Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Wisteria GmbH
Hechtstr. 43
82266 Inning, Germany
Email: [email protected]

2. Accessing our website (server log files)

Each time our website is accessed, your browser automatically transmits information to our server, which is temporarily stored in a log file. The following is recorded:

• the website accessed and the time of access
• the volume of data transferred in bytes
• the website previously visited (referrer)
• the browser and operating system used
• the IP address (anonymised where applicable)

This processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring a smooth connection, comfortable use of the website, and the evaluation of system security and stability.

3. Cookies

We use cookies and similar technologies. Strictly necessary cookies, in particular to manage your session, your shopping cart and to store your cookie settings, are used on the basis of § 25 (2) TDDDG and Art. 6 (1) (b) and (f) GDPR; no consent is required for them (for our cookieless reach measurement, see section 4).

We only set statistics and marketing cookies (see sections 5 to 7) if you have consented via our cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Your consent is voluntary and not required to use the shop; you can withdraw it at any time with effect for the future via “Cookie settings” in the footer. A complete list of all cookies used, including storage periods, can be found on our “Cookie Policy” page.

4. Reach measurement (cookieless)

To determine the load and usage of our shop, we carry out our own cookieless reach measurement (e.g. page views and the number of concurrently active visitors). This uses only a random identifier held solely in the memory of the browser tab; no cookies are set and no data is stored on your device. We do not combine this with other data sources and do not track you across devices. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the statistical evaluation and in ensuring the stable operation of our offering.

5. Google Analytics 4

If you have consented, we use Google Analytics 4, a web analytics service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies (_ga and _ga_*, stored for 2 years each) and processes pseudonymous identifiers (client and session ID) as well as device and usage data to evaluate how our shop is used. After a purchase we also transmit, server-side, a purchase event with client/session ID, order number and cart data to Google Analytics (Measurement Protocol) to attribute the purchase to the session; this, too, only happens if consent has been given.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without consent, Google Analytics is not loaded. Google processes this data on our behalf as a processor under the Google Data Processing Terms (Art. 28 GDPR). Data may be transferred to Google LLC in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. You can withdraw your consent at any time via “Cookie settings” in the footer. Further information: https://policies.google.com/privacy.

6. Google Ads

If you have consented, we use Google Ads (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to measure the success of our ads (conversion measurement) and for remarketing. Cookies such as _gcl_au and _gcl_aw (3 months each) and IDE (13 months) are set to recognise whether you reached us via an ad and whether a purchase followed. After a purchase we also transmit a pseudonymised (SHA-256-hashed) form of your email address to Google (“Enhanced Conversions”) to attribute the purchase to the ad; the hashing takes place in your browser and the email address itself is never sent to Google. This, too, only happens with your consent to Google Ads.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer. For the processing of advertising data in its own systems, Google is an independent controller; Google's controller-controller data protection terms apply in that respect. Data may be transferred to Google LLC in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. Further information: https://policies.google.com/privacy.

Google Customer Reviews: after an order you can, if you wish, open the "Google Customer Reviews" programme on the order confirmation page. Only with that click is a Google module (Google Ireland Ltd.) loaded and your order number, email address, delivery country and estimated delivery date sent to Google; if you agree inside the module, Google emails you after delivery asking for a review. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); it is voluntary, and without your click no data is transferred to Google. Google is independently responsible for the further processing; for the transfer to the USA the above applies.

7. Meta Pixel and Conversions API

If you have consented, we use the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) to measure the success of our advertising on Facebook and Instagram and to build audiences (custom audiences). The pixel sets cookies (_fbp, _fbc and fr, stored for 3 months each) and records your interactions with our shop. After a purchase we also transmit, server-side via the Meta Conversions API, a pseudonymised (SHA-256-hashed) form of your email address, the _fbp/_fbc cookie IDs and order data (e.g. order value and currency) to Meta to attribute the purchase to the ad; this, too, only happens if consent has been given.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without marketing consent, neither the pixel is loaded nor does the server-side transmission take place. For the collection and transmission of this data we are joint controllers with Meta (Art. 26 GDPR); the arrangement for this is Meta's Controller Addendum. Under it, Meta is responsible in its own right for the subsequent processing of the data. Data may be transferred to Meta Platforms Inc. in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Meta Platforms Inc. is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. You can withdraw your consent at any time via “Cookie settings” in the footer. Further information: https://www.facebook.com/privacy/policy.

8. Where orders come from (campaign attribution)

To understand which pages and campaigns lead to orders, we note the following during your visit, without storing anything on your device for it: the page through which you entered our shop (without any appended parameters), the domain of the website you came to us from, the campaign parameters of the address you opened (UTM parameters, e.g. source, medium and campaign name) and a short code we use to mark links and recommendations on our own pages. When you add an item to your cart or place an order, we store this information with the cart and the order, together with the type of device (smartphone, tablet or computer), which we derive from the information your browser sends with every page request. If you later order from the same cart, we attribute the order to this origin. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to see which advertising and which content lead to purchases. We delete this information 14 months after the order; on a cart, after an order or after 90 days without changes.

If you have consented to statistics cookies, we additionally store the campaign parameters, the entry page and the origin of a visit that began through a campaign or such a marked link in your browser for up to 90 days. If you order on a later visit within this period, we attribute the order to that first campaign (“first-touch” attribution). The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer.

If you have consented to Google Ads and came to us through a Google ad, we also transmit the click identifier that Google appends to the address you opened (gclid, gbraid or wbraid) when you order, and store it with the order so that we can attribute the purchase to the ad. We do not store the click identifier on your device ourselves for this; with your consent, Google stores it in the cookie _gcl_aw (see section 6). On the order, we delete it 90 days after the order. The legal basis is your consent (Art. 6 (1) (a) GDPR).

9. Consent log (cookie consents)

We log your decision in the cookie banner (consent or rejection) server-side so that we can demonstrate it (Art. 7 (1) GDPR). We store a pseudonymous consent ID generated in your browser, your decision per category, the version of the consent text, the time, the page accessed, a truncated (not complete) IP address and the browser identifier (user agent). The legal basis is Art. 6 (1) (c) GDPR (duty to demonstrate consent) in conjunction with Art. 6 (1) (f) GDPR. The log is retained for 13 months and then deleted.

10. Customer account and registration

You can create a customer account with us. The data collected for this (e.g. name, email address, billing and delivery address) is processed to perform the contract and manage your account on the basis of Art. 6 (1) (b) GDPR. You can have your customer account deleted at any time by contacting us.

For business customers (B2B) we additionally process the VAT identification number to assess tax liability. Sign-in to the customer account is passwordless via a one-time code sent by email.

11. Order processing

To process your order we process the order, billing and delivery data you provide. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). Where statutory retention obligations apply (e.g. under commercial and tax law), we store the relevant data on the basis of Art. 6 (1) (c) GDPR for the duration of those periods (generally up to ten years).

12. Disclosure to shipping service providers

To deliver the ordered goods, we pass on your delivery data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery. The legal basis is Art. 6 (1) (b) GDPR. Depending on the order, this may be one of the following companies:

• DHL / Deutsche Post AG
• DPD Deutschland GmbH
• United Parcel Service Deutschland S.à r.l. & Co. OHG (UPS)
• General Logistics Systems Germany GmbH & Co. OHG (GLS)
• Hermes Germany GmbH

13. Payment processing

Card payment via Stripe

When paying by credit card or comparable means of payment, processing is carried out by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The data required for the payment is transmitted directly to Stripe. The legal basis is Art. 6 (1) (b) GDPR. Further information can be found in Stripe's privacy policy.

Payment via PayPal

When paying via PayPal, processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. The payment data is transmitted directly to PayPal. The legal basis is Art. 6 (1) (b) GDPR. PayPal's privacy terms additionally apply.

Payment by bank transfer (prepayment)

When paying by bank transfer, we process the data required to reconcile the payment. No data is passed on to a payment service provider in this case; the payment is made via your bank.

14. Invoicing, accounting and archiving

To fulfil our tax and commercial-law obligations, we process order and invoice data in our accounting and tax system (DATEV format) and archive invoices in an audit-proof manner. Archiving is carried out in encrypted form on storage operated by us or on our behalf (Nextcloud). The legal basis is Art. 6 (1) (c) GDPR in conjunction with statutory retention obligations.

15. Order management and inventory (ERP)

To process orders, manage stock and inventory, and control shipping, we use an enterprise resource planning system (LingXing). The order and delivery data required for this is transmitted to that system. The legal basis is Art. 6 (1) (b) and (f) GDPR (performance of a contract and efficient order processing).

16. Email dispatch (transactional emails)

As part of order processing we send transaction-related emails (e.g. sign-in codes, order and shipping confirmations, invoices). The legal basis is Art. 6 (1) (b) GDPR.

17. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about products and offers. Subscription uses the double opt-in procedure: after you sign up, we send you an email with a confirmation link; only after you click that link do we add you to the mailing list. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR.

To document your consent, we log the time of sign-up and of confirmation, the IP addresses used, and the wording of the consent. You can unsubscribe from the newsletter at any time, for example via the unsubscribe link at the end of every newsletter email; the withdrawal of your consent takes effect for the future.

18. Contacting us

If you contact us by email or via a contact form, we process the data you provide in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR (where the enquiry relates to a contract) or Art. 6 (1) (f) GDPR. The data is deleted once your enquiry has been conclusively dealt with, provided no retention obligations prevent this.

19. Hosting

Our website and the associated systems are hosted by a provider within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Processing is carried out to provide our online offering on the basis of Art. 6 (1) (f) GDPR.

20. Your rights

Under the GDPR you have the following rights:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of a given consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal message to the contact details above is sufficient.

21. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA).