Privacy policy

1. Privacy at a glance

General information

The following information gives a simple overview of what happens to your personal data when you visit this website. Personal data means any data that can identify you personally. Detailed information is provided in the privacy policy below.

Data collection on this website

Who is responsible for collecting data on this website?

Data on this website is processed by the website operator. Contact details are provided in the section “Information about the controller” in this privacy policy.

How do we collect your data?

Some data is collected when you provide it to us, for example when entering information into a contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This mainly includes technical data, such as your browser, operating system or the time you access a page. This data is collected automatically when you enter the website.

What do we use your data for?

Some data is collected to ensure the website functions correctly. Other data may be used to analyse user behaviour. Where contracts can be concluded or initiated through the website, submitted data is also processed for quotations, orders or other order enquiries.

What rights do you have regarding your data?

You have the right to obtain information free of charge about the origin, recipients and purposes of your stored personal data at any time. You may also request rectification or erasure. If you have consented to processing, you can withdraw consent at any time with future effect. Under certain circumstances, you may request restriction of processing. You also have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about these rights or other privacy questions.

Analytics and third-party tools

When you visit this website, your browsing behaviour may be evaluated statistically, mainly using analytics programmes.

Details of these programmes are provided in the privacy policy below.

2. Hosting

We host our website content with the following provider:

External hosting

This website is hosted externally. Personal data collected on this website is stored on the hosting provider’s servers. This may include IP addresses, contact enquiries, metadata and communication data, contract and contact details, names, website access records and other data generated through a website.

External hosting serves performance of contracts with prospective and existing customers (Article 6(1)(b) GDPR) and our interest in secure, fast and efficient provision of our online services by a professional provider (Article 6(1)(f) GDPR). Where consent has been requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG insofar as consent covers storage of cookies or access to information on the user’s device, such as device fingerprinting, within the meaning of the TDDDG. Consent can be withdrawn at any time.

Our hosting provider(s) will process your data only as necessary to fulfil their service obligations and will follow our instructions regarding that data.

We use the following hosting provider(s):

netcup GmbH
Emmy-Noether-Straße 10
D-76131 Karlsruhe

Processing on our behalf

We have concluded a data processing agreement for the above service. This agreement, required by data protection law, ensures that the provider processes visitors’ personal data only on our instructions and in accordance with the GDPR.

3. General and mandatory information

Privacy

The operators of this website take the protection of your personal data seriously. We treat it confidentially and in accordance with statutory data protection requirements and this privacy policy.

Various personal data is collected when you use this website. Personal data is data that can identify you personally. This policy explains what we collect, how we collect it and for what purposes it is used.

Please note that internet data transmission, for example by email, may have security vulnerabilities. Complete protection against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

Felix Fleißner
Limesstraße 64
81243 München

Telephone: +49 (0)89 / 248 891 011
E-Mail: info@bambinaut.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data, such as names or email addresses.

Retention period

Unless a more specific retention period is stated in this policy, we retain your personal data until the purpose of processing no longer applies. If you make a valid erasure request or withdraw consent, your data will be deleted unless we have other legally permissible grounds for retaining it, such as tax or commercial retention requirements. In that case, deletion follows once those grounds no longer apply.

General information on the legal bases for processing

If you consent to processing, we process personal data under Article 6(1)(a) GDPR, or Article 9(2)(a) GDPR where special categories under Article 9(1) are involved. Explicit consent to transfers to third countries is additionally governed by Article 49(1)(a) GDPR. Consent to storing cookies or accessing information on your device, for example through device fingerprinting, also provides a basis under section 25(1) TDDDG. Consent may be withdrawn at any time. Data needed to perform a contract or take pre-contractual steps is processed under Article 6(1)(b) GDPR. Processing required by a legal obligation is based on Article 6(1)(c) GDPR. Processing may also be based on our legitimate interests under Article 6(1)(f) GDPR. The following sections specify the applicable bases in each case.

Transfers to third countries without adequate data protection and to US companies without DPF certification

We use tools from companies based in third countries without adequate data protection and US tools whose providers are not certified under the EU–US Data Privacy Framework (DPF). When these tools are active, your personal data may be transferred to and processed in those countries. A level of protection comparable to the EU cannot be guaranteed in third countries without adequate protection.

We note that the USA, as a safe third country under the relevant framework, generally provides a level of protection comparable to the EU. Transfers are permitted where the recipient is certified under the EU–US Data Privacy Framework (DPF) or has suitable additional safeguards. Information about third-country transfers and recipients is provided in this policy.

Recipients of personal data

We work with external organisations in the course of our business, which sometimes requires personal data to be shared. We share data only where necessary to perform a contract, required by law (for example disclosure to tax authorities), supported by a legitimate interest under Article 6(1)(f) GDPR or permitted by another legal basis. We share customer data with processors only under a valid processing agreement. Where processing is joint, a joint-controller agreement is concluded.

Withdrawal of consent

Many processing operations require your express consent. You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Right to object in special cases and to direct marketing (Article 21 GDPR)

WHERE PROCESSING IS BASED ON ARTICLE 6(1)(e) OR (f) GDPR, YOU MAY OBJECT AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THOSE PROVISIONS. THE APPLICABLE LEGAL BASIS IS SET OUT IN THIS POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS THE AFFECTED PERSONAL DATA UNLESS WE DEMONSTRATE COMPELLING LEGITIMATE GROUNDS OVERRIDING YOUR INTERESTS, RIGHTS AND FREEDOMS, OR PROCESSING IS NECESSARY FOR ESTABLISHING, EXERCISING OR DEFENDING LEGAL CLAIMS (ARTICLE 21(1) GDPR).

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU MAY OBJECT AT ANY TIME TO PROCESSING FOR THAT PURPOSE, INCLUDING RELATED PROFILING. IF YOU OBJECT, YOUR DATA WILL NO LONGER BE USED FOR DIRECT MARKETING (ARTICLE 21(2) GDPR).

Right to complain to a supervisory authority

If the GDPR is infringed, data subjects may complain to a supervisory authority, in particular in the member state of their habitual residence, place of work or the alleged infringement. This right is without prejudice to other administrative or judicial remedies.

Right to data portability

You may receive data that we process automatically on the basis of consent or a contract, or have it provided to a third party, in a commonly used, machine-readable format. Direct transfer to another controller is carried out only where technically feasible.

Access, rectification and erasure

Under applicable law, you may obtain free information about your stored personal data, its origin and recipients and the purpose of processing, and may have a right to rectification or erasure. Contact us at any time about these rights or other personal data questions.

Right to restrict processing

You may request restriction of processing of your personal data. Contact us at any time. This right applies in the following circumstances:

If you dispute the accuracy of data stored by us, we usually need time to check it. You may request restriction of processing while we verify its accuracy.
If processing is or was unlawful, you may request restriction instead of erasure.
If we no longer need your data but you need it to establish, exercise or defend legal claims, you may request restriction instead of erasure.
If you object under Article 21(1) GDPR, your interests must be weighed against ours. You may request restriction while it remains unclear whose interests prevail.

Once processing is restricted, the data may, apart from storage, be processed only with your consent, for establishing, exercising or defending legal claims, to protect another natural or legal person’s rights, or for important public-interest reasons of the European Union or a member state.

SSL/TLS encryption

For security and to protect confidential content such as orders or enquiries sent to us, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the address changing from “http://” to “https://” and the browser’s security indicator.

When SSL/TLS encryption is active, data transmitted to us cannot be read by third parties in transit.

Encrypted payments on this website

Where a paid contract requires you to provide payment details, such as an account number for direct debit, those details are needed to process payment.

Payments using common methods such as Visa/Mastercard or direct debit are processed exclusively over encrypted SSL/TLS connections, indicated by “https://” and the browser’s security indicator.

With encrypted communication, payment details transmitted to us cannot be read by third parties in transit.

Objection to promotional emails

We object to the use of contact details published under legal-notice obligations for unsolicited advertising or information. The website operators reserve the right to take legal action against unsolicited promotional material, such as spam emails.

4. Data collection on this website

Cookies

Our websites use cookies, which are small data packets that do not damage your device. They are stored temporarily for a session or persistently. Session cookies are deleted automatically after your visit. Persistent cookies remain until you delete them or your browser deletes them automatically.

Cookies may come from us (first-party cookies) or other companies (third-party cookies). Third-party cookies allow services from other companies to be integrated, for example payment services.

Cookies serve different functions. Many are technically necessary for features such as shopping baskets or video playback. Others may be used to analyse behaviour or for advertising.

Necessary cookies used for electronic communication, requested functions such as a shopping basket, or website optimisation such as audience measurement are stored under Article 6(1)(f) GDPR unless another basis is specified. The operator has a legitimate interest in necessary cookies for technically reliable, optimised services. Where consent to cookies or comparable recognition technologies has been requested, processing is based exclusively on that consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent can be withdrawn at any time.

You can configure your browser to notify you about cookies, allow them individually, reject them in particular cases or generally, or delete them when the browser closes. Disabling cookies may limit this website’s functionality.

The cookies and services used on this website are described in this policy.

CCM19

Our website uses CCM19 to obtain and document your consent to storing certain cookies or using certain technologies in accordance with data protection law. The provider is Papoo Software & Media GmbH, Auguststr. 4, 53229 Bonn, Germany (“CCM19”).

When you enter the website, a connection is established to CCM19 servers to obtain your cookie choices. CCM19 then stores a cookie in your browser to associate consent or withdrawal with you. This data is stored until you request deletion, delete the CCM19 cookie or the storage purpose no longer applies. Mandatory statutory retention duties remain unaffected.

CCM19 is used to obtain legally required consent for cookies. The legal basis is Article 6(1), first sentence, point (c) GDPR.

Processing on our behalf

Server log files

The hosting provider automatically collects and stores information in server log files that your browser transmits to us:

Browser type and version
Operating system
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address

This data is not combined with other data sources.

The data is collected under Article 6(1)(f) GDPR. The operator has a legitimate interest in technically reliable presentation and optimisation of the website, which requires server logs.

Contact form

If you send us an enquiry through a contact form, we store the information, including the contact details you provide, to process the enquiry and any follow-up questions. We do not share this data without your consent.

Processing is based on Article 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual steps. Otherwise, it is based on our legitimate interest in effectively handling enquiries (Article 6(1)(f) GDPR) or your consent where requested (Article 6(1)(a) GDPR). Consent may be withdrawn at any time.

Contact-form data remains with us until you request deletion, withdraw consent to storage or the storage purpose no longer applies, for example after the enquiry is resolved. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, we store and process your enquiry and the personal data it contains, such as your name and request, to handle it. We do not share this data without your consent.

Data sent with enquiries remains with us until you request deletion, withdraw consent to storage or the purpose no longer applies, for example once your enquiry is resolved. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Communication through WhatsApp

We use WhatsApp, among other services, to communicate with customers and third parties. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Communication uses end-to-end encryption to prevent WhatsApp or other third parties from accessing message content. WhatsApp does, however, receive metadata such as sender, recipient and time. WhatsApp states that it shares users’ personal data with its US-based parent company Meta. See its privacy policy for details: https://www.whatsapp.com/legal/#privacy-policy.

WhatsApp is used on the basis of our legitimate interest in fast, effective communication with customers, prospects and business or contractual partners (Article 6(1)(f) GDPR). Where consent has been requested, processing is based exclusively on that consent, which may be withdrawn at any time with future effect.

Messages exchanged with us through WhatsApp remain with us until you request deletion, withdraw consent to storage or the purpose no longer applies, for example when an enquiry is resolved. Mandatory statutory provisions, particularly retention periods, remain unaffected.

The company is certified under the EU–US Data Privacy Framework (DPF), an arrangement intended to ensure European data protection standards for processing in the USA. Certified companies undertake to meet those standards. Further information is available from the provider: https://www.dataprivacyframework.gov/participant/7735.

We use WhatsApp Business.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://www.whatsapp.com/legal/business-data-transfer-addendum.

Our WhatsApp accounts are configured not to synchronise automatically with the address books of the smartphones used.

We have concluded a data processing agreement with the above provider.

Communication through Telegram

We use Telegram, among other services, to communicate with customers and third parties. The provider is Telegram Messenger LLP, 71–75 Shelton Street, Covent Garden, London, United Kingdom.

Telegram communication is encrypted between the device and server. This protects communications in transit.

End-to-end encryption is additionally available only for secret chats. Ordinary chats are generally not end-to-end encrypted.

Telegram receives metadata generated through use and communication, such as sender, recipient, message times, device, operating system, IP address and usernames.

Telegram is used on the basis of our legitimate interest in fast, effective communication with customers, prospects and other third parties (Article 6(1)(f) GDPR).

See Telegram’s privacy policy for further details: https://telegram.org/privacy/de.

Brevo Chat

We use Brevo Chat to handle chat enquiries. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo Chat uses cookies and other recognition technologies, such as IDs, to recognise you on a later visit and associate your previous chat history with you.

Messages sent to us remain with us until you request deletion or the storage purpose no longer applies, for example after your enquiry is resolved. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Brevo Chat is used under Article 6(1)(f) GDPR. We have a legitimate interest in handling enquiries quickly, reliably and efficiently. Where consent is requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG insofar as it covers cookies or access to device information, such as device fingerprinting. Consent may be withdrawn at any time.

Further information is available in Brevo’s privacy policy: https://www.brevo.com/de/legal/privacypolicy/.

Processing on our behalf

Registration through Facebook Connect

Instead of registering directly on this website, you may register through Facebook Connect. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Facebook states that collected data is also transferred to the USA and other third countries.

If you select Facebook Connect and click “Login with Facebook” or “Connect with Facebook”, you are redirected to Facebook, where you can sign in. This links your Facebook profile with this website or our services and gives us access to data held by Facebook, in particular:

Facebook name
Facebook profile and cover photo
Facebook cover photo
Email address stored with Facebook
Facebook ID
Facebook friends lists
Facebook likes
Date of birth
Gender
Country
Language

This data is used to set up, provide and personalise your account.

Facebook Connect registration and related processing are based on your consent under Article 6(1)(a) GDPR, which you may withdraw at any time with future effect.

Where this tool collects personal data on our website and forwards it to Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are joint controllers under Article 26 GDPR. Joint responsibility is limited to collection and transmission; Facebook’s subsequent processing is excluded. Our respective obligations are set out in a joint-controller agreement available at: https://www.facebook.com/legal/controller_addendum. Under this agreement, we are responsible for providing privacy information and implementing the Facebook tool in compliance with data protection law. Facebook is responsible for its products’ data security. Rights concerning data processed by Facebook, such as access requests, can be exercised directly with Facebook. If you exercise them through us, we must forward the request to Facebook.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://www.facebook.com/legal/EU_data_transfer_addendum, https://de-de.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php.

Further information is provided in Facebook’s terms and privacy policies: https://de-de.facebook.com/about/privacy/ and https://de-de.facebook.com/legal/terms/.

Registration through Google

Instead of registering directly on this website, you may register through Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

To register through Google, sign in with your Google username and password. Google identifies you and confirms your identity to our website.

When you sign in through Google, we may use certain account information to complete your profile with us. You decide which information is available through your Google security settings: https://myaccount.google.com/security and https://myaccount.google.com/permissions.

Processing associated with Google registration is based on our legitimate interest in a straightforward registration process (Article 6(1)(f) GDPR). Use is voluntary and users control the access granted, so no overriding opposing interests of data subjects are apparent.

5. Social media

Facebook

This website integrates Facebook elements. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Facebook states that collected data is also transferred to the USA and other third countries.

An overview of Facebook social media elements is available here: https://developers.facebook.com/docs/plugins/?locale=de_DE.

When a social media element is active, your device connects directly to Facebook servers. Facebook learns that your IP address visited this website. If you click the Like button while logged in to Facebook, you can link this website’s content to your Facebook profile, allowing Facebook to associate the visit with your account. As website operator, we do not know the content of transmitted data or how Facebook uses it. Further information: https://de-de.facebook.com/privacy/explanation.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

Instagram

This website integrates Instagram functions provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

When the social media element is active, your device connects directly to Instagram servers, giving Instagram information about your visit.

If you are logged in to Instagram, clicking the Instagram button can link this website’s content to your profile, allowing Instagram to associate your visit with your account. As website operator, we do not know the content of transmitted data or how Instagram uses it.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

Where the tool collects personal data here and forwards it to Facebook or Instagram, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are joint controllers under Article 26 GDPR. Joint responsibility covers only collection and transmission, not subsequent processing by Facebook or Instagram. Our obligations are set out in a joint-controller agreement: https://www.facebook.com/legal/controller_addendum. Under this agreement, we provide privacy information and implement the Facebook/Instagram tool in compliance with data protection law. Facebook is responsible for its products’ data security. Rights concerning data processed by Facebook or Instagram can be exercised directly with Facebook. Requests made to us must be forwarded to Facebook.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://www.facebook.com/legal/EU_data_transfer_addendum, https://privacycenter.instagram.com/policy/ and https://de-de.facebook.com/help/566994660333381.

Further information is available in Instagram’s privacy policy: https://privacycenter.instagram.com/policy/.

We use Pinterest elements on this website. Pinterest is operated by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

When you open a page containing a Pinterest element, your browser connects directly to Pinterest servers. The element transmits log data to Pinterest servers in the USA. This may include your IP address, addresses of visited websites containing Pinterest features, browser type and settings, request date and time, your use of Pinterest and cookies.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

Pinterest’s privacy policy explains the purpose, scope and further processing of data, your rights and options for protecting your privacy: https://policy.pinterest.com/de/privacy-policy.

6. Analytics tools and advertising

Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager lets us integrate tracking, statistics and other technologies. It does not itself create user profiles, store cookies or perform independent analysis; it manages and deploys integrated tools. It does collect your IP address, which may be transferred to Google’s parent company in the USA.

Google Tag Manager is used under Article 6(1)(f) GDPR. We have a legitimate interest in quickly and easily integrating and managing website tools. Where consent is requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG insofar as it covers cookies or access to device information, such as device fingerprinting. Consent may be withdrawn at any time.

Google Analytics

This website uses Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Analytics lets the operator analyse visitor behaviour using data such as page views, time spent, operating systems and user origin. Data is grouped under a user ID and associated with the visitor’s device.

Google Analytics may also record mouse and scroll movements and clicks. It uses modelling to supplement collected data and machine learning in its analysis.

Google Analytics uses technologies such as cookies or device fingerprinting to recognise users and analyse behaviour. Information collected about website use is generally transferred to and stored on Google servers in the USA.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://business.safety.google/adscontrollerterms/sccs/.

IP anonymisation

Google Analytics IP anonymisation is enabled. Google truncates your IP address within EU member states or other parties to the EEA Agreement before transmission to the USA. Only exceptionally is the full address sent to the USA and truncated there. On our behalf, Google uses the information to evaluate website use, prepare activity reports and provide related website and internet services. The IP address transmitted by your browser through Google Analytics is not combined with other Google data.

Browser add-on

You can prevent Google from collecting and processing your data by downloading and installing this browser add-on: https://tools.google.com/dlpage/gaoptout?hl=de.

Further information about user data in Google Analytics is available here: https://support.google.com/analytics/answer/6004245?hl=de.

Google signals

We use Google signals. When you visit, Google Analytics collects information such as location, search and YouTube history and demographic data. Google signals may use this visitor data for personalised advertising. If you have a Google account, visitor data is linked to it and used for personalised advertising. The data also supports anonymised statistics about user behaviour.

Processing on our behalf

We have concluded a processing agreement with Google and implement the strict requirements of German data protection authorities when using Google Analytics.

Google Analytics e-commerce measurement

This website uses Google Analytics e-commerce measurement to analyse purchasing behaviour and improve online marketing. Information such as orders, average order values, shipping costs and time from viewing a product to purchase is collected. Google may group this data under a transaction ID associated with the user or device.

Google Ads

The operator uses Google Ads, an online advertising programme from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Google Ads lets us show adverts in Google search or on third-party websites based on search terms (keyword targeting) or Google’s user data, such as location and interests (audience targeting). We can evaluate this quantitatively, for example which keywords triggered adverts and how many adverts led to clicks.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.

Google AdSense (non-personalised)

This website uses Google AdSense to display advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

We use AdSense in non-personalised mode. Adverts are therefore not based on previous behaviour and no user profile is created for this purpose. Instead, contextual information such as location, page content or current search terms is used. Further information about personalised and non-personalised targeting: https://support.google.com/adsense/answer/9007336.

Even in non-personalised mode, AdSense may use cookies or comparable recognition technologies such as device fingerprinting. Google states that these are used to combat fraud and abuse.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://business.safety.google/adscontrollerterms/sccs/.

You can change advertising settings in your user account by signing in here: https://adssettings.google.com/authenticated.

Further information about Google advertising technologies: https://policies.google.com/technologies/ads and https://www.google.de/intl/de/policies/privacy/.

Meta pixel (formerly Facebook pixel)

This website uses Meta’s visitor-action pixel to measure conversions. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Meta states that data is also transferred to the USA and other third countries.

This tracks visitor behaviour after users reach the website through a Meta advert, allowing advertising effectiveness to be evaluated for statistical and market-research purposes and future advertising to be optimised.

The collected data is anonymous to us as website operator, so we cannot identify users from it. Meta stores and processes it, however, and may link it to Facebook or Instagram profiles and use it for its own advertising under its data policy (https://de-de.facebook.com/about/privacy/). This allows Meta to show adverts on Facebook, Instagram and other channels. We cannot influence this use of data.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

We use advanced matching within the Meta pixel.

Advanced matching lets us transmit customer and prospect data collected on our website to Meta, such as town, region, postcode, hashed email addresses, names, gender, date of birth or telephone number. This allows more precise targeting on Facebook and Instagram, improves conversion attribution and expands Custom Audiences.

Where this tool collects personal data here and transmits it to Meta, we and Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland are joint controllers under Article 26 GDPR. Joint responsibility is limited to collection and transmission, excluding subsequent Meta processing. Our obligations are set out in a joint-controller agreement: https://www.facebook.com/legal/controller_addendum. Under that agreement, we provide privacy information and implement the Meta tool in compliance with data protection law. Meta is responsible for its products’ data security. Rights concerning data processed by Facebook or Instagram can be exercised directly with Meta; requests made to us must be forwarded to Meta.

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

Meta’s privacy information provides further guidance: https://de-de.facebook.com/about/privacy/.

You can also disable Custom Audiences remarketing in your advertising settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen . You must be logged in to Facebook.

If you do not have a Facebook or Instagram account, you can disable Meta’s interest-based advertising through the European Interactive Digital Advertising Alliance: http://www.youronlinechoices.com/de/praferenzmanagement/.

Meta Conversion API

This website integrates the Meta Conversion API, provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Meta states that data is also transferred to the USA and other third countries.

The Meta Conversion API records visitors’ interactions with our website and shares them with Meta to improve advertising performance on Facebook and Instagram.

Data includes access time, page visited, IP address and user agent, and potentially specific information such as purchased products, basket value and currency. A full list of collectable data is available here: https://developers.facebook.com/docs/marketing-api/conversions-api/parameters.

This service is used on the basis of your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn at any time.

Meta’s privacy information provides further guidance: https://de-de.facebook.com/about/privacy/.

You can also disable Custom Audiences remarketing in your advertising settings at https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen . You must be logged in to Facebook.

Processing on our behalf

Pinterest tag

This website integrates the Pinterest tag, provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

The Pinterest tag records certain actions on our website. The data may then be used to show interest-based adverts here or on other sites in the Pinterest advertising network.

It collects information such as tag ID, location and referrer URL, and may collect action-specific data such as order value, quantity and number, purchased-item category and video views.

The Pinterest tag uses technologies such as cookies or device fingerprinting to recognise users across websites and analyse behaviour.

Where consent is obtained, this service is used exclusively under Article 6(1)(a) GDPR and section 25 TDDDG. Consent may be withdrawn at any time. Where no consent is obtained, use is based on Article 6(1)(f) GDPR and the operator’s legitimate interest in effective marketing.

Pinterest operates globally, so data may be transferred to the USA. Pinterest states that transfers are based on the European Commission’s standard contractual clauses. Details: https://policy.pinterest.com/de/privacy-policy.

Further information about the Pinterest tag: https://help.pinterest.com/de/business/article/track-conversions-with-pinterest-tag.

Processing on our behalf

7. Newsletter

Newsletter data

To receive our newsletter, you must provide an email address and information allowing us to verify that you own it and consent to receiving the newsletter. Other data is not collected or is provided voluntarily. We use the newsletter providers described below.

Brevo

This website uses Brevo to send newsletters. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo organises and analyses newsletter distribution. Data provided to subscribe is stored on Sendinblue GmbH servers in Germany.

Analysis by Brevo

Brevo lets us analyse newsletter campaigns, for example whether messages are opened and which links are clicked. This helps identify frequently clicked links.

We can also see whether predefined actions follow opening or clicking a message (conversion rate), for example whether a purchase follows a newsletter click.

Brevo also lets us group recipients into categories such as age, gender or location, so newsletters can be tailored to audiences.

If you do not want analysis by Brevo, unsubscribe using the link provided in every newsletter.

Detailed information about Brevo’s features is available here: https://www.brevo.com/de/newsletter-software/.

Legal basis

Processing is based on consent under Article 6(1)(a) GDPR. You may withdraw consent at any time. This does not affect the lawfulness of prior processing.

Retention period

Subscription data is stored by us or the newsletter provider until you unsubscribe, then removed from the mailing list. Data stored for other purposes remains unaffected.

After you unsubscribe, your email address may be retained in a suppression list where needed to prevent future mailings. This data is used only for that purpose and is not combined with other data. It serves your interests and our legitimate interest in complying with newsletter requirements under Article 6(1)(f) GDPR. Suppression-list storage has no fixed time limit. You may object to this storage where your interests outweigh our legitimate interest.

See Brevo’s privacy information for details: https://www.brevo.com/de/datenschutz-uebersicht/ and https://www.brevo.com/de/legal/privacypolicy/.

Processing on our behalf

8. Plugins and tools

YouTube privacy-enhanced mode

This website embeds YouTube videos. YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

Visiting a page with embedded YouTube establishes a connection to YouTube servers, which learn which page you visited. If logged in to YouTube, your browsing behaviour may be associated with your profile. You can prevent this association by logging out.

We use YouTube privacy-enhanced mode. YouTube states that videos played in this mode are not used to personalise browsing on YouTube and displayed adverts are not personalised. This mode does not set cookies, but local-storage elements may store personal data and enable recognition similarly to cookies. Details: https://support.google.com/youtube/answer/171780.

Activating a YouTube video may trigger further processing beyond our control.

YouTube is used in our legitimate interest in presenting our online offering attractively (Article 6(1)(f) GDPR). Where consent is requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG insofar as consent covers cookies or access to device information such as fingerprinting. Consent may be withdrawn at any time.

Further information about privacy at YouTube: https://policies.google.com/privacy?hl=de.

Google reCAPTCHA

This website uses Google reCAPTCHA, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

reCAPTCHA checks whether website input, for example in a contact form, comes from a person or an automated programme. It analyses visitor behaviour using various characteristics, beginning automatically when the visitor enters the website. Information such as IP address, time spent and mouse movements is evaluated and sent to Google.

reCAPTCHA analysis runs entirely in the background. Visitors are not separately notified that it is taking place.

Storage and analysis are based on Article 6(1)(f) GDPR and our legitimate interest in protecting the website against abusive automated access and spam. Where consent is requested, processing is based exclusively on Article 6(1)(a) GDPR and section 25(1) TDDDG insofar as consent covers cookies or access to device information such as fingerprinting. Consent may be withdrawn at any time.

Further information about reCAPTCHA is provided in Google’s privacy policy and terms: https://policies.google.com/privacy?hl=de and https://policies.google.com/terms?hl=de.

9. E-commerce and payment providers

Customer and contract data

We collect, process and use personal customer and contract data to establish, define and change contractual relationships. Website usage data is processed only insofar as needed to enable use of the service or billing. The legal basis is Article 6(1)(b) GDPR.

Customer data is deleted after the order or business relationship ends and applicable statutory retention periods expire. Statutory retention requirements remain unaffected.

Data transfers when concluding contracts for services and digital content

We transfer personal data to third parties only where necessary to perform the contract, for example to the institution processing payment.

No further transfer takes place unless you expressly consent. Data is not shared with third parties for purposes such as advertising without express consent.

The basis is Article 6(1)(b) GDPR, which permits processing to perform a contract or take pre-contractual steps.

Payment services

We integrate third-party payment services. When you make a purchase, payment details such as name, amount, bank details and credit card number are processed by the payment provider. Its contractual and privacy terms apply. Use is based on Article 6(1)(b) GDPR for contract performance and our interest in smooth, convenient and secure payment under Article 6(1)(f) GDPR. Where consent is requested for particular actions, Article 6(1)(a) GDPR applies; consent can be withdrawn at any time with future effect.

We use the following payment services/providers:

PayPal

This service is provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (“PayPal”).

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://www.paypal.com/de/webapps/mpp/ua/pocpsa-full.

Details are available in PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Stripe

For EU customers, the provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”).

Transfers to the USA are based on the European Commission’s standard contractual clauses. Details: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation.

Details are available in Stripe’s privacy policy: https://stripe.com/de/privacy.

Our social media profiles

This policy applies to the following social media profiles:

Processing by social networks

We maintain publicly accessible social media profiles. The networks we use are listed below.

Networks such as Facebook and X can generally analyse behaviour extensively when you visit their websites or sites with integrated social media content such as Like buttons or advertising banners. Visiting our profiles triggers various processing operations:

If you visit our profile while logged in to a social network, its operator can associate the visit with your account. Data may also be collected when you are logged out or have no account, for example through cookies or your IP address.

Operators can use this data to create profiles of preferences and interests and show interest-based adverts both within and outside their platforms. If you have an account, advertising may appear across devices on which you are or were logged in.

We cannot fully understand or control all processing on social networks. Depending on the provider, further operations may occur. Consult the relevant network’s terms and privacy policy for details.

Legal basis

Our social profiles serve our legitimate interest in a broad online presence under Article 6(1)(f) GDPR. Analytics initiated by the networks may rely on other bases specified by their operators, such as consent under Article 6(1)(a) GDPR.

Controller and exercising your rights

When you visit one of our profiles, for example Facebook, we and the platform operator are jointly responsible for processing triggered by the visit. You may generally exercise rights of access, rectification, erasure, restriction, portability and complaint against us or the relevant operator.

Despite joint responsibility, we do not have full influence over platform processing. Our options depend largely on the provider’s policies.

Retention period

Data collected directly by us through social media is deleted from our systems when you request deletion, withdraw consent to storage or the purpose no longer applies. Cookies remain on your device until deleted. Mandatory statutory provisions, particularly retention periods, remain unaffected.

We do not control how long social network operators retain data for their own purposes. Consult them directly, for example through the privacy policies linked below.

Your rights

You may obtain free information about the origin, recipients and purposes of your stored personal data. You also have rights to object, data portability and complaint to a supervisory authority, and may request rectification, blocking, erasure or, under certain circumstances, restriction of processing.

Individual social networks

Instagram

We maintain an Instagram profile. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Details about processing are provided in Instagram’s privacy policy: https://privacycenter.instagram.com/policy/.

We maintain a Pinterest profile, operated by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Its privacy policy explains how personal data is handled: https://policy.pinterest.com/de/privacy-policy.

Partner programme

Registering for our partner programme creates a partner account. We process email address, encrypted password, selected partner code and time of acceptance of participation terms, and, once provided, name, company, address, account holder, IBAN, BIC, VAT ID and small-business tax status. The IBAN is stored encrypted and used only for payouts.

For commission accounting, orders using a partner code are linked to that partner’s account. Partners see only the order number, date, amount and commission, not customer details.

The legal bases are Article 6(1)(b) GDPR for the partner contract and Article 6(1)(c) GDPR for tax and commercial retention duties. Accounting data, including credit notes, payouts and attributed orders, is kept for ten years. Other account data is deleted or anonymised when participation ends. Partner account deletion can be requested by email at any time.

Product recommendations and optional measurement

We display labelled product recommendations in selected free features. As an Amazon Associate, Bambinaut earns from qualifying purchases. Recommendations are selected by page context (parents or gift ideas), without analysing private diary text, baby names, dates of birth or health information. Paid plans are excluded from these recommendations.

Only when you open a product link do you visit Amazon. The link contains a product and affiliate identifier, but no Bambinaut account, baby or private sharing identifier. The referrer is restricted to our origin. Amazon processes data under its own privacy notice. Product links work without consenting to our optional measurement.

If you consent to “Bambinaut – product recommendation measurement”, we count displayed recommendations, views of at least 50 percent for one continuous second, and clicks. Events contain a product identifier, placement, web channel, experiment version, UTC day and a short-lived random identifier. No diary text, baby names or dates of birth are sent in these events. Processing takes place on our servers in Germany. Technical connection data is handled as described in the server-log section of this privacy policy.

The legal basis for optional measurement is your consent under Article 6(1)(a) GDPR and, where information on your device is accessed, Section 25(1) TDDDG. You can change or withdraw consent in cookie settings at any time with effect for the future. Refusal or withdrawal does not prevent use of the product links.

The measurement script adds no analytics cookies or localStorage identifiers. It uses the existing session and consent choice. Event receipts expire with a 30-minute token and are removed at the next daily cleanup. Daily aggregate counters are retained for 400 days and removed at the next daily cleanup. They cannot be assigned to your account.

If you choose “Not interested” or “Already have it”, we save the product identifier and your choice in your account to honour your preference (Article 6(1)(b) GDPR). You can undo this in the displayed card. These settings are removed when your account is deleted; orphaned settings are also cleaned up daily. This preference is separate from optional measurement.