Privacy policy
Privacy Policy of Althaus Tee
Protecting your privacy is very important to us. Below, we inform you in detail about how we handle your data.
1. Access data and hosting
You can visit our website without providing any personal information. Each time a web page is accessed, the web server merely automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access. This access data is evaluated exclusively for the purpose of ensuring the smooth operation of the website and improving our offering. This serves to protect our legitimate interests in the correct presentation of our offering, which prevail in the context of a balancing of interests, pursuant to Art. 6(1)(1)(f) GDPR.
Hosting
The services for hosting and displaying the website are provided by our service providers as part of processing on our behalf. Unless otherwise explained in this privacy policy, all access data and all data collected in the forms provided for this purpose on this website are processed on their servers.
Our online shop is operated on the Shopify platform. The provider is Shopify International Limited, Ireland. The European Union is set as the hosting location for our shop's data. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this privacy policy.
2. Data processing for contract processing and for contacting us
2.1 Data processing for contract processing
For the purpose of processing the contract (including inquiries about and the handling of any existing warranty and performance claims as well as any statutory update obligations) pursuant to Art. 6(1)(1)(b) GDPR, we collect personal data if you provide it to us voluntarily as part of your order. Mandatory fields are marked as such, as in these cases we absolutely need the data to process the contract and cannot ship the order without it. The data collected can be seen in the respective input forms. Further information on the processing of your data, in particular on its transfer to our service providers for the purpose of order, payment and shipping processing, can be found in the following sections of this privacy policy. After the contract has been fully processed, your data will be restricted from further processing and deleted after the expiry of the retention periods under tax and commercial law pursuant to Art. 6(1)(1)(c) GDPR, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(1)(a) GDPR or we reserve the right to use the data beyond this, as permitted by law and about which we inform you in this policy.
2.2 Customer account
Insofar as you have given your consent pursuant to Art. 6(1)(1)(a) GDPR by choosing to open a customer account, we use your data for the purpose of opening the customer account and storing your data for further future orders on our website. You can delete your customer account at any time by sending a message to the contact option described in this privacy policy. After your customer account has been deleted, your data will be deleted, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(1)(a) GDPR or we reserve the right to use the data beyond this, as permitted by law and about which we inform you in this policy.
2.3 Contacting us
As part of customer communication, we collect personal data to process your inquiries pursuant to Art. 6(1)(1)(b) GDPR if you provide it to us voluntarily when contacting us (e.g. via contact form or e-mail). Mandatory fields are marked as such, as in these cases we absolutely need the data to process your inquiry. The data collected can be seen in the respective input forms. After your inquiry has been fully processed, your data will be deleted, unless you have expressly consented to further use of your data pursuant to Art. 6(1)(1)(a) GDPR or we reserve the right to use the data beyond this, as permitted by law and about which we inform you in this policy.
3. Data processing for the purpose of shipping
To fulfil the contract pursuant to Art. 6(1)(1)(b) GDPR, we pass on your data to the shipping service provider commissioned with the delivery, insofar as this is necessary for the delivery of the ordered goods. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this privacy policy.
Transfer of data to DHL for the purpose of shipping notifications
We transfer your e-mail address together with the shipping data to DHL Paket GmbH so that DHL can inform you about the shipment of your order. In this way, DHL informs you of the expected delivery day and enables you to adjust the delivery, for example by specifying a drop-off location or redirecting the parcel to a branch or Packstation. If the parcel could not be delivered and was deposited at a branch or parcel shop, you will also receive a message from DHL with the details for collection.
The legal basis is Art. 6(1)(1)(f) GDPR. Our legitimate interest is that you know and can influence the time of delivery and that parcels are delivered instead of remaining unnoticed or being returned to us.
You can object to this processing at any time with effect for the future (Art. 21(1) GDPR). Please address your objection to the contact option stated in this privacy policy; we will then no longer transfer your e-mail address to DHL for future orders. You can also contact DHL directly:
DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany
DHL is responsible for the processing of your e-mail address after the transfer, in particular for the content and sending of the notifications. Details can be found in DHL's privacy notice.
Deliveries to countries outside the European Union
For deliveries to countries outside the European Union, we transfer the information required for customs clearance to the competent customs authorities. This serves to fulfil our legal obligations pursuant to Art. 6(1)(1)(c) GDPR.
4. Data processing for payment processing
When processing payments in our online shop, we work with the following partners: technical service providers, credit institutions, payment service providers.
4.1 Data processing for transaction processing
Depending on the payment method selected, we pass on the data required for processing the payment transaction to our technical service providers, who act on our behalf as processors, or to the commissioned credit institutions or to the selected payment service provider, insofar as this is necessary for processing the payment. This serves to fulfil the contract pursuant to Art. 6(1)(1)(b) GDPR. In some cases, the payment service providers collect the data required for processing the payment themselves, e.g. on their own website or via a technical integration in the ordering process. In this respect, the privacy policy of the respective payment service provider applies.
Specifically, we use the following providers:
- Shopify Payments, provided via the Shopify platform (credit card, Apple Pay, Google Pay, Bancontact, EPS, MobilePay)
- PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
- Klarna Bank AB (publ), Sweden
If you have any questions about our payment processing partners and the basis of our cooperation with them, please use the contact option described in this privacy policy.
4.2 Data processing for the purpose of fraud prevention and optimisation of our payment processes
Where applicable, we provide our service providers with further data, which they use as our processors together with the data required for processing the payment for the purpose of fraud prevention and optimising our payment processes (e.g. invoicing, processing of disputed payments, accounting support). Pursuant to Art. 6(1)(1)(f) GDPR, this serves to protect our legitimate interests, which prevail in the context of a balancing of interests, in protecting ourselves against fraud and in efficient payment management.
4.3 Identity and credit check for Klarna payment methods
If you choose a Klarna payment method, Klarna carries out an identity and credit check under its own responsibility and decides on this basis which payment options are offered to you. We have no influence on this decision. The controller for this processing is Klarna Bank AB (publ), Sweden. For details on the processing of your data by Klarna and your rights vis-à-vis Klarna, please refer to Klarna's privacy notice, which is displayed to you during the ordering process.
We do not carry out our own inquiries with credit agencies.
5. Cookies and other technologies
5.1 General information
In order to make visiting our website attractive and to enable the use of certain functions, we use technologies including so-called cookies on various pages. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted again after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your device and enable us to recognise your browser on your next visit (persistent cookies).
Protection of privacy on terminal devices
When you use our online offering, we use strictly necessary technologies in order to be able to provide the telemedia service you have expressly requested. In this respect, the storage of information on your device or access to information already stored on your device does not require consent (Section 25(2) No. 2 TDDDG).
For functions that are not strictly necessary, the storage of information on your device or access to information already stored on your device requires your consent (Section 25(1) TDDDG). Please note that if you do not give your consent, parts of the website may not be fully usable. Any consent you have given remains in effect until you adjust or reset the respective settings.
Possible subsequent data processing through cookies and other technologies
We use technologies that are absolutely necessary for the use of certain functions of our website (e.g. shopping cart function). These technologies collect and process the IP address, time of visit, device and browser information as well as information about your use of our website (e.g. information about the contents of the shopping cart). This serves our legitimate interests in an optimised presentation of our offering, which prevail in the context of a balancing of interests, pursuant to Art. 6(1)(1)(f) GDPR and, in the context of order processing, the fulfilment of the contract pursuant to Art. 6(1)(1)(b) GDPR.
In addition, we use technologies that are not strictly necessary and are used exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR and Section 25(1) TDDDG. These include in particular the technologies for advertising and analysis purposes described in section 5.4.
We also use technologies to fulfil the legal obligations to which we are subject (e.g. to be able to prove consent to the processing of your personal data).
Cookie settings
You can find the cookie settings for your browser under the following links: Microsoft Edge / Safari / Chrome / Firefox / Opera
Insofar as you have consented to the use of the technologies pursuant to Art. 6(1)(1)(a) GDPR, you can withdraw your consent at any time with effect for the future. To do so, call up the cookie settings again via the consent banner on our website or send us a message to the contact option described in this privacy policy. If you do not accept cookies, the functionality of our website may be restricted.
5.2 Consent management via the Shopify platform
On our website, we use the consent management of the Shopify platform to inform you about the cookies and other technologies we use on our website and to obtain, manage and document any consent you may be required to give to the processing of your personal data by these technologies. Pursuant to Art. 6(1)(1)(c) GDPR, this is necessary to fulfil our legal obligation under Art. 7(1) GDPR to be able to prove your consent to the processing of your personal data.
When you first visit our website, a consent banner is displayed through which you can accept or reject the use of non-essential technologies and manage individual categories. After you have made your declaration, information about your consent behaviour, in particular the status and date of consent, is stored. The provider of the platform is Shopify International Limited, Ireland.
5.3 Information on third-country transfers (transfer of data to third countries)
We use technologies from service providers on our website whose registered office and/or server locations may be in third countries outside the EU or EEA. If there is no adequacy decision of the EU Commission for this country, an adequate level of data protection must be ensured by means of other appropriate safeguards.
Appropriate safeguards in the form of contractually agreed standard contractual clauses of the EU Commission or binding corporate rules are generally possible, but require prior verification by the contracting parties as to whether an adequate level of protection can be guaranteed. According to the case law of the CJEU, it may be necessary to take additional protective measures for this purpose.
We have generally agreed the standard data protection clauses issued by the EU Commission with the technology providers we use that process personal data in a third country. Where possible, we also agree additional safeguards intended to ensure adequate data protection in third countries without an adequacy decision.
Notwithstanding this, it may happen that, despite all contractual and technical measures, the level of data protection in the third country does not correspond to that of the EU. For these cases, we ask you, if necessary, as part of the cookie consent for your consent pursuant to Art. 49(1)(a) GDPR to the transfer of your personal data to a third country. In particular, there is a risk that local authorities in the third country may obtain access rights to your personal data that are not sufficiently restricted from a European data protection perspective, that we as the data exporter or you as the data subject may not become aware of this, and/or that you may not have sufficient legal remedies available to prevent this and/or take action against such access.
5.4 Meta Pixel, advanced matching and Conversions API
In our online shop, we use technologies from the provider Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter "Meta"). These are the so-called Meta Pixel including advanced matching and the Conversions API. These technologies are integrated into our shop via the "Facebook & Instagram" sales channel.
We use these technologies to measure the effectiveness of our advertisements on Meta's platforms (in particular Facebook and Instagram), to evaluate which actions visitors take in our shop after clicking on an advertisement, to create target groups for future advertising and to have advertisements displayed there again to visitors who have already visited our shop (so-called remarketing).
Data processed
Information about your use of our shop is collected and transmitted to Meta, in particular regarding the following actions: viewing a page, viewing a product, using the search, adding a product to the shopping cart, starting the checkout process, entering payment information and completing an order including the order value. In addition, technical information is processed, in particular your IP address, information about your browser and device, the addresses accessed and identifiers stored in cookies or similar technologies on your device.
Via advanced matching and the Conversions API, personal information that you provide when placing an order or registering in our shop is also transmitted, in particular first and last name, e-mail address, telephone number and information about your place of residence. Before transmission, this information is converted into a cryptographic check value (so-called hashing); Meta makes this mandatory for the transmission of such information. Meta compares these check values with the user accounts stored at Meta in order to determine whether the person is registered with Meta. This makes it possible for Meta to attribute the data to you; hashing merely prevents the information from being available in plain text during transmission.
In addition to the Meta Pixel, the Conversions API transmits this data directly from our shop system to Meta, i.e. without the transmission taking place via your browser. This transmission can therefore not be prevented by your browser settings or by ad and script blockers. However, it also only takes place if you have given your consent beforehand; you can effectively prevent it by not giving your consent or by withdrawing it.
If the same event is transmitted both via the Meta Pixel and via the Conversions API, Meta merges the two transmissions using a common event identifier (so-called deduplication), so that the event is only counted once.
Legal basis and withdrawal
The use of these technologies and the associated storage of information on your device as well as access to information already stored there take place exclusively on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR and Section 25(1) TDDDG. Without your consent, these technologies are not loaded and no data is transmitted to Meta.
You can withdraw your consent at any time with effect for the future. To do so, call up the settings again via the consent banner on our website or send us a message to the contact option described in this privacy policy. The lawfulness of the processing carried out until the withdrawal remains unaffected.
Irrespective of this, if you are registered with Meta, you can view and restrict in your account settings there under "Your activity off Meta technologies" which information from third-party websites is linked to your account, and object to the use of your data for personalised advertising in the ad settings.
Joint controllership
We are jointly responsible with Meta within the meaning of Art. 26 GDPR for the collection of the aforementioned data and its transmission to Meta. For this purpose, we have concluded with Meta the joint controller agreement provided by Meta, which sets out the respective obligations. The essential content of this agreement is available at https://www.facebook.com/legal/controller_addendum. According to this agreement, Meta is in particular responsible for making the information pursuant to Art. 13 and 14 GDPR available to you and for ensuring your data subject rights.
The further processing of the data after transmission to Meta, in particular its combination with other data available to Meta and its use for Meta's own purposes, is the sole responsibility of Meta. We have no influence on this processing and no knowledge of the extent of the processing taking place at Meta. For more information on this and on your rights vis-à-vis Meta, please refer to Meta's privacy policy at https://www.facebook.com/privacy/policy.
You can assert your data subject rights both against us and against Meta. If you contact us, we will forward your request to Meta without delay insofar as Meta is responsible for responding.
Transfer of data to the USA
Meta also processes data outside the European Union, in particular in the United States of America. The transfer takes place on the basis of the standard data protection clauses issued by the EU Commission and additionally on the basis of your consent given in the consent banner pursuant to Art. 49(1)(a) GDPR. Express reference is made to the information in section 5.3 of this privacy policy on the risks of a transfer to third countries. In particular, it cannot be ruled out that US authorities may access your personal data without you becoming aware of this or without effective legal remedies being available to you.
Storage period
The storage period of the data transmitted to Meta is determined by Meta's specifications. For information on this, please refer to the aforementioned Meta privacy policy. The cookies stored on your device remain there until you delete them or their period of validity has expired.
6. Other services used
6.1 Customer reviews (Judge.me)
We use the Judge.me service to collect and display product reviews. After an order, you may receive an e-mail asking you to submit a review. For this purpose, your e-mail address and information about the order are transmitted to the service, which acts as our processor in this respect. The legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in obtaining reviews to inform other customers. Insofar as consent is required for sending the review request, it is sent exclusively on the basis of Art. 6(1)(1)(a) GDPR. You can object to receiving such requests at any time.
A review you submit will be published in our shop with the name you provided. Please note that any information you include in the review text will be publicly visible.
6.2 Address verification
To avoid delivery errors, we check the delivery address entered during the ordering process for completeness and plausibility using an address validation service provider. The address entered is transmitted to the service provider and, if applicable, a suggested correction is displayed to you. The service provider is based in Germany and acts as our processor. If you have any questions about our service providers and the basis of our cooperation with them, please use the contact option described in this privacy policy. This serves to fulfil the contract pursuant to Art. 6(1)(1)(b) GDPR and to protect our legitimate interests in correct delivery pursuant to Art. 6(1)(1)(f) GDPR.
6.3 Accessibility and checkout functions
We use supplementary services that improve the usability of our shop and control the payment and shipping options available during the ordering process. These services process the data required for this on our behalf. This serves to protect our legitimate interests in a functional and accessible online shop pursuant to Art. 6(1)(1)(f) GDPR and, insofar as the processing serves order processing, the fulfilment of the contract pursuant to Art. 6(1)(1)(b) GDPR.
6.4 Analyses by Shopify
Shopify uses data from the operation of our shop across shops to improve its own services, product recommendations and the targeting of advertising. Shopify is independently responsible for this processing. Further information can be found in Shopify's privacy notice for consumers and in Shopify's privacy portal.
7. Contact options and your rights
7.1 Your rights
As a data subject, you have the following rights:
- pursuant to Art. 15 GDPR, the right to request information about your personal data processed by us to the extent specified therein;
- pursuant to Art. 16 GDPR, the right to request without delay the correction of inaccurate or the completion of your personal data stored by us;
- pursuant to Art. 17 GDPR, the right to request the deletion of your personal data stored by us, unless further processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
- pursuant to Art. 18 GDPR, the right to request the restriction of the processing of your personal data, insofar as you dispute the accuracy of the data, the processing is unlawful but you refuse its deletion, we no longer need the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR;
- pursuant to Art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
- pursuant to Art. 7(3) GDPR, the right to withdraw consent once given at any time with effect for the future;
- pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or of our registered office for this purpose. For our registered office, this is the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen (Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen).
Right to object
Insofar as we process personal data as explained above to protect our legitimate interests, which prevail in the context of a balancing of interests, you can object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you can exercise this right at any time as described above. If the processing is carried out for other purposes, you only have a right to object if there are grounds relating to your particular situation. After you have exercised your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims. This does not apply if the processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for this purpose.
7.2 Contact options
If you have any questions about the collection, processing or use of your personal data, about information, correction, restriction or deletion of data, or about withdrawing consent or objecting to a particular use of data, please contact us directly using the contact details below or the details in our legal notice.
The controller responsible for data processing is:
ATV GmbH
represented by the Managing Directors Ralf Janecki and Andreas Brehm
Konsul-Smidt-Str. 8H
28217 Bremen
Germany
Telephone: 0421 6964770
E-mail: shop@althaustea.sbs
Status of this privacy policy: 18.09.2026
