Privacy Policy

§ 1 General information

Unless stated otherwise below, providing your personal data is neither legally nor contractually required, nor is it necessary to conclude a contract. You are under no obligation to provide the data. Not providing it has no consequences. This applies only insofar as no other information is given for the processing activities described below.

“Personal data” means any information relating to an identified or identifiable natural person.

You can visit our website without providing any information about yourself.

§ 2 Server log files

Each time you access our website, usage data is transmitted by your internet browser to us or to our web host / IT service provider and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.

This processing is carried out on the basis of Art. 6(1)(f) GDPR arising from our predominant legitimate interest in ensuring the smooth operation of our website and improving our offering.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision by the European Commission exists for Canada. For the USA, an adequacy decision by the European Commission is also in place, the Trans-Atlantic Data Privacy Framework (TADPF). This data transfer is based on contractual obligations comparable to the European Commission's standard contractual clauses.

§ 3 Controller & Data Protection Officer

The controller responsible for data processing is:

Our Data Protection Officer you can reach directly at: Farzaneh Asadi · info@dietees.de

§ 4 Contact by email / form

If you contact us by email on your own initiative, we collect your personal data (name, email address, message text) only to the extent you provide it. This processing serves to handle and respond to your enquiry.

If the contact serves to carry out pre-contractual measures or relates to a contract already concluded, this processing is carried out on the basis of Art. 6(1)(b) GDPR.

If the contact is made for other reasons, this processing is carried out on the basis of Art. 6(1)(f) GDPR arising from our predominant legitimate interest in processing and responding to your enquiry. In this case, you have the right to object at any time, for reasons arising from your particular situation, to this processing of your personal data based on Art. 6(1)(f) GDPR.

We use your email address solely to handle your enquiry. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

§ 5 Google address validation

We use the address validation service provided by Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland; “Google”) on our website.

This processing serves to check your entries in our address forms in real time for input and spelling errors and, if necessary, to complete missing data. The following information may be transmitted to Google: postal addresses, email address, phone number.

Your data may be transferred to the USA. An adequacy decision by the European Commission is in place for the USA (TADPF). Google is certified under the TADPF.

This processing is carried out on the basis of Art. 6(1)(f) GDPR. The data is deleted by the provider after 30 days at the latest. More information: cloud.google.com/maps-platform/terms and policies/privacy.

§ 6 Customer account

When you open a customer account, we collect your personal data to the extent specified there. This processing serves to improve your shopping experience and simplify order processing. It is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent until the withdrawal. Your customer account will subsequently be deleted.

§ 7 Collection & disclosure for orders

When you place an order, we collect and process your personal data only to the extent necessary to fulfil and process your order and to handle your enquiries. Providing this data is required to conclude the contract. This processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.

Your data is shared with your chosen shipping company, payment service provider, order-processing service providers and IT service providers. In all cases, we strictly comply with statutory requirements. The scope of the data transfer is limited to the minimum necessary.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. Adequacy decisions by the European Commission exist for both Canada and the USA (TADPF).

§ 8 Newsletter via Mailchimp

For sending our newsletter, we use the service of Rocket Science Group LLC (675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA; “Mailchimp”) as part of a data processing agreement.

We pass on the information you provide during newsletter sign-up (email address and, where applicable, first and last name) to Mailchimp. This processing serves the purpose of sending the newsletter and its statistical evaluation.

To evaluate newsletter campaigns, the newsletters sent contain a 1×1 pixel graphic (tracking pixel) or a tracking link. This allows us to determine whether you have opened the newsletter and whether you have clicked on any embedded links. The data collected is not used to identify you personally.

Your data is transmitted to Mailchimp's servers in the USA. Mailchimp is certified under the TADPF. This processing is carried out on the basis of Art. 6(1)(f) GDPR. More information: mailchimp.com/de/legal/data-processing-addendum.

§ 9 Shipping provider (DHL)

As part of the contract processing, we pass on your email address to the transport company (DHL), provided you have expressly consented to this during the order process. This disclosure serves the purpose of informing you by email about the shipping status.

This processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You can withdraw your consent at any time by notifying us or the transport company.

§ 10 PayPal

We use the PayPal payment service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). This processing serves the purpose of offering you payment via this payment service.

By selecting and using payment via PayPal, the data required to process the payment is transmitted to PayPal in order to fulfil the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

All PayPal transactions are subject to the PayPal privacy policy: paypal.com/de/webapps/mpp/ua/privacy-full.

§ 11 PayPal Express

We use the PayPal Express payment service on our website. To integrate this payment service, it is necessary for PayPal to collect, store and analyse data (e.g. IP address, device type, operating system, browser type, location of your device) when the website is accessed. Cookies may also be used for this purpose.

This processing is carried out on the basis of Art. 6(1)(f) GDPR. By selecting and using it, the payment is processed on the basis of Art. 6(1)(b) GDPR. More information: paypal.com privacy policy.

§ 12 Stripe

We use the Stripe payment service provided by Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) on our website. This processing serves the purpose of offering you payment via this payment service.

Stripe reserves the right to obtain a credit report, if necessary, based on mathematical-statistical methods using credit agencies. This credit report may include probability values (score values) calculated using scientifically recognised mathematical-statistical methods.

This processing is carried out on the basis of Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR (credit check). All Stripe transactions are subject to the Stripe privacy policy: stripe.com/de/privacy.

§ 13 Cookies (general)

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on a user's computer system. Cookies are stored on your device. You therefore have full control over the use of cookies.

The links below provide information on how to manage cookies (including disabling them) in the most common browsers:

• Chrome
• Microsoft Edge
• Mozilla Firefox
• Safari

The use of cookies or similar technologies is carried out on the basis of Section 25(2) TDDDG. The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR arising from our predominant legitimate interest in ensuring the optimal functionality of the website.

§ 14 Consent management tool

We use a consent management tool on our website that allows you to give consent to data processing via the website — in particular the setting of cookies — and to exercise your right to withdraw consent already given.

Cookies may be used for this purpose. Among other things, the following information may be collected and transmitted to the service provider: anonymised IP address, date and time of consent, URL from which consent was sent, anonymous randomly generated encrypted key, consent status.

This processing is carried out to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR.

§ 15 Google Analytics

We use the Google Analytics web analysis service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”).

This processing serves to analyse this website and its visitors, as well as for marketing and advertising purposes. Among other things, the following information may be collected: IP address, date and time of the page visit, click path, information about the browser and device used, pages visited, referrer URL, location data.

The IP address is shortened by Google beforehand within EU member states or other states party to the Agreement on the European Economic Area. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR.

Google is certified under the TADPF. More information: policies.google.com/technologies/partner-sites and policies.google.com/privacy.

§ 16 Hotjar

We use the analysis tool provided by Hotjar Ltd. (Level 2, St Julian's Business Centre, 3, Elia Zammit Street, St Julians STJ1000, Malta; “Hotjar”).

The tool records the movements of website visitors on a sample basis. This produces a record of mouse movements, scrolling behaviour, time spent on the page and clicks on the website (so-called heatmap).

This data is used to create user profiles under a pseudonym. The data is not used to identify the website visitor personally.

Your data may be transferred to the USA. Hotjar is not certified under the TADPF. The data transfer is based, among other things, on appropriate safeguards. This processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR. Further information: hotjar.com/legal/policies/privacy.

§ 17 Meta Pixel (Facebook / Instagram)

We use the Meta Pixel provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Meta”).

Meta and we are joint controllers for the collection of your data and its transmission to Meta that takes place when the service is integrated. This is based on an agreement on joint processing of personal data, available at facebook.com/legal/terms/businesstools.

This application serves the purpose of targeting website visitors with interest-based advertising on the Facebook and Instagram social networks and creating conversion statistics.

Meta is certified under the TADPF. This processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR. Further information: facebook.com/about/privacy.

§ 18 Google Ads & Remarketing

We use the online advertising program “Google Ads” on our website, including conversion tracking. If you click on an ad placed by Google, a cookie for conversion tracking is stored on your device. These cookies have a limited validity period, contain no personal data and are therefore not used for personal identification.

We also use the remarketing function or “similar audiences”. This application serves the purpose of analysing visitor behaviour and interests. Anonymised data on the use of the website is collected via cookies.

Your data may be transmitted to servers operated by Google LLC in the USA. Google is certified under the TADPF. This processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR. More information: policies/privacy and google.com/privacy/ads.

§ 19 Pinterest Tag

We use the Pinterest Tag provided by Pinterest Europe Limited (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland; “Pinterest”).

This application serves the purpose of targeting website visitors with interest-based advertising on the Pinterest social network and creating conversion statistics.

Pinterest is not certified under the TADPF. The data transfer is based on standard contractual clauses. This processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR. Further information: policy.pinterest.com/de/privacy-policy.

§ 20 HubSpot Marketing Hub

We use the Marketing Hub software provided by HubSpot, Inc. (25 First Street Cambridge, MA 02141, USA; “HubSpot”) as part of a data processing agreement.

This processing serves to analyse our website and its visitors, as well as to analyse and evaluate our marketing campaigns and to improve customer engagement through targeted advertising.

HubSpot is certified under the TADPF. This processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR. Further information: legal.hubspot.com/de/privacy-policy.

§ 21 TikTok Pixel

We use the TikTok Pixel provided by TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) and TikTok Information Technologies UK Limited on our website.

This processing serves to identify and analyse our customers' visits to the website and to improve customer engagement through targeted advertising.

TikTok is not certified under the TADPF. The transfer of data to the USA is based on standard contractual clauses. This processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR. Further information: tiktok.com privacy policy.

§ 22 Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). This application manages JavaScript tags and HTML tags used in particular to implement tracking and analysis tools.

Google Tag Manager itself does not store cookies, nor does it process any personal data. However, it enables the triggering of other tags that may collect and process personal data.

§ 23 Google reCAPTCHA

We use the reCAPTCHA service provided by Google Ireland Limited on our website. This check serves to distinguish input made by a human from automated, machine-based processing. For this purpose, your input is transmitted to Google and further used there. In addition, the IP address and, where applicable, further data are transmitted to Google.

Google is certified under the TADPF. This processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR. Further information: google.com/recaptcha and google.com/privacy.

§ 24 Cloudflare CDN

We use the Cloudflare CDN content delivery network provided by Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA; “Cloudflare”). This is a supra-regional network of servers in various data centres, to which our web server connects and through which certain content on our website is delivered.

This processing serves the purpose of optimising our website's loading times. Among other things, the following information may be collected: IP address, system configuration information, information about traffic to and from customer websites.

Cloudflare is certified under the TADPF. This processing is carried out on the basis of Art. 6(1)(f) GDPR. Further information: cloudflare.com/de-de/privacypolicy.

§ 25 Google Maps

We use the function for embedding Google Maps maps provided by Google Ireland Limited on our website. This function enables the visual display of geographical information and interactive maps. In doing so, Google also collects, processes and uses data from visitors to the website.

Google is certified under the TADPF. This processing is carried out with your consent on the basis of Art. 6(1)(a) GDPR. Further information: google.com/privacypolicy.

§ 26 Storage & retention periods

After the contract has been fully processed, the data is retained initially for the duration of the warranty period, and subsequently in accordance with statutory retention periods, in particular tax and commercial law retention periods and then deleted once the retention period has expired, unless you have consented to further processing and use.

§ 27 Your rights (Art. 15–21 GDPR)

Provided the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR:

• Right to access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)

In addition, under Art. 21(1) GDPR you have the right to object to processing based on Art. 6(1)(f) GDPR, as well as to processing for the purposes of direct marketing.

§ 28 Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is unlawful.

You may, among other things, lodge a complaint with the supervisory authority responsible for us: