Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Wisteria GmbH
Hechtstr. 43
82266 Inning, Germany
Phone: +49 160 94403341
Email: info@puzzlepotato.com

2. Accessing our website (server log files)

Each time our website is accessed, your browser automatically transmits information to our server, which is temporarily stored in a log file. The following is recorded:

• the website accessed and the time of access
• the volume of data transferred in bytes
• the website previously visited (referrer)
• the browser and operating system used
• the IP address (anonymised where applicable)

This processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in ensuring a smooth connection, comfortable use of the website, and the evaluation of system security and stability.

3. Cookies

We use cookies and similar technologies. Strictly necessary cookies, in particular to manage your session, your shopping cart and to store your cookie settings, are used on the basis of § 25 (2) TDDDG and Art. 6 (1) (b) and (f) GDPR; no consent is required for them (for our cookieless reach measurement, see section 4).

We only set statistics and marketing cookies (see sections 5 to 7) if you have consented via our cookie banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Your consent is voluntary and not required to use the shop; you can withdraw it at any time with effect for the future via “Cookie settings” in the footer. A complete list of all cookies used, including storage periods, can be found on our “Cookie Policy” page.

4. Reach measurement (cookieless)

To determine the load and usage of our shop, we carry out our own cookieless reach measurement (e.g. page views and the number of concurrently active visitors). This uses only a random identifier held solely in the memory of the browser tab; no cookies are set and no data is stored on your device. We do not combine this with other data sources and do not track you across devices. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the statistical evaluation and in ensuring the stable operation of our offering.

5. Google Analytics 4

If you have consented, we use Google Analytics 4, a web analytics service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies (_ga and _ga_*, stored for 2 years each) and processes pseudonymous identifiers (client and session ID) as well as device and usage data to evaluate how our shop is used. After a purchase we also transmit, server-side, a purchase event with client/session ID, order number and cart data to Google Analytics (Measurement Protocol) to attribute the purchase to the session; this, too, only happens if consent has been given.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without consent, Google Analytics is not loaded. Google processes this data on our behalf as a processor under the Google Data Processing Terms (Art. 28 GDPR). Data may be transferred to Google LLC in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. You can withdraw your consent at any time via “Cookie settings” in the footer. Further information: https://policies.google.com/privacy.

6. Google Ads

If you have consented, we use Google Ads (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to measure the success of our ads (conversion measurement) and for remarketing. Cookies such as _gcl_au and _gcl_aw (3 months each) and IDE (13 months) are set to recognise whether you reached us via an ad and whether a purchase followed. After a purchase we also transmit a pseudonymised (SHA-256-hashed) form of your email address to Google (“Enhanced Conversions”) to attribute the purchase to the ad; the hashing takes place in your browser and the email address itself is never sent to Google. This, too, only happens with your consent to Google Ads.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer. For the processing of advertising data in its own systems, Google is an independent controller; Google's controller-controller data protection terms apply in that respect. Data may be transferred to Google LLC in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. Further information: https://policies.google.com/privacy.

7. Meta Pixel and Conversions API

If you have consented, we use the Meta Pixel of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”) to measure the success of our advertising on Facebook and Instagram and to build audiences (custom audiences). The pixel sets cookies (_fbp, _fbc and fr, stored for 3 months each) and records your interactions with our shop. After a purchase we also transmit, server-side via the Meta Conversions API, a pseudonymised (SHA-256-hashed) form of your email address, the _fbp/_fbc cookie IDs and order data (e.g. order value and currency) to Meta to attribute the purchase to the ad; this, too, only happens if consent has been given.

The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG); without marketing consent, neither the pixel is loaded nor does the server-side transmission take place. For the collection and transmission of this data we are joint controllers with Meta (Art. 26 GDPR); the arrangement for this is Meta's Controller Addendum. Under it, Meta is responsible in its own right for the subsequent processing of the data. Data may be transferred to Meta Platforms Inc. in the USA; the transfer rests on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Meta Platforms Inc. is certified (the UK Extension and the Swiss-U.S. DPF apply to the UK and Switzerland). Where the DPF does not apply in an individual case, the transfer is based on your consent (Art. 49 (1) (a) GDPR); the USA may then not provide an equivalent level of data protection, and authorities may access data without you having effective legal remedies. You can withdraw your consent at any time via “Cookie settings” in the footer. Further information: https://www.facebook.com/privacy/policy.

8. Campaign attribution (UTM)

If you have consented to statistics cookies, on your first visit via an advertising campaign we store the campaign parameters of the address you opened (UTM parameters, e.g. source, medium and campaign name) in your browser for up to 90 days. If an order is placed within this period, we store these parameters together with the order (“first-touch” attribution) to understand which campaigns lead to purchases. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer.

9. Consent log (cookie consents)

We log your decision in the cookie banner (consent or rejection) server-side so that we can demonstrate it (Art. 7 (1) GDPR). We store a pseudonymous consent ID generated in your browser, your decision per category, the version of the consent text, the time, the page accessed, a truncated (not complete) IP address and the browser identifier (user agent). The legal basis is Art. 6 (1) (c) GDPR (duty to demonstrate consent) in conjunction with Art. 6 (1) (f) GDPR. The log is retained for 13 months and then deleted.

10. Customer account and registration

You can create a customer account with us. The data collected for this (e.g. name, email address, billing and delivery address) is processed to perform the contract and manage your account on the basis of Art. 6 (1) (b) GDPR. You can have your customer account deleted at any time by contacting us.

For business customers (B2B) we additionally process the VAT identification number to assess tax liability. Sign-in to the customer account is passwordless via a one-time code sent by email.

11. Order processing

To process your order we process the order, billing and delivery data you provide. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). Where statutory retention obligations apply (e.g. under commercial and tax law), we store the relevant data on the basis of Art. 6 (1) (c) GDPR for the duration of those periods (generally up to ten years).

12. Disclosure to shipping service providers

To deliver the ordered goods, we pass on your delivery data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery. The legal basis is Art. 6 (1) (b) GDPR. Depending on the order, this may be one of the following companies:

• DHL / Deutsche Post AG
• DPD Deutschland GmbH
• United Parcel Service Deutschland S.à r.l. & Co. OHG (UPS)
• General Logistics Systems Germany GmbH & Co. OHG (GLS)
• Hermes Germany GmbH

13. Payment processing

Card payment via Stripe

When paying by credit card or comparable means of payment, processing is carried out by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The data required for the payment is transmitted directly to Stripe. The legal basis is Art. 6 (1) (b) GDPR. Further information can be found in Stripe's privacy policy.

Payment via PayPal

When paying via PayPal, processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. The payment data is transmitted directly to PayPal. The legal basis is Art. 6 (1) (b) GDPR. PayPal's privacy terms additionally apply.

Payment by bank transfer (prepayment)

When paying by bank transfer, we process the data required to reconcile the payment. No data is passed on to a payment service provider in this case; the payment is made via your bank.

14. Invoicing, accounting and archiving

To fulfil our tax and commercial-law obligations, we process order and invoice data in our accounting and tax system (DATEV format) and archive invoices in an audit-proof manner. Archiving is carried out in encrypted form on storage operated by us or on our behalf (Nextcloud). The legal basis is Art. 6 (1) (c) GDPR in conjunction with statutory retention obligations.

15. Order management and inventory (ERP)

To process orders, manage stock and inventory, and control shipping, we use an enterprise resource planning system (LingXing). The order and delivery data required for this is transmitted to that system. The legal basis is Art. 6 (1) (b) and (f) GDPR (performance of a contract and efficient order processing).

16. Email dispatch (transactional emails)

As part of order processing we send transaction-related emails (e.g. sign-in codes, order and shipping confirmations, invoices). The legal basis is Art. 6 (1) (b) GDPR.

17. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about products and offers. Subscription uses the double opt-in procedure: after you sign up, we send you an email with a confirmation link; only after you click that link do we add you to the mailing list. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR.

To document your consent, we log the time of sign-up and of confirmation, the IP addresses used, and the wording of the consent. You can unsubscribe from the newsletter at any time, for example via the unsubscribe link at the end of every newsletter email; the withdrawal of your consent takes effect for the future.

18. Contacting us

If you contact us by email or via a contact form, we process the data you provide in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR (where the enquiry relates to a contract) or Art. 6 (1) (f) GDPR. The data is deleted once your enquiry has been conclusively dealt with, provided no retention obligations prevent this.

19. Hosting

Our website and the associated systems are hosted by a provider within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Processing is carried out to provide our online offering on the basis of Art. 6 (1) (f) GDPR.

20. Your rights

Under the GDPR you have the following rights:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR)
• withdrawal of a given consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal message to the contact details above is sufficient.

21. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA).