Privacy policy

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

Lukas Vidrago Nell
Bebelplatz 12
50679 Cologne
Germany

Email: support@vidragold.de
Phone: 0157 32487542

2. General Information on Data Processing

We are pleased that you are interested in our online shop.

The protection of your personal data is important to us. Below, we inform you about which personal data we process when you use our online shop, for which purposes this is done, the legal basis for the processing, to whom data may be disclosed, and which rights you have.

Personal data means any information relating to an identified or identifiable natural person.

3. Visiting Our Website and Hosting

3.1 Server Log Files

When you access our website, the technical systems we use automatically process information transmitted by your browser to the server.

This may include, in particular:

  • IP address,

  • date and time of access,

  • pages and files accessed,

  • referrer URL,

  • browser used and browser version,

  • operating system used,

  • amount of data transferred,

  • technical status information.

The processing is carried out to ensure the secure and stable operation of our online shop, to identify technical errors, and to ensure the security of our systems.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and technically proper provision of our online shop.

The data will be deleted as soon as it is no longer required for the purposes stated above, unless statutory retention obligations or the assertion, exercise, or defence of legal claims require longer storage.

3.2 Hosting and Technical Provision

Our online shop is technically provided by an external service provider.

Insofar as personal data is processed as part of the hosting services, this is carried out for the technical provision, security, and operation of our online shop.

Insofar as the service provider used processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

4. Data Processing When Placing Orders

4.1 Contract Processing

When you place an order in our online shop, we process the personal data required to process and fulfil your order.

This includes, in particular:

  • first and last name,

  • billing address,

  • delivery address,

  • email address,

  • telephone number, where provided,

  • products ordered,

  • order and transaction data,

  • payment information,

  • individual information relating to an order.

For individually manufactured jewellery, additional information provided by you concerning the requested production may also be processed.

This may include, in particular:

  • ring size or other measurements,

  • desired material,

  • desired type of precious metal,

  • desired gemstone or gemstone setting,

  • engraving text,

  • other individual design requirements.

This information is processed insofar as it is necessary for the manufacture and delivery of the product you have ordered.

The processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.

4.2 Legal Obligations

We also process personal data insofar as this is necessary to comply with legal obligations.

This includes, in particular, statutory retention obligations under tax and commercial law.

The legal basis is Art. 6(1)(c) GDPR.

After expiry of the respective statutory retention periods, the relevant data will be deleted unless another legal basis exists for further storage.

5. Customer Account

Insofar as our online shop allows the creation of a customer account, we process the personal data required for this purpose to create and manage the customer account and to process future orders.

The processing is carried out pursuant to Art. 6(1)(b) GDPR insofar as it is necessary to provide the customer account.

You may generally request the deletion of your customer account at any time. Statutory retention obligations or the storage of data required for the assertion, exercise, or defence of legal claims remain unaffected by this.

6. Contacting Us

If you contact us by email, contact form, or other means, we process the personal data you provide for the purpose of processing and responding to your inquiry.

If your inquiry is related to the initiation or performance of a contract, the processing is carried out on the basis of Art. 6(1)(b) GDPR.

For other inquiries, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper processing and response to your inquiry.

The data will be deleted as soon as the inquiry has been conclusively dealt with, unless statutory retention obligations exist or further storage is necessary for the assertion, exercise, or defence of legal claims.

7. Shipping and Delivery

For the fulfilment of your order, we provide the personal data required for delivery to the respective shipping service provider commissioned by us.

This includes, in particular, your name and delivery address as well as, where applicable, further contact details required for delivery.

The processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.

8. Payment Processing

We use payment service providers to process payments.

8.1 PayPal

If you select PayPal as your payment method, the data required for payment processing will be transmitted to PayPal.

The provider is:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

The processing is carried out for the purpose of processing the payment and therefore for the performance of the contract pursuant to Art. 6(1)(b) GDPR.

Depending on the payment method selected, PayPal may process additional personal data and may conduct its own assessment for payment processing.

PayPal's privacy policy also applies to the processing carried out by PayPal.

9. Newsletter

If you subscribe to our newsletter, we use your email address to send you our newsletter on a regular basis.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future. To do so, you may use the unsubscribe link contained in each newsletter or contact us using the contact details provided above.

After unsubscribing, your email address will generally be removed from the newsletter mailing list unless a legal obligation or a legitimate interest in further storage exists.

Note: The specific newsletter service provider must still be named here according to the system actually used by you.

10. Cookies and Similar Technologies

We use cookies and similar technologies on our website.

Cookies are small files or pieces of information that can be stored on or read from your device.

10.1 Technically Necessary Technologies

We use technologies that are strictly necessary for the operation of our online shop.

These include, in particular, technologies required for:

  • the shopping cart,

  • the ordering process,

  • logging into a customer account,

  • storing security-related settings,

  • the technical provision of our online shop.

Insofar as the storage of information on your device or access to information already stored is strictly necessary for the provision of the digital service expressly requested by you, the permissibility is governed by Section 25(2) TDDDG.

The processing of personal data is additionally governed by the provisions of the GDPR.

10.2 Analytics and Marketing Technologies

Technologies that are not strictly necessary, in particular those used for analytics, marketing, and advertising purposes, are only used if the required consent has been obtained.

Consent is obtained via our consent management system.

The legal basis for the processing of personal data based on consent is Art. 6(1)(a) GDPR.

Insofar as the storage of or access to information on the device is concerned, Section 25(1) TDDDG is additionally applicable.

You may change or withdraw your consent at any time with effect for the future via the settings of our consent management system.

11. Consent Management with Pandectes

We use the consent management solution provided by:

Pandectes OÜ
Männimäe 1
74626 Harju maakond
Kuusalu vald
Pudisoo küla
Estonia

Pandectes supports us in obtaining, managing, and documenting consent for cookies and similar technologies that are not strictly necessary.

The following information may be processed in particular:

  • IP address,

  • date and time of consent,

  • technical information about the device used,

  • browser information,

  • information about the consent settings selected by you.

The processing serves in particular to document and manage your consent decisions.

Insofar as Pandectes processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Insofar as we are legally obliged to document your consent, the corresponding processing is based on Art. 6(1)(c) GDPR.

12. Google Analytics

We use Google Analytics to analyse the use of our online shop.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics enables us to statistically evaluate the use of our online shop and thereby improve our services.

The following information may be processed in particular:

  • IP address,

  • time of visit,

  • pages accessed,

  • device used,

  • browser information,

  • usage and interaction data,

  • technical information,

  • approximate location.

Google Analytics uses cookies and similar technologies for this purpose.

Google Analytics is only used on our website if the required consent has been obtained.

The processing is based on Art. 6(1)(a) GDPR.

Insofar as the storage of or access to information on your device is concerned, this is based on Section 25(1) TDDDG.

We use Google Analytics in conjunction with the data protection and consent functions provided by Google.

For its services, Google specifically describes the use of Google Consent Mode, through which users' consent decisions may be transmitted to the Google tags used and taken into account during processing. (Google Help)

You may withdraw your consent at any time via our consent management system.

Further information on data processing by Google can be found in Google's privacy information.

13. Google Ads and Google Advertising Services

We use Google Ads and associated Google advertising functions to advertise our online shop, measure the success of our advertising, and, where applicable, create target groups for advertising purposes.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

This may involve processing information about visits to our online shop, pages accessed, interactions, and certain events defined by us.

Google may use this information to measure the effectiveness of advertisements and, where the corresponding consent has been obtained, to provide personalised advertising or remarketing functions.

The processing only takes place if the required consent has been obtained.

The legal basis is Art. 6(1)(a) GDPR and, insofar as access to information on the device is concerned, Section 25(1) TDDDG.

For users in the European Economic Area, Google requires appropriate consent signals for certain analytics and advertising functions. These include, in particular, consent for ad storage, the transmission of user data for advertising purposes, and personalised advertising. (Google Help)

You may withdraw your consent at any time via our consent management system.

14. Meta Pixel

We use the Meta Pixel provided by Meta Platforms to analyse the use of our online shop and to measure and optimise our advertising.

The provider is:

Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

The Meta Pixel may collect information about the use of our online shop and certain events defined by us.

This may include, in particular:

  • pages accessed,

  • interactions with our online shop,

  • information about devices and browsers used,

  • referrer information,

  • information about the completion of certain actions, such as a purchase.

The data may be used to measure the effectiveness of our advertising, create target groups, and, insofar as permitted and consented to by you, display interest-based advertising.

The Meta Pixel is only used if the required consent has been obtained.

The legal basis is Art. 6(1)(a) GDPR and, insofar as access to information on your device is concerned, Section 25(1) TDDDG.

You may withdraw your consent at any time with effect for the future via our consent management system.

15. Microsoft Advertising / Universal Event Tracking

We use Microsoft Advertising and, where applicable, Microsoft's Universal Event Tracking (UET) to measure and optimise our advertising campaigns.

The provider is:

Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland

UET enables the collection of information about how users use our online shop after interacting with a Microsoft advertisement.

The following information may be processed in particular:

  • IP address,

  • time of visit,

  • browser information,

  • device information,

  • pages accessed,

  • interactions and certain events defined by us.

The processing only takes place if the required consent has been obtained.

The legal basis is Art. 6(1)(a) GDPR and, where required, Section 25(1) TDDDG.

You may withdraw your consent at any time via our consent management system.

16. Social Media

We may maintain presences on social networks, in particular Facebook and Instagram.

When visiting our social media presences, personal data may be processed by the respective platform operator.

We have only limited influence over the specific processing of personal data by the operators of social networks.

The respective privacy policies of the platform operators apply to processing carried out by them.

17. Disclosure of Personal Data

We only disclose personal data where this is legally permissible.

Disclosure may be necessary in particular:

  • for the performance of a contract,

  • for processing payments,

  • for delivering ordered goods,

  • for complying with legal obligations,

  • on the basis of your consent,

  • for safeguarding legitimate interests,

  • for the assertion, exercise, or defence of legal claims.

Recipients may include, in particular:

  • technical service providers,

  • hosting and shop service providers,

  • payment service providers,

  • shipping service providers,

  • IT service providers,

  • newsletter service providers,

  • tax advisors,

  • authorities,

  • providers of analytics and advertising services, insofar as you have consented to this.

Insofar as service providers process personal data on our behalf, we conclude data processing agreements pursuant to Art. 28 GDPR where legally required.

18. Transfers to Third Countries

When using certain services, in particular international analytics and advertising services, the processing of personal data outside the European Union or the European Economic Area cannot be ruled out.

Personal data is only transferred to a third country in compliance with the statutory requirements of Art. 44 et seq. GDPR.

Where an adequacy decision by the European Commission exists, the transfer may be based on such a decision.

Where no adequacy decision exists, in particular the European Commission's Standard Contractual Clauses and other appropriate safeguards pursuant to Art. 46 GDPR may be used.

With individual providers, processing may take place in the United States. Where a provider is certified under the EU-U.S. Data Privacy Framework and the applicable requirements are met, the transfer may be based on the corresponding adequacy decision.

19. Storage Period

As a general rule, we store personal data only for as long as is necessary for the respective purpose.

In addition, there are in particular statutory retention obligations under tax and commercial law.

After expiry of the respective retention periods, the data will be deleted unless another legal basis exists for further storage.

Data may also be stored insofar as this is necessary for the assertion, exercise, or defence of legal claims.

20. Your Rights

You have the following rights vis-à-vis us:

Right of Access

Pursuant to Art. 15 GDPR, you have the right to request information about the personal data concerning you that we store and further information about its processing.

Right to Rectification

Pursuant to Art. 16 GDPR, you have the right to request the rectification of inaccurate personal data or the completion of incomplete personal data.

Right to Erasure

Pursuant to Art. 17 GDPR, you may request the erasure of your personal data under the statutory conditions.

Right to Restriction of Processing

Pursuant to Art. 18 GDPR, you may request the restriction of the processing of your personal data under the statutory conditions.

Right to Data Portability

Pursuant to Art. 20 GDPR, under the statutory conditions, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format or to request that it be transmitted to another controller.

Right to Withdraw Consent

If the processing is based on your consent, you may withdraw your consent at any time with effect for the future.

The lawfulness of processing carried out prior to the withdrawal remains unaffected.

Right to Object

Pursuant to Art. 21 GDPR, you have the right, on grounds relating to your particular situation, to object to the processing of your personal data insofar as the processing is based on Art. 6(1)(e) or (f) GDPR.

Where personal data is processed for the purpose of direct marketing, you may object to the processing for such purposes at any time. This also applies to profiling related to such direct marketing.

Following an objection, personal data will no longer be processed for the purposes of direct marketing.

21. Right to Lodge a Complaint with a Data Protection Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

In particular, you may contact the data protection supervisory authority responsible for your place of residence or our registered business location.

The competent authority for North Rhine-Westphalia is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)

Kavalleriestraße 2–4
40213 Düsseldorf
Germany

22. Contact Regarding Data Protection

If you have any questions regarding the processing of your personal data or the exercise of your data protection rights, you may contact us at any time:

Lukas Vidrago Nell
Bebelplatz 12
50679 Cologne
Germany

Email: support@vidragold.de
Phone: 0157 32487542