Privacy policy

Privacy Policy Oslery.com

 

1) Introduction and Contact Information of the Data Controller

 

1.1 We are pleased that you are visiting our website. Below, we inform you about the handling of your personal data when using our website. Personal data includes any data that can be used to personally identify you.

 

1.2 The controller for data processing on this website in accordance with the General Data Protection Regulation (GDPR) is Oslery GmbH, Kemmelallee 6, 82418 Murnau, Germany, E-mail: shop@oslery.com. The controller for the processing of personal data is the legal person who alone or jointly with others determines the purposes and means of processing personal data.

 

1.3. The Oslery GmbH has appointed Mervyn Lange as its designated Privacy Officer (DPO), responsible for overseeing and ensuring compliance with data protection laws in connection with Oslery GmbH. For any inquiries or concerns regarding the processing of personal data, participants can contact Mervyn Lange directly via E-Mail at privacyoslery@langeberatung.de or via postal mail at Mervyn Lange DPO, Lotosweg 78, 13467, Berlin, Germany.


2) Data Collection When Visiting Our Website

 

2.1 When you visit our website purely for informational purposes, i.e., when you do not register or otherwise provide us with information, we only collect data that your browser transmits to the server (so-called "server log files"). When you access our website, we collect the following data that is technically required to display the website:

 

    The website you visited

    Date and time of access

    Amount of data transmitted in bytes

    Source/referral from which you accessed the page

    Browser used

    Operating system used

    IP address used

 

Processing is carried out in accordance with Art. 6 (1) lit. f GDPR based on our legitimate interest in improving the stability and functionality of our website. No transfer or further use of the data takes place. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller). You can recognize an encrypted connection by the "https://" and the lock symbol in your browser's address bar.

 

 

 

3) Hosting & Content-Delivery-Network

3.1 Shopify

For hosting our website and displaying the page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify").

Data is also transmitted to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

When data is transferred to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.2 Cloudflare

We utilize Cloudflare, Inc. as a service provider for edge routing to ensure the security and performance of our website. Cloudflare processes personal data as a part of its services, including data transfers to the United States.

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, is certified under the EU-U.S. Data Privacy Framework, ensuring an adequate level of data protection for personal data transferred from the European Union to the United States. This certification demonstrates Cloudflare's compliance with EU data protection standards, facilitating lawful data transfers under GDPR.

In cases where additional safeguards are necessary, such as when Cloudflare’s certification is under review or if required by future regulatory changes, we implement standard contractual clauses (SCCs) or other appropriate mechanisms to ensure the protection of personal data.

For more information on Cloudflare’s data protection practices, please visit their GDPR compliance page.

 

4) Cookies

To make visiting our website attractive and to enable the use of certain features, we use cookies, which are small text files stored on your device. Some cookies are automatically deleted after closing the browser (so-called "session cookies"), while others remain stored on your device for a longer period and allow the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of the cookie settings in your web browser.

You can find a detailed list of cookies and their respective uses at https://www.shopify.com/legal/cookies#shopify-s-websites

If individual cookies we use also process personal data, processing is carried out in accordance with Art. 6 (1) lit. b GDPR for the performance of the contract, pursuant to Art. 6 (1) lit. a GDPR if consent is given, or pursuant to Art. 6 (1) lit. f GDPR to protect our legitimate interest in the best possible functionality of the website and an efficient and customer-friendly design of the site visit.

You can set your browser to inform you when cookies are set and to individually decide whether to accept them, or to exclude the acceptance of cookies for certain cases or generally.
We manage your consent with a cookie consent tool (see below).

Please note that if cookies are not accepted, the functionality of our website may be limited.

Our website also recognizes the Global Privacy Control (GPC) signal, which enables you to opt-out of certain uses or disclosures of your information. If you notify us of your preference through GPC, we will treat such signal as a valid request to opt out of sharing / targeted advertising for the associated browser or device, and, if we are able to associate the device sending the signal to a Shopify account, we will apply the opt out request to the account as well. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org/. Other than the Global Privacy Control, we do not recognize other “Do Not Track” signals that may be sent from your web browser or device.

 

5) Contacting Us

When you contact us (e.g., via contact form or e-mail), we process personal data solely for the purpose of handling and responding to your inquiry and only to the extent necessary.
The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Art. 6 (1) lit. f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) lit. b GDPR. Your data will be deleted once the issue in question is resolved and provided there are no legal retention obligations to the contrary.

6) Data Processing for Opening a Customer Account

In accordance with Art. 6 (1) lit. b GDPR, personal data will be collected and processed to the extent necessary when you provide it to us during the opening of a customer account. The required data for account creation can be found in the input mask of the respective form on our website.

You can delete your Shopify account by contacting us or through your account settings. Upon deletion, we will remove or anonymize your personal data, unless required for legal or business purposes. Some data may remain in backups for a limited period, in accordance with our data retention policy.

For any inquiries regarding account deletion, personal data, or our data retention policy, please contact us at shop@oslery.com.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to Our Email Newsletter

When you subscribe to our e-mail newsletter, we send you regular information about our offers. The mandatory information for sending the newsletter is your e-mail address. Providing additional data is voluntary and helps us address you personally. We use the so-called double opt-in procedure for sending newsletters, which ensures that you will only receive the newsletter once you have explicitly confirmed your consent to the receipt of the newsletter by clicking on a confirmation link sent to the provided e-mail address.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) lit. a GDPR. We also store the IP address registered by your Internet Service Provider (ISP) and the date and time of your registration to trace any misuse of your e-mail address at a later point. The data we collect when you subscribe to the newsletter is used exclusively for the stated purpose.

You can unsubscribe from the newsletter at any time via the provided link in the newsletter or by sending a corresponding message to the aforementioned controller. After unsubscribing, your e-mail address will be immediately removed from our newsletter distribution list, unless you explicitly consent to further use of your data or we reserve the right to use your data in a manner permitted by law and about which we inform you in this statement.

7.2 Shopify Email

Our email newsletter is sent using Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, and Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

We share your registration data based on our legitimate interest in effective marketing (Art. 6(1)(f) GDPR). With your explicit consent (Art. 6(1)(a) GDPR), Shopify may perform statistical analyses of newsletter performance using tracking tools (e.g., web beacons, pixels) to measure open rates and interactions. Device information (e.g., IP address, browser type) may also be collected but is not merged with other data.

You can withdraw consent to tracking at any time. A data processing agreement with Shopify ensures data protection and prohibits third-party transfers. Transfers to Canada are safeguarded by an EU adequacy decision.

8) Data Processing for Order Processing

8.1 Cooperation with External Shipping Partners

To fulfil our contractual obligations to customers, we collaborate with external shipping partners. Your name, delivery address, and, if required for delivery, your phone number will be shared exclusively for shipping purposes in accordance with Art. 6 (1) lit. b GDPR. The following shipping providers are involved:

  • DHL: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany
  • DPD: DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany
  • INTEX: INTEX Paketdienst GmbH, In der Held 2, 66620 Nonnweiler-Otzenhausen

 

8.2 Use of Payment Service Providers

For payment processing, we cooperate with the following payment service providers. When you select a payment method requiring prepayment (e.g., credit card), your payment data (name, address, bank and payment card information, currency, transaction number) and order details will be shared with the respective provider in accordance with Art. 6 (1) lit. b GDPR solely for payment processing purposes:

  • Shopify Payments: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
  • Amazon Pay: Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg
  • PayPal: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
  • American Express: American Express Services Europe Ltd., 1-3 St. James's Gate, Dublin 8, Ireland
  • Mastercard: Mastercard International Incorporated, 2000 Purchase Street, Purchase, NY 10577, USA
  • Visa: Visa Europe Services Inc., 1 Sheldon Square, London W2 6TT, UK

 

9) Tools and Other Services

Cookie-Consent Tool

This website uses a "cookie-consent tool" to obtain valid user consent for cookies and cookie-based applications requiring consent.

The tool displays an interactive user interface upon visiting the site, where users can grant consent for specific cookies and/or cookie-based applications by ticking appropriate boxes. Consent-based cookies are only activated once the user has provided explicit consent via the tool. This ensures that such cookies are placed on a user’s device only with their permission.

The tool sets technically necessary cookies to save your preferences. Personal user data is generally not processed during this operation.

In cases where personal data (such as IP addresses) is processed for purposes like storing, assigning, or recording cookie settings, this processing is based on Art. 6(1)(f) GDPR, reflecting our legitimate interest in legally compliant, user-specific cookie management. Additional legal grounds for processing may include Art. 6(1)(c) GDPR, as we are legally obligated to seek consent for non-essential cookies.

Where applicable, we have concluded a data processing agreement with the provider to ensure the protection of our visitors' data and prevent unauthorized disclosure to third parties.

Further details about the operator and configuration options of the cookie-consent tool can be found directly in the tool’s user interface on our website.

 

10) Rights of the Data Subject

10.1 Your rights under the GDPR include the following:

  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restriction of processing
  • Right to notification
  • Right to data portability
  • Right to withdraw consent
  • Right to lodge a complaint

 

10.2 Right to Object

When we process your personal data based on our overriding legitimate interest, you have the right at any time to object to this processing for reasons arising from your particular situation.

If you object, we will cease processing the relevant data unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such purposes.

If you exercise your right to object, we will stop processing the relevant data for direct marketing purposes.

 

11) Duration of Storage of Personal Data

Personal data is stored only as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations.

Data processed under Art. 6(1)(a) GDPR is stored until you withdraw your consent. Data processed under Art. 6(1)(b) GDPR is stored until the contractual relationship ends and statutory retention periods expire.

If processing occurs based on Art. 6(1)(f) GDPR, data is stored until you object under Art. 21 GDPR, unless compelling legitimate grounds for continued processing exist.

When no longer necessary, personal data is deleted in accordance with GDPR requirements.