The responsible person in the sense of the Basic Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:

ETERNA Mode GmbH
Media Street 12
94036 Passau (Germany)
Phone: (+49) 08 51 / 98 16-0
Fax: (+49) 08 51 98 16-465
Email: contact@eterna.de,

hereinafter referred to as "ETERNA".

If you have any questions regarding the collection, processing or use of your personal data, for information, correction, blocking or deletion of data and revocation of consents granted, please contact contact@eterna.de.

§ 2 Name and address of the data protection officer

The data protection officer can be reached by e-mail at datenschutz@eterna.de as well as at the contact details mentioned in § 1 with the addition "data protection officer".

§ 3 General information on data processing

(3.1) Scope of the processing of personal data

As a matter of principle, we only process personal data of our users insofar as this is necessary for the provision of a functional website as well as our contents and services. The processing of personal data of our users is regularly only carried out with the consent of the user. An exception applies in those cases in which obtaining prior consent is not possible for actual reasons and the processing of the data is permitted by legal regulations.

(3.2) Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6 (1) sentence 1 lit. a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Article 6 (1) sentence 1 lit. b) GDPR serves as the legal basis. This also applies to processing operations that are necessary for the implementation of precontractual measures.
Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which our company is subject, Article 6 (1) sentence 1 lit. c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person make it necessary to process personal data, Article 6 (1) sentence 1 lit. d) GDPR serves as the legal basis.
If the processing is necessary to protect a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Article 6 (1) sentence 1 lit. f) GDPR serves as the legal basis for the processing.

(3.3) Data deletion and storage period

The personal data of the data subject shall be deleted or blocked as soon as the purpose of the storage ceases to apply. Storage may also take place if this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the person responsible is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned standards expires, unless there is a necessity for the continued storage of the data for the conclusion or fulfilment of a contract.

(3.4) Note on data transfer to unsafe third countries

Among other things, tools from companies based in the USA are integrated on our website. If these tools are active, your personal data may be transferred to the US servers of the respective companies. We would like to point out that the USA is not a safe third country in the sense of EU data protection law. US companies are obliged to hand over personal data to security authorities without you as a data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data located on US servers for monitoring purposes. We have no influence on these processing activities. However, appropriate data protection agreements have been concluded with the service providers and, since July 2023, the United States has also been certified as having an adequate level of data protection in the European Union. To do this, US companies must submit to the Data Privacy Framework, which many of our US partners already use.

(3.5) Declaration of consent according to §25 para. 1 TTDSG

Depending on your consent, we use various tools on our website that process your data. Insofar as we base data processing on your declaration of consent in accordance with Art. 6 para. 1 lit. a GDPR and inform you about the purpose and mode of action of the declaration of consent in our data protection declaration, your consent also applies within the meaning of §25 para. 1 TTDSG.

Please refer to the data protection declaration to find out which cookies, plug-ins and other data processing tools are used.

§ 4 Provision of the website and creation of log files ("informational use")

(4.1) Description and scope of data processing

Each time you visit our website (i.e. even if you only use our website for informational purposes), our system automatically collects data and information from the computer system of the calling computer. Your internet browser therefore transmits usage data, which is stored in log files (so-called server log files). The data records stored contain the following data:

- Browser type/version of the user,
- Operating system of the user,
- Unit identifier
- IP address/Internet service provider of the user ,
- Date/time of access,
- Websites from which the user's system accesses our website (Refferer URL)
- Websites that are accessed by the user's system via our website.
- http reply code

The data is stored in the log files of our system. This data is not stored together with other personal data of the user.

(4.2) Legal basis for data processing

The legal basis for the temporary storage of the data and the log files is Art. 6 para. 1 p. 1 lit. f) GDPR.

(4.3) Purpose of the data processing

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session. The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context.

These purposes are also our legitimate interest in data processing according to Art. 6 para. 1 p. 1 lit. f) GDPR.

(4.4) Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated so that an assignment of the calling client is no longer possible.

(4.5) Possibility of objection and removal

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.

§ 5 Use of cookies

(5.1) Description, scope and purpose of data processing

(5.1.1) Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user calls up a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. Cookies help to optimise the offers of the website or also of the online shop, e.g. by saving your personal preferences or enabling the storage of your virtual shopping basket. The information collected does not allow any conclusions to be drawn about a specific person and does not contain any data such as your name.

This website uses

- Technically required cookies
These technologies are required to enable the core functionality of the website. Technically necessary cookies help make a website usable by enabling basic functions such as page navigation and access to secure areas of the website. The ETERNA Online Shop cannot function properly without these cookies.

- Functionality cookies,
Functional cookies help us to make the experience in the ETERNA online shop even better for you and to provide you with enhanced features (e.g. our "friends refer friends" programme, our Store Finder or videos).

- Analysis and statistics cookies
These cookies help us understand how visitors interact with the ETERNA online shop by providing data about which web pages or search terms bring users to our online shop, how long they typically stay on our pages, or how many sub-pages they view on average. We use this data to improve the content of our websites and to compile statistics on the performance of our websites for internal market analysis purposes. This data does not allow any direct conclusions to be drawn about your person. All the data we collect is only processed in aggregated form.

- Marketing and retargeting cookies
These technologies are used by advertisers to serve content and ads that are relevant to you and your interests. This allows you to shop for your favourite products via ads from anywhere - for example, via search engines and on social networks. Marketing and retargeting cookies help us and our (advertising) partners to provide personalised advertising and limit the frequency with which you are shown an advertisement. They also help us to assess the effectiveness of advertising campaigns.

(5.1.2) Transient cookies are automatically deleted when you close the browser. These include, in particular, session cookies. These store a so-called session ID, with which various requests from your browser can be assigned to the joint session. This enables your computer to be recognised when you return to the website. The session cookies are deleted when you log out or close the browser.

(5.1.3) Persistent cookies are automatically deleted after a predefined period of time, which may differ depending on the cookie. The maximum storage period of cookies set by ETERNA is 60 days. You can delete the cookies in the security settings of your browser at any time.

(5.2) We use the Usercentrics service of Usercentrics GmbH, Rosental 4, 80331 Munich, Germany ("User-centrics") to comply with our obligations under data protection law, in particular to manage and control automated data processing and consent under data protection law. This service helps us to obtain consents for cookies and tracking as required by law. When you visit our website, the Usercentrics script is automatically loaded. On your first visit, a window opens (so-called "cookie banner") in which you can give your consent to the use of cookies in general or make user-defined settings. Usercentrics saves this selection and then loads further cookies according to your consent or other legal basis. On further visits, the cookie banner will no longer open, but Usercentrics will immediately load the cookies according to your selection on the first visit. You can change this selection at any time under "Cookie settings" in the lower area of our website (so-called footer) with effect for the future. You can also change the cookie settings under Cookie Settingsview.

Usercentrics collects the date and time of your visit, device information, browser information, your anonymised IP address and information about your selection in the privacy settings. Insofar as this data allows conclusions to be drawn about you personally, Usercentrics does not use it for its own purposes and processes it exclusively in the European Union. Further information on data protection at Usercentrics is available at https://usercentrics.com/de/datenschutzerklaerung/.

The legal basis for the use of Usercentrics is Art. 6 (1) lit. c GDPR, as the use is necessary to comply with our legal obligations regarding data protection, in particular the GDPR.

(5.3) Further legal basis for data processing

The legal basis for the processing of personal data at using cookies is Art. 6 para. 1 p. 1 lit. f) GDPR . Our legitimate interest in processing your personal data also lies in the purposes described above.

(5.4) Possibility of objection and removal

Cookies are stored on the user's computer and transmitted from it to our site. Therefore, you as a user also have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser as well as under " Cookie settings " in the lower area of our website (so-called footer) or under Cookie Settings. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.

The following links will help you find out how to make settings to reject or accept cookies in the most commonly used browsers:

- Internet Explorer / Windows Edge: https://windows.microsoft.com/de-de/windows-vista/block-or-allow-cookies
- Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
- Google Chrome: https://support.google.com/chrome/answer/95647?hl=de
- Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
- Opera: https://help.opera.com/Windows/10.20/de/cookies.html.

§ 6 Data processing in the ETERNA online shop

(6.1) If you wish to order something from the ETERNA online shop, you have the choice of providing your data required for the order only once for this order (guest order) or whether you wish to create a password-protected customer account in which your data is stored for subsequent further purchases.

(6.2) Guest order

(6.2.1) Description and scope of data processing

Your personal data is entered into an input mask and transmitted to us and stored. For your order as a guest, we require the following personal data as "mandatory data":

- Salutation
- First name,
- Last name,
- Street, house number, postcode, city, country (billing or delivery address),
- Date of birth,
- E-mail address,
- Data about the order.

It is not possible to place an order without providing the fields marked as mandatory. Furthermore, we store the IP address of the user as well as the date and time of access.

(6.2.2) Legal basis for data processing

The data processing is carried out in response to your order and is necessary in accordance with Art. 6 para. 1 p. 1 lit. b) GDPR for the processing of your order or for the fulfilment of the obligations resulting from the concluded purchase contract.

(6.2.3) Purpose of the data processing

The collection of this data takes place,

- to be able to identify you as our customer;
- in order to be able to process, fulfil and handle your order;
- to be able to conduct correspondence with you;
- for invoicing;
- for the settlement of any existing liability claims, as well as the assertion of any claims against you.

We need your date of birth to ensure clear identification of the customer or the customer data. You must also be at least 18 years old to place an order in the ETERNA Online Shop.

If you have selected purchase on account as a payment method, your date of birth will also be passed on to our service provider for credit assessment purposes.

As ETERNA will send you an access or order confirmation by e-mail, it is also necessary to provide your e-mail address.

(6.2.4) Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case for the data stored for the fulfilment of the purchase contract when the data is no longer required for the execution of the contract. Even after the conclusion of the contract, it may be necessary to store personal data of the contractual partner in order to comply with contractual or legal obligations. The personal data collected by us for the processing of your order will therefore be stored until the expiry of the legal obligation to keep records and then deleted, unless we are required by Art. 6 para. 1 p. 1 lit. c) GDPR, we are obliged to store the data for a longer period of time due to tax and commercial law retention and documentation obligations (from HGB, StGB or AO), you have consented to additional storage according to Art. 6 Para. 1 S. 1 lit. a) GDPR or a justified interest according to Art. 6 Para. 1 S. 1 lit. f) GDPR is given.

(6.3) Data processing in connection with the customer account

(6.3.1) Description and scope of data processing

(6.3.1.1) Registration

On our website (in particular also in the context of an order process of our online shop), we offer users the opportunity to register with a customer account by providing personal data (so-called "basic data") and also to participate in the bonus programme. The data is entered, transmitted and stored in an input mask.

The following basic data is collected as mandatory information as part of the registration process:
- Salutation
- First name,
- Last name,
- Street, house number, postcode, city, country,
- E-mail address,
- Password.

Online registration is not possible without providing this basic data. We also store the user's IP address and the date and time of access. If you have decided to voluntarily provide a title or telephone number, these will also be stored.

By sending the digital application form, you initiate the creation of a personalised password-protected customer account . Following registration, a confirmation email is sent, which completes the creation of the customer account. A further confirmation is not necessary.

(6.3.2) Data collection after registration

Once you have registered, your personal customer number will be assigned and the medium of your registration will also be saved. In addition, the purchases you have made (date, article, article number, clothing size, quantity, price, currency, type of transaction) are registered and the resulting loyalty points (booking type (e.g. purchase), booking date, total number) are saved.
In addition, we collect and store your other voluntary information that you provide in your customer account, e.g. your preferences ("SHIRTID").

(6.4) Legal basis for data processing

By registering with your customer account, you have consented to the processing of your data, which is why the legal basis for this data processing is Art. 6 para. 1 p. 1 lit. a) GDPR. Furthermore, the processing of the data you have provided is necessary for the implementation of the customer loyalty programme, so that Art. 6 para. 1 p. 1 lit. b) GDPR constitutes an additional legal basis for the processing of the data.

(6.5) Purpose of the data processing

The data collected is necessary for the implementation of the customer loyalty programme. Your name and date of birth are used to verify that you are of age and for identification purposes. The e-mail address or postal address you provide will be used for sending the vouchers and for regular information about your current points balance or about special promotions in connection with the bonus programme (including double or extra points). The registration of your purchases made and the resulting loyalty points is the basis of the voucher dispatch.
Via the customer account you can view the data of your completed, open or even recently shipped orders as well as correct/manage the data you provided during registration.

(6.6) Duration of data processing

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case for the data collected during the registration process when the registration is cancelled or modified.

(6.7) Right of withdrawal; removal claim

In order to delete the registration or to change the data stored about you, you can contact us by e-mail at service@eterna.de or send a message (e.g. fax or letter) to the ETERNA contact details given in § 1.

(6.8) CRM system from Salesforce

(6.8.1) The personal data collected from you in connection with the registration in the customer account will be transferred to the CRM system ("Customer-Relationship-Management") of the cloud provider Salesforce (salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany; "Salesforce") and managed there. You can view Salesforce's privacy policy here: https://www.salesforce.com/de/company/privacy/. Further information on the GDPR can be found at https://www.salesforce.com/de/campaign/gdpr/. Of course, an order processing agreement has been concluded between ETERNA and Salesforce.

(6.8.2) Although Salesforce has a branch in Germany, its headquarters are in the USA. Therefore, it cannot be ruled out that the above-mentioned data will be transferred to the USA. Further information on certification can be found at the following link: https://www.privacyshield.gov/welcome.

(6.8.3) The processing of your data by Salesforce is based on Art. 6 para. 1 sentence 1 lit. a) GDPR (as you have registered with a customer account and thus consented) and Art. 6 para. 1 sentence 1 lit. b) GDPR ("processing for the fulfilment of the bonus programme").

(6.8.4) You have the option to revoke your consent to data processing or to object to data processing at any time. As already explained under (6.7), you have the option to delete the registration of the customer account at any time and thus object to the further use of your data.

(6.9) SHIRTID

You have the option of creating a SHIRTID in your customer account and saving your product preferences. You can view the available products in our online shop without any obligation or have them conveniently sent to you by e-mail. The legal basis for this is Art. 6 para. 1 p. 1 lit. a) GDPR.
The following details are saved: fit, size, sleeve length, cuff, collar shape, favourite colour and favourite pattern.
You can change or delete the SHIRTID at any time in your customer account.

§ 7 Data transmission for contract processing

In order to process your order, we work together with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information. We pass on your payment data to the commissioned credit institution within the framework of payment processing, insofar as this is necessary for payment processing. If payment service providers are used, we explicitly inform you about this below. The personal data collected by us will be passed on to the transport company commissioned with the delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods. The legal basis for the transfer of the data in this respect is Art. 6 para. 1 p. 1 lit. b) GDPR.
As part of a processing operation on our behalf, a third-party provider provides the services for hosting and displaying the website. All data collected in the course of using this website or in forms provided for this purpose in the online shop as described below are processed on its servers.

(7.1) Payment transactions; payment providers

Payment transactions via the common means of payment are carried out exclusively via an encrypted SSL connection.

(7.1.1) Payment

For the purposes of payment processing (i.e. making payments by credit card, iDEAL, PayPal, ApplePay, GooglePay and Bancontact), we process the personal data required for this and pass this on to payment service providers commissioned by us.

Depending on your chosen payment method, the data required for payment processing will be transmitted to the selected payment service provider. You can find more information about the payment methods and providers offered below. Regardless of the payment method, all data is transmitted encrypted.

We use the service provider Adyen (Adyen BV, Simon carminggeltstraat 6-50, 5th floor, PO Box 10095, 1001 EB Amsterdam, Netherlands) for the technical connection of the payment service providers and the processing of payments. Further information about data protection at Ayden can be found athttps://www.adyen.com/de_DE/linien-und-haftungsaustritt/privacy-policy. For more information about Google/ Apple Pay, please see their privacy policy Google Payments and Apple Pay.

The legal basis for processing your data for payment processing is Article 6 paragraph 1 letter b) GDPR, regardless of the payment method. For further details and legal bases, please see the information on the payment service providers used.

In accordance with Section 257 Paragraph 1 of the German Commercial Code (HGB) and Section 147 Paragraph 2 of the AO, we must retain all data (payment receipts) generated during payment processing for 10 years. The period begins at the end of the year in which the last order was placed.

(7.1.2) PayPal (only DE, AT, CH, GB, FR, NL, BE, LU, IRL, ES, DK)

On our website we offer, among other things, payment via PayPal. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal").
If you select payment via PayPal, the payment data you enter will be transmitted to PayPal.
The transfer of your data to PayPal is based on Art. 6 para. 1 p. 1 lit. a) GDPR (consent) and Art. 6 para. 1 p. 1 lit. b) GDPR (processing for the performance of a contract).
For further information on data protection, please refer to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
You have the possibility to revoke your consent to data processing or to object to data processing at any time. A revocation does not affect the validity of past data processing operations.

(7.1.3) iDEAL (NL only)

If you select the payment method "iDEAL", the payment will be processed via the payment service provider Currence iDEAL BV (hereinafter: "iDEAL"), to whom we will pass on the information you provided during the ordering process, together with information about your order.
You can obtain further information about iDEAL's data protection policy at the following Internet address: https://www.ideal.nl/disclaimer-privacy/.

You have the possibility to revoke your consent to data processing or to object to data processing at any time. A revocation does not affect the validity of past data processing operations.

(7.1.4) Address validation and verification; credit assessment

Please note that for the purpose of address validation and verification as well as credit assessment, personal data may be transferred to GFKL PayProtect GmbH, Am Europa-Center 1b, 45145 Essen, Germany, or to infoscore Consumer Data GmbH, Rheinstr. 99, 76532 Baden-Baden, Germany (in AT: Credify Informationssysteme GmbH, Gumpendorfer Straße 21, 1060 Vienna, Austria), (in NL: Experian Netherlands B.V., Grote Markstraat 49, NL-2511 BH Den Haag), (in CH: CRIF AG Hagenholzstrasse 81, 8050 Zurich, Switzerland), (in BE: Focum, situé à Bellevue 3, 9050, Gent, Belgique). Further details can be found under §8 of this data protection notice

(7.2) Shipping service provider

Our goods will be delivered to you by the shipping service provider DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn) or DPD (DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg).

Pursuant to Art. 6 para. 1 sentence 1 lit. a) of the German Data Protection Act (GDPR), we will pass on your e-mail address to the shipping service provider prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, provided you have given your express consent to this in the ordering process. Otherwise, we will only pass on the name of the recipient and the delivery address to the shipping service provider on the basis of Art. 6 Para. 1 lit. b) GDPR for the purpose of delivery. This information is only passed on if it is necessary for the delivery of the goods. In this case, prior coordination of the delivery date with the shipping service provider or notification of delivery is not possible.

Consent may be revoked at any time with effect for the future. A revocation does not affect the validity of past data processing operations.

§ 8 Data transmission for address validation and verification as well as credit assessment

For the purpose of address validation and verification, personal data will be transmitted to GFKL PayProtect GmbH, Am Europa-Center 1b, 45145 Essen.
For the purpose of credit assessment, personal data will be transmitted to infoscore Consumer Data GmbH, Rheinstr. 99, 76532 Baden-Baden.

(8.1) Address validation and verification

(8.1.1) Description and scope of data processing

For the purpose of address validation and address verification, the data entered in ETERNA's online shop will be processed during the order process.

- Street,
- House number,
- Postcode,
- the place as well as the
- Country

to GFKL PayProtect GmbH, Am Europa-Center 1b, 45145 Essen.

For this purpose, GFKL PayProtect GmbH obtains information from the following service providers:

Address validation:
- Creditreform Boniversum GmbH, Hellersbergstraße 11, 41460 Neuss, Germany
- ACS Informatik GmbH, Offenbachstraße 47, 81245 Munich, Germany
- AddressDoctor GmbH, Röntgenstraße 9, 67133 Maxdorf

Address verification:
- Creditreform Boniversum GmbH, Hellersergstraße 11, 41460 Neuss, Germany
- arvato infoscore GmbH, Rheinstraße 99, 76532 Baden-Baden, Germany
- Deutsche Post Direkt GmbH, Junkersring 57, 53844 Troisdorf.

(8.1.2) Legal basis for the processing

The address validation and verification serves to fulfil the purchase contract concluded with us, as this is used to check whether the ordered goods can be delivered at all to the address specified during the order process. In this respect, Art. 6 para. 1 p. 1 lit. b) GDPR constitutes a legal basis. Another legal basis for this form of data processing is Art. 6 para. 1 p. 1 lit. f) GDPR.

(8.1.3) Purpose of the data processing

This address validation and verification serves to check whether the goods ordered by you can be delivered to the address provided at all. This is also our legitimate interest. Furthermore, this is also in your interest, as such a comparison of the address detects any input errors in the address you provided during the order process and you can correct this as a result.

(8.1.4) Right of objection

You can object to the transmission of this data to GFKL PayProtect GmbH at any time.

(8.2) Credit assessment for "purchase on account" (only DE, CH, AT, NL, BE)

(8.2.1) Description and scope of data processing

ETERNA also offers "invoice" as a payment method. If you choose this payment method during the ordering process, ETERNA will transmit the necessary personal data to a carefully selected service provider for the purpose of a credit check. The transmission of personal data will only take place after the aforementioned address validation and address verification and will only take place if you select the "invoice" payment method. In this way, ETERNA prevents potential bad debt losses and possible misuse associated with "purchase on account".

When selecting the payment method "invoice", ETERNA obtains a credit report based on mathematical-statistical methods using address data in order to protect its legitimate interests. ETERNA obtains the information required for this from infoscore Consumer Data GmbH, Rheinstr. 99, 76532 Baden-Baden. (in AT: Credify Informationssysteme GmbH, Gumpendorfer Straße 21, 1060 Vienna), (in NL: Experian Netherlands B.V., Grote Markstraat 49, NL-2511 BH Den Haag), (in CH: CRIF AG Hagenholzstrasse 81, 8050 Zurich, Switzerland.), (in BE: Focum, situé à Bellevue 3, 9050, Gent, Belgique).

For this purpose, ETERNA shall transmit the personal data required for a credit assessment, i.e.
- Name,
- Address

On the basis of this information, a statistical probability of a credit default is calculated and the decision on the further implementation of the contractual relationship is made on this basis. Your interests worthy of protection are taken into account in accordance with the legal provisions.

If the credit check is positive, an order on account is possible. If the credit check is negative, our shop system will not offer you payment on account.

(8.2.2) internal scoring

In cases where the customer wishes to order from ETERNA using an unsecure method of payment, ETERNA shall be entitled to use information obtained in the course of the order or the ongoing customer relationship to calculate a probability of default (internal scoring). For example, if a certain reminder level is reached, purchase on account can no longer be offered.

(8.2.3) Fraud prevention

The data provided as part of your order may be used by ETERNA to check whether an atypical order transaction has occurred (e.g. simultaneous ordering of a large number of goods to the same address using different customer accounts). In principle, ETERNA has a legitimate interest in carrying out such a check (e.g. avoiding payment defaults/identity theft).

(8.2.4) Legal basis for processing

The collection, storage and forwarding is therefore carried out for the purpose of checking creditworthiness in order to avoid a payment default and on the basis of Art. 6 (1) sentence 1 lit. b) GDPR and Art. 6 (1) sentence 1 lit. f) GDPR.

(8.2.5) Purpose of the data processing

The credit check serves exclusively to avoid non-payment, since in the case of a "purchase on account" you first receive the goods and only then have to make the payment. In this respect, we make an "advance payment". This is also our legitimate interest.

(8.2.6) Right of objection

You may consent to the transfer of your data to infoscore Consumer Data GmbH, Rheinstr. 99, 76532 Baden-Baden (in AT: Credify Informationssysteme GmbH, Gumpendorfer Straße 21, 1060 Vienna), (in NL: Experian Netherlands B.V., Grote Markstraat 49, NL-2511 BH Den Haag), (in CH: CRIF AG Hagenholzstrasse 81, 8050 Zurich, Switzerland), (in BE: Focum, situé à Bellevue 3, 9050, Gent, Belgique) at any time. However, ETERNA would like to point out at this point that in the event of such an objection to the transfer of data for the purpose of your credit check, the "invoice" payment method will not be available to you.

(8.3) Information on the credit report

Detailed information on infoscore Consumer Data GmbH (in AT: Credify Informationssysteme GmbH, Gumpendorfer Straße 21, 1060 Vienna) , (in NL: Experian Netherlands B.V., Grote Markstraat 49, NL-2511 BH Den Haag) ), (in CH: CRIF AG Hagenholzstrasse 81, 8050 Zurich, Switzerland), (in BE: Focum, situé à Bellevue 3, 9050, Gent, Belgique) i. S. d. Art. 14 European Data Protection Regulation ("EU GDPR"), i.e. information on the business purpose, purposes of data storage, data recipients, right to self-disclosure, right to deletion or rectification etc. can be found at https://finance.arvato.com/icdinfoblatt (in AT: https://www.credify.at/art-14-GDPR-info/); (in NL: https://www.experian.nl/contact/contact-consumenten); (in CH: https://www.crif.ch/datenschutz/), (in BE: https://www.focum.be)

(8.4) Information on free self-disclosure for credit reports

We are unable to provide information ourselves for data protection reasons in connection with the automated credit assessment described. In this case, please contact us in writing at:

infoscore Consumer Data GmbH
Rheinstraße 9976527
Baden-Baden or online:
https://finance.arvato.com/de/verbraucher/selbstauskunft/selbstauskunft-anfordern.html

For the sole purpose of debt collection, we transfer your personal data to Paigo GmbH, Gütersloher Str. 123, 33415 Verl.

For AT:
For data protection reasons, we ourselves cannot provide any information on questions in connection with the automated creditworthiness check described above. In this case, please contact us in writing:

Credify Informationsdienstleistungen GmbH,
Gumpendorfer Street 21
1060 Vienna or by e-mail to:
datenschutz@credify.at

Further information is available at: https://www.credify.at/art-14-GDPR-info/ - Point 8

We inform you that in the event that you do not comply with this request for payment in due time and do not settle the claim in full without disputing the existence of the claim, your claim data (name, address data and the outstanding amount) will be transmitted to Credify Informationsdienstleistungen GmbH, Gumpendorfer Straße 21, 1060 Vienna, for lawful use within the scope of its trade licence pursuant to §151 GewO (address publisher) and §152 GewO (credit agency on credit relationships). Credify Informationsdienstleistungen GmbH invokes legitimate interests within the meaning of Art 6 (1) lit f EU-GDPR for the storage of this data and the transfer to third parties making enquiries. Detailed information on data processing at Credify Informationsdienstleistungen GmbH within the meaning of Art. 14 EU-GDPR can be found on their website at www.credify.at/datenschutz.

For NL:
If you have any questions regarding the aforementioned automated credit assessment, we cannot provide any information ourselves for data

protection reasons. In this case, please contact the following party in writing:

infoscore Nederland B.V. [Payment Claims Management],
K.R. Poststraat 90-5
8441 ER Heerenveen or online:
https://www.experian.nl/contact/contact-consumenten

The following information is required: copy of ID, address and name of the audited company (ETERNA).

For the sole purpose of debt collection, we transfer your personal data to infoscore Nederland B.V. [Payment Claims Management] , K.R. Poststraat 90-5, 8441 ER Heerenveen.

For CH:
For data protection reasons, we ourselves cannot provide any information on questions in connection with the automated creditworthiness check described above. In this case, please contact us in writing at:

CRIF AG
Hagenholzstrasse 81
8050 Zurich, Switzerland or online at:
https://www.crif.ch/privatpersonen/selbstauskunft/

Further information is available at: https://www.crif.ch/privatpersonen/haeufig-gestellte-fragen/

For the sole purpose of debt collection, we transfer your personal data to infscore CRIF AG,Hagenholzstrasse 81, 8050 Zurich, Switzerland.

For BE:
For data protection reasons, we cannot provide any information for questions in connection with the automated creditworthiness check shown. In this case, please contact us in writing at:

Focum (registered office: Bellevue 3, 9050, Ghent, Belgium) or online:
https://www.focum.be/consumenten/gegevens-opvragen/

For the sole purpose of debt collection, we transfer your personal data to infoscore Nederland B.V., K.R. Poststraat 90-5, 8441 ER Heerenveen.

§ 9 Contact

(9.1) Description and scope of data processing

When you contact ETERNA by e-mail or telephone, your e-mail address and, if you so indicate, the personal data forwarded with the e-mail (e.g. your name and telephone number) will be stored by ETERNA in order to answer your questions. In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation.
In order to provide you with good customer service, we work with external communication service providers who may access the following data for the purpose of processing your orders and customer enquiries: First name, last name, postal address, email address, telephone number, order history, communication data.

(9.2) Legal basis for the processing

By sending us an enquiry by e-mail, you have consented to the processing of your data transmitted thereby, which is why the legal basis for this data processing is Art. 6 para. 1 p. 1 lit. a) GDPR. Furthermore, the processing of the data you have provided is necessary to process your enquiry, so that Art. 6 para. 1 p. 1 lit. f) GDPR constitutes an additional legal basis for the processing of the data.

(9.3) Purpose of the data processing

The processing of personal data serves us solely to process the contact.

(9.4) Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Mandatory legal provisions - in particular retention periods - remain unaffected.

(9.5) Possibility of objection and removal

You have the option to revoke your consent to the processing of personal data or to object to the storage of your personal data at any time. Please note that in such a case, the conversation cannot be continued.

§ 10 Newsletter; product recommendations for similar goods; direct mail advertising

(10.1) ETERNA Newsletter

(10.1.1) Description and scope of data processing

You have the option of subscribing to the free ETERNA newsletter, with which we inform you about our current interesting offers. The advertised goods are named in the declaration of consent. ETERNA uses the so-called double opt-in procedure to register for the newsletter. This means that after you have registered by entering your email address, ETERNA will send you a confirmation email to the email address you have given, in which ETERNA asks you to confirm that you wish to receive the newsletter. This ensures that no third party has used your data. You must confirm your registration within 24 hours in order to activate your registration.

The only mandatory information for sending the newsletter is your e-mail address. The provision of further, separately marked information is voluntary and will only be used to personalise the newsletter.

Furthermore, ETERNA stores your IP addresses together with the date and time of registration and confirmation. The purpose of this procedure is to verify your registration and, if necessary, to be able to clarify any possible misuse of your personal data.

(10.1.2) Legal basis for processing

The data entered in the newsletter registration form is processed exclusively on the basis of your consent pursuant to Art. 6 (1) p. 1 lit. a) GDPR.

(10.1.3) Purpose of the data processing

The collection of the user's email address is used to deliver the newsletter.

(10.1.4) Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.

(10.1.5) Right of withdrawal; right of removal

You may cancel your subscription to the newsletter at any time (i.e. revoke the consent given at any time). The revocation can be declared by clicking on the link provided in every newsletter email, by email to service@eterna.de or by sending a message (e.g. fax or letter) to the ETERNA contact details given in § 1. The legality of the data processing operations already carried out remains unaffected by the revocation.

(10.2) Product recommendations for similar goods from ETERNA

(10.2.1) Description and scope of data processing

ETERNA uses the e-mail address you provide in connection with the purchase of goods, in addition to the processing of the contract, to inform you regularly by e-mail about its own similar goods by way of direct advertising. This takes place regardless of whether you have registered for the newsletter or not.

(10.2.2) Legal basis for processing

The legal basis for sending the product recommendation email as a result of the sale of goods or services is Section 7 (3) UWG. The legal basis under data protection law is the legitimate interest of ETERNA pursuant to Art. 6 para. 1 p. 1 lit. f) GDPR.

(10.2.3) Purpose of the data processing

The purpose of processing the e-mail address is to send you information about new products and current offers.

(10.2.4) Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.

(10.2.5) Right of objection and removal

You can object to using your email address to send product information to ETERNA at any time , without incurring any costs other than the transmission costs according to the basic rates. You can declare your objection by clicking on the link provided in every product recommendation e-mail, by e-mail to service@eterna.de or by sending a message (e.g. fax or letter) to the ETERNA contact details given in § 1.

(10.3) Newsletter tracking

(10.3.1) The newsletter and the product information e-mail are sent using "Email Studio", a newsletter dispatch platform of the cloud provider Salesforce (salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany; "Salesforce"). You can view the data protection provisions of the shipping service provider here: https://www.salesforce.com/de/company/privacy/. Further information on the GDPR can be found at https://www.salesforce.com/de/campaign/gdpr/.

(10.3.2) The email addresses of the recipients are stored on the servers of Salesforce. Salesforce uses this information to send and evaluate the newsletters and product information emails on our behalf. Furthermore, Salesforce uses this data to optimise or improve its own services, e.g. to technically optimise the dispatch and presentation of the newsletters/product information emails or for statistical purposes to determine which countries the recipients come from. The use of this data takes place in pseudonymous form, i.e. without assignment to a user.

(10.3.3) The newsletters and product information emails contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from the Salesforce server when the email is opened. In the course of this retrieval, technical information such as information on the browser and your system, as well as your IP address and the time of the retrieval are initially collected. This information is used for the technical improvement of the services on the basis of the technical data or the target groups and their reading behaviour on the basis of their retrieval locations (which can be determined with the help of the IP address) or the access times. The statistical surveys also include the determination of whether the newsletters or the product information e-mail are opened, when they are opened and which links are clicked. For technical reasons, this information can be assigned to the individual recipients, whereby the evaluations only serve to recognise the reading habits of our users and to adapt our content to them, to improve it or to send different content according to the interests of our users.

(10.3.4) Although Salesforce has a branch in Germany, its headquarters are in the USA. It can therefore not be ruled out that the above-mentioned data will be transferred to the USA. . Further information on certification can be found at the following link: https://www.privacyshield.gov.

(10.3.5) The legal basis for data processing is Art. 6 para. 1 sentence 1 lit. a) GDPR due to your registration for the newsletter or Art. 6 para. 1 sentence 1 lit. f) GDPR with regard to the product recommendation email. Your consent also includes the possible transfer of data to unsafe third countries (Art. 49 para. 1 lit. a GDPR). You can unsubscribe from the newsletter at any time and object to the use of your email address to send product information. As a result, Salesforce will no longer process your data for the aforementioned purposes. In this regard, we refer to the explanations under (10.1.5) and (10.2.5) of this data protection notice.

(10.4) Direct mail advertising

(10.4.1) Description and scope of data processing

ETERNA will use the postal address you provide in connection with the purchase of goods (together with your name) to send you regular information by letter by way of direct marketing (e.g. to send you interesting offers and information about our products).

(10.4.2) Legal basis for processing

The legal basis for direct mail advertising is Art. 6 para. 1 p. 1 lit. f) GDPR.

(10.4.3) Purpose of the data processing

The collection of your name and address is also used to send you direct marketing by letter. According to recital 47 to the GDPR, the processing of personal data for the purpose of direct marketing can be considered as processing serving a legitimate interest. In this context, it must be taken into account in particular that a customer relationship exists between you and ETERNA as a result of your purchase and that we therefore have a legitimate interest in informing you about current offers from now on.

(10.4.4) Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.

(10.4.5) Right of objection

You can object to this form of direct advertising by letter to ETERNA at any time. You can declare your objection by sending an e-mail to service@eterna.de or by sending a message (e.g. fax or letter) to the ETERNA contact details given in § 1.

§ 11 Participation in competitions, prize draws or other promotions

ETERNA organises competitions, prize draws or other promotions at irregular intervals. If the provision of personal data is required for the purpose of your participation (e.g. your name, address or email address), ETERNA will use this data exclusively for the purpose of conducting the competition, prize draw or other promotion. You can find more details in the respective separate conditions of participation and separate data protection notices.

§ 12 Use of cookies and similar technologies

In order to make the visit to our website attractive and to enable the use of certain functions, we use so-called cookies on various pages.

With the use of measures, we would like to ensure a needs-based design and the ongoing optimisation of our website. In addition, we use the tools to statistically record the use of our website and to evaluate it for the purpose of optimising our offer for you. These interests are to be regarded as legitimate within the meaning of the aforementioned provision.

For a list of the cookies we use, descriptions of the purposes of the cookies and further information about each cookie, please see. Cookie Settings ; in our cookie consent solution.

You can accept or reject individual or all cookies separately when you first visit our website and then at any time in our cookie consent solution by placing a green tick next to the respective cookie or removing it and then clicking on "Save settings".

The settings you make in the cookie consent solution are saved on your computer or mobile device. You will therefore need to make them again if you delete your browsing history or use a different device or internet browser.

(12.1) SAIZ size advisor

We use the services of SAIZ (SAIZ GmbH, Nostiltzstr. 23, 10961 Berlin, Germany, hereinafter “SAIZ”) on our website. SAIZ collects, processes and stores personal data from website visitors to provide personalized size and fit recommendations, statistical analysis and business cost optimization. In particular, SAIZ processes the following personal data: Data that you provide in order to receive a personalized size recommendation such as age, gender, height in cm, chest circumference if applicable, hip circumference if applicable, waist circumference if applicable, weight, information on body structure and the body shape of visitors to the website. In addition, the IP address of the website visitor is stored. SAIZ collects this data via persistent cookies, which are stored in the website visitor's local browser. SAIZ stores the profiles of each visitor in the local browser of the website visitor. The data collected is processed by SAIZ in the European Union. The provision is not required by law or contract or is absolutely necessary for the conclusion of a contract. There is no obligation to provide this data. If the data is not provided, we cannot provide the content accessed and cannot make a size recommendation.

The purposes of data collection and processing by SAIZ are size calculation, sales promotion or increased sales through cost optimization for our company (size recommendation, fit testing of products), marketing purposes (personalization and fit testing) and analysis purposes (conversion tracking).

The data recipient of the collected data is SAIZ GmbH and its external service providers:

- DataDog Inc.

- Microsoft Corp.

- Google LLC

- Amazon Web Services Inc

whereby in connection with the use of those service providers have ensured through appropriate agreements that the personal data collected only on Microsoft and DataDog servers in the EU get saved. However, it cannot be guaranteed with 100 percent certainty that no data will be transferred to a third country as a result of the use of Microsoft and DataDog by SAIZ as their subcontractor. If personal data is processed in a third country, this may only take place if the special requirements of Article 44 ff. GDPR are met. This includes in particular the conclusion of standard data protection clauses (“EU-SCC”) and a so-called “Transfer Impact Assessment” (“TIA”) was carried out by SAIZ.

The necessary legal basis for the processing of personal data by SAIZ is Article 6 Paragraph 1 Sentence 1 Letter a GDPR (consent). In other words, the personal data of the respective visitor to the website will only be used with the prior consent of the processed by the visitor to the website. This consent is obtained via the cookie banner. You can revoke your consent at any time via the cookie banner.

The visitor's personal data will be deleted as soon as the processing purposes for which they were collected have been achieved or you have withdrawn your consent to data collection. Further information about the storage period can be found on the website via the cookie banner / cookie settings.

You can revoke your consent to data processing at any time via the cookie banner.

Further information on data processing by the Saiz tool can be found at:

https://www.saiz.io/datenschutz

(12.2) Data protection provisions about the application and use of WhatsApp as a means of communication

The controller uses WhatsApp as a means of communication between employees, customers, business partners, shareholders and steakholders. WhatsApp is a widely used application that can be used to chat, make phone calls and send voice messages, among other things. The operating company of the service is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We use the WhatsApp marketing tool from the company chatarmin.com, based in Vienna, Austria. The purpose of the processing is to handle operational communication.

The legal basis is Art. 6 para. 1 lit. f GDPR. WhatsApp is used to handle communication. WhatsApp stores personal communication data and itself accesses personal data, in particular the phone book of mobile devices, more precisely: all phone numbers of the persons stored in the phone are read out.

The communication processed via WhatsApp, the telephone numbers collected and all other data are or could be transmitted to third parties, in particular Facebook or other companies as well as American or international secret services. If you do not want us to store your phone number in one of our mobile devices and/or communicate with you via WhatsApp, please simply inform us.

In such a case, we would of course use alternative means of communication (e.g. telephone call). Further information and the applicable data protection provisions of WhatsApp can be found at https://www.whatsapp.com/legal/#privacy-policy

Further information about our WhatsApp software can be found on the Chatarmin website.

§ 13 Customer evaluation request through eKomi

(13.1) Description and scope of data processing

For the purposes of customer and product reviews by ETERNA customers and for internal quality management, ETERNA has integrated the review software from eKomi Ltd, Markgrafenstraße 11, 10969 Berlin ("e-Komi") on its website. ETERNA would like to give you the opportunity to give a rating after you have made a purchase. eKomi is a company that specialises in the web-based collection of authentic customer opinions, product ratings and recommendations. You can find more information about this third-party provider at https://www.ekomi.de.

After the goods have been dispatched, eKomi sends randomly selected customers a link to a purchase evaluation page, combined with a request to submit an evaluation of your purchase at ETERNA ("customer evaluation request"). The submission of such a customer review is completely voluntary on your part.

Since only customers who have purchased goods from ETERNA can submit a purchase review, it is necessary for ETERNA to pass on to eKomi any personal data or order data that you have provided, i.e. your name, e-mail address and order number.

eKomi receives the data from ETERNA exclusively for the purpose of obtaining the customer review.

(13.2) Legal basis for data processing

The legal basis for the processing of your aforementioned personal data is Art. 6 para. 1 lit. p. 1 f) GDPR.

(13.3) Purpose of the data processing

Feedback from our customers in the form of customer and product ratings enables us to monitor our online shop. Through the evaluation of submitted ratings, we are able to compile information about customer satisfaction. This helps us to continuously improve our website and its user-friendliness. These purposes are also our legitimate interest in processing the data according to Art. 6 para. 1 p. 1 lit. f) GDPR.

(13.4) Right of objection and removal

You can object to the sending of such a customer evaluation request to ETERNA at any time. You can declare your objection by sending an e-mail to service@eterna.de or by sending a message (e.g. fax or letter) to the ETERNA contact details given in § 1.

§ 14 Voucher offers of Sovendus GmbH

We participate in the partner network of Sovendus GmbH, Hermann-Veit-Str. 6, 76133 Karlsruhe, Germany, www.sovendus.de; in short: "Sovendus") in order to be able to offer you vouchers for purchases in other shops that participate in the Sovendus network.

In order to select a voucher offer that is currently of interest to you, we will transmit the hash value of your e-mail address and your IP address to Sovendus GmbH, Hermann-Veit-Str. 6, 76133 Karlsruhe (Sovendus) in a pseudonymised and encrypted form (Art. 6 (1) sentence 1 lit. f) GDPR). The pseudonymised hash value of the e-mail address is used by Sovendus to take into account a possible objection to advertising (Art. 21 para. 3, Art. 6 para. 1 p. 1 lit. c) GDPR). The IP address is used by Sovendus exclusively for data security purposes and is usually anonymised after seven days (Art. 6 para. 1 p. 1 lit. f) GDPR). In addition, we transmit the order number, order value with currency, session ID, coupon code and timestamp to Sovendus in pseudonymised form for billing purposes (Art. 6 para. 1 lit. f) GDPR).

If you are interested in a voucher offer from Sovendus, if there is no advertising objection to your e-mail address and if you click on the voucher banner displayed only in this case, your title, name, postcode, country and your e-mail address will be transmitted by us in encrypted form to Sovendus for the preparation of the voucher (Art. 6 para. 1 p. 1 lit. b), f) GDPR).

§ 15 Use of Facebook, Google, Instagram, YouTube, VIMEO and Microsoft

(15.1) ETERNA maintains online presences on the social networks Facebook, Google+, Instagram, YouTube and VIMEO in order to inform you about their services and news from the fashion and lifestyle sector. This serves to protect our legitimate interests in the optimal marketing of our offer, which outweigh our interests in the context of a balancing of interests, in accordance with Art. 6 Para. 1 S. 1 lit. f) GDPR. In order to increase the protection of your data when visiting our website, these buttons are not fully integrated as plug-ins, but only using an HTML link on the page. This integration ensures that when you call up a page of our website that contains such buttons, no connection is yet established with the servers of the provider of the respective social network. If you click on one of the buttons, a new window of your browser opens and calls up the page of the respective service provider on which you can (if necessary after entering your login data) e.g. click on the Like or Share button.

(15.2) In the following, you will find more detailed information on the respective providers of the online presences as well as - via the respective links - a description of the respective data processing.

(15.2.1) Facebook

The provider of Facebook is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 (Ireland).

The purpose and scope of the data collection, the further processing and use of the data by Facebook as well as your rights in this regard and setting options for protecting your privacy can be found in Facebook's privacy policy, which you can access at the following link: https://www.facebook.com/privacy/explanation.

You can object to Facebook's use of your data for advertising purposes by using the following opt-out links: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen or https://www.youronlinechoices.com/.

We expressly point out that Facebook Ireland limited is a subsidiary of the US company Facebook Inc. (1 Hacker Way, Menlo Park, California, 94025, USA). Accordingly, a transfer of data to the USA cannot be ruled out. However, Facebook Inc. has submitted to the EU-US Privacy Shield, which ensures that the data is also subject to an appropriate level of data protection in the USA. Further general information on certification can be found under the link https://www.privacyshield.gov; the current Privacy Shield status of Facebook can be found under the following link: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.

(15.2.2) Google

The Google+ service is offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

The purpose and scope of the data collection, the further processing and use of the data by Google as well as your rights in this regard and setting options for protecting your privacy can be found in Google's data protection information, which you can access at the following link: https://policies.google.com/privacy.

Due to Google's headquarters, a transfer of data to the USA cannot be ruled out. However, Google has submitted to the EU-US Privacy Shield, which ensures that the data is also subject to an appropriate level of data protection in the USA. Further general information on certification can be found under the link https://www.privacyshield.gov; the current Privacy Shield status of Google can be found under the following link: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active.

(15.2.3) Instagram

The Instagram service is provided by Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2 (Ireland)).

For the purpose and scope of the data collection, the further processing and use of the data by Instagram, as well as your rights in this regard and setting options for protecting your privacy, please refer to Instagram's privacy policy, which you can access at the following link: https://instagram.com/about/legal/privacy/.

(15.2.4) Two-click solution from YouTube

Our site uses the provider YouTube LLC , 901 Cherry Avenue, San Bruno, CA 94066, USA, represented by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, for the integration of videos. Normally, when you call up a page with embedded videos, your IP address is already sent to YouTube and cookies are installed on your computer. However, we have embedded our YouTube videos with the extended data protection mode (in this case, YouTube still contacts Google's Double Klick service, but according to Google's privacy policy, personal data is not evaluated). This means that YouTube no longer stores any information about visitors unless they watch the video. If you click on the video, your IP address is transmitted to YouTube and YouTube learns that you have watched the video. If you are logged in to YouTube, this information is also assigned to your user account (you can prevent this by logging out of YouTube before viewing the video).

We have no knowledge of and no influence on the possible collection and use of your data by YouTube. You can find more information in YouTube's privacy policy at www.google.de/intl/de/policies/privacy/. In addition, we refer to our general presentation in this data protection declaration for the general handling and deactivation of cookies.

(15.2.5) Two-click solution from VIMEO

This website uses plugins from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York 10011, USA.
When you visit one of our pages equipped with Vimeo videos, a connection is established to the servers of Vimeo are established. This tells the Vimeo server which of our pages you have visited In addition, Vimeo obtains your IP address. However, we have set Vimeo in such a way that Vimeo does not will not track user activity and will not set cookies. The use of Vimeo is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. Insofar as a corresponding
If consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.
Data transfer to the USA is based on the standard contractual clauses of the EU Commission as well as according to Statement by Vimeo based on "legitimate business interests". Details can be found here: https://vimeo.com/privacy.
For more information on the handling of user data, please see the Vimeo privacy policy under: https://vimeo.com/privacy.

(15.2.6) Google Maps

We use Google Maps on our website to display our locations (store locater) and, if necessary, to create directions. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, hereinafter referred to as "Google".

Through certification under the EU-US Privacy Shield ("EU-US Privacy Shield") https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active Google guarantees that the data protection requirements of the EU are also complied with when processing data in the USA.

To enable the display of certain fonts on our website, a connection to the Google server in the USA is established when our website is accessed.
If you call up the Google Maps component integrated into our website, Google will save a cookie on your end device via your internet browser. In order to display our location and create directions, your user settings and data are processed. We cannot exclude the possibility that Google uses servers in the USA.

The legal basis is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest lies in optimising the functionality of our website.

The connection to Google established in this way enables Google to determine which website your request was sent from and to which IP address the directions should be sent.

If you do not agree to this processing, you have the option of preventing the installation of cookies by making the appropriate settings in your internet browser. Details on this can be found above under the item "Cookies".

In addition, the use of Google Maps and the information obtained via Google Maps is subject to the Google Terms of Use https://policies.google.com/terms?gl=DE&hl=de and the Terms and Conditions for Google Maps https://www.google.com/intl/de_de/help/terms_maps.html.

In addition, Google offers https://adssettings.google.com/authenticated & https://policies.google.com/privacy for further information.

(15.2.7) Microsoft

This is a service provided by Microsoft Corporation, One Microsoft Way Redmond, WA 98052-6399, USA. This service makes it possible to track the activities of users on our website if they have reached our website via ads from Bing Ads when using the Bing search engine and a cookie from Bing Ads has been set on their computers on the respective website on which our ad is presented. For this purpose, a Bing UET tag is integrated on our website. This is a code which, in conjunction with the cookie, stores some non-personal information about your use of the website. Information about your identity is not collected. The purpose of this data processing is to determine whether the product information and recommendations displayed to you were relevant to you.

The information collected is transferred to Microsoft's server in the USA and stored there for a maximum of 180 days.

The legal basis for this data collection is your consent (Art. 6 para. 1 letter a) GDPR).

You can withdraw your consent at any time by deactivating the relevant Microsoft Advertising cookie under Marketing and Targeting in your cookie settings. Please note that in the event that you revoke your consent, the lawfulness of our processing of your data on the basis of consent up to the time of revocation will not be affected.

You can also prevent the collection of data generated by the cookie and related to your use of the website, as well as the processing of this data, by deactivating the setting of cookies. This may restrict the functionality of the website under certain circumstances. In addition, Microsoft may be able to track your usage behaviour across multiple electronic devices through cross-device tracking, which enables Microsoft to display personalised advertising on or within Microsoft websites and apps. You can disable this behaviour by following the link below: Cookie settings Cookie Settings.

For more information on Bing's analytics services, please visit the Bing Ads website: https://help.bingads.microsoft.com/#apex/3/de/53056/2

(15.3) Please note that the exercise of the data subject rights to which you are entitled can most effectively be made vis-à-vis the respective provider, as only they have direct access to the data concerning you. If you require assistance in this regard, please feel free to contact us using the ETERNA contact details provided.

§ 16 Data Security

We use the widespread SSL procedure (Secure Socket Layer) in connection with the highest encryption level supported by your browser when visiting the website. As a rule, this is a 256-bit encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

We also use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

§ 17 Your data subject rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis us as the controller.

You can declare these rights to us by sending an e-mail to service@eterna.de or by sending a message (e.g. fax or letter) to the contact details given in § 1.

Right of access, Art. 15 GDPR

You have the right to request confirmation from us as to whether personal data in question are being processed. If this is the case, you have the right to obtain information about these personal data and (in particular) about the

- Processing purposes,
- the category of personal data,
- the categories of recipients to whom your data has been or will be disclosed,
- the planned storage period,
- the existence of a right to rectification, erasure, restriction of processing or objection,
- the existence of a right of appeal,
- the origin of your data if it has not been collected by us,
- and about the existence of automated decision-making, including profiling, and, if applicable, meaningful information about its details.

Right to rectification, Art. 16 GDPR

You have a right of rectification and/or completion vis-à-vis the controller if the personal data processed concerning you are inaccurate or incomplete. We shall carry out the rectification without delay.

Right to erasure ("right to be forgotten"), Art. 17 GDPR

You have the right to request the erasure of your personal data stored by us, unless (in particular) processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.

Right to restriction of processing, Art. 18 GDPR

You have the right to request the restriction of the processing of your personal data insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defence of legal claims or you have objected to the processing pursuant to Art. 21 GDPR.

Right to information, Art. 19 GDPR

If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed about these recipients.

Right to data portability, Art. 20 GDPR

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller.

Right of objection, Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you which is carried out on the basis of Article 6 (1) sentence 1 lit. e) or lit. f) GDPR; this also applies to profiling based on these provisions.

We will no longer process the personal data relating to you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

If the personal data concerning you is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

Right to revoke the declaration of consent under data protection law, Art. 7 (3) GDPR

You have the right to revoke your consent at any time. This has the consequence that we may no longer continue the data processing based on this consent in the future. However, the revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

Right to complain to a supervisory authority, Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you

§ 18 Note for business partners: Data protection information for business partners

§ 19 Up-to-dateness and amendment of this privacy policy

(19.1) This data protection declaration is valid as of December 12, 2023.

(19.2) Due to the further development of our website or due to changed legal or official requirements, it may become necessary to change this data protection declaration. The current data protection declaration can be called up and printed out at any time on our website under the following link: Data Protection Declaration