PRIVACY POLICY

Name and Address of the Company The responsible party within the meaning of the General Data Protection Regulation (hereinafter "GDPR") and other national data protection laws of the member states as well as other data protection regulations is:

soulbottles.de is represented by:

products with soul GmbH
Liegnitzer Str. 9
33098 Paderborn, Deutschland

Email: hello@soulbottles.com
Phone: +49 30 549050980
Managing Directors: Christian Seewald, Manuel Bode

General Data Processing

Scope and Permission for Processing Personal Data

We collect and use personal data of our users only to the extent necessary to provide the functionality of our website, content, and services. The collection and use of personal data of our users regularly occur only with the user's consent.

An exception applies in cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by legal regulations.

The legal basis for processing personal data when obtaining consent from the data subject is Art. 6(1)(a) GDPR. For processing personal data necessary for the performance of a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. If processing personal data is necessary to fulfill a legal obligation, the legal basis is Art. 6(1)(c) GDPR. If the processing is necessary to protect vital interests of the data subject or another natural person, Art. 6(1)(d) GDPR serves as the legal basis. If processing is necessary for the purposes of legitimate interests pursued by our company or a third party, and these interests outweigh the interests, fundamental rights, and freedoms of the data subject, then Art. 6(1)(f) GDPR serves as the legal basis.

Data Deletion and Storage Period

Personal data of the affected person will be deleted or blocked as soon as the purpose of storage ceases to apply. Storage may also occur if this is provided for by legal regulations. In this case, data will be deleted or blocked once the legally prescribed retention period expires unless further storage is necessary for contract fulfillment or contract execution.

Data Processing Through the Use of Our Website

Visiting Our Website

When you visit our website, the browser used on your device automatically sends information to our website server. This information is temporarily stored in a log file. The following information is collected without your intervention and stored until automatic deletion:

• IP address of the requesting device

• Date and time of access

• Name and URL of the accessed file

• Website from which access is made (referrer URL)

• Used browser and, if applicable, the operating system of your computer and the name of your access provider

 

The data mentioned above are processed for the following purposes:

• Ensuring a smooth connection to the website

• Ensuring a comfortable use of our website

• Evaluation of system security and stability

• Administrative purposes

The legal basis for data processing is Art. 6(1)(f) GDPR. Our legitimate interest follows from the above-listed purposes. Under no circumstances do we use the collected data to draw conclusions about you personally.

Use of Online Shop Functions

We process the data of our customers as part of order transactions in our online shop to enable them to select and order the chosen products and services, as well as to make payments and receive delivery or performance.

The data processed includes inventory data, communication data, contract data, and payment data. The persons affected by the processing include our customers, prospects, and other business partners.

The information you may provide to us directly through our services includes, in particular:

• Contact details including your name, address, telephone number, and email address.
• Order information including your name, billing address, shipping address, payment confirmation, email address, and telephone number.
• Account information including your username, password, security questions, and other information used for account security.
• Shopping information including items you view, place in your shopping cart, save in your account (e.g., loyalty points, reviews, recommendations, or gift cards), or purchases made.
• Stored loyalty points/product reviews/recommendations/gift cards.
• Customer support information including the information you include in your communication with us, such as when you send a message via the services.

Some features of the services may require you to provide certain information directly about yourself. You may choose not to provide this information, but this may result in you not being able to use or access those features.

The processing is carried out for the purpose of providing contractual services as part of operating an online shop, billing, delivery, and customer service. We use session cookies to store the contents of the shopping cart and permanent cookies to store the login status.

Processing is based on Art. 6 (1) lit. b (performance of order processes) and c (legally required archiving) of the GDPR. The information marked as mandatory is required for the conclusion and fulfillment of the contract. We only disclose data to third parties within the scope of delivery, payment, or legal permissions and obligations, for example to legal advisors or authorities. Data is only processed in third countries if necessary for the fulfillment of the contract (e.g., upon customer request for delivery or payment).

Users can optionally create a user account, where they can especially view their orders. During registration, users are informed of the required mandatory information. User accounts are not public and cannot be indexed by search engines. If users terminate their user account, their data related to the account will be deleted, subject to retention requirements under commercial or tax law in accordance with Art. 6 (1) lit. c GDPR. Information in the customer account remains until it is deleted, with subsequent archiving in the case of a legal obligation. It is the users' responsibility to back up their data before the end of the contract if the account is terminated.

During registration, re-login, and the use of our online services, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests, as well as those of the users, in protecting against misuse and other unauthorized use. This data is generally not passed on to third parties, unless it is necessary to pursue our claims or there is a legal obligation according to Art. 6 (1) lit. c GDPR.

Data is deleted after the expiration of statutory warranty and similar obligations. The necessity of retaining the data is reviewed every three years. In the case of statutory archiving obligations, deletion occurs after their expiration (end of commercial law (6 years) and tax law (10 years) retention periods).

Use of our contact form

Our website offers a contact form that can be used for electronic communication. If a user makes use of this option, the data entered in the contact form as well as the IP address, date, and time will be transmitted to us and stored. Your consent will be obtained as part of the submission process, and this privacy policy will be referenced. The legal basis for the processing of this data is Art. 6 (1) (a) GDPR.

Alternatively, it is possible to contact us via the provided email address. In this case, the personal data transmitted with the email will be stored. There will be no disclosure of this data to third parties. The legal basis for processing this data is Art. 6 (1) (f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR.

Data processing for the purpose of contacting us is carried out according to Art. 6 (1) sentence 1 (a) GDPR based on your voluntarily given consent. The personal data collected by us for the use of the contact form will be automatically deleted once your inquiry has been resolved.

Newsletter Subscription

We offer the opportunity to subscribe to our newsletter to receive regular updates on our offers. To subscribe, you need a valid email address, which we verify for ownership and authorization to receive the newsletter.

We use the service Brevo (Sendinblue GmbH) for our email campaigns. Brevo enables detailed analysis of email interactions, including whether and when newsletters were opened and which links were clicked. This data helps improve our service. Your personal data is stored securely on our servers and Brevo's servers. Newsletter data is stored on servers in Germany and deleted two years after the termination of the contractual relationship. You can unsubscribe at any time using the link in each email or by contacting us directly. Your data will then be deleted.

The legal basis for sending newsletters is your consent (Art. 6(1)(a) GDPR). If legally permissible, we may send emails based on our legitimate interest in direct marketing (Art. 6(1)(f) GDPR).

For more information, please refer to Brevo’s privacy policy: https://www.brevo.com/de/legal/privacypolicy/.

Transfer of data

Your personal data will not be transferred to third parties for purposes other than those listed below. We only pass on your personal data to third parties if you have given your express consent to this in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, if the disclosure in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR is necessary for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data, in the event that there is a legal obligation for the disclosure in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR, and this is legally permissible and necessary for the processing of contractual relationships with you in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR.

Use of Cookies

Our website uses cookies to enhance user experience. For details on cookies related to our Shopify store, please visit: https://www.shopify.com/legal/cookies.

Cookies are small files stored on users' devices. They help improve website usability, such as storing login data, and enable statistical analysis of website usage.

The legal basis for processing personal data using cookies is Art. 6(1)(f) GDPR. The use of technically necessary cookies is based on our legitimate interest in a functional website. The use of analysis cookies requires user consent (Art. 6(1)(a) GDPR).

Users can restrict or disable cookies in their browser settings, but this may impact website functionality.

This privacy policy is subject to change to comply with legal requirements or accommodate new functionalities on our website.

Third-Party Services

We have integrated content, services, and features from other providers on our website. In order for this data to be accessed and displayed in the user’s browser, the transmission of the IP address is essential. The providers (hereinafter referred to as "third-party providers") thus become aware of the respective user’s IP address.

Even though we strive to use only third-party providers that require the IP address solely to deliver content, we have no influence over whether the IP address may be stored. In such cases, this process serves statistical purposes, among others. If we become aware that the IP address is stored, we will inform our users accordingly.

Use of Google Analytics (with Anonymization Function)

The data controller has integrated the Google Analytics component (with anonymization function) on this website. Google Analytics is a web analytics service. Web analytics involves the collection, gathering, and analysis of data regarding the behavior of website visitors. A web analytics service collects, among other things, data about the website from which a person arrived at a website (so-called referrer), which subpages of the website were accessed, how often, and for what duration a subpage was viewed. Web analysis is mainly used to optimize a website and to conduct cost-benefit analyses of internet advertising.

The operating company of the Google Analytics component is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The data controller uses the "_gat._anonymizeIp" extension for web analysis via Google Analytics. This extension shortens and anonymizes the IP address of the user when accessing our website from a member state of the European Union or from another contracting state of the Agreement on the European Economic Area.

The purpose of the Google Analytics component is to analyze visitor flows on our website. Google uses the data and information obtained, among other things, to evaluate the use of our website, to compile online reports for us that show activities on our website, and to provide other services related to the use of our website.

Google Analytics places a cookie on the user's IT system. With each visit to a subpage of this website that integrates a Google Analytics component, the user’s browser is automatically prompted to transmit data to Google for online analysis. Through this process, Google gains knowledge of personal data, such as the user’s IP address, which Google uses, among other things, to trace the origin of visitors and clicks and to enable commission settlements.

The cookie stores personal information such as access time, location from which access was made, and the frequency of website visits. These personal data, including the user’s IP address, are transmitted to and stored by Google in the United States. Google may transfer these personal data to third parties.

Users can prevent cookies from being set by our website at any time by adjusting their internet browser settings accordingly, thereby permanently objecting to the placement of cookies. Such a setting would also prevent Google Analytics from placing a cookie. Additionally, cookies already set by Google Analytics can be deleted at any time via an internet browser or other software programs.

Furthermore, users can prevent Google Analytics from collecting and processing data relating to their website usage. To do so, users must download and install a browser add-on available at https://tools.google.com/dlpage/gaoptout. The installation of the browser add-on is considered an objection by Google. If the IT system of the user is later deleted, formatted, or reinstalled, the user must reinstall the browser add-on to disable Google Analytics.

Further information and Google's applicable privacy policy can be found at https://www.google.de/intl/en/policies/privacy/ and at http://www.google.com/analytics/terms/en.html. More detailed information about Google Analytics can be found at https://www.google.com/intl/en_us/analytics/.

 

Use and application of Google AdWords

The data controller has integrated Google AdWords on this website. Google AdWords is an internet advertising service that allows advertisers to place adverts in Google's search engine results as well as in the Google advertising network. Google AdWords allows an advertiser to specify certain keywords in advance, which are used to display an advert in Google's search engine results only when the user uses the search engine to retrieve a keyword-relevant search result. In the Google advertising network, the adverts are distributed to relevant websites using an automatic algorithm and taking into account the previously defined keywords.

The company operating the Google AdWords services is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of Google AdWords is to advertise our website by displaying interest-relevant adverts on the websites of third-party companies and in the search engine results of the Google search engine and by displaying third-party adverts on our website.

If a data subject reaches our website via a Google advert, a so-called conversion cookie is stored on the data subject's IT system by Google. What cookies are has already been explained above. A conversion cookie loses its validity after thirty days and is not used to identify the data subject. If the cookie has not yet expired, the conversion cookie is used to track whether certain sub-pages, such as the shopping basket from an online shop system, have been accessed on our website. The conversion cookie enables both us and Google to track whether a data subject who has reached our website via an AdWords ad has generated sales, i.e. completed or cancelled a purchase.

The data and information collected through the use of the conversion cookie is used by Google to compile visit statistics for our website. These visit statistics are in turn used by us to determine the total number of users who were referred to us via AdWords ads, i.e. to determine the success or failure of the respective AdWords ad and to optimise our AdWords ads for the future. Neither our company nor other Google AdWords advertisers receive information from Google that could be used to identify the data subject.

The conversion cookie is used to store personal information, such as the websites visited by the data subject. Each time our website is visited, personal data, including the IP address of the Internet connection used by the data subject, is transmitted to Google in the United States of America. This personal data is stored by Google in the United States of America. Google may share this personal data collected through the technical process with third parties.

The data subject may, as stated above, prevent the setting of cookies through our website at any time by means of a corresponding adjustment of the web browser used and thus permanently deny the setting of cookies. Such a setting of the Internet browser used would also prevent Google from placing a conversion cookie on the data subject's IT system. In addition, a cookie already set by Google AdWords can be deleted at any time via the internet browser or other software programmes.

Furthermore, the data subject has the option of objecting to interest-based advertising by Google. To do this, the data subject must call up the link www.google.de/settings/ads from each of the Internet browsers they use and make the desired settings there.

Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.de/intl/de/policies/privacy/.

 

Use and application of Google Tag Manager

We have integrated Google Tag Manager on our website. Google Tag Manager allows marketers to manage website tags via an interface. However, the Tag Manager itself, which uses the tags, works without cookies and does not collect any personal data. The Tag Manager merely triggers other tags, which in turn may collect data. Corresponding explanations for these respective third-party providers can be found in this privacy policy. However, the Google Tag Manager does not use this data. If you have set or otherwise deactivated cookies, this will be observed for all tracking tags used with Google Tag Manager, i.e. the tool will not change your cookie settings.

Google may ask you for permission to share some product data (e.g. your account information) with other Google products to enable certain features, such as making it easier to add new conversion tracking tags for AdWords. In addition, Google's developers review product usage information from time to time to further optimise the product. However, Google will never pass on this type of data to other Google products without your consent.

Further information can be found in Google's terms of use at https://www.google.com/intl/de/tagmanager/use-policy.html and in Google's privacy policy for this product at https://www.alphabet.com/de-de/datenschutzrechtlicher-hinweis.

 

Application and use of Google Web Fonts

External fonts, Google Fonts, are used on this website. Google Fonts is a service of Google Inc ("Google"). These web fonts are integrated by a server call, usually a Google server in the USA. This tells the server which of our web pages you have visited. The IP address of the browser of the end device of the visitor to this website is also stored by Google. You can find more information in Google's privacy policy, which you can access here:

www.google.com/fonts#AboutPlace:about

www.google.com/policies/privacy/

 

Application and use of Shopify

We use the online marketplace Shopify, whose service provider is Shopify International Limited, based at Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Shopify also processes your data in the USA, among other places. We would like to point out that, in the opinion of the European Court of Justice, there is currently no adequate level of protection for data transfers to the USA. This may entail various risks for the legality and security of data processing.

Shopify bases data processing with recipients in third countries (outside the European Union, Iceland, Liechtenstein and Norway, in particular in the USA) or the transfer of data to such countries on so-called standard contractual clauses (in accordance with Art. 46 para. 2 and 3 GDPR). These Standard Contractual Clauses (SCCs) are templates provided by the EU Commission. They serve to ensure that your data complies with European data protection standards even if it is transferred and stored in third countries, such as the USA. Through the standard contractual clauses, Shopify undertakes to comply with the European level of data protection when processing your data, even if the data is processed, stored or managed outside the EU. These regulations are based on an implementing decision of the EU Commission. You can find the corresponding decision and the standard contractual clauses at the following link https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

Further information on the standard contractual clauses and the data processed by Shopify can be found in the Privacy Policy at https://www.shopify.de/legal/datenschutz and in the FAQs on the GDPR at https://help.shopify.com/en/manual/your-account/privacy/GDPR/gdpr-faq#will-shopify-sign-standard-contractual-clauses.

 

Application and use of Hubspot

We use the CRM system of the provider HubSpot, Inc. (25 First Street, Cambridge, MA 02141 USA) to manage our customer and prospect data.

A CRM system or customer relationship management system is, as the name suggests, a system with which we manage the relationship and interaction with our (potential) customers. Among other things, contact details are saved here, offers and agreements are stored and further communication is planned. When you first contact us, we store your contact details in HubSpot and the information obtained from this conversation. If the contact between us and you is then continued, we will also store all the information we need for a possible collaboration with you there. This means that we can always see what agreements we have made, when our last contact with you was and which of our services you are interested in. This procedure is necessary due to the large number of customers and enquiries we receive. However, only employees who are entrusted with the processing or implementation of your enquiries or with the fulfilment of contracts with you have access to your data.

The legal basis for the storage of data in our CRM system is Art. 6 para. b) GDPR (fulfilment of a contract or implementation of pre-contractual measures) in conjunction with Art. 6 para. 1 lit. Art. 6 para. 1 lit. c) GDPR (fulfilment of legal obligations).

In summary, the following data may be collected, stored and processed by HubSpot:

Contact details (company, name, email, telephone number, contact person, department)

Offer content

Enquiries and correspondence

As HubSpot is a US company and some of HubSpot's data centres are located outside the EU, it is possible that the data collected from you (or parts thereof) may be stored outside the EU. We have a contract with HubSpot in which the so-called EU standard contractual clauses are taken into account and a data transfer to HubSpot is therefore legally permissible. The aforementioned personal data is stored for as long as it is required to fulfil the purpose of processing. The data will be deleted as soon as it is no longer required to fulfil the purpose or you request us to delete it. The right to erasure of your data may be suspended if we need the data due to a legal obligation or another overriding legitimate interest (e.g. defence against legal claims). You can find information on data protection at HubSpot here: https://legal.hubspot.com/de/privacy-policy

If we communicate with you by email, your necessary data must of course also be processed in our email programme. In addition, our email programme is linked to HubSpot so that all contact data stored in HubSpot can also be accessed by us via the email software.

The legal basis for the processing of data with our email programme is:

Art. 6 para. 1 lit. b) GDPR, insofar as the email correspondence takes place for the initiation, execution or termination of a contractual relationship.

Art. 6 para. 1 lit. a) GDPR, when sending newsletters or advertising requested by you.

Art. 6 para. 1 lit. f) GDPR, when sending e-mail advertising, e.g. in connection with a previous purchase or contract with the data subject.