Privacy Policy

Collection, Processing, and Use of Your Personal Data

1. Name and Contact Details of the Data Controller

This privacy notice applies to the processing of data by:
Data controller: IwonaTEC GmbH (hereinafter: IwonaTEC)
Address: Gladbacher Str. 69, 52525 Heinsberg, Germany
Email: info@iwonatec.com
Phone: +49 (0) 2452 97708-0
Fax: +49 (0) 2452 97708-29
Commercial register: HRB 14722 (Aachen Local Court)
VAT ID: DE259071133
Management: Iwona Ptaszynska

2. Collection and Storage of Personal Data, and the Nature and Purpose of Its Use, When Simply Visiting Our Website

When you access our website www.iwonatec.com, the browser used on your device automatically sends information to our website's server. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and is stored until it is automatically deleted:

IP address of the requesting computer,
Date and time of access,
Name and URL of the file retrieved,
Website from which access was made (referrer URL),
Browser used and, where applicable, the operating system of your computer, as well as the name of your access provider.

We process the data listed above for the following purposes:

Ensuring a smooth connection to the website,
Ensuring convenient use of our website,
Evaluating system security and stability, and
Other administrative purposes.

The legal basis for this data processing is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes for data collection listed above. Under no circumstances do we use the data collected to draw conclusions about you personally.

In addition, we use cookies and analytics services when you visit our website. Further explanations can be found in sections 8 and 9 of this privacy policy.

3. Collection and Storage of Personal Data, and the Nature and Purpose of Its Use, Upon Registration

Upon registration, we store the information set out in section 2 above, as well as, in addition:

Date and time of registration
Email address
Password

We also store our terms and conditions as in effect at that time. Our registration form is encrypted so that the data entered there cannot be viewed by third parties. You may change your registration data at any time.

We store this data in order to provide you with the ability to place orders and to access your order data at any time. Your order data comprises: your orders, your account details, your address book, your password, your newsletter subscription, your user data, and your reviews.

This data processing takes place at your request and is necessary, pursuant to Art. 6(1)(b) GDPR, for the purposes stated for the proper handling of your orders and subscriptions and for the mutual performance of obligations arising from the order contracts.

After registering, you can complete your customer account. In that case, in addition to the data already mentioned under 1. and your email address and password, we also store the data you voluntarily provide regarding:

Telephone number
Address, place of residence, place of work
Postal address

If you have entered into a contract with us for the order of goods, the duration for which your data is stored is governed by the provisions below under 4. – Online Order. If you have not placed an order, we store your registration data for a reasonable period during which an order can be expected to follow the registration, but for no longer than three months.

4. Collection and Storage of Personal Data, and the Nature and Purpose of Its Use, for Online Orders

An online order can only be placed by someone who has completed the registration process. We therefore store the information set out under 2. and 3. above. Our order form is encrypted so that the data entered there cannot be viewed by third parties. When you place an order, we collect the following additional information:

Title, first name, last name,
Email address
Address
Telephone number (if provided)
Date and time of the order
Goods ordered
Account details
Payment method details

We also store the text of the contract and our terms and conditions as in effect at the time the contract was concluded.
This data is collected:

to identify you as our customer,
to deliver the ordered goods to you and to perform the contract,
for invoicing purposes,
to process payment claims and to assert any other claims against you,
to correspond with you.

This data processing takes place at your request and is necessary, pursuant to Art. 6(1)(b) GDPR, for the purposes stated, for the mutual performance of obligations arising from the purchase contract. The personal data collected by us for the processing of the purchase contract is stored until expiry of the statutory limitation period (3 years from the end of the calendar year in which the claim arose and in which the creditor obtained knowledge, or ought to have obtained knowledge without gross negligence, of the circumstances giving rise to the claim and of the identity of the debtor, § 199(1) of the German Civil Code (BGB)), and is then deleted, unless we are obliged, pursuant to Art. 6(1)(c) GDPR, to retain it for longer due to tax- and commercial-law retention and documentation obligations (arising from the German Commercial Code (HGB), the German Criminal Code (StGB), or the German Fiscal Code (AO)), or unless you have consented to further storage pursuant to Art. 6(1)(a) GDPR.

5. Collection and Storage of Personal Data, and the Nature and Purpose of Its Use, for Registration for Our Newsletter

Where you have expressly consented pursuant to Art. 6(1)(a) GDPR, we use your email address to send you our newsletter on a regular basis. Providing an email address is sufficient to receive the newsletter. You can unsubscribe at any time, for example via a link at the end of each newsletter. Alternatively, you may send your request to unsubscribe by email at any time to info@iwonatec.com.

6. Collection and Storage of Personal Data, and the Nature and Purpose of Its Use, When Using Our Contact Form

For any questions you may have, we offer you the option of contacting us via a form provided on our website. For this purpose, you must provide your name and a valid email address so that we know who is making the enquiry and can respond to it. Any further information is provided voluntarily. The processing of data for the purpose of contacting us is carried out pursuant to Art. 6(1)(a) GDPR, on the basis of your voluntarily given consent. The personal data collected by us for the use of the contact form is automatically deleted once your enquiry has been dealt with. Our contact form is encrypted so that the data entered there cannot be viewed by third parties.

7. Disclosure of Data

Your personal data is not transferred to third parties for purposes other than those set out below.
We only pass your personal data on to third parties if:

this is legally permissible and, pursuant to Art. 6(1)(b) GDPR, necessary for the performance of contractual relationships with you. We use the data you have provided:
to fulfil and process your order,
your data is passed on to the shipping company commissioned with delivery, insofar as this is necessary for the delivery of the goods,
to process payments, we may pass your payment data on to our bank;
the disclosure is necessary, pursuant to Art. 6(1)(f) GDPR, for the assertion, exercise, or defense of legal claims, and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
there is a legal obligation to disclose the data pursuant to Art. 6(1)(c) GDPR, and
you have given your express consent pursuant to Art. 6(1)(a) GDPR, for example when applying for an instalment purchase (instalment payment transaction). In the case of an instalment payment transaction, by submitting the application you consent to the transfer of your data to PayPal for a credit check. For the purpose of this credit check, the data collected from you for this purpose – first and last name, street, house number, postal code, city, date of birth, telephone number, as well as data relating to your order – is stored, processed, and used to the extent legally permissible. You consent to this data being transferred to PayPal for the purpose of the credit check.

Your data is not otherwise passed on to any other third parties or used for advertising purposes beyond a newsletter you have consented to. Where we have passed on your data to third parties as described above, such third parties have been carefully selected and instructed by us, are bound by our instructions, and are regularly monitored.

Where our service providers or partners are based in a country outside the European Economic Area (EEA), we will inform you of the consequences of this circumstance in the description of the offer. We only transfer your data to a service provider or partner outside the EEA if the delivery location you specified in your order is outside the EEA. We transfer your data to service providers or partners outside the EEA where an adequacy decision of the Commission exists for the relevant country. In the case of a transfer pursuant to Art. 46, Art. 47, or Art. 49(1) subparagraph 2 GDPR, we will inform you
of the consequences of this circumstance in the offer. Adequacy decisions of the Commission exist for the following countries: Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay, USA (limited to the Privacy Shield framework). Further information from the Commission on its adequacy decisions can be found at:
https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_de

Further information and explanations on the EU-US Privacy Shield can be found at:

https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_de

8. Cookies

We use cookies to design our website according to your needs and to optimize it. Cookies are small text files that are stored on your hard drive and associated with the browser you use. Cookies cannot run programs or transmit viruses to your computer. They serve to make the internet offering as a whole more user-friendly and effective.

We use the following types of cookies, the scope and functioning of which are explained below:
– Transient cookies (see a)
– Persistent cookies (see b).

a) Transient cookies are automatically deleted when you close your browser. These include, in particular, session cookies. These store a so-called session ID, which can be used to assign various requests from your browser to the shared session. This allows your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close your browser.

b) Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can delete the cookies at any time in your browser's security settings.

You can configure your browser settings as you wish and, for example, refuse to accept third-party cookies or all cookies. We would like to point out that you may then not be able to use all functions of this website.

We use cookies to be able to identify you on subsequent visits.

The data processed by cookies is necessary for the aforementioned purposes to safeguard our legitimate interests and those of third parties pursuant to Art. 6(1)(f) GDPR.

9. Analytics Tools

Tracking tools
The tracking measures listed below and used by us are carried out on the basis of Art. 6(1)(f) GDPR. With the tracking measures used, we aim to ensure that our website is designed to meet your needs and is continuously optimized. In addition, we use tracking measures to statistically record the use of our website and evaluate it for the purpose of optimizing our offering for you. These interests are to be regarded as legitimate within the meaning of the aforementioned provision. The respective data processing purposes and categories of data can be found in the relevant tracking tools.

(1) Google Analytics
For the purpose of designing and continuously optimizing our pages according to your needs, we use Google Analytics, a web analytics service provided by Google Inc. (https://www.google.de/intl/de/about/) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter "Google"). In this context, pseudonymized usage profiles are created and cookies are used (see section 8). The information generated by the cookie about your use of this website, such as

Browser type/version
Operating system used,
Referrer URL (the previously visited page),
Host name of the accessing computer (IP address),
Time of the server request,

is transmitted to and stored on a Google server in the USA. This information is used to evaluate use of the website, to compile reports on website activity, and to provide further services related to website and internet usage for the purposes of market research and the needs-based design of these websites. This information may also be transferred to third parties where this is required by law or where third parties process this data on our behalf. Under no circumstances will your IP address be merged with other data held by Google. IP addresses are anonymized so that assignment is not possible (IP masking). You can prevent the installation of cookies by adjusting your browser software settings accordingly; however, we would like to point out that in this case you may not be able to use all functions of this website to their full extent. In addition, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address), as well as the processing of this data by Google, by downloading and installing a browser add-on (https://tools.google.com/dlpage/gaoptout?hl=de). As an alternative to the browser add-on, particularly for browsers on mobile devices, you can also prevent collection by Google Analytics by clicking on this link. An opt-out cookie will be set, which prevents the future collection of your data when visiting this website. The opt-out cookie only applies to this browser and only for our website, and is stored on your device. If you delete the cookies in this browser, you will need to set the opt-out cookie again. Further information on data protection in connection with Google Analytics can be found, for example, in the Google Analytics help pages (https://support.google.com/analytics/answer/6004245?hl=de).

(2) Trustpilot Tracker

We use a tracker from Trustpilot A/S, Pilestraede 58,5, 1112 Copenhagen, Denmark, support@trustpilot.com, on our website.
Trustpilot's privacy information can be found at https://legal.trustpilot.com/end-user-privacy-terms

10. Rights of Data Subjects

You have the right:

pursuant to Art. 15 GDPR, to request information about your personal data processed by us. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing, or objection, the existence of a right to lodge a complaint with a supervisory authority, the origin of your data if it was not collected by us, and the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR, and, at least in these cases, meaningful information about the logic involved as well as the significance and envisaged consequences of such processing for the data subject. You are entitled to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you may request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer;
pursuant to Art. 16 GDPR, to request the immediate rectification of inaccurate data or the completion of your personal data stored by us;
pursuant to Art. 17 GDPR, to request the erasure of your personal data stored by us in the following cases:
the personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
you withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
you object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
the personal data concerning you has been processed unlawfully.
the erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union or Member State law to which the controller is subject;
the personal data concerning you was collected in relation to the offer of information society services referred to in Art. 8(1) GDPR;

Where the controller has made the personal data concerning you public and is obliged, pursuant to Art. 17(1) GDPR, to erase it, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of any links to, or copies or replications of, that personal data.
The right to erasure does not apply insofar as processing is necessary

to exercise the right of freedom of expression and information;
to comply with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i), as well as Art. 9(3) GDPR;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to above is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the assertion, exercise, or defense of legal claims.
pursuant to Art. 18 GDPR, you may request the restriction of the processing of your personal data if
you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
the controller no longer needs the personal data for the purposes of processing, but you require it for the assertion, exercise, or defense of legal claims; or
you have objected to the processing pursuant to Art. 21(1) GDPR, pending verification as to whether the controller's legitimate grounds override your own.

Where the processing of personal data concerning you has been restricted, such data may, with the exception of storage, only be processed with your consent or for the assertion, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been limited in accordance with the above requirements, you will be informed by the controller before the restriction is lifted;

pursuant to Art. 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller. You also have the right to have this data transmitted directly by one controller to another, without hindrance from the controller to whom the personal data was provided, insofar as
the processing is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, or on a contract pursuant to Art. 6(1)(b) GDPR, and
the processing is carried out by automated means.

In exercising this right, you further have the right to have personal data concerning you transmitted directly from one controller to another, insofar as this is technically feasible. This shall not adversely affect the freedoms and rights of other persons. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

pursuant to Art. 7(3) GDPR, to withdraw your consent, once given, to us at any time. This means that we may no longer continue, for the future, any data processing based on that consent; and
pursuant to Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority of your habitual place of residence, place of work, or of our company's registered office.

11. Right to Object

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing of your personal data on grounds relating to your particular situation, or where the objection relates to direct marketing. In the latter case, you have a general right to object, which we will implement without your needing to state a particular situation. If you wish to exercise your right of withdrawal or objection, an email to info@iwonatec.com is sufficient.
Of course, you may object at any time to the processing of your personal data for the purposes of advertising and data analysis. You can inform us of your objection to advertising at the email address given above.

12. Data Security

We use the widely used SSL procedure when you visit our website. You can tell whether an individual page of our website is transmitted in encrypted form by the closed display of the key or padlock symbol in the lower status bar of your browser. Furthermore, we use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or total loss, destruction, or unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

13. Currency and Amendment of This Privacy Policy

This privacy policy is currently valid and dated May 2018. It may become necessary to amend this privacy policy as we further develop our website and offerings, or due to changes in legal or regulatory requirements. The current version of this privacy policy can be accessed and printed at any time on the website under Privacy Policy.