Privacy policy
Contents
- Controller
- General information and legal bases
- Provision of the online shop using Shopify
- Cookies, consent management and shop analytics
- Orders and customer accounts
- Payment processing
- Delivery and shipping
- Accounting, invoicing and DATEV integration
- Contacting us
- Newsletter
- Recipients of data
- Storage periods
- Automated decisions
- Your rights
- Competent data protection supervisory authority
- Data security
- Changes to this Privacy Policy
1. Controller
The controller within the meaning of the General Data Protection Regulation (DSGVO) is:
VICALO GmbH
Mozartstraße 36
88441 Mittelbiberach
Deutschland
Telephone: +49 163 6718932
Email: hello@teguscafe.com
2. General information and legal bases
We process personal data only to the extent necessary to provide our online shop, handle enquiries, fulfil orders, comply with statutory obligations or on the basis of consent.
Depending on the processing involved, we rely in particular on the following legal bases:
- Art. 6 Abs. 1 lit. a DSGVO for processing based on your consent;
- Art. 6 Abs. 1 lit. b DSGVO for pre-contractual measures and the performance of a contract;
- Art. 6 Abs. 1 lit. c DSGVO for compliance with legal obligations, in particular retention obligations under commercial and tax law;
- Art. 6 Abs. 1 lit. f DSGVO for safeguarding legitimate interests, in particular the secure, stable and economically viable operation of our online shop, the prevention of abuse and fraud, and the establishment or defence of legal claims.
Where information is stored on or accessed from your device, its permissibility is also governed by § 25 TDDDG. We use cookies and similar technologies that are not strictly technically necessary only with your consent.
3. Provision of the online shop using Shopify
Our online shop operates on the Shopify e-commerce platform. For merchants in the European Economic Area, the contracting party is generally Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Irland. Shopify processes data on our behalf that is necessary to operate the shop and fulfil orders. For certain additional Shopify services, Shopify may process data as an independent controller.
When you visit the shop, the data processed may include, in particular, your IP address, device and browser information, the date and time of access, pages viewed, referrer information, cookie and session identifiers, and information about interactions with the shop. The processing serves technical provision, security, error analysis, fraud prevention and, subject to consent, analytics or personalisation.
Shopify also uses affiliated companies and subprocessors outside the European Economic Area, in particular in Canada and the USA. International transfers are carried out in accordance with Art. 44 ff. DSGVO, in particular on the basis of adequacy decisions, standard contractual clauses and supplementary safeguards where required.
Further information is available in Shopify's privacy policy: https://www.shopify.com/de/legal/datenschutz
4. Cookies, consent management and shop analytics
Our shop uses technically necessary cookies and similar technologies so that pages can be displayed, shopping carts saved, sessions secured, payments processed and the functions you expressly request provided. This processing is based on § 25 Abs. 2 TDDDG and, where personal data is processed, on Art. 6 Abs. 1 lit. b or lit. f DSGVO.
Technologies that are not technically necessary, in particular those used for audience measurement, personalisation or marketing, are used only with your consent. The legal bases are § 25 Abs. 1 TDDDG and Art. 6 Abs. 1 lit. a DSGVO. You can change your selection or withdraw consent at any time via the “Cookie settings” link in the footer. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
The cookie categories, providers, purposes and storage periods applicable at any given time are displayed in the consent banner or cookie settings. Without consent, non-essential Shopify pixels, Shopify Network Intelligence and, where applicable, other analytics or marketing services remain disabled insofar as consent is legally required.
5. Orders and customer accounts
When you place an order or create a customer account, we process the master data, contact, delivery, order, contract and payment information you provide. Mandatory information is marked in the relevant form. Without this data, we are generally unable to process an order.
The processing is carried out to initiate and perform the purchase contract on the basis of Art. 6 Abs. 1 lit. b DSGVO. Where data is contained in invoices, accounting records or business correspondence, we also process and store it to comply with obligations under commercial and tax law pursuant to Art. 6 Abs. 1 lit. c DSGVO.
A customer account can be deleted using the functions provided in the shop. Data subject to statutory retention obligations or required to enforce or defend claims will be restricted from use until the relevant period expires and then deleted.
6. Payment processing
At checkout, you can choose from the payment methods offered at that time. The data required to process payment is transmitted to the selected payment service provider. The legal basis is Art. 6 Abs. 1 lit. b DSGVO. Payment service providers may process data as independent controllers, in particular for identity verification, fraud prevention and compliance with obligations under anti-money laundering law.
Shopify Payments
If Shopify Payments or payment methods provided through it are used, payments are processed via Shopify and its banking and payment partners. Depending on the selection, these may include credit and debit cards, Shop Pay, Apple Pay, Google Pay or local payment methods. The options actually available are displayed at checkout.
Further information: https://www.shopify.com/de/legal/datenschutz
PayPal
If PayPal is selected, the data required to process payment is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal also processes data for fraud prevention, risk assessment and compliance with regulatory obligations.
Further information: https://www.paypal.com/de/legalhub/paypal/privacy-full
7. Delivery and shipping
To perform the contract, we transmit your name, delivery address and, where necessary for delivery, contact details to the shipping service provider commissioned to deliver the goods. The legal basis is Art. 6 Abs. 1 lit. b DSGVO. Your email address or telephone number will be transmitted for delivery notifications or delivery according to your preferences only if this is necessary for the selected delivery service or if consent has been given.
8. Accounting, invoicing and DATEV integration
We use the platform provided by pathway solutions GmbH, c/o ba tax GmbH, Alstertwiete 3, 20099 Hamburg, to automate the creation and processing of invoices and to prepare our accounts. For this purpose, Pathway may retrieve, prepare and store order, customer, invoice, refund and payment data from Shopify, Shopify Payments and PayPal and make it available in DATEV format. The processing is carried out on our behalf under a data processing agreement pursuant to Art. 28 DSGVO.
The legal bases are Art. 6 Abs. 1 lit. b DSGVO insofar as the processing serves to perform the contract, and Art. 6 Abs. 1 lit. c DSGVO for obligations under commercial and tax law. Data may be transmitted to our tax adviser and to DATEV eG or the DATEV services we use to the extent necessary.
Further information: https://www.pathway-solutions.de/datenschutzerklaerung
9. Contacting us
If you contact us by email, telephone or through a contact form, we process your information to handle your enquiry. The legal basis is Art. 6 Abs. 1 lit. b DSGVO if the enquiry relates to a contract or its initiation; otherwise, it is Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest lies in responding appropriately to enquiries.
The data will be deleted once the enquiry has been fully dealt with and there are no statutory retention obligations or legitimate interests in further storage.
10. Newsletter
If you subscribe to our newsletter, we process your email address and, where applicable, your name to send you information about products, offers and news. Subscription is confirmed through a double opt-in procedure. The legal basis is your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO.
You can withdraw your consent at any time with effect for the future, in particular via the unsubscribe link in each newsletter email or by sending a message to hello@teguscafe.com. After you unsubscribe, we may store your email address in a suppression list insofar as this is necessary to ensure continued compliance with your withdrawal of consent and to substantiate legal claims.
Where newsletters are sent using Shopify Email, Shopify processes the necessary data in accordance with the section “Provision of the online shop using Shopify”.
11. Recipients of data
Personal data is received only by those internal departments and external service providers that require it for the relevant purposes. These may include, in particular, hosting and e-commerce service providers, payment service providers, shipping companies, IT and support service providers, accounting and invoicing service providers, tax advisers, DATEV, and authorities and courts where disclosure is legally required.
We enter into the legally required data processing agreements with service providers that process personal data on our behalf.
12. Storage periods
We store personal data only for as long as necessary for the relevant purpose. It is then deleted or anonymised unless statutory retention periods or legitimate grounds for longer storage apply.
Documents governed by commercial and tax law are generally retained for six or eight years, as applicable. Contract-related data may also be stored until the statutory limitation periods expire. We retain evidence of consent for as long as necessary to meet our accountability obligations and to defend legal claims.
13. Automated decisions
As a rule, we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Payment service providers may carry out automated checks for fraud and risk prevention. Details can be found in the privacy notices of the selected payment service provider.
14. Your rights
Subject to the statutory requirements, you have the following rights in particular:
- access to the personal data we process pursuant to Art. 15 DSGVO;
- rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 DSGVO;
- erasure pursuant to Art. 17 DSGVO;
- restriction of processing pursuant to Art. 18 DSGVO;
- data portability pursuant to Art. 20 DSGVO;
- objection to processing based on Art. 6 Abs. 1 lit. e or lit. f DSGVO pursuant to Art. 21 DSGVO;
- withdrawal of consent with effect for the future pursuant to Art. 7 Abs. 3 DSGVO;
- lodging a complaint with a data protection supervisory authority pursuant to Art. 77 DSGVO.
To exercise your rights, you can contact hello@teguscafe.com. If we have reasonable doubts about your identity, we may request additional information to verify it.
15. Competent data protection supervisory authority
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Deutschland
Telephone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de
Website: https://www.baden-wuerttemberg.datenschutz.de
You may also contact another data protection supervisory authority competent for you.
16. Data security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and unauthorised alteration. Data transmitted through the online shop is encrypted using TLS/HTTPS.
17. Changes to this Privacy Policy
We update this Privacy Policy when our data processing activities, service providers or the legal situation change. The current version is available on this website.