PRIVACY POLICY

As the operator of the XENOX online shop at xenozz.shop, we, being
Stütz GmbH
Gürtelstraße 34–36
4020 Linz
Austria
Tel.: +43 732 772895 0
Fax: +43 732 781895,
E-mail: office@stuetz.com
FN 358176f (Regional Court of Linz), hereby inform you in accordance with Article 12 et seq. of the General Data Protection Regulation (GDPR) regarding data processing activities carried out by us in connection with the website xenozz.shop and the XENOX online shop:

1. The rights of the data subjects:

Every person affected by any of the data processing activities mentioned below has – provided the legal requirements are met and always only in accordance with the relevant legal provisions – the following rights:

• The right to access the personal data concerning them.
• The right to rectification of the personal data concerning them.
• The right to erasure of the personal data concerning them.
• The right to restriction of processing of the personal data concerning them.
• The right to portability of the personal data concerning them.
• The right to object to the processing of the personal data concerning them.
• The right to lodge a complaint with the Austrian Data Protection Authority.
• The right to withdraw any consent given for data processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

2. Processing of customer data:

We process the personal data of each customer (purchaser) as a data subject that the customer (purchaser) provides in the course of placing an order in the XENOX online shop by entering it into the respective form, for the following purposes (based on the specified legal basis):

• Processing of the order, conclusion and fulfillment of the purchase contract (legal basis is the necessity for the performance of pre-contractual measures at the request of the data subject and for the fulfillment of a contract to which the data subject is a party).
• Accounting and documentation of all sales (legal basis is our legal obligation, namely our commercial and tax law retention obligations).
• Contacting you, sending useful or interesting information, and advertising by post (legal basis is our legitimate interest in achieving these purposes).
• Contacting you and sending information and offers regarding similar products of our own by e-mail to existing customers, provided that we have received the e-mail address in connection with the sale of a product and there is no objection (legal basis is our legitimate interest in direct marketing in accordance with Art. 6 Para. 1 lit. f GDPR in conjunction with Section 107 Para. 3 of the Telecommunications Act (TKG)).
• If the data subject has given corresponding consent: Sending the e-mail newsletter; contacting you, sending useful or interesting information and advertising by e-mail (legal basis is the consent of the data subject).
• If necessary, legal assessment and the assertion or defense of legal claims, provision of evidence (legal basis is our legitimate interest in achieving these purposes).

This data will be disclosed at least in part to the following categories of recipients, whereby this disclosure only occurs to the extent necessary to achieve the respective purpose and the data will not leave the territory of the European Union:

• Our employees.
• Our tax advisors.
• Processors used by us, such as IT service providers and software providers.
• Carriers commissioned by us.
• If necessary, our legal representatives, courts, and various authorities.

We store data concerning customers until the expiry of all relevant limitation and retention periods.

The provision of personal data by the customer is neither legally nor contractually required. However, we can only process an order if the data requested during the ordering process is made available to us.

3. Processing of website visitor data:

A) Data actively provided by the visitor:

We process all data that the visitor to the website xenozz.shop ("visitor") actively provides by filling out the corresponding fields, in particular when registering for the newsletter. Such data processing serves the purpose of providing the visitor with the service for which they have registered (legal basis is the consent of the data subject).

This data is disclosed to our employees and processors used by us (in particular IT service providers).

B) Automatically collected personal data (= information about cookies):

In the course of visiting our website, we also collect and process personal data concerning the visitor that the visitor does not actively provide by entering it into a designated field. This is done by setting cookies. A cookie is a small text file that stores internet settings and which the visitor's web browser downloads during the first visit to a website. When this website is called up again with the same terminal device, the cookie is sent back and provides information, either to the website that created and sent it itself (first-party cookie) or to a person different from the website who created the cookie independently of the website and then sent it via the website (third-party cookie). Through this return of the cookie, the website or this person different from the website recognizes that the visitor has already visited this website or another website that sends the same third-party cookie with their browser. And possibly the content varies based on this information.

Newsletter

With the following information, we inform you about the contents of our newsletter as well as the registration, dispatch, and statistical evaluation procedures, and your right to object. By subscribing to our newsletter, you agree to receive it and to the described procedures.

Content of the newsletter:
We send newsletters, e-mails, and other electronic notifications containing promotional information (hereinafter "newsletter") only with the consent of the recipients or legal permission. If the contents of the newsletter are specifically described during registration, they are decisive for the user's consent. Otherwise, our newsletters contain information about our products and accompanying information (e.g., safety instructions), offers, promotions, and our company.

Double opt-in and logging:
Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registration, you will receive an e-mail asking you to confirm your registration. This confirmation is necessary so that no one can register with third-party e-mail addresses. Newsletter registrations are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the registration and confirmation time, as well as the IP address. Changes to your data stored with the dispatch service provider are also logged.

Registration data:
To register for the newsletter, it is sufficient to provide your e-mail address. Optionally, we ask you to provide a name for the purpose of a personal address in the newsletter.

The dispatch of the newsletter and the associated performance measurement are based on the consent of the recipients pursuant to Art. 6 Para. 1 lit. a, Art. 7 GDPR in conjunction with Section 107 Para. 2 TKG or, if consent is not required, on the basis of our legitimate interests in direct marketing pursuant to Art. 6 Para. 1 lit. f GDPR in conjunction with Section 107 Para. 2 and 3 TKG.

The logging of the registration process is based on our legitimate interests pursuant to Art. 6 Para. 1 lit. f GDPR. Our interest is focused on the use of a user-friendly and secure newsletter system that serves both our business interests and meets the expectations of the users, and also allows us to provide evidence of consent.

Cancellation/Withdrawal – You can cancel the receipt of our newsletter at any time, i.e., withdraw your consent. You will find a link to cancel the newsletter at the end of every newsletter. We may store the unsubscribed e-mail addresses for up to three years based on our legitimate interests before deleting them, in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of a possible defense against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time.

Newsletter – Klaviyo

The newsletters are sent using the dispatch service provider "Klaviyo", a newsletter dispatch platform of the US provider Klaviyo Inc., 60 South Street, Suite 910, Boston, Massachusetts, USA ("Klaviyo"). There is no adequacy decision by the EU Commission for data transfers to the USA. Klaviyo ensures an adequate level of data protection via EU standard contractual clauses. You can view the privacy policy of the dispatch service provider here: https://www.klaviyo.com/legal

The dispatch service provider may use the recipients' data in a pseudonymous form, i.e., without assignment to a user, for the optimization or improvement of its own services, e.g., for technical optimization of the dispatch and presentation of the newsletters or for statistical purposes. However, the dispatch service provider does not use the data of our newsletter recipients to write to them itself or to pass the data on to third parties.

Newsletter – Performance measurement

The newsletters contain a so-called "web beacon", i.e., a pixel-sized file that is retrieved from our server when the newsletter is opened, or if we use a dispatch service provider, from its server. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, is initially collected.

This information is used for the technical improvement of the services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined with the help of the IP address) or the access times. Statistical collection also includes determining whether the newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can indeed be assigned to individual newsletter recipients. However, it is neither our intention nor that of the dispatch service provider, if used, to observe individual users. The evaluations rather serve us to recognize the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users.

A separate withdrawal of the performance measurement is unfortunately not possible; in this case, the entire newsletter subscription must be cancelled.

Hosting and e-mail dispatch

The hosting services we use serve to provide the following services: infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services, and technical maintenance services, which we use for the purpose of operating this online offer.

In doing so, we or our hosting provider process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties, and visitors to this online offer on the basis of our legitimate interests in an efficient and secure provision of this online offer pursuant to Art. 6 Para. 1 lit. f GDPR in conjunction with Art. 28 GDPR (conclusion of a data processing agreement).

i. We use Google Analytics: The visitor's IP address is anonymized in this process.

• Google Analytics is a web analysis service operated by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States). Google processes the data on website usage on our behalf (as a data processor) and is contractually committed to measures to ensure the confidentiality of the processed data.
• Google Analytics uses cookies that enable an analysis of the use of the website. The information generated by the cookie about the use of this website is generally transmitted to a Google server in the USA and stored there. The pages accessed, any orders, visitor behavior on the pages (e.g., clicks, scrolling behavior, and time spent), the approximate location of the visitor (country and city), the visitor's IP address (in anonymized form, so that no clear assignment is possible, cf. immediately below), technical information about the connection and the internet provider, the terminal device (including ID and screen resolution) and the browser, as well as the source of origin of the visit ("referral URL") are collected.
• The IP anonymization active on this website, however, leads to the anonymization of the IP address and thus to the anonymization of all collected data: For user IP addresses of the IPv4 type, the last octet is set to zero, and for IPv6 addresses, the last 80 bits are set to zero in memory (i.e., "anonymized") shortly after they have been sent to the Analytics data collection network for recording, and this occurs within the working memory and before storage on the hard disk (more on anonymization at https://support.google.com/analytics/answer/2763052?hl=de).
• The anonymized IP address transmitted by the browser as part of Google Analytics will not be merged with other data from Google.
• The purpose of this data processing by Google is the analysis of the use of our website and, based on this, the optimization of our website and the advertising measures taken in connection with it. We have a legitimate interest in achieving this purpose.
• On our behalf, Google will use the information received to evaluate – in anonymized form – the use of the website by the visitor, to compile reports on website activities, and to provide further services associated with website use and internet use.
• Google stores this data on our behalf for 14 months, after which this data is deleted. Only in aggregated form does it remain permanently (e.g., in the specified total number of website hits).
• Anyone who does not want user data and IP addresses to be stored and processed in anonymized form must not allow the storage of cookies and thus the collection of data by Google (setting in the web browser used: do not allow third-party cookies). Of course, not all functions of the website may be fully usable then.
• Even more details on Google Analytics can be found here: https://policies.google.com/privacy?hl=de

Google Tag Manager

Google Tag Manager is a solution with which we can manage so-called website tags via an interface (and thus, for example, integrate Google Analytics and other Google marketing services into our online offer). The Tag Manager itself (which implements the tags) does not process any personal data of the users. With regard to the processing of users' personal data, reference is made to the following information on Google services. Usage guidelines: https://www.google.com/intl/de/tagmanager/use-policy.html.

You can deactivate Google Analytics here:

Further information on data usage by Google, settings, and objection options can be found in Google's privacy policy (https://policies.google.com/technologies/ads) as well as in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

The users' personal data is deleted or anonymized after 14 months.

Google Universal Analytics

We use Google Analytics in the form of Universal Analytics. "Universal Analytics" refers to a method of Google Analytics in which user analysis is carried out on the basis of a pseudonymous user ID and thus a pseudonymous profile of the user is created with information from the use of different devices (so-called "cross-device tracking").

Target group formation with Google Analytics

We use Google Analytics to display advertisements placed within Google's and its partners' advertising services only to those users who have also shown an interest in our online offer or who have certain characteristics (e.g., interests in certain topics or products that are determined based on the visited websites) that we transmit to Google (so-called "remarketing" or "Google Analytics audiences"). With the help of remarketing audiences, we also want to ensure that our advertisements correspond to the potential interest of the users.

Google AdWords and conversion measurement

Based on our legitimate interests (i.e., interest in the analysis, optimization, and economic operation of our online offer within the meaning of Art. 6 Para. 1 lit. f GDPR), we use the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, ("Google").

Google is certified under the Privacy Shield agreement and thereby offers a guarantee to comply with European data protection law (https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active). (Disable Google Analytics)

We use the online marketing tool Google "AdWords" to place advertisements in the Google advertising network (e.g., in search results, videos, on websites, etc.) so that they are displayed to users who have a presumed interest in the ads. This allows us to display ads for and within our online service in a more targeted manner, to present users only with ads that potentially correspond to their interests. For example, if a user is shown ads for products they have expressed interest in on other online services, this is referred to as "remarketing." For these purposes, when our website and other websites on which the Google advertising network is active are accessed, a code is executed directly by Google, and so-called (re)marketing tags (invisible graphics or code, also known as "web beacons") are integrated into the website. With their help, an individual cookie, i.e., a small file, is stored on the user's device (comparable technologies can also be used instead of cookies). This file records which websites the user has visited, which content they are interested in, and which offers the user has clicked on, as well as technical information about the browser and operating system, referring websites, visit time, and other details regarding the use of the online service.

Furthermore, we receive an individual "conversion cookie." The information obtained with the help of the cookie serves the purpose of Google creating conversion statistics for us. However, we only learn the anonymous total number of users who have clicked on our ad and were redirected to a page provided with a conversion tracking tag. We do not receive any information that can personally identify users.

The data of the users is processed pseudonymously within the framework of the Google advertising network. This means that Google does not store and process, for example, the name or email address of the users, but rather processes the relevant data on a cookie-related basis within pseudonymous user profiles. In other words, from Google's perspective, the ads are not managed and displayed for a specifically identified person, but for the cookie owner, regardless of who this cookie owner is. This does not apply if a user has expressly permitted Google to process the data without this pseudonymization. The information collected about the users is transmitted to Google and stored on Google's servers in the USA.

Further information on data usage by Google, settings, and objection options can be found in Google's privacy policy (https://policies.google.com/technologies/ads) as well as in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

ii. We use Facebook Pixel:

• Facebook Pixel is provided by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook").
• We are jointly responsible with Facebook under data protection law for the processing of personal data associated with the use of Facebook Pixel.
• The use of Facebook Pixel results in Facebook setting a cookie, provided the visitor has consented to this through the corresponding settings of their web browser (by allowing third-party cookies).
• Moreover, personal data concerning the visitor is only collected and processed if the visitor is logged into Facebook and has arrived at our website via a Facebook advertisement. In this process, a link to the visitor's Facebook profile is established. In addition, data regarding the visitor's behavior on our website and the hardware and software used is processed. We do not perform so-called "automatic advanced matching."
• The purpose of this data processing is the analysis and optimization of our online service and its appropriate promotion, specifically through the placement of targeted and individualized Facebook advertisements (details at https://www.facebook.com/business/learn/facebook-ads-pixel). The legal basis for the data processing is our legitimate interest in achieving this purpose.
• Tracking procedures enable Facebook to track the visitor affected by the data processing across numerous websites and to use this for advertising products on Facebook. We as website operators, however, cannot view this collected user data.
• Furthermore, the visitor can change the settings for Facebook advertisements in their Facebook profile.
• Facebook Pixel is integrated into our website using Google Tag Manager. Google Tag Manager is a solution that allows us to manage website tags (Facebook Pixel) via an interface. The Tag Manager tool itself (which implements the tags) is a cookie-less domain. The tool ensures the triggering of other tags, which in turn collect data (as described above). Google Tag Manager does not access this data.

iii. Consentmanager (Consent Management Tool)

We use the consent management platform "Consentmanager" from consentmanager AB, Haltegelvägen 1b, 72348 Västeras, Sweden. This service allows us to obtain and manage the consent of website users for data processing. Consentmanager collects data generated by end users who use our website. When an end user gives consent, the following data is automatically logged by Consentmanager:

• Browser information
  
• Date and time of access
  
• Device information
  
• The URL of the visited page
  
• Banner language
  
• Consent ID
  
• The consent status of the end user, which serves as proof of consent. The consent status is also saved in the end user's browser, so that the website can automatically read and follow the end user's consent for all subsequent page requests and future end user sessions for up to 12 months. Consent data (consent and revocation of consent) is stored for three years. The retention period corresponds to the regular statute of limitations according to § 195 of the German Civil Code (BGB). The data is then deleted immediately.

The functionality of the website is not guaranteed without the described processing. There is no possibility for the user to object as long as there is a legal obligation to obtain the user's consent for certain data processing operations (Art. 7 para. 1, Art. 6 para. 1 sentence 1 lit. c GDPR).

Consentmanager is a recipient of your personal data and acts as a processor for us. Data processing takes place exclusively in the European Union. Detailed information on the use of Consentmanager can be found at: https://www.consentmanager.de/datenschutz/.

Online presence in social media

We maintain online presence within social networks and platforms in order to communicate with the customers, interested parties, and users active there and to be able to inform them about our services there.

We point out that user data may be processed outside the territory of the European Union. This can result in risks for users because, for example, the enforcement of user rights could be made more difficult. With regard to US providers that are certified under the Privacy Shield, we point out that they commit themselves to complying with EU data protection standards.

Furthermore, user data is generally processed for market research and advertising purposes. For example, usage profiles can be created based on user behavior and the interests resulting from it. The usage profiles can in turn be used, for example, to place advertisements within and outside the platforms that presumably correspond to the interests of the users. For these purposes, cookies are generally stored on the users' computers, in which the usage behavior and the interests of the users are stored. Furthermore, data can also be stored in the usage profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged into them).

The processing of the users' personal data takes place on the basis of our legitimate interests in providing effective information to users and communicating with them pursuant to Art. 6 para. 1 lit. f. GDPR. If users are asked for consent to data processing by the respective providers (i.e., they declare their consent, e.g., by checking a checkbox or confirming a button), the legal basis for the processing is Art. 6 para. 1 lit. a., Art. 7 GDPR.

For a detailed description of the respective processing and the possibilities of objection (opt-out), we refer to the information provided by the providers linked below.

Also in the case of requests for information and the assertion of user rights, we point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data in each case and can directly take appropriate measures and provide information. Should you nevertheless require assistance, you can contact us.

• Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) – Privacy Policy: https://www.facebook.com/about/privacy/ , Opt-Out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com , Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000GnywAAC&status=Active.
• Google/ YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – Privacy Policy: https://policies.google.com/privacy , Opt-Out: https://adssettings.google.com/authenticated , (Disable Google Analytics) Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI&status=Active
• Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) – Privacy Policy/ Opt-Out: http://instagram.com/about/legal/privacy/
• Twitter (Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA) – Privacy Policy: https://twitter.com/de/privacy, Opt-Out: https://twitter.com/personalization, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000TORzAAO&status=Active.
• Pinterest (Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA) – Privacy Policy/ Opt-Out: https://about.pinterest.com/de/privacy-policy.
• LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) – Privacy Policy https://www.linkedin.com/legal/privacy-policy , Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out, Privacy Shield: https://www.privacyshield.gov/participant?id=a2zt0000000L0UZAA0&status=Active.
• Xing (XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany) – Privacy Policy/ Opt-Out: https://privacy.xing.com/de/datenschutzerklaerung.

Integration of third-party services and content

Within our online offer, we use content or service offerings from third-party providers on the basis of our legitimate interests (i.e., interest in the analysis, optimization, and economic operation of our online offer within the meaning of Art. 6 para. 1 lit. f. GDPR) in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content").

This always presupposes that the third-party providers of this content perceive the IP address of the users, as they would not be able to send the content to their browsers without the IP address. The IP address is therefore necessary for the display of this content. We strive to use only such content whose respective providers use the IP address solely for the delivery of the content. Third-party providers may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. Through "pixel tags," information such as visitor traffic on the pages of this website can be evaluated. The pseudonymous information can also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, visit time, and other details about the use of our online offer, as well as be linked with such information from other sources.

Instagram:

Functions and content of the Instagram service, offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA, can be integrated within our online offer. This can include, for example, content such as images, videos, or texts and buttons with which users can share content of this online offer within Instagram. If users are members of the Instagram platform, Instagram can assign the access to the aforementioned content and functions to the users' profiles there. Privacy Policy of Instagram: http://instagram.com/about/legal/privacy/

Pinterest:

We use functions and advertising opportunities of the Pinterest platform, provided by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA. This can lead to the processing of personal data of the users by Pinterest, especially if they have a Pinterest account or interact with our content (e.g., pins, ads).

Pinterest uses cookies and similar technologies to analyze and optimize advertising, for example, to create pseudonymous usage profiles. This data can also be processed across devices. Further information on data processing and objection options (opt-out) can be found in Pinterest's privacy policy:
https://policy.pinterest.com/de/privacy-policy.

TikTok:

We maintain an online presence and place advertisements on the TikTok platform, a service of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (for users in the EEA) or TikTok Inc., 5800 Bristol Parkway, Suite 100, Culver City, CA 90230, USA.

When using TikTok (both within the scope of our organic content and advertising campaigns), personal data may be processed by TikTok and transferred to countries outside the EU, in particular to the USA. TikTok collects, among other things, technical data, interaction data, and—if a user account exists—can assign the interaction with our channel to the respective profile. Further information can be found in TikTok's privacy policy:
https://www.tiktok.com/legal/page/eea/privacy-policy/de