Privacy Policy

Responsible:

Social Fashion Company GmbH

Thebäerstr. 17

50823 Cologne

Germany

Phone: +49 (221) 29 23 29 0

Email: datenschutz@armedangels.com

The company data protection officer is:

Mr. Christian Volkmer
Project 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg
Germany
Phone: +49 941 2986930
Fax: +49 941 29869316
Email: anfragen@projekt29.de

When you shop in the store, we process the following data:

• Transaction data (e.g. product, price, payment method, time)
• Payment information (e.g. bank details, card details – via the payment service provider)
• Email address (if you wish to receive a digital receipt or register for the club)
• First name, last name, optional date of birth (if participating in the Changemakers Club)

We collect the data directly from you during the checkout process or when you voluntarily participate in our offers

Purpose Legal basis

Purposes of data processing and legal bases:

• Execution of the purchase process and payment processing (including Shopify Payments) – Art. 6 (1) (b) GDPR
  
• Provision of the digital receipt – Art. 6 (1) (b) GDPR
• Participation in the Changemakers Club including benefit communication – Art. 6 (1) (b) GDPR (contract), if applicable Art. 6 (1) (a) GDPR (consent for advertising)
• Fulfillment of statutory retention obligations (e.g. commercial and tax law) – Art. 6 (1) (c) GDPR
• IT security, fraud prevention, optimization of internal processes – Art. 6 (1) (f) GDPR

You can object to the use of your personal data for advertising purposes at any time, either in whole or in respect of individual measures, without incurring any costs other than the transmission costs according to the basic rates.

The confidentiality of your personal data is important to us. Your personal data will only be shared if this is necessary to fulfill pre-contractual, contractual, or legal obligations, to protect our overriding legitimate interests or those of a third party, or if we have your consent.

Your data will only be passed on to parties necessary to process the contract or to comply with legal obligations, e.g.:

• Payment service providers (e.g. Shopify Payments)
• IT and system service providers who operate our cash register systems or customer loyalty programs
• if applicable, shipping service provider if a reshipment or complaint occurs
• Authorities, if legally obliged (e.g. tax office)

Unless there are legal retention obligations to the contrary and we no longer need your data for the purposes stated above, we will delete your data. However, as long as a contractual relationship exists between us and you, the processing of the data collected for this purpose is mandatory.

We generally only store your data for as long as is necessary for the respective processing purposes or as long as statutory retention periods apply:

• Tax and commercial retention period: 10 years
• Marketing data (e.g. club membership): until revocation or end of membership
• Digital receipt data: max. 6 months, unless otherwise stipulated by law

The transfer of personal data to a third country within the EU is of course permitted. We have no plans to transfer data outside the EU or the EEA. Within the scope of the contractual relationship – particularly in the event of a service being provided and for the assertion, exercise, and defense of any legal claims – it is necessary for us to transfer your personal data to the extent necessary to recipients in third countries. These are countries outside the EU or the EEA.

In all other cases, the data transfer takes place on the basis of an adequacy decision (Art. 45 GDPR), suitable safeguards (such as standard data protection clauses) within the meaning of Art. 46 GDPR or binding internal data protection rules (binding corporate rules of a group of companies).

In any case, insurers may, in individual cases, transfer personal data to recipients in third countries in accordance with Art. 49 GDPR. This occurs, in particular, for the performance of the respective insurance contract (lit. b) or for the assertion or defense of legal claims (lit. e).

You have the right to information, correction, deletion or restriction of the processing of your stored data at any time, the right to object to the processing as well as the right to data portability and to lodge a complaint in accordance with the requirements of data protection law.

Right to information:

You can request information from us as to whether and to what extent we process your data.

Right to rectification:

If we process your data that is incomplete or incorrect, you can request that we correct or complete it at any time.

Right to erasure:

You can request that we delete your data if we process it unlawfully or if the processing disproportionately interferes with your legitimate interests. Please note that there may be reasons that prevent immediate deletion, e.g., in the case of statutory retention periods.

Regardless of whether you exercise your right to erasure, we will delete your data immediately and completely, unless there is a contractual or statutory obligation to retain it.

Right to restriction of processing:

You can request that we restrict the processing of your data if

• You dispute the accuracy of the data for a period that enables us to verify the accuracy of the data.
• the processing of the data is unlawful, but you refuse to delete it and instead request a restriction of data use,
• we no longer need the data for the intended purpose, but you still need this data to assert or defend legal claims, or
• You have objected to the processing of your data.
  

Right to data portability:

You can request that we provide you with the data you have provided to us in a structured, common and machine-readable format and that you can transmit this data to another responsible party without hindrance from us, provided that

we process this data based on your consent which can be revoked or to fulfil a contract between us, and
this processing is carried out using automated procedures.
If technically feasible, you can request that we transmit your data directly to another controller.

Right of objection:

If we process your data based on legitimate interests, you can object to this data processing at any time; this would also apply to profiling based on these provisions. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims. You can object to the processing of your data for direct marketing purposes at any time without giving reasons.

Right to complain:

If you believe that we are violating German or European data protection law in the processing of your data, please contact us so we can clarify any questions. You also have the right to contact the supervisory authority responsible for you, the relevant state data protection authority.

If you wish to exercise any of the aforementioned rights, please contact our data protection officer. If in doubt, we may request additional information to confirm your identity.

The processing of your data is necessary for the conclusion or fulfillment of the contract you have entered into with us. If you do not provide us with this data, we will generally have to refuse to conclude the contract or will no longer be able to perform an existing contract and will therefore have to terminate it. However, you are not obligated to consent to the processing of data that is not relevant for the fulfillment of the contract or is not required by law.