Privacy Policy Statement
Privacy Policy
Below we provide information about how we process your personal data when you visit our online shop, place an order, communicate with us or use the functions provided within our online shop.
Controller Responsible for Data Processing
CS Bewässerungssysteme GmbH
In der Aue 29
64385 Reichelsheim
Germany
Represented by the Managing Directors Carole Friedel and Sven Baier
Email: info@cs-wss.com
Phone: +49 6164 6429717
1. Access Data and Hosting
Whenever you access our online shop, technically necessary access data is processed by the web server. This may include, in particular, your IP address, the date and time of access, the page or file requested, the amount of data transferred, browser and operating system information, referrer information and the requesting provider.
The processing is carried out to provide our online shop securely and reliably, to analyse technical errors and to detect and prevent attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, functional and reliable operation of our online shop.
Hosting
We use JTL Hosting for the hosting and technical provision of our online shop. As part of the hosting service, the data required for operating the online shop is processed on the hosting provider's servers. Where the hosting provider processes personal data on our behalf, this processing is carried out pursuant to Article 28 GDPR.
Server log data is stored only for as long as necessary for secure technical operation, error analysis and the prevention of attacks. Data is stored for longer periods only where there is a legal basis for doing so.
2. Contract Processing, Customer Account and Contact
2.1 Data Processing for Contract Performance
When you place an order with us, we process the personal data you provide insofar as this is necessary for initiating, performing and processing the contract. This includes, in particular, your name, billing and delivery address, contact details, ordered goods, payment information and the contractual and communication data required to process your order.
The legal basis is Article 6(1)(b) GDPR. Where we are required to retain data due to commercial or tax law obligations, the processing is additionally based on Article 6(1)(c) GDPR.
Merchandise Management System
For order and contract processing, we process order, customer and contract data using our JTL Wawi merchandise management system. JTL Wawi is operated on a server maintained by us.
2.2 Customer Account
You may voluntarily create a customer account. In this case, we process the data you provide in order to create and provide the customer account and to simplify the processing of future orders.
The legal basis is Article 6(1)(b) GDPR.
You may request deletion of your customer account at any time. Data that must continue to be stored due to statutory retention obligations will only be processed for the legally prescribed purposes until the relevant retention period expires.
2.3 Contact Requests and Product Questions
If you contact us by email, telephone, contact form or via a contact function provided in the online shop such as "Question about this item", we process the data you provide in order to handle your request.
Depending on the method of contact, this may include your name, email address, an optionally provided telephone number and the content of your message.
If your request relates to an existing contract or pre contractual measures, the processing is based on Article 6(1)(b) GDPR.
For other enquiries, the processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the proper handling of enquiries from customers and interested parties.
2.4 Product Reviews
You may voluntarily submit product reviews in our online shop. We process the data you enter in the review form in order to receive, technically manage and publish your review in our online shop.
When a product review is published, your first name, the initial of your surname, the star rating, the title of the review, the date and any review content submitted by you for publication are displayed publicly.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide other customers with useful experiences and information about our products and to improve our offering on the basis of customer feedback.
Product reviews are generally stored and displayed for as long as this is necessary for the stated purpose. Statutory retention or documentation obligations and the establishment, exercise or defence of legal claims remain unaffected.
3. Data Processing for Shipping
For the delivery of your order, we transfer the data required for delivery to our shipping service provider DHL. This currently includes, in particular, the recipient's name and delivery address.
The recipient of the data is the DHL service provider responsible for the specific shipment, in particular DHL Paket GmbH or Deutsche Post AG.
The transfer is carried out for the performance of the contract on the basis of Article 6(1)(b) GDPR. We currently do not transmit your email address or telephone number to DHL for additional shipment notifications.
4. Data Processing for Payments
Depending on the payment method you select, we either process the data required to carry out the payment ourselves or transmit the required data to the relevant payment service provider or participating financial institution. The legal basis for the processing carried out by us for payment purposes is Article 6(1)(b) GDPR.
4.1 Invoice and Advance Payment
When paying by invoice or advance payment, we process the contractual, invoice and payment data required to assign, execute and record the payment. Where financial institutions are involved in processing the payment, they receive the data required for the respective transaction.
4.2 PayPal Checkout
We use PayPal Checkout for various payment methods. Through PayPal Checkout, we offer in particular PayPal, SEPA direct debit, credit card payments, Apple Pay and Google Pay.
The provider of PayPal payment services in the European Economic Area is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
If you select a payment method provided through PayPal Checkout, the data required for payment processing is transmitted to PayPal. Depending on the payment method, this may include, in particular, your name, billing and delivery address, email address, order and transaction data and bank or payment details.
PayPal processes personal data in connection with its payment services under its own responsibility under data protection law and may process data, among other purposes, for payment processing, identity and risk checks and fraud prevention.
If you select Apple Pay or Google Pay within PayPal Checkout, additional data may be processed by Apple or Google as part of the respective payment process. However, these payment methods are technically provided in our online shop through PayPal Checkout.
Further information on data processing by PayPal can be found in the PayPal Privacy Statement .
5. Cookies, Consent Management and Other Technologies
5.1 General Information
Our online shop uses cookies and comparable technologies where these are required for the technical operation of the shop or where you have consented to their use.
Cookies are small pieces of information stored on your device. Some cookies are deleted when your browser session ends. Others may remain stored on your device for a specified period.
5.2 Strictly Necessary Technologies and Consent
Strictly necessary technologies are used in particular to provide essential shop functions such as the shopping cart, login, navigation, security and the storage of your privacy settings.
Where information is stored on your device or information already stored on your device is accessed, strictly necessary technologies are used on the basis of Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Non essential technologies are used only with your consent in accordance with Section 25(1) TDDDG.
Where the use of these technologies involves the processing of personal data, the applicable legal basis depends on the respective purpose. For technologies requiring consent, personal data is processed on the basis of Article 6(1)(a) GDPR.
5.3 Consent Management
We use the consent functionality provided within our online shop to manage your privacy preferences. Your selection is stored so that the settings you have chosen can be taken into account during subsequent visits.
You may withdraw or change any consent you have given at any time with effect for the future via the privacy or consent settings of our online shop.
5.4 Google reCAPTCHA
We use Google reCAPTCHA to protect certain forms against automated submissions, misuse and spam. reCAPTCHA is activated only after you have consented to its use through our consent settings.
When reCAPTCHA is used, data such as your IP address, browser and device information, usage data and other information required for the security assessment may be transmitted to and processed by Google.
For users in the European Economic Area, Google services are generally provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Depending on the processing involved, other companies within the Google group may also participate in the processing.
The legal basis for accessing your device is your consent pursuant to Section 25(1) TDDDG. Where personal data is subsequently processed, this is based on your consent pursuant to Article 6(1)(a) GDPR.
Further information on Google's processing of personal data can be found in Google's Privacy Policy .
6. Social Media and WhatsApp
6.1 Links to Facebook, Instagram and WhatsApp
Where links or buttons to Facebook, Instagram or WhatsApp are displayed in our online shop, they are integrated as simple links. Merely displaying such a link does not establish a direct connection to the respective provider.
Only when you click on such a link do you leave our online shop or access the relevant external service. From that point onwards, further processing is governed by the terms and privacy policies of the respective platform provider.
6.2 Our Presence on Facebook and Instagram
We maintain company profiles on Facebook and Instagram. We use these profiles to provide company and product information and to communicate with customers and interested parties.
When you access our profiles on these platforms, the respective platform provider processes personal data in accordance with its own privacy policies. Such processing may also take place for analytics, security, personalisation or advertising purposes.
Where we process personal data within our own social media profiles, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR depending on the nature of the communication. Our legitimate interest is customer communication and the presentation of our company and products.
Further information can be found in the privacy policies of Facebook and Instagram .
6.3 Communication via WhatsApp Business
We use the WhatsApp Business app to communicate with customers and interested parties. The provider for users in the European region is WhatsApp Ireland Limited, Ireland.
If you contact us via WhatsApp, your telephone number, profile name, profile picture where applicable, the content of messages you send and communication and metadata may be processed.
Where the communication relates to an order, an existing contract or pre contractual advice requested by you, our processing is based on Article 6(1)(b) GDPR.
For other enquiries, the processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to provide an additional communication channel requested by customers and interested parties.
Use of WhatsApp is voluntary. You may alternatively contact us at any time by email or telephone.
Further information can be found in the WhatsApp Privacy Policy .
6.4 Transfers of Data Outside the EEA
When individual external services are used, personal data may be processed outside the European Union or the European Economic Area. This may apply in particular to globally operating providers such as Google, Meta or WhatsApp, PayPal and Apple.
Where personal data is transferred to a third country, such transfer takes place in accordance with Articles 44 et seq. GDPR. Depending on the recipient and destination country, the transfer may in particular be based on an adequacy decision of the European Commission or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Further details can be found in the privacy information of the respective provider.
7. Storage Period, Your Rights and Contact Details
7.1 General Storage Period
Unless a specific storage period is stated in this Privacy Policy, we store personal data only for as long as necessary for the relevant processing purpose.
Where statutory retention obligations apply, particularly under commercial or tax law, the affected data is stored until the relevant statutory retention period expires. The data is then deleted unless there is another legal basis for further processing.
7.2 Your Rights
As a data subject, you have the following rights in particular, subject to the applicable statutory requirements:
- Right of access pursuant to Article 15 GDPR
- Right to rectification pursuant to Article 16 GDPR
- Right to erasure pursuant to Article 17 GDPR
- Right to restriction of processing pursuant to Article 18 GDPR
- Right to data portability pursuant to Article 20 GDPR
- Right to object pursuant to Article 21 GDPR
- Right to withdraw consent pursuant to Article 7(3) GDPR
- Right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR
7.3 Right to Object
Where we process your personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
Following an objection, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, you may object to such processing at any time. Following your objection, the personal data will no longer be processed for direct marketing purposes.
7.4 Data Protection Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection laws.
The supervisory authority particularly responsible for our company is:
The Hessian Commissioner for Data Protection and Freedom of Information
Postfach 3163
65021 Wiesbaden
Germany
Email: poststelle@datenschutz.hessen.de
7.5 Contact Details
If you have any questions about the processing of your personal data or wish to exercise your data protection rights, you may contact us at any time at info@cs-wss.com .