Privacy policy

1 Introduction and Contact Information of the Responsible Party

1.1 We are delighted that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data refers to all data that can be used to identify you personally.

1.2 The party responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Michels, Nora Maria – Witt, Svitlana GbR, Aachener Straße 93, 40223 Düsseldorf, Germany, Email: info@drinkandpaint.de. The responsible party for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the responsible party), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string “https://” and the lock symbol in your browser’s address bar.

2 Data Collection When Visiting Our Website

When you use our website for informational purposes only, i.e., if you do not register or otherwise transmit information to us, we only collect the data your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

Our visited website
Date and time of access
Amount of data sent in bytes
Source/referrer from which you accessed the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

3 Cookies

To make your visit to our website appealing and to enable the use of certain features, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called “session cookies”), while others remain on your device longer and allow your site settings to be saved (so-called “persistent cookies”). For the latter, you can find the storage duration in your web browser’s cookie settings overview.

If any of the cookies we use also process personal data, this processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR either for the performance of a contract, in accordance with Art. 6 para. 1 lit. a GDPR if consent has been given, or in accordance with Art. 6 para. 1 lit. f GDPR to protect our legitimate interests in the best possible functionality of the website as well as a customer-friendly and efficient design of your visit to our site.

You can configure your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or you can exclude the acceptance of cookies for certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

4 Contacting Us

When you contact us (e.g., via contact form or email), personal data is processed solely for the purpose of handling and responding to your inquiry and only to the extent necessary for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Art. 6 para. 1 lit. f GDPR. If your contact aims at concluding a contract, then an additional legal basis for processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been fully clarified and provided there are no statutory retention obligations to the contrary.

5 Data Processing When Opening a Customer Account

In accordance with Art. 6 para. 1 lit. b GDPR, personal data is collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required for opening the account can be found in the input form on our website.

You can delete your customer account at any time by sending a message to the above-mentioned address of the controller. After your customer account is deleted, your data will be deleted as long as all contracts concluded through it have been fully processed, there are no statutory retention periods, and we have no legitimate interest in further storage.

6 Use of Customer Data for Direct Advertising

6.1 Subscribing to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure to ensure that you only receive newsletters after you have expressly confirmed your consent to receive them by clicking a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR. We store your IP address as provided by your Internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later point. The data we collect during newsletter registration is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller mentioned at the beginning. After you unsubscribe, your email address will be promptly deleted from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this, which is permitted by law and about which we inform you in this statement.

6.2 Shopify Email

Our email newsletters are sent via the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc., or Shopify (USA) Inc.

Based on our legitimate interest in effective and user-friendly newsletter marketing, we forward the data you provided when signing up for the newsletter to this provider in accordance with Art. 6 para. 1 lit. f GDPR, so that they can send the newsletter on our behalf.

Subject to your express consent in accordance with Art. 6 para. 1 lit. a GDPR, the provider also conducts statistical analysis of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure open rates and specific interactions with the newsletter content. Device information (e.g., time of access, IP address, browser type, and operating system) is also collected and analyzed, but not merged with other data sets.
You may revoke your consent to newsletter tracking at any time with effect for the future.

We have entered into a data processing agreement with the provider, which protects the data of our website visitors and prohibits disclosure to third parties.

When data is transferred to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

6.3 If you abandon your purchase with us before completing the order, you have the option to receive a one-time reminder by email about the contents of your virtual shopping cart.
The only required information for sending this reminder is your email address. Providing additional data is voluntary and may be used to address you personally. We use the so-called double opt-in procedure for sending emails, which ensures that you only receive a notification after you have expressly confirmed your consent by clicking a verification link sent to the provided email address.

By activating the confirmation link, you grant us your consent to use your personal data in accordance with Art. 6 para. 1 lit. a GDPR for sending a cart reminder. In this process, we store the IP address entered by your Internet Service Provider (ISP) as well as the date and time of registration, to be able to trace any possible misuse of your email address at a later time. The data we collect during registration for our email notification service is used strictly for its intended purpose.

You can unsubscribe from cart reminders at any time by sending a corresponding message to the contact person named above. After you unsubscribe, your email address will be promptly removed from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to further data use that is legally permitted and about which we inform you in this statement.

7 Data Processing for Order Fulfillment

7.1 To the extent necessary for contract processing for delivery and payment purposes, the personal data we collect is forwarded in accordance with Art. 6 para. 1 lit. b GDPR to the contracted shipping company and the contracted financial institution.

If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we will process the contact details you provided when placing your order (name, address, email address) in order to personally inform you about upcoming updates within the legally prescribed period through appropriate communication channels (such as by mail or email) in accordance with our legal information obligations under Art. 6 para. 1 lit. c GDPR. Your contact data will be used strictly for notifications about updates owed by us and will only be processed by us for this purpose to the extent necessary for the respective information.

To process your order, we also work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

7.2 Use of Payment Service Providers

- Apple Pay

If you choose the payment method "Apple Pay" from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment processing is carried out via the "Apple Pay" feature on your device running iOS, watchOS, or macOS by charging a payment card stored in "Apple Pay." Apple Pay uses security features built into the hardware and software of your device to protect your transactions. To authorize a payment, you must enter a code you previously set and verify via the "Face ID" or "Touch ID" feature on your device.

For the purpose of payment processing, the information you provide during the order process, along with details about your order, will be forwarded to Apple in encrypted form. Apple then encrypts this data again with a developer-specific key before transmitting it to the payment service provider of the payment card stored in Apple Pay to complete the transaction. Encryption ensures that only the website where the purchase was made can access the payment data. After the payment is completed, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm the successful payment.

If personal data is processed in the course of the described transmissions, processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.

Apple stores anonymized transaction data, including the approximate purchase amount, approximate date and time, and whether the transaction was successfully completed. Anonymization fully excludes any personal reference. Apple uses the anonymized data to improve "Apple Pay" and other Apple products and services.

If you use Apple Pay on your iPhone or Apple Watch to complete a purchase you made via Safari on your Mac, your Mac and the authorizing device communicate via an encrypted channel on Apple servers. Apple does not process or store any of this information in a format that can identify you. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to "Wallet & Apple Pay," and turn off "Allow Payments on Mac."

For further information on privacy with Apple Pay, please visit the following website: https://support.apple.com/de-de/HT203027
- Google Pay

If you choose the payment method "Google Pay" from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment processing is carried out via the "Google Pay" app on your mobile device running at least Android 4.4 ("KitKat") and equipped with NFC, by charging a payment card stored in Google Pay or another verified payment system (e.g., PayPal). To authorize a Google Pay payment over €25, you must first unlock your mobile device using the verification method you have set up (such as facial recognition, password, fingerprint, or pattern).

For the purpose of payment processing, the information you provide during the order process, along with details about your order, will be forwarded to Google. Google then transmits your payment information stored in Google Pay to the originating website in the form of a one-time transaction number, which verifies the payment. This transaction number contains no information about the actual payment data for your stored payment methods, but is generated and transmitted as a one-time valid numeric token. For all transactions via Google Pay, Google acts only as an intermediary to process the payment. The transaction itself is carried out solely between the user and the originating website by charging the payment method stored in Google Pay.

If personal data is processed in the course of the described transmissions, processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.

Google reserves the right to collect, store, and evaluate certain transaction-specific information for every transaction made via Google Pay. This includes the date, time, and amount of the transaction, merchant location and description, a description of the goods or services purchased provided by the merchant, photos you have attached to the transaction, the name and email address of the seller and buyer or sender and recipient, the payment method used, your description of the reason for the transaction, and, if applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively in accordance with Art. 6(1)(f) GDPR based on the legitimate interest in proper accounting, verification of transaction data, and optimization and maintenance of the Google Pay service.

Google also reserves the right to combine the processed transaction data with other information collected and stored when using other Google services.

You can find the Google Pay Terms of Service here:

https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de
For further information on data protection with Google Pay, please visit the following website:
https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
- Klarna

One or more online payment methods from the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method from this provider that requires you to pay in advance (such as credit card payment), the payment details you provided during the order process (including name, address, bank and card information, currency, and transaction number) as well as information about your order will be shared with the provider in accordance with Art. 6 (1) lit. b GDPR. Your data will only be shared for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method where the provider pays in advance (such as purchase on account, installment purchase, or direct debit), you will also be asked to provide certain personal information (first and last name, street, house number, postal code, city, date of birth, email address, phone number, and, if applicable, data for an alternative payment method) during the order process.

To protect our legitimate interest in assessing the creditworthiness of our customers, we will forward this data to the provider for the purpose of a credit check in accordance with Art. 6 (1) lit. f GDPR. The provider will use the personal data you provide, as well as other data (such as shopping cart, invoice amount, order history, payment experience), to determine whether the payment option you have chosen can be granted with regard to payment and/or default risks.

When deciding as part of the application review, the provider may, in accordance with Art. 6 (1) lit. f GDPR, also include identity and credit information from the following credit agencies, in addition to internal provider criteria:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical process. Address data, among other things, but not exclusively, is included in the calculation of the score values.

You may object to this processing of your data at any time by notifying us or the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
- Paypal

One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

One or more online payment methods from the following provider are available on this website: SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany

8 Online Marketing

Facebook Pixel for creating Custom Audiences with advanced data matching (with cookie consent tool)

Within our online offering, we use the "Facebook Pixel" service from the following provider in advanced data matching mode: Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland ("Facebook")

When a user clicks on one of our ads placed on Facebook, the URL of our linked page is extended with a parameter using "Facebook Pixel." This URL parameter is then entered into the user's browser after redirection via a cookie set by our linked page itself. In addition, this cookie captures specific customer data, such as the email address that we collect on our website linked to the Facebook ad during processes like purchases, account logins, or registrations (advanced data matching). The cookie is then read and enables the transmission of the data, including specific customer data, to Facebook.

We use "Facebook Pixel" with advanced data matching to make our Facebook ads more effective and to ensure that they match users' interests or exhibit certain characteristics (such as interest in specific topics or products, determined based on the websites visited), which we transmit to Facebook (so-called "Custom Audiences").

We also analyze the effectiveness of our ads by tracking whether users are redirected to our website after clicking on an ad (conversion). Compared to the standard version of "Facebook Pixel," the advanced data matching feature helps us better measure the effectiveness of our ad campaigns by capturing more attributed conversions.

All transmitted data is stored and processed by Facebook, allowing it to be linked to the respective user profile, and Facebook may use the data for its own advertising purposes. The data may enable Facebook and its partners to display ads both on and off Facebook.

All of the processing described above, especially the setting of cookies to read information on the device used, will only take place if you have given us your explicit consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website.

We have entered into a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

The information generated by Facebook is generally transferred to a Facebook server and stored there; in this context, it may also be transferred to servers of Meta Platforms Inc. in the USA.

For the transfer of data to the USA, the provider relies on the European Commission's standard contractual clauses, which are intended to ensure compliance with the European level of data protection.

9 Rights of the Data Subject

9.1 The applicable data protection law grants you the following rights as a data subject with respect to the processing of your personal data by the controller (rights to information and intervention), with reference to the legal basis cited for the respective exercise requirements:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent given pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

9.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTERESTS AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA IN QUESTION. HOWEVER, FURTHER PROCESSING MAY BE RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE RELEVANT DATA FOR DIRECT MARKETING PURPOSES.

10 Duration of storage of personal data

The length of time personal data is stored depends on the applicable legal basis, the purpose of processing, and—if relevant—also on the respective statutory retention period (e.g. commercial and tax law retention periods).

If personal data is processed on the basis of explicit consent pursuant to Art. 6 (1) (a) GDPR, the data concerned will be stored until you revoke your consent.

If there are statutory retention periods for data processed under contractual or quasi-contractual obligations based on Art. 6 (1) (b) GDPR, such data will be routinely deleted after the retention periods expire, provided it is no longer required for contract fulfillment or initiation and/or we no longer have a legitimate interest in further storage.

If personal data is processed on the basis of Art. 6 (1) (f) GDPR, this data will be stored until you exercise your right to object under Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defense of legal claims.

If personal data is processed for direct marketing purposes on the basis of Art. 6 (1) (f) GDPR, this data will be stored until you exercise your right to object under Art. 21 (2) GDPR.

Unless otherwise specified in the additional information in this statement regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.