Privacy Policy

1) Introduction and contact details of the responsible person

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data refers to all data that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is KOLAGORA GmbH, Neubaugasse 24, 8020 Graz, Austria, email: kontakt@aurenis.de. The controller of personal data is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

2) Data collection when visiting our website

2.1 If you use our website for informational purposes only, i.e., if you do not register or otherwise provide us with information, we only collect data that your browser transmits to the website server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• Our visited website
• Date and time of access
• Amount of data sent in bytes
• Source/reference from which you came to the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6 (1) (f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be shared or used for any other purpose. However, we reserve the right to subsequently review the server log files if there are concrete indications of illegal use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser bar.

3) Hosting & Content Delivery Network

Shopify

For hosting our website and displaying the page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data will also be transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

When data is transferred to Canada, an appropriate level of data protection is guaranteed by an adequacy decision of the European Commission.

4) Cookies

To make visiting our website more attractive and enable the use of certain functions, we use cookies, i.e., small text files stored on your device. Some of these cookies are automatically deleted after closing your browser (so-called "session cookies"); others remain on your device for a longer period and allow you to save page settings (so-called "persistent cookies"). In the latter case, you can find out how long cookies are stored in your web browser's cookie settings overview.

If personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6 (1) (b) GDPR either to execute the contract, in accordance with Art. 6 (1) (a) GDPR in the event of consent being given, or in accordance with Art. 6 (1) (f) GDPR to protect our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them or to exclude the acceptance of cookies in certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contact

5.1 Loox

For review reminders, we use the services of the following provider: Loox Online Ltd., Rehov Har Sinai 2, 6581602 Tel Aviv-Yafo, Israel

Solely on the basis of your express consent in accordance with Art. 6 (1) (a) GDPR, we will transmit your email address and, if applicable, other customer data to the provider so that they can contact you by email with a review reminder.

You can revoke your consent to us or the provider at any time with future effect.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

When data is transferred to the provider's location, an appropriate level of data protection is guaranteed by an adequacy decision of the European Commission.

5.2 When you contact us (e.g. via contact form or email), personal data will be processed exclusively for the purpose of processing and answering your request and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) (f) GDPR. If your contact is related to a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted if the circumstances indicate that the matter in question has been conclusively resolved and provided there are no statutory retention periods to the contrary.

6) Data processing when opening a customer account

Pursuant to Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. You can find out which data is required to open an account in the input mask of the corresponding form on our website.

You can delete your customer account at any time by sending a message to the controller's address above. After deleting your customer account, your data will be deleted, provided that all contracts concluded through it have been fully processed, there are no statutory retention periods that prevent this, and we have no legitimate interest in continuing to store it.

7) Use of customer data for direct marketing

7.1 Registration for our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing additional information is voluntary and will be used to address you personally. We use the so-called double opt-in process to send the newsletter, which ensures that you only receive the newsletter after you have expressly confirmed your consent to receive the newsletter by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you consent to the use of your personal data in accordance with Art. 6 (1) (a) GDPR. We store your IP address entered by your Internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later date. The data we collect when you register for the newsletter is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a corresponding message to the person responsible mentioned above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to use the data in any other way that is permitted by law and about which we will inform you in this declaration.

7.2 Klaviyo

Our email newsletter is sent via this provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we will pass on the data you provided when registering for the newsletter to this provider in accordance with Art. 6 (1) (f) GDPR so that they can send the newsletter on our behalf.

Subject to your express consent in accordance with Art. 6 (1) (a) GDPR, the provider also conducts a statistical evaluation of the success of newsletter campaigns using web beacons or tracking pixels in the emails sent, which can measure opening rates and specific interactions with the newsletter content. Device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated, but not merged with other data sets.

You can revoke your consent to newsletter tracking at any time with future effect.

We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits its transfer to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

7.3 Shopping cart reminders by email

If you cancel your purchase with us before completing your order, you have the option of receiving a one-time email reminder of the contents of your virtual shopping cart.

The only mandatory information required to send this reminder is your email address. Providing additional information is voluntary and may be used to contact you personally. We use the so-called double opt-in process to send emails, which ensures that you will only receive a notification after you have expressly confirmed your consent by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you consent to the use of your personal data in accordance with Art. 6 (1) (a) GDPR to send you a shopping cart reminder. We store your IP address entered by your Internet service provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later date. The data we collect when you register for our email notification service is used strictly for the intended purpose.

You can unsubscribe from shopping cart reminders at any time by sending a corresponding message to the person responsible named above. After unsubscribing, your email address will be immediately deleted from our mailing list unless you have expressly consented to further use of your data or we reserve the right to use the data in any other way that is permitted by law and about which we will inform you in this policy.

8) Data processing for order processing

8.1 To the extent necessary for the execution of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR.

If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we will process the contact information you provided when placing your order (name, address, email address) in order to inform you personally about upcoming updates within the legally stipulated period via a suitable communication channel (e.g., by post or email) within the scope of our statutory information obligations pursuant to Art. 6 (1) (c) GDPR. Your contact information will be used strictly for the purpose of notifying you about updates owed by us and will only be processed by us to the extent necessary for the respective information.

To process your order, we also work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.

8.2 To fulfill our contractual obligations to our customers, we work with external shipping partners. We will share your name, delivery address, and, if necessary for delivery, your telephone number with a shipping partner selected by us exclusively for the purpose of delivering the goods in accordance with Art. 6 (1) (b) GDPR.

8.3 CJ Dropshipping

For order processing, we use the following provider: YIWU CUJIA TRADE CO.,LTD, F2, Building 8, No.89, Siyuan Road, Yidong Industrial Zone, Niansanli St, China

Your name, address, and any other personal data, if any, will be passed on to the provider in accordance with Art. 6 (1) (b) GDPR solely for the purpose of processing your online order. Your data will only be passed on to the extent that this is actually necessary for processing your order.

8.4 DSers

For order processing, we use the following provider: Bowers Enterprises, LLC, 109 Cloister Drive, Peachtree City, GA 30269, USA

Your name, address, and any other personal data, if any, will be passed on to the provider for the purpose of processing your online order in accordance with Art. 6 (1) (b) GDPR. Your data will only be passed on to the extent that this is actually necessary for processing your order. The provider is also used for accounting purposes. The provider processes incoming and outgoing invoices, as well as our company's bank transactions, if applicable, in order to automatically record invoices, match them to transactions, and create financial accounting using a semi-automated process.

If personal data is also processed, the processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the efficient organization and documentation of our business transactions.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are intended to ensure compliance with the European level of data protection.

8.5 Use of payment service providers (payment services)

- Paypal

This website offers one or more online payment methods from the following provider: PayPal (Europe) Sarl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method from the provider that requires you to make an advance payment, the payment details you provided during the ordering process (including your name, address, bank and payment card information, currency, and transaction number), as well as information about the content of your order, will be passed on to the provider in accordance with Art. 6 (1) (b) GDPR. In this case, your data will be passed on exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method for which we make advance payments, you will also be asked to provide certain personal information (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, details of an alternative payment method) during the ordering process.

In such cases, in order to protect our legitimate interest in determining your ability to pay, we will forward this data to the provider for the purpose of a credit check in accordance with Art. 6 (1) (f) GDPR. The provider will check, based on the personal data you provide and other data (such as shopping cart, invoice amount, order history, and payment experience), whether the payment option you have selected can be granted in view of payment and/or default risks.

The credit report may contain probability values ​​(so-called scores). To the extent that scores are included in the credit report results, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, is used in the calculation of the scores.

You can object to this processing of your data at any time by sending us a message or contacting the provider. However, the provider may still be entitled to process your personal data if this is necessary for contractual payment processing.
- Shopify Payments

This website offers one or more online payment methods from the following provider: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method from the provider that requires you to make an advance payment (e.g., credit card payment), the payment details you provided during the ordering process (including your name, address, bank and payment card information, currency, and transaction number), as well as information about the content of your order, will be passed on to the provider in accordance with Art. 6 (1) (b) GDPR. In this case, your data will be passed on exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

9) Retargeting/remarketing and conversion tracking

9.1 Meta Pixel

Within our online offering, we use the "Meta Pixel" service of the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Quare, Dublin 2, Ireland ("Meta")

When a user clicks on an ad placed by us on Facebook and/or Instagram, a parameter is added to the URL of our linked page using "meta pixels." This URL parameter is then entered into the user's browser after redirection via a cookie set by our linked page itself.

This allows Meta to define visitors to our online offering as a target group for displaying advertisements (so-called "ads"). Accordingly, we use the service to display the Facebook and/or Instagram ads we place only to users who have also shown an interest in our online offering or who exhibit certain characteristics (e.g., interests in certain topics or products determined based on the websites visited) that we transmit to Meta (so-called "custom audiences").

On the other hand, the “Meta Pixel” can be used to track whether users were redirected to our website after clicking on an advertisement and which actions they perform there (so-called “conversion tracking”).

The data collected is anonymous to us, meaning it does not allow us to draw any conclusions about the identity of the users. However, the data is stored and processed by Meta, allowing a connection to the respective user profile and allowing Meta to use the data for its own advertising purposes.

All processing described above, in particular the setting of cookies for reading information on the device used, will only be carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with future effect by deactivating this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

The information generated by Meta is generally transferred to a Meta server and stored there; in this context, it may also be transferred to Meta Platforms Inc. servers in the USA.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

9.2 Google Ads Remarketing

This website uses retargeting technology from the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

For this purpose, Google places a cookie in the browser of your device, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you visit. Further data processing only takes place if you have given Google your consent to link your internet and app browsing history with your Google Account and to use information from your Google Account to personalize ads that you view on the web. In this case, if you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. For this purpose, Google will temporarily link your personal data with Google Analytics data to create target groups. When using Google Ads Remarketing, personal data may also be transferred to the servers of Google LLC in the USA.

All processing described above, in particular the setting of cookies for reading information on the device used, will only be carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. Without this consent, retargeting technology will not be used during your visit to the site.

You can revoke your consent at any time with future effect. To exercise your revocation, please deactivate this service using the "Cookie Consent Tool" provided on the website.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

Details on the processing initiated by Google and how Google handles data from websites can be found here: https://policies.google.com/technologies/partner-sites

Further information on Google's privacy policy can be found here: https://business.safety.google/intl/de/privacy/ and https://www.google.de/policies/privacy/

9.3 TikTok Pixel

This website uses the conversion tracking technology of the following provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland

If you have accessed our website from an advertisement on the provider's domain, the success of the advertisement can be tracked using cookies and/or similar technologies (tracking pixels, web beacons, pings or HTTP requests).

For this purpose, certain device and browser information, including your IP address if applicable, is read using tracking technology in order to record and evaluate user actions predefined by us (e.g., completed transactions, leads, search queries on the website, visits to product pages). This enables us to compile statistics on user behavior on our website after redirection from an advertisement, which we use to optimize our offering.

All processing described above, in particular the setting of cookies for reading information on the device used, will only be carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with future effect by deactivating this service in the "Cookie Consent Tool" provided on the website.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

10) Page functionalities

10.1 Google Web Fonts

This site uses web fonts from the following provider for the uniform display of fonts: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

When you visit a page, your browser loads the required web fonts into your browser cache to correctly display text and fonts and establishes a direct connection to the provider's servers. Certain browser information, including your IP address, is transmitted to the provider.

Data may also be transmitted to: Google LLC, USA

The processing of personal data during the connection with the font provider will only take place if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with future effect by deactivating this service using the "Cookie Consent Tool" provided on the website. If your browser does not support web fonts, a standard font from your computer will be used.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

Further information on Google's privacy policy can be found here: https://business.safety.google/intl/de/privacy/

10.2 Google reCAPTCHA

On this website we use the CAPTCHA service of the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transmitted to: Google LLC, USA. The provider uses "Google Fonts," i.e., fonts downloaded from the Internet by Google, for the visual design of the Captcha window. No further information beyond that mentioned above, which is already transmitted to Google via the ReCaptcha functionality, is processed in this case.

The service checks whether an input was made by a natural person or abusively by machine and automated processing, and blocks spam, DDoS attacks, and similar automated malicious access. To ensure that an action is performed by a human and not an automated bot, the provider collects the IP address of the device used, identification data of the browser and operating system type used, as well as the date and duration of the visit, and transmits this data to the provider's servers for evaluation.

The legal basis is our legitimate interest in determining individual responsibility on the Internet and preventing misuse and spam in accordance with Art. 6 (1) (f) GDPR.

We have concluded a data processing agreement with the provider, which ensures the protection of the data of our website visitors and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

Further information on Google's privacy policy can be found here: https://business.safety.google/intl/de/privacy/

11) Tools and Other

Cookie Consent Tool

This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The "cookie consent tool" is displayed to users when they visit the website in the form of an interactive user interface, where consent for specific cookies and/or cookie-based applications can be granted by checking the boxes. By using the tool, all cookies/services that require consent are only loaded if the respective user grants the corresponding consent by checking the boxes. This ensures that such cookies are only placed on the user's device if consent has been granted.

The tool uses technically necessary cookies to save your cookie preferences. Personal user data is generally not processed.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning or logging cookie settings, this is done in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.

A further legal basis for processing is Art. 6 (1) (c) GDPR. As the controller, we are legally obliged to make the use of technically unnecessary cookies dependent on the respective user's consent.

Where necessary, we have concluded a data processing agreement with the provider, which ensures the protection of the data of our site visitors and prohibits unauthorized disclosure to third parties.

Further information about the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

12) Rights of the data subject

12.1 The applicable data protection law grants you the following data subject rights (rights of information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the legal basis stated for the respective conditions for exercising these rights:

• Right to information pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to information pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to revoke consent given in accordance with Art. 7 (3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

12.2 RIGHT OF OBJECTION

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCE OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH FUTURE EFFECT FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

If you exercise your right to object, we will stop processing the data in question. However, we reserve the right to continue processing if we can demonstrate compelling legitimate grounds for the processing that override your interests, fundamental rights, and freedoms, or if the processing serves to assert, exercise, or defend legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes. You can exercise your right of objection as described above.

IF YOU EXERCISE YOUR RIGHT OF OBJECTION, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13) Duration of storage of personal data

The duration of storage of personal data is determined based on the respective legal basis, the purpose of the processing and – where applicable – also on the respective statutory retention period (e.g. retention periods under commercial and tax law).

When processing personal data on the basis of an express consent in accordance with Art. 6 (1) (a) GDPR, the data concerned will be stored until you revoke your consent.

If there are statutory retention periods for data that are processed within the framework of legal transactions or quasi-legal obligations on the basis of Art. 6 (1) (b) GDPR, these data will be routinely deleted after the retention periods have expired, provided that they are no longer required for the fulfilment or initiation of a contract and/or we no longer have a legitimate interest in continuing to store them.

When processing personal data on the basis of Art. 6 (1) (f) GDPR, these data will be stored until you exercise your right of objection in accordance with Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6 (1) (f) GDPR, these data will be stored until you exercise your right of objection in accordance with Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this declaration on specific processing situations, stored personal data will be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.