Privacy Policy

Privacy Policy and Consents

Table of Contents

1. Purpose and Controller
2. General Information on Data Processing
3. Processing of Personal Data
4. Collection of Access Data
5. Cookies and Audience Measurement
6. Google Analytics
7. Google Marketing and Remarketing Services
8. Facebook Social Plugins
9. Facebook Remarketing
10. Pinterest Buttons
11. Newsletter
12. Integration of Third-Party Services and Content
13. User Rights and Data Deletion
14. Amendments to this Privacy Policy

1. Purpose and Controller
This Privacy Policy explains the nature, scope and purpose of the processing, including the collection, processing and use, as well as the obtaining of consent, of personal data within our online services and the associated websites, functions and content, hereinafter collectively referred to as the “online services” or “website”. This Privacy Policy applies regardless of the domains, systems, platforms and devices, such as desktop or mobile devices, on which the online services are provided. The provider of the online services and the controller responsible under data protection law is:

Karlotta Pink – Fabrics from Around the World – Kerstin Kroth – Im Glasloch 4 – 64658 Fürth (Odenwald) – Germany, hereinafter referred to as the “Provider”. For contact details, please refer to our Legal Notice.

The term “users” includes all customers and visitors to our online services. Terms such as “users” are intended to be gender-neutral.

2. General Information on Data Processing
We process users’ personal data only in compliance with the relevant data protection regulations and in accordance with the principles of data minimisation and data avoidance. This means that users’ data is processed only where there is a legal basis for doing so, particularly where the data is required for the provision of our contractual services and online services or where processing is required by law.

We implement organisational, contractual and technical security measures in accordance with the current state of technology to ensure compliance with data protection legislation and to protect the data processed by us against accidental or intentional manipulation, loss, destruction or access by unauthorised persons.

Where content, tools or other resources from other providers, hereinafter collectively referred to as “third-party providers”, are used within the scope of this Privacy Policy and the stated registered office of such providers is located abroad, it must be assumed that data will be transferred to the countries in which those third-party providers are based. Data is transferred to third countries, all within the EEA, either on the basis of statutory permission, the user’s consent or specific contractual clauses that guarantee the legally required level of data security.

3. Processing of Personal Data
In addition to the uses expressly stated in this Privacy Policy, personal data is processed for the following purposes on the basis of statutory permission or user consent:

- Provision, performance, maintenance, optimisation and security of our services and user services;
- Ensuring effective customer service and technical support.

We transfer user data to third parties only where this is necessary for billing purposes, for example to a payment service provider, or for other purposes where this is necessary to fulfil our contractual obligations towards users, for example providing address details to suppliers or delivery services.

When users contact us, for example by contact form or email, the information provided by the user is stored for the purpose of processing the enquiry and in case any follow-up questions arise.

Personal data is deleted once the purpose for which it was used has been fulfilled and provided that no statutory retention obligations, for example tax-related retention obligations, prevent deletion.

4. Collection of Access Data
We collect data relating to every access to the server on which this service is hosted, known as server log files. The access data includes the name of the accessed website, the requested file, the date and time of access, the amount of data transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL, meaning the previously visited page, IP address and the requesting internet service provider.

In accordance with statutory requirements, we use the log data without associating it with the user’s identity and without creating any other user profiles, solely for statistical evaluations for the purposes of operating, securing and optimising our online services.

However, we reserve the right to review the log data retrospectively where there are specific grounds for a justified suspicion of unlawful use.

5. Cookies and Audience Measurement
Cookies are pieces of information transferred by our web server or third-party web servers to users’ web browsers and stored there for subsequent retrieval.

Users are informed about the use of cookies for pseudonymous audience measurement within this Privacy Policy.

Our online services can also be viewed with cookies disabled. Users who do not wish cookies to be stored on their computer are asked to disable the relevant option in their browser’s system settings. Stored cookies can be deleted using the browser’s system settings.

Disabling cookies may restrict certain functions of our online services.

It is possible to manage many online advertising cookies from companies using the US website http://www.aboutads.info/choices or the EU website http://www.youronlinechoices.com/uk/your-ad-choices/.

6. Google Analytics
We use Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google uses cookies. The information generated by the cookie about users’ use of the online services is usually transmitted to a Google server in the United States and stored there.

Google will use this information on our behalf to evaluate users’ use of our online services, compile reports on activities within these online services and provide us with other services relating to the use of the online services and the internet.

Pseudonymous user profiles may be created from the processed data.

We use Google Analytics only with IP anonymisation enabled. This means that users’ IP addresses are shortened by Google within Member States of the European Union or other states that are parties to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and shortened there.

The IP address transmitted by the user’s browser is not combined with other data held by Google.

Users can prevent cookies from being stored by selecting the appropriate settings in their browser software. Users can also prevent the collection by Google of the data generated by the cookie relating to their use of the online services and the processing of this data by Google by downloading and installing the browser plugin available at: http://tools.google.com/dlpage/gaoptout?hl=en.

Further information regarding Google’s use of data for advertising purposes, settings and objection options can be found on Google’s websites: https://www.google.com/intl/en/policies/privacy/partners, http://www.google.com/policies/technologies/ads, http://www.google.com/settings/ads and http://www.google.com/ads/preferences/.

7. Google Marketing and Remarketing Services
We use the marketing and remarketing services, hereinafter referred to as “Google Marketing Services”, of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).

Google Marketing Services allow us to display advertisements for and on our website in a more targeted manner, so that users are shown only advertisements that may correspond to their interests. Where users are shown advertisements for products in which they previously showed an interest on other websites, this is referred to as remarketing.

For these purposes, when our website or other websites on which Google Marketing Services are active are accessed, Google immediately executes Google code and integrates so-called remarketing tags, invisible graphics or code also known as “web beacons”, into the website.

These are used to store an individual cookie, meaning a small file, on the user’s device. Comparable technologies may also be used instead of cookies.

The cookies may be set by various domains, including: google.com, doubleclick.net, invitemedia.com, admeld.com, googlesyndication.com and googleadservices.com.

This file records which websites the user has visited, which content they were interested in and which offers they clicked on. It also records technical information about the browser and operating system, referring websites, time of visit and other information concerning the use of the online services.

The user’s IP address is also recorded. In the context of Google Analytics, we inform Google that IP addresses must be shortened within Member States of the European Union or other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the United States and shortened there.

The IP address is not combined with user data from other Google services.

The information described above may also be combined with information from other sources. When the user subsequently visits other websites, advertisements tailored to their interests may be displayed.

User data is processed pseudonymously as part of Google Marketing Services. This means that Google does not generally store or process users’ names or email addresses, but processes the relevant data associated with cookies within pseudonymous user profiles.

From Google’s perspective, the advertisements are therefore not managed and displayed for a specifically identified person, but for the holder of the relevant cookie, regardless of who that cookie holder is. This does not apply where a user has expressly permitted Google to process the data without pseudonymisation.

Information collected about users by DoubleClick is transferred to Google and stored on Google servers in the United States.

The Google Marketing Services we use include the Google AdWords online advertising programme. In the case of Google AdWords, each AdWords customer receives a different conversion cookie. Cookies therefore cannot be tracked across the websites of different AdWords customers.

The information collected using the cookie is used to generate conversion statistics for AdWords customers who have opted for conversion tracking. AdWords customers are informed of the total number of users who clicked on their advertisement and were redirected to a page containing a conversion tracking tag. However, they do not receive information that personally identifies users.

We integrate third-party advertisements using the DoubleClick service. DoubleClick uses cookies that enable Google and its partner websites to display advertisements based on users’ visits to this website or other websites on the internet.

Another Google Marketing Service used by us is Google Tag Manager, which allows additional Google analytics and marketing services to be integrated into our website, such as AdWords, DoubleClick and Google Analytics.

Further information concerning Google’s use of data for marketing purposes is available at: https://www.google.com/policies/technologies/ads. Google’s Privacy Policy is available at: https://www.google.com/policies/privacy.

Users who wish to object to collection by Google Marketing Services may use the settings and opt-out options provided by Google: http://www.google.com/ads/preferences.

8. Facebook Social Plugins
Our online services use social plugins, hereinafter referred to as “plugins”, from the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).

The plugins can be identified by one of the Facebook logos, such as a white “f” on a blue tile, the terms “Like” or a thumbs-up symbol, or by the wording “Facebook Social Plugin”.

A list and examples of the appearance of Facebook Social Plugins are available at: https://developers.facebook.com/docs/plugins/.

When a user accesses a function within our online services that contains such a plugin, their device establishes a direct connection to Facebook’s servers.

The content of the plugin is transmitted directly by Facebook to the user’s device and integrated into the online services. User profiles may be created from the processed data.

We therefore have no influence over the scope of the data collected by Facebook using this plugin and inform users according to our current level of knowledge.

By integrating the plugins, Facebook receives information that a user has accessed the corresponding page of the online services.

Where the user is logged into Facebook, Facebook can associate the visit with the user’s Facebook account.

Where users interact with the plugins, for example by clicking the Like button or submitting a comment, the corresponding information is transmitted directly from their device to Facebook and stored there.

Even where a user is not a member of Facebook, Facebook may still obtain and store the user’s IP address. According to Facebook, only an anonymised IP address is stored in Germany.

Information regarding the purpose and scope of data collection and the further processing and use of data by Facebook, as well as users’ rights and settings options for protecting their privacy, can be found in Facebook’s privacy information: https://www.facebook.com/about/privacy.

Users who are Facebook members and do not want Facebook to collect data about them through our online services and associate it with their membership data stored by Facebook must log out of Facebook and delete their cookies before using our online services.

Further settings and objections concerning the use of data for advertising purposes are available within Facebook profile settings: https://www.facebook.com/settings?tab=ads, through the US website http://www.aboutads.info/choices/ or through the EU website http://www.youronlinechoices.com/.

These settings apply across platforms and are therefore adopted for all devices, including desktop computers and mobile devices.

9. Facebook Remarketing
Our online services use the Facebook Pixel provided by the Facebook social network, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA or, where users are based in the EU, by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”).

The Facebook Pixel allows Facebook to identify visitors to our services as a target group for the display of advertisements known as Facebook Ads.

We use the Facebook Pixel to display Facebook Ads placed by us only to Facebook users who have shown an interest in our online services.

This means that the Facebook Pixel helps us ensure that our Facebook Ads correspond to users’ potential interests and are not perceived as intrusive.

The Facebook Pixel also enables us to measure the effectiveness of Facebook advertisements for statistical and market research purposes by determining whether users were redirected to our website after clicking on a Facebook advertisement.

The Facebook Pixel is integrated directly by Facebook when our website is accessed and may store a cookie, meaning a small file, on the user’s device.

Where users subsequently log into Facebook or visit Facebook while logged in, their visit to our services is recorded in their profile.

The data collected about users is anonymous to us and therefore does not allow us to identify individual users.

However, the data is stored and processed by Facebook, meaning that it may be linked to the relevant user profile.

Facebook processes the data in accordance with its Data Use Policy. Further information regarding how the remarketing pixel works and the display of Facebook Ads is available in Facebook’s Data Use Policy: https://www.facebook.com/policy.php.

Users may object to collection by the Facebook Pixel and the use of their data for displaying Facebook Ads.

To do this, users may access the page provided by Facebook and follow the instructions regarding settings for interest-based advertising: https://www.facebook.com/settings?tab=ads.

Users may also object through the US website http://www.aboutads.info/choices/ or the EU website http://www.youronlinechoices.com/.

These settings apply across platforms and therefore apply to all devices, including desktop computers and mobile devices.

10. Pinterest Buttons
We use the “Pin It” buttons provided by Pinterest, http://pinterest.com.

These buttons allow users to share our products or web pages on their Pinterest boards.

When a user accesses a web page containing a Pin It button, their browser establishes a direct connection to Pinterest’s servers.

The content of the Pin It button is transmitted directly by Pinterest to the user’s browser.

We therefore have no influence over the scope of the data collected by Pinterest using the Pin It button and inform users according to our current level of knowledge.

According to the information available to us, only the user’s IP address and the URL of the relevant web page are transmitted. This data is used only to display the Pin It button and enable content to be shared.

Further information is available in Pinterest’s Privacy Policy: http://pinterest.com/about/privacy/.

[NOTE: Please remove the following section if you do not offer a newsletter. Information regarding the mailing service provider is not required if you send the newsletter yourself.]

11. Newsletter
The following information explains the content of our newsletter, the registration and mailing procedures, the statistical evaluation process and your rights of objection.

By subscribing to our newsletter, you consent to receiving it and to the procedures described below.

Newsletter content
We send newsletters, emails and other electronic notifications containing promotional information, hereinafter referred to as “newsletters”, only with the recipient’s consent or where permitted by law.

Where the content of the newsletter is specifically described as part of the subscription process, this description determines the scope of the user’s consent.

Otherwise, our newsletters contain information about our products, offers and promotions, dates and information relating to workshops.

Double opt-in and record keeping: Subscription to our newsletter takes place using a double opt-in procedure. This means that after registering, users receive an email asking them to confirm their registration. This confirmation is necessary to prevent anyone from registering using another person’s email address.

Newsletter registrations are recorded in order to demonstrate that the registration process complies with legal requirements.

This includes storing the time of registration, the time of confirmation and the IP address. Changes to the data stored by the mailing service provider are also recorded.

Mailing service provider
In accordance with the requirements of the General Data Protection Regulation, applicable since 25 May 2018, we inform users that consent to the mailing of emails is based on Articles 6(1)(a) and 7 GDPR and Section 7(2)(3) or Section 7(3) of the German Act Against Unfair Competition.

The use of the Mailchimp mailing service provider, the performance of statistical surveys and analyses and the recording of the registration procedure are based on our legitimate interests pursuant to Article 6(1)(f) GDPR.

Our interest is in using a user-friendly and secure newsletter system that serves both our business interests and the expectations of users.

We also inform users that they may object at any time to the future processing of their personal data in accordance with Article 21 GDPR. This objection may particularly relate to processing for direct marketing purposes.

Newsletters are sent using Mailchimp, a newsletter distribution platform provided by the US company The Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA.

The mailing service provider’s Privacy Policy is available at: https://mailchimp.com/legal/privacy/.

The email addresses of newsletter recipients and the additional data described in this Privacy Policy are stored on Mailchimp’s servers in the United States.

Mailchimp uses this information to send and evaluate newsletters on our behalf.

According to Mailchimp, it may also use this data to optimise or improve its own services, for example to improve the technical delivery and display of newsletters or for commercial purposes, such as determining the countries from which recipients originate.

However, Mailchimp does not use the data of our newsletter recipients to contact them directly or to transfer it to third parties.

We rely on Mailchimp’s reliability and IT and data security.

Mailchimp is certified under the US-EU Privacy Shield and thereby undertakes to comply with European data protection requirements.

We have also concluded a Data Processing Agreement with Mailchimp. Under this agreement, Mailchimp undertakes to protect users’ data, process it on our behalf in accordance with its data protection provisions and, in particular, not transfer it to third parties.

Registration information
To subscribe to the newsletter, users need only provide their email address.

Users may optionally provide their first and last name. This information is used solely to personalise the newsletter.

Statistical collection and analysis
The newsletters contain a web beacon, meaning a file the size of a single pixel, which is retrieved from Mailchimp’s server when the newsletter is opened.

During this retrieval, technical information is initially collected, including information regarding the browser and system, the user’s IP address and the time of retrieval.

This information is used to improve the services technically on the basis of the technical data, or to analyse target groups and their reading behaviour according to the locations from which the newsletter is accessed, which can be determined using the IP address, or the times at which it is accessed.

Statistical collection also includes determining whether newsletters are opened, when they are opened and which links are clicked.

For technical reasons, this information may be associated with individual newsletter recipients.

However, neither we nor Mailchimp intend to monitor individual users.

The evaluations instead help us understand users’ reading habits, adapt our content accordingly and send different content based on users’ interests.

Online access and data management
In some cases, newsletter recipients are directed to Mailchimp websites.

For example, newsletters may contain a link that allows recipients to view the newsletter online, such as where it is not displayed correctly in their email program.

Newsletter recipients may also subsequently correct their data, such as their email address.

Mailchimp’s Privacy Policy is likewise available only on its website.

We point out that Mailchimp websites use cookies and that personal data is processed by Mailchimp, its partners and service providers, such as Google Analytics.

We have no influence over this data collection.

Further information is available in Mailchimp’s Privacy Policy.

We also draw attention to the objection options concerning data collection for advertising purposes available at: http://www.aboutads.info/choices/ and http://www.youronlinechoices.com/ for users in Europe.

Cancellation and withdrawal
Users may cancel receipt of our newsletter at any time, meaning they may withdraw their consent.

This simultaneously withdraws consent to mailing through Mailchimp and to the statistical analyses.

It is unfortunately not possible to separately withdraw consent to mailing through Mailchimp or to the statistical evaluation.

A link for unsubscribing from the newsletter can be found at the end of every newsletter.

12. Integration of Third-Party Services and Content
Our online services may incorporate content or services from third-party providers, such as maps or fonts from other websites.

The integration of third-party content always requires those providers to receive the user’s IP address, as they would otherwise be unable to transmit the content to the user’s browser.

The IP address is therefore required to display this content.

Third-party content providers may also set their own cookies and process users’ data for their own purposes.

User profiles may be created from the processed data.

We will use such content in a way that minimises and avoids unnecessary data collection wherever possible and will select reliable third-party providers with regard to data security.

The following overview lists third-party providers and their content, together with links to their privacy policies containing further information regarding data processing and, in some cases, objection options:

- External fonts from Google Inc., https://www.google.com/fonts (“Google Fonts”). Google Fonts are integrated by making a server request to Google, usually in the United States. Privacy Policy: https://www.google.com/policies/privacy/. Opt-out: https://www.google.com/settings/ads/.

- Maps from Google Maps, provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/. Opt-out: https://www.google.com/settings/ads/.

- Videos from the YouTube platform, provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/. Opt-out: https://www.google.com/settings/ads/.

13. User Rights and Data Deletion
Users have the right, upon request and free of charge, to receive information regarding the personal data stored about them by us.

Users also have the right to have inaccurate data corrected, to withdraw consent, to have their personal data restricted or deleted and, where they suspect unlawful data processing, to lodge a complaint with the competent supervisory authority.

Data stored by us is deleted as soon as it is no longer required for the purpose for which it was collected, provided that no statutory retention obligations prevent deletion.

14. Amendments to this Privacy Policy
We reserve the right to amend this Privacy Policy in order to adapt it to changes in the law or to changes in our services or data processing.

However, this applies only to information concerning data processing.

Where user consent is required or where parts of the Privacy Policy contain provisions relating to the contractual relationship with users, amendments will be made only with the users’ consent.

Users are asked to review the content of this Privacy Policy regularly.

Last updated: 14 May 2018