Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide your data. Failure to provide it will have no consequences. This only applies unless otherwise stated in the following processing operations.

“Personal data” means any information relating to an identified or identifiable natural person.

Server Log Files

You can visit our website without providing any personal information.

Each time our website is accessed, usage data is transmitted to us or to our web hosting provider or IT service provider by your internet browser and stored in log data, so called server log files. This stored data may include, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.

The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in ensuring the smooth operation of our website and improving our services.

Your data may also be transferred to Canada. An adequacy decision by the European Commission exists for data transfers to Canada.

Contact

Controller

The controller responsible for data processing is:

Boxinton
Email: info@boxinton.com

Customer Contact by Email

If you contact us by email, we collect your personal data such as your name, email address and message content only to the extent provided by you. The data processing serves the purpose of handling and responding to your contact request.

If the contact is made for the purpose of carrying out pre contractual measures, for example advice regarding a purchase interest or the preparation of an offer, or if it concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your request. In this case, you have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data based on Art. 6 para. 1 lit. f GDPR.

We use your email address only to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and Processing When Using the Contact Form

When using the contact form, we collect your personal data such as your name, email address and message content only to the extent provided by you. The data processing serves the purpose of contacting you.

If the contact is made for the purpose of carrying out pre contractual measures, for example advice regarding a purchase interest or the preparation of an offer, or if it concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your request. In this case, you have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data based on Art. 6 para. 1 lit. f GDPR.

We use your email address only to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Customer Account and Orders

Customer Account

When opening a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing.

The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal. Your customer account will then be deleted.

Collection, Processing and Transfer of Personal Data When Placing Orders

When placing an order, we collect and process your personal data only to the extent necessary to fulfil and process your order and to handle your inquiries. The provision of this data is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded.

The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR and is necessary for the performance of a contract with you.

Your data may be transferred, for example, to the shipping companies selected by you, dropshipping providers, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly observe the legal requirements. The scope of the data transfer is limited to the minimum necessary.

Your data may also be transferred to Canada. An adequacy decision by the European Commission exists for data transfers to Canada.

Advertising

Use of Email Address for Sending Newsletters

We use your email address independently of contract processing exclusively for our own advertising purposes to send newsletters, provided that you have expressly consented to this.

The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal.

You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the mailing list.

Use of Email Address for Direct Advertising

We use your email address, which we received in connection with the sale of goods or services, for the electronic sending of advertising for our own goods or services that are similar to those you have already purchased from us, unless you have objected to this use.

The provision of the email address is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded.

The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in direct advertising. You can object to this use of your email address at any time by notifying us. You can also use the link provided in the advertising email. No costs other than the transmission costs according to the basic rates will be incurred.

Use of Klaviyo

We use the service Klaviyo Inc., 125 Summer St Floor 7, Boston, MA 02111, USA, “Klaviyo”, for sending newsletters as part of order processing.

We pass on the information provided by you during newsletter registration, such as your email address and, if applicable, your first and last name, to Klaviyo. The data processing serves the purpose of sending newsletters and statistical evaluation.

In order to evaluate newsletter campaigns, the newsletters sent may contain a 1x1 pixel graphic, also known as a tracking pixel, or a tracking link. This allows us to determine whether you have opened the newsletter and whether you have clicked on any integrated links.

In this context, we collect personal data such as your IP address, browser type, device and the time of access. Usage profiles may be created from this data under a pseudonym. The collected data is not used to personally identify you. The data is used only for statistical evaluation to improve newsletter campaigns.

Your data is usually transferred to Klaviyo servers in the USA and stored there. An adequacy decision by the European Commission exists for the USA, the Trans Atlantic Data Privacy Framework, TADPF. Klaviyo is certified under the TADPF and has committed itself to comply with European data protection principles.

The processing of your personal data is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in a targeted, effective and user friendly newsletter system. You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data.

Further information on data protection at Klaviyo can be found here:
https://www.klaviyo.com/legal/privacy-notice
https://www.klaviyo.com/legal/data-processing-agreement

Shipping Service Providers

Forwarding of Email Address to Shipping Companies for Shipping Status Information

We pass on your email address to the shipping company as part of contract processing, provided that you have expressly consented to this during the order process. The transfer serves the purpose of informing you by email about the shipping status.

The processing is carried out on the basis of Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us or the shipping company, without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal.

Payment Service Providers

Use of the Payment Service Provider Stripe

We use the payment service Stripe on our website. The provider is Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

The data processing serves the purpose of offering you payment via the payment service. By selecting and using Stripe, the data required for payment processing is transmitted to Stripe in order to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR.

Stripe reserves the right, if necessary, to obtain a credit report on the basis of mathematical and statistical procedures using credit agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of payment default for a balanced decision on the establishment, implementation or termination of the contractual relationship.

The credit report may include probability values, so called score values, which are calculated on the basis of scientifically recognized mathematical and statistical methods and may include address data in their calculation. Your legitimate interests are taken into account in accordance with the legal provisions.

The data processing serves the purpose of checking creditworthiness for the initiation of a contract. The processing is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default, if Stripe makes advance payments.

You have the right, for reasons arising from your particular situation, to object at any time to this processing of your personal data based on Art. 6 para. 1 lit. f GDPR by notifying Stripe.

The provision of the data is necessary for the conclusion of the contract with the payment method requested by you. Failure to provide it means that the contract cannot be concluded with the payment method selected by you.

All Stripe transactions are subject to the Stripe Privacy Policy, which can be found here:
https://stripe.com/privacy

Cookies

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your device. Therefore, you have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set, decide individually whether to accept them, and prevent the storage of cookies and transmission of the data they contain. Cookies that have already been stored can be deleted at any time.

Please note that you may not be able to use all functions of this website fully if you disable cookies.

You can find information on how to manage and deactivate cookies in the most important browsers here:

• Chrome: https://support.google.com/accounts/answer/61416
• Microsoft Edge: https://support.microsoft.com/microsoft-edge
• Mozilla Firefox: https://support.mozilla.org/kb/cookies-information-websites-store-on-your-computer
• Safari: https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Technically Necessary Cookies

Unless otherwise stated in this privacy policy, we only use technically necessary cookies for the purpose of making our services more user friendly, effective and secure. Cookies also enable our systems to recognize your browser after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary that the browser is recognized even after a page change.

The use of cookies or comparable technologies is based on Section 25 para. 2 TTDSG. The processing of your personal data is carried out on the basis of Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website and a user friendly and effective design of our services.

You have the right, for reasons arising from your particular situation, to object at any time to this processing of your personal data.

Plugins and Other Services

Use of Google Tag Manager

We use Google Tag Manager on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

This application is used to manage JavaScript tags and HTML tags, which are used in particular to implement tracking and analysis tools. The data processing serves the purpose of designing and optimizing our website according to demand.

Google Tag Manager itself does not store cookies and does not process personal data. However, it enables the triggering of further tags that may collect and process personal data.

Further information on terms of use and data protection can be found here:
https://policies.google.com/privacy

Rights of Data Subjects and Storage Period

Duration of Storage

After complete processing of the contract, the data will initially be stored for the duration of the warranty period. Thereafter, it will be stored in accordance with statutory retention periods, in particular tax and commercial law retention periods, and then deleted after expiry of the period, unless you have consented to further processing and use.

Rights of the Data Subject

If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: the right of access, the right to rectification, the right to erasure, the right to restriction of processing and the right to data portability.

In addition, you have the right to object under Art. 21 para. 1 GDPR to processing based on Art. 6 para. 1 lit. f GDPR and to processing for the purpose of direct advertising.

Right to Lodge a Complaint with the Supervisory Authority

According to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.

Right to Object

If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR, you have the right, for reasons arising from your particular situation, to object to this processing at any time with effect for the future.

After an objection has been made, the processing of the affected data will be terminated unless we can prove compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims.

If personal data is processed for the purpose of direct advertising, you can object to this processing at any time by notifying us. After your objection, we will stop processing the affected data for the purpose of direct advertising.

Last updated: July 13, 2023