if applicable.
  • Shop Pay/Shopify Payments — Payment processing via Shopify Group companies.

Recipients as part of order processing are also our hosting provider Webflow as well as the shipping service provider DHL; contracted tax advisors can process legally required billing data.

7. External content & links from third parties

This website may include content and features from external providers (e.g. fonts, maps, videos, support/chat widgets). If activated/consented, the provider can process its own data (including IP address, device information). Only their operators are responsible for the content, security and data protection practices of linked third-party sites.

8. Your rights

Within the framework of legal requirements, you have the following rights: Information (Art. 15 GDPR), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and revocation of consents granted (Art. 7 para. 3). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77). To exercise your rights, please contact us using the contact details above.

9. International data transfers

Insofar as data is transferred to third countries (outside the EU/EEA), this is done in compliance with Art. 44 et seq. of the GDPR (e.g. EU standard contractual clauses). Where available, providers also rely on certifications in accordance with EU-U.S. Data Privacy Framework (DPF). We take additional technical and organizational protective measures.

10. Changes to this privacy statement

We reserve the right to adapt this privacy policy as soon as changes in our processing or the legal situation make this necessary. The latest version can be found on this page.