Privacy policy
Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide your data. Failure to provide the data will have no consequences. This only applies insofar as no other information is provided in the following processing operations.
“Personal data” means any information relating to an identified or identifiable natural person.
Server log files
You can visit our websites without providing any personal information.
Each time our website is accessed, usage data is transmitted to us or to our web host / IT service provider by your internet browser and stored in log files (so-called server log files). The data stored includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.
The processing is carried out on the basis of Art. 6(1)(f) GDPR due to our overriding legitimate interest in ensuring the trouble-free operation of our website and improving our services.
Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. Canada has an adequacy decision from the European Commission. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the European Commission’s Standard Contractual Clauses.
Contact
Controller
You may contact us at any time. The controller responsible for data processing is:
Jonas Hain
Heilbronner Straße 12
10711 Berlin
Germany
Phone: +49 176 34623196
Email: shop@jonashain.com
Customer-initiated contact by email
If you contact us by email on your own initiative, we collect your personal data (name, email address, message content) only to the extent provided by you. The data processing serves to process and respond to your inquiry.
If the contact serves to carry out pre-contractual measures (e.g. advice in connection with an interest in purchasing or preparing an offer) or concerns a contract already concluded between you and us, this data processing is based on Art. 6(1)(b) GDPR.
If the contact is made for other reasons, this data processing is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR.
We use your email address only to process your inquiry. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Collection and processing when using the contact form
When using the contact form, we collect your personal data (name, email address, message content) only to the extent provided by you. The data processing serves the purpose of contacting you.
If the contact serves to carry out pre-contractual measures (e.g. advice in connection with an interest in purchasing or preparing an offer) or concerns a contract already concluded between you and us, this data processing is based on Art. 6(1)(b) GDPR.
If the contact is made for other reasons, this data processing is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR.
We use your email address only to process your inquiry. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Collection and processing when using the right of withdrawal button
If you have concluded a contract through our online presence, we provide you with a withdrawal function (withdrawal button), which allows you to submit your declaration of withdrawal directly.
When using the withdrawal function, we collect your personal data (name, email address, information identifying the contract or part of the contract you wish to withdraw from, and the date and time at which the declaration of withdrawal was submitted) only to the extent provided by you. The data processing serves the purpose of providing you with the legally required option to withdraw from your contract and properly processing your withdrawal.
If the contact concerns a contract already concluded between you and us, this data processing is based on Art. 6(1)(b) GDPR. Otherwise, the data processing is based on Art. 6(1)(c) GDPR in order to fulfil a legal obligation to provide a withdrawal function on our online presence.
We use your email address only to process your declaration of withdrawal. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Disclosure to third-party providers (plugin use)
For the technical provision and administration of the withdrawal function on our online presence, we use a software solution provided by the third-party provider Händlerbund Legal GmbH, Kohlgartenstraße 11-13, 04315 Leipzig, Germany, as part of data processing on our behalf. The plugin enables you to submit your declaration of withdrawal directly via the withdrawal button if you have concluded a contract with us through our website. Technically necessary cookies are used for this purpose, and the following information is collected: encrypted session ID.
Your data may be transferred to third countries such as the USA. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). If providers are not certified under the TADPF, the transfer of data to the USA is based on Standard Contractual Clauses as appropriate safeguards for the protection of personal data, available at:
Your personal data collected when using the withdrawal function is transmitted to the servers of the third-party providers named above.
The processing of your personal data serves the purpose of complying with the statutory requirements for the legally compliant design of the withdrawal function and is based on Art. 6(1)(c) GDPR. This data processing is also based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in providing you with a user-friendly withdrawal option. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR.
The use of cookies or comparable technologies is based on Section 25(2) TDDDG. Further information on data protection can be found at:
https://www.haendlerbund.de/de/datenschutzerklaerung
Customer account / orders
Customer account
When opening a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is based on Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time by notifying us, without affecting the lawfulness of processing based on your consent before its withdrawal. Your customer account will subsequently be deleted.
Collection, processing and disclosure of personal data when placing orders
When placing an order, we collect and process your personal data only to the extent necessary to fulfil and process your order and to handle your inquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is based on Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.
Your data may be disclosed, for example, to shipping companies, dropshipping or fulfilment providers, payment service providers, service providers involved in order processing and IT service providers. In all cases, we strictly comply with the statutory requirements. The scope of data transmitted is limited to the minimum necessary.
Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. Canada has an adequacy decision from the European Commission. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the European Commission’s Standard Contractual Clauses.
Advertising
Use of email address for sending newsletters
We use your email address to send you information and offers by newsletter, provided that you have expressly consented to this. The data processing serves exclusively the purpose of promotional communication. For this purpose, we process your email address and, where applicable, other data that you voluntarily provided when registering for our newsletter.
The processing is based on Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time without affecting the lawfulness of processing based on your consent before its withdrawal.
You can unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the mailing list. Despite removal from the mailing list, we may continue to store your email address in a so-called blacklist to prevent you from receiving newsletter emails from us in the future. This storage is based on Art. 6(1)(f) GDPR due to our and your legitimate interest in preventing the renewed use of your email address for sending our newsletter. You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.
Use of email address for sending direct advertising
We use your email address, which we received in connection with the sale of a product or service, to electronically send you advertising for our own products or services similar to those you have already purchased from us, unless you have objected to this use. The provision of the email address is necessary for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. The processing is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in direct advertising.
You may object to the use of your email address at any time by notifying us. The contact details for exercising your right to object can be found in the Legal Notice. You may also use the corresponding link in the advertising email. No costs other than the transmission costs according to the basic rates will be incurred for this.
Payment service providers
Use of PayPal
We use the PayPal payment service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg; “PayPal”) on our website. The data processing serves the purpose of offering you payment via the payment service. When you select and use PayPal as a payment method, the data required for payment processing is transmitted to PayPal in order to perform the contract with you using the selected payment method. This processing is based on Art. 6(1)(b) GDPR.
All PayPal transactions are subject to PayPal’s Privacy Statement. It can be found at:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Use of Shopify Payments
We use the “Shopify Payments” payment service provided by Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) on our website. In this case, payment processing is carried out by various payment service providers such as Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; “Stripe”) or Adyen N.V. (Simon Carmiggeltstraat 6, 1011 DJ, Amsterdam, Netherlands; “Adyen”).
The data processing serves the purpose of offering you payment via the Shopify Payments payment service. When you select and use a corresponding “Shopify Payments” payment method, the data required for payment processing is transmitted to the respective payment service provider in order to perform the contract with you using the selected payment method. This processing is based on Art. 6(1)(b) GDPR.
The payment service providers reserve the right, where applicable, to obtain a credit report based on mathematical-statistical procedures using credit agencies. For this purpose, the payment service providers transmit the personal data required for a credit assessment to a credit agency and use the information received on the statistical probability of payment default to make a balanced decision regarding the establishment, performance or termination of the contractual relationship. The credit report may contain probability values (score values) calculated on the basis of scientifically recognised mathematical-statistical procedures, which may include address data. Your legitimate interests are taken into account in accordance with the statutory provisions. The data processing serves the purpose of assessing creditworthiness when initiating a contract. The processing is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in protecting against payment defaults where the payment service providers make advance payments.
You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data by notifying the respective payment service provider, where the processing is based on Art. 6(1)(f) GDPR. The provision of the data is necessary for the conclusion of the contract using the payment method you have selected. Failure to provide the data means that the contract cannot be concluded using the payment method you have selected.
Further information on data processing when using the Shopify Payments payment service can be found in Shopify’s Terms and Privacy Policy at:
https://www.shopify.com/de/legal/terms-shopify-payments
https://www.shopify.com/de/legal/datenschutz
Other services and applications used
Use of Fileflare to provide digital content
We use the “Fileflare” application provided by Kestrel Commerce, LLC, 1111B S Governors Ave, Suite 3239, Dover, DE 19904, USA (“Fileflare”) to provide and deliver the digital content you have purchased, in particular our PDF piano sheet music.
As part of providing the digital content, the order and customer data required for this purpose is processed. This includes, in particular, your name, email address, order number, information about the products and variants ordered, and other data associated with the order. When download links are accessed, your IP address and technical information about the browser and device used may also be processed.
The processing is carried out for the purpose of processing the contract and providing the digital content you have purchased. The processing is based on Art. 6(1)(b) GDPR.
Fileflare processes purchasers’ personal data on our behalf as a processor. The processing includes, in particular, the provision of digital content and the administration and documentation of the downloads associated with it.
Fileflare is operated by Kestrel Commerce, LLC, based in the USA. Personal data may therefore be transferred to and processed in the USA. According to its own information, Fileflare uses the European Commission’s Standard Contractual Clauses for transfers of personal data from the European Economic Area to the USA.
According to the provider, the order and download information required to provide the service is stored while Fileflare is being used. Following uninstallation of the application, the relevant data is currently deleted within 48 hours of receipt of the deletion request from Shopify. Statutory retention periods remain unaffected.
Further information on data processing by Fileflare can be found at:
https://fileflare.io/legal/privacy/
Use of Order Printer Pro for invoice creation
We use the “Order Printer Pro” application provided by Shop Circle Holdings Ltd., One Kingdom Street, Paddington Central, London W2 6BD, United Kingdom, to create invoices for our orders. The invoices created using Order Printer Pro are made available to you for download via the order confirmation.
As part of using Order Printer Pro, the order and customer data required to create and provide the invoice is processed. This may include, in particular, your name, email address, billing and shipping address, order details, products ordered, prices, discounts, taxes and other data associated with the order.
For this purpose, Order Printer Pro accesses the corresponding data in our Shopify store. The processing is carried out for the purpose of creating invoices and processing the contract as well as fulfilling statutory obligations. Where necessary for contract processing, the processing is based on Art. 6(1)(b) GDPR and, where statutory obligations are concerned, on Art. 6(1)(c) GDPR.
Order Printer Pro generally processes customer and order data on our behalf as a processor. According to the provider, complete customer and order data is generally not permanently stored in the Order Printer Pro database but retrieved from Shopify when required. Data may be temporarily cached to perform certain functions, and technical and operational metadata, such as order IDs, status information and timestamps, may be stored.
Personal data may be processed in the United Kingdom, the European Economic Area, the USA and other countries. Where personal data is transferred to countries outside the European Economic Area, Order Printer Pro states that it uses appropriate data protection safeguards, in particular the European Commission’s Standard Contractual Clauses where required.
Further information on data processing by Order Printer Pro can be found at:
https://get.orderprinterpro.com/policies/privacy-policy
Cookies
Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again.
Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide individually whether to accept them, as well as prevent the storage of cookies and transmission of the data they contain. Cookies that have already been stored can be deleted at any time. However, please note that you may then not be able to use all functions of this website to their full extent.
You can find information on how to manage cookies in the most important browsers (including how to disable them) at the following links:
Chrome: https://support.google.com/accounts/answer/61416?hl=de
Microsoft Edge: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-lB6schen-63947406-40ac-c3b8-57b9-2a946a29ae09
Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Safari: https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac
Technically necessary cookies
Unless otherwise stated in this Privacy Policy, we only use technically necessary cookies for the purpose of making our services more user-friendly, effective and secure. Cookies also enable our systems to recognise your browser after a page change and provide you with services. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary for the browser to be recognised again after a page change.
The use of cookies or comparable technologies is based on Section 25(2) TDDDG. The processing of your personal data is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website and providing a user-friendly and effective service.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.
Analytics / advertising tracking
Use of Google Analytics 4
We use the web analytics service Google Analytics provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website.
The data processing serves the purpose of analysing this website and its visitors as well as for marketing and advertising purposes. Google uses the information collected on behalf of the operator of this website to evaluate your use of the website, compile reports on website activity and provide the website operator with other services relating to website and internet usage.
The following information may be collected, among other things: IP address, date and time of the page view, click path, information about the browser and device you use, pages visited, referrer URL (the website from which you accessed our website), location data and purchasing activities. Google may combine your data with other data, such as your search history, personal accounts, usage data from other devices and all other data Google has about you.
Google truncates the IP address beforehand within member states of the European Union or other states party to the Agreement on the European Economic Area.
Google uses technologies such as cookies, browser storage and tracking pixels that enable analysis of your use of the website. The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR.
The processing of your personal data is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing based on your consent before its withdrawal.
The information generated about your use of this website is generally transmitted to and stored on a Google server in the USA. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has therefore undertaken to comply with European data protection principles. Both Google and US government authorities have access to your data.
Further information on terms of use and data protection can be found at:
https://policies.google.com/technologies/partner-sites
https://policies.google.com/privacy?hl=de&gl=de
https://business.safety.google/privacy/
Use of Shopify Analytics
We use the statistics and analytics functions of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) on our website as part of data processing on our behalf. Shopify is an affiliated company of Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).
The data processing serves the purpose of analysing this website and its visitors. Data is stored for marketing and optimisation purposes and provided in reports, analyses and statistics. The following device information is collected and processed, among other things: information about the web browser, IP address, time zone and some of the cookies installed on your device. When you navigate the website, information about pages or products accessed, the referrer URL (the website from which you accessed our website) and information about how you interact with the website is also collected. Technologies such as cookies, web beacons, tags and pixels (electronic files used to collect information about how you navigate the website) are used for this purpose.
Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. Canada has an adequacy decision from the European Commission. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the European Commission’s Standard Contractual Clauses.
The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing based on your consent before its withdrawal.
Further information on data protection at Shopify can be found at https://www.shopify.com/de/legal/datenschutz, information on the data processing agreement can be found at https://www.shopify.com/de/legal/dpa and information on the cookies used can be found at https://www.shopify.com/de/legal/cookies.
Use of Microsoft Clarity
We use the analytics tool “Microsoft Clarity” provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; “Microsoft”) on our website. Microsoft is an affiliated company of Microsoft Corporation (One Microsoft Way, Redmond, Washington 98052, USA).
The data processing serves the purpose of designing, optimising and analysing our website according to user needs. The tool records the movements of website visitors on a sample basis. This creates a record of mouse movements, scrolling behaviour, time spent on the website and clicks (so-called heatmap).
Cookies or comparable technologies are used for this purpose. The following information may be collected, among other things: IP address, time of access, click path, information about the device you use (device type, screen size and resolution, unique device identifier, operating system), information about the browser you use (browser type and browser version), location data, preferred website display language, subpages visited, time spent, content viewed, and requested websites or files.
Pseudonymous user profiles are created from this data. The data is not used to personally identify website visitors and is not combined with personal data relating to the holder of the pseudonym. Microsoft is contractually prohibited from selling the collected data to other third parties.
Your data may be transferred to the USA. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Microsoft is certified under the TADPF and has therefore undertaken to comply with European data protection principles.
The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing based on your consent before its withdrawal.
Detailed information on the cookies used and their functions can be found at:
https://learn.microsoft.com/en-us/clarity/setup-and-installation/cookie-list
Information on the retention period of the collected information can be found at:
https://learn.microsoft.com/en-us/clarity/setup-and-installation/data-retention
Further information on data protection when using Microsoft Clarity can be found at:
https://learn.microsoft.com/en-us/clarity/faq#privacy
https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data
https://clarity.microsoft.com/terms
General information on data protection at Microsoft can be found at:
https://privacy.microsoft.com/de-de/privacystatement
Use of the Meta Pixel
We use the Meta Pixel provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “Meta”) on our website.
Meta and we are joint controllers for the collection of your data and its transmission to Meta in connection with the integration of the service. This is based on an agreement between us and Meta on the joint processing of personal data, which defines the respective responsibilities. The agreement can be accessed at:
https://de-de.facebook.com/legal/terms/businesstools
According to this agreement, we are particularly responsible for fulfilling the information obligations under Articles 13 and 14 GDPR, complying with the security requirements of Article 32 GDPR regarding the correct technical implementation and configuration of the service, and complying with the obligations under Articles 33 and 34 GDPR insofar as a personal data breach concerns our obligations under the joint processing agreement. Meta is responsible for enabling data subject rights under Articles 15–20 GDPR, complying with the security requirements of Article 32 GDPR regarding the security of the service, and complying with the obligations under Articles 33 and 34 GDPR insofar as a personal data breach concerns Meta’s obligations under the joint processing agreement.
The application serves the purpose of targeting visitors to the website with interest-based advertising on the social networks Facebook and Instagram. For this purpose, Meta’s remarketing tag has been implemented on the website. When you visit the website, this tag establishes a direct connection to Meta’s servers. This transmits to Meta information about which of our pages you have visited. Meta assigns this information to your personal Facebook and/or Instagram user account. When you visit the social networks Facebook or Instagram, you will then be shown personalised, interest-based ads.
The application also serves the purpose of creating conversion statistics. In this context, we learn the total number of users who clicked on one of our advertisements and were redirected to a page equipped with a conversion tracking tag, as well as what actions were taken after being redirected to this website. However, we do not receive information that personally identifies users.
Your data may be transferred to the USA. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Meta is certified under the TADPF and has therefore undertaken to comply with European data protection principles.
The processing of your personal data is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing based on your consent before its withdrawal.
You can deactivate the “Custom Audiences” remarketing function here. Further information on the collection and use of data by Meta, your rights in this regard and options for protecting your privacy can be found in Meta’s Privacy Policy at:
https://www.facebook.com/about/privacy/
Use of the TikTok Pixel
We use the TikTok Pixel provided by TikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland; “TikTok Ireland”) and TikTok Information Technologies UK Limited (6th Floor, One London Wall, London, EC2Y 5EB, United Kingdom; “TikTok UK”) on our website. Both companies are joint controllers for data processing (hereinafter “TikTok”).
The data processing serves the purpose of identifying and analysing our customers’ website visits, as well as better targeting customers through targeted advertising and evaluating the effectiveness of advertising on TikTok. For this purpose, TikTok uses technologies such as cookies and pixels that enable recognition of your browser. The following information may be collected and transmitted to TikTok, among other things: date and time of the visit, information about the browser and device type you use, screen resolution and IP address. TikTok may assign this information to your personal TikTok user account. Usage profiles may be created from the data collected using pseudonyms. However, this does not enable personal identification of users.
Your data may be transferred to third countries, such as the USA. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). TikTok is not certified under the TADPF. The transfer of data to the USA and to third countries without an adequacy decision is based, among other things, on Standard Contractual Clauses as appropriate safeguards for the protection of personal data, available at:
The use of cookies or comparable technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is based on Art. 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing based on your consent before its withdrawal.
Further information on data protection can be found at:
https://www.tiktok.com/legal/page/eea/privacy-policy/de
https://ads.tiktok.com/i18n/official/policy/controller-to-controller
Data subject rights and retention period
Retention period
After the contract has been fully performed, the data is initially stored for the duration of the statutory warranty period, then taking into account statutory retention periods, in particular those under tax and commercial law, and subsequently deleted once the retention period has expired, unless you have consented to further processing and use.
Rights of the data subject
Where the statutory requirements are met, you have the following rights under Articles 15 to 20 GDPR: the right of access, rectification, erasure, restriction of processing and data portability.
You also have the right under Art. 21(1) GDPR to object to processing based on Art. 6(1)(f) GDPR, as well as to processing for the purpose of direct advertising.
Right to lodge a complaint with a supervisory authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is not lawful.
Among others, you may lodge a complaint with the supervisory authority responsible for us, which can be reached at the following contact details:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
Visitor entrance: Puttkamerstr. 16–18 (5th floor)
10969 Berlin
Germany
Tel.: +49 30 138890
Fax: +49 30 2155050
Email: mailbox@datenschutz-berlin.de
Right to object
If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to such processing with effect for the future.
Following an objection, the processing of the affected data will be terminated unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.
If personal data is processed for the purposes of direct advertising, you may object to this processing at any time by notifying us. Following an objection, we will stop processing the affected data for the purpose of direct advertising.