Privacy Policy

1. Introduction and Contact Details of the Controller

1.1

We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how your personal data is handled when you use our website.

Personal data means any information that can be used to identify you personally.

1.2

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Brivalux

Chiemsee Str. 26
83022 Rosenheim
Germany

Phone: +49 157 74758042
Email: brivalux@gmail.com

The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

⸻

2. Collection of Data When Visiting Our Website

2.1

When you use our website for informational purposes only, meaning that you do not register or otherwise provide us with information, we collect only the data that your browser transmits to the website server, known as server log files.

When you access our website, we collect the following data, which is technically necessary to display the website to you:

* The page visited on our website
* The date and time of access
* The amount of data transmitted in bytes
* The source or referring page from which you accessed the website
* The browser used
* The operating system used
* The IP address used, possibly in anonymized form

This processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

The data will not be shared or used for any other purpose. However, we reserve the right to review the server log files at a later date if there are specific indications of unlawful use.

2.2

For security reasons and to protect the transmission of personal data and other confidential content, such as orders or inquiries sent to the controller, this website uses SSL or TLS encryption.

You can recognize an encrypted connection by the prefix “https://” and the padlock symbol displayed in your browser’s address bar.

⸻

3. Hosting and Content Delivery Network

Shopify

We use the following provider to host our website and display its content:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland
(“Shopify”)

Data may also be transferred to:

Shopify Inc.
150 Elgin Street
Ottawa, Ontario K2P 1L4
Canada

All data collected on our website is processed on the provider’s servers.

We have entered into a data processing agreement with the provider. This agreement ensures the protection of our website visitors’ data and prevents unauthorized disclosure to third parties.

For transfers of data to Canada, an adequate level of data protection is ensured by an adequacy decision issued by the European Commission.

⸻

4. Cookies

To make your visit to our website more attractive and enable the use of certain functions, we use cookies. Cookies are small text files stored on your device.

Some cookies are automatically deleted when you close your browser. These are known as session cookies. Other cookies remain stored on your device for a longer period and allow us to save website settings. These are known as persistent cookies.

Information about the storage period of persistent cookies can be found in your browser’s cookie settings.

Where personal data is processed through cookies used by us, the processing is carried out:

* in accordance with Article 6(1)(b) GDPR where necessary for the performance of a contract;
* in accordance with Article 6(1)(a) GDPR where you have provided consent; or
* in accordance with Article 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and providing a user-friendly and effective website experience.

You can configure your browser so that you are informed whenever cookies are set. You may decide individually whether to accept cookies, accept them only in certain cases, or reject them entirely.

Please note that the functionality of our website may be limited if cookies are not accepted.

⸻

5. Contacting Us

5.1 WhatsApp Business

You may contact us through the WhatsApp messaging service provided by:

WhatsApp Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

For this purpose, we use the business version of WhatsApp, known as WhatsApp Business.

If you contact us via WhatsApp regarding a specific transaction, such as an order you have placed, we will store and use the mobile phone number you use for WhatsApp, as well as your first and last name, where provided, in accordance with Article 6(1)(b) GDPR for the purpose of processing and responding to your inquiry.

On the same legal basis, we may ask you through WhatsApp to provide additional information, such as your order number, customer number, address, or email address, so that we can associate your inquiry with a specific transaction.

If you use our WhatsApp contact option for general inquiries, for example regarding our range of services, availability, or website, we will store and use the mobile phone number you use for WhatsApp and your first and last name, where provided, in accordance with Article 6(1)(f) GDPR.

This processing is based on our legitimate interest in providing the requested information efficiently and promptly.

Your data will be used exclusively to respond to your inquiry through WhatsApp and will not be disclosed to other third parties.

Please note that WhatsApp Business may access the address book of the mobile device we use for this purpose and automatically transfer the phone numbers stored in it to the servers of its parent company, Meta Platforms Inc., in the United States.

To operate our WhatsApp Business account, we use a mobile device whose address book contains only the WhatsApp contact details of users who have actively contacted us through WhatsApp.

This ensures that every person whose WhatsApp contact details are stored in our address book has previously consented to the transfer of their WhatsApp phone number from their contacts’ address books in accordance with Article 6(1)(a) GDPR by accepting WhatsApp’s terms of service when first using the application on their device.

The transfer of data relating to users who do not use WhatsApp or who have not contacted us through WhatsApp is therefore excluded.

Further information about the purpose and scope of data collection and the further processing and use of data by WhatsApp, as well as your rights and privacy settings, can be found in WhatsApp’s Privacy Policy:

https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have entered into a data processing agreement with the provider. This agreement protects the data of our website visitors and prohibits unauthorized disclosure to third parties.

The processing described above may involve the transfer of data to servers operated by Meta Platforms Inc. in the United States.

For data transfers to the United States, the provider participates in the EU–US Data Privacy Framework. Based on an adequacy decision by the European Commission, this framework ensures compliance with the European level of data protection.

5.2 Contact Form and Email

When you contact us, for example through a contact form or by email, personal data will be processed solely for the purpose of handling and responding to your inquiry and only to the extent necessary.

The legal basis for processing this data is our legitimate interest in responding to your inquiry in accordance with Article 6(1)(f) GDPR.

If your contact is intended to lead to the conclusion of a contract, Article 6(1)(b) GDPR also serves as an additional legal basis for processing.

Your data will be deleted once it can be inferred from the circumstances that the matter has been fully resolved, provided that there are no statutory retention obligations preventing deletion.

6. Comment Function

When you use the comment function on this website, the time at which your comment was submitted and the username you selected will be recorded and published on the website.

Your IP address will also be recorded and stored. The IP address is stored for security reasons in the event that a comment infringes the rights of third parties or contains unlawful content.

We require your email address so that we can contact you if a third party objects to the content you have published on the grounds that it is unlawful.

The legal basis for storing your data is Article 6(1)(b) and Article 6(1)(f) GDPR.

We reserve the right to delete comments if third parties object to them as unlawful.

⸻

7. Data Processing When Opening a Customer Account

In accordance with Article 6(1)(b) GDPR, personal data will be collected and processed to the extent necessary if you provide it to us when opening a customer account.

The data required to open an account can be found in the input fields of the relevant registration form on our website.

You may request the deletion of your customer account at any time by sending a message to the controller at the contact address stated above.

After your account has been deleted, your data will also be deleted, provided that:

* all contracts concluded through the account have been fully processed;
* the data is not subject to statutory retention periods; and
* we have no legitimate interest in continuing to store the data.

⸻

8. Use of Customer Data for Direct Marketing

8.1 Subscription to Our Email Newsletter

When you subscribe to our email newsletter, we will regularly send you information about our offers.

The only mandatory information required to send the newsletter is your email address. Providing any additional information is voluntary and may be used to personalize our communications with you.

We use a double opt-in procedure for newsletter subscriptions. This means that you will receive the newsletter only after you have expressly confirmed your consent by clicking the verification link sent to the email address you provided.

By activating the confirmation link, you consent to the use of your personal data in accordance with Article 6(1)(a) GDPR.

We store the IP address assigned by your internet service provider, as well as the date and time of registration, so that we can identify any possible misuse of your email address at a later date.

The data collected when you subscribe to the newsletter will be used exclusively for the intended purpose.

You may unsubscribe from the newsletter at any time by using the unsubscribe link included in the newsletter or by sending a message to the controller identified above.

After you unsubscribe, your email address will be removed from the newsletter mailing list without undue delay unless:

* you have expressly consented to the continued use of your data for other purposes; or
* we reserve the right to continue using the data for another purpose permitted by law and explained in this Privacy Policy.

8.2 Shopping Cart Reminders by Email

If you discontinue the purchase process before completing your order, you may have the option to receive a one-time email reminder about the contents of your virtual shopping cart.

The only mandatory information required to send this reminder is your email address. Providing additional information is voluntary and may be used to personalize our communications with you.

We use a double opt-in procedure for shopping cart reminder emails. This ensures that you will receive a reminder only after expressly confirming your consent by clicking the verification link sent to the email address you provided.

By activating the confirmation link, you consent to the use of your personal data in accordance with Article 6(1)(a) GDPR for the purpose of sending you a shopping cart reminder.

We store the IP address assigned by your internet service provider, as well as the date and time of registration, to identify any possible misuse of your email address at a later date.

The data collected when you register for the email notification service will be used exclusively for this purpose.

You may unsubscribe from shopping cart reminders at any time by sending a message to the controller identified above.

After you unsubscribe, your email address will be removed from the relevant mailing list without undue delay unless:

* you have expressly consented to the continued use of your data for other purposes; or
* we reserve the right to use the data for another purpose permitted by law and explained in this Privacy Policy.

⸻

9. Data Processing for Order Fulfilment

9.1 General Processing of Orders

To the extent necessary for processing the delivery and payment aspects of a contract, the personal data collected by us will be transferred to the commissioned transport company and the commissioned financial institution in accordance with Article 6(1)(b) GDPR.

If, under a relevant contract, we are required to provide you with updates for goods with digital elements or digital products, we will process the contact details you provided when placing your order in order to personally inform you of such updates.

This processing is carried out in accordance with our statutory notification obligations under Article 6(1)(c) GDPR.

Your contact details will be used exclusively for the purpose of notifying you about updates that we are legally required to provide and will be processed only to the extent necessary for this purpose.

To fulfil your order, we also work with the service providers listed below. These service providers support us in whole or in part in performing the contracts concluded with you.

Certain personal data will be transferred to these service providers in accordance with the information set out below.

9.2 Transfer of Personal Data to Shipping Service Providers

DHL

We use the following transport service provider:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

Before delivery of the goods, we may transfer your email address and/or telephone number to the provider for the purpose of coordinating or announcing delivery, provided that you have expressly consented to this during the ordering process in accordance with Article 6(1)(a) GDPR.

If you have not provided such consent, we will transfer only the recipient’s name and delivery address to the provider for the purpose of delivery in accordance with Article 6(1)(b) GDPR.

The data will be transferred only to the extent necessary for delivery of the goods.

Without your consent, it will not be possible to coordinate the delivery date in advance with the provider or send you a delivery notification.

You may withdraw your consent at any time with effect for the future by contacting the controller identified above or the shipping service provider.

DHL Express

We use the following transport service provider:

DHL Express Germany GmbH
Heinrich-Brüning-Straße 5
53113 Bonn
Germany

If you have not provided such consent, we will transfer only the recipient’s name and delivery address to the provider for the purpose of delivery in accordance with Article 6(1)(b) GDPR.

The data will be transferred only to the extent necessary for delivery of the goods.

Without your consent, it will not be possible to coordinate the delivery date in advance with the provider or send you a delivery notification.

You may withdraw your consent at any time with effect for the future by contacting the controller identified above or the shipping service provider.

⸻

10. Tools and Other Cookie Consent Tools

This website uses a cookie consent tool to obtain users’ explicit consent to cookies and cookie-based applications that require consent.

When users visit the website, the tool is displayed as an interactive interface through which they can grant consent to specific cookies or cookie-based applications by selecting the relevant checkboxes.

By using this tool, cookies or services requiring consent are loaded only after the user has granted the relevant consent. This ensures that such cookies are placed on the user’s device only after consent has been provided.

The tool uses technically necessary cookies to store your cookie preferences. As a general rule, no personal user data is processed for this purpose.

If personal data, such as an IP address, is processed in individual cases for the purpose of storing, assigning, or recording cookie settings, this processing is carried out in accordance with Article 6(1)(f) GDPR.

The processing is based on our legitimate interest in providing a legally compliant, user-specific, and user-friendly cookie consent management system and therefore in ensuring the legally compliant design of our website.

Article 6(1)(c) GDPR also serves as an additional legal basis for processing. As the controller, we are legally required to make the use of technically unnecessary cookies dependent on the consent of the relevant user.

Where necessary, we have entered into a data processing agreement with the provider. This agreement ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

Further information about the operator and the settings available within the cookie consent tool can be found directly in the relevant user interface on our website.

⸻

11. Rights of the Data Subject

11.1 Data Subject Rights

Applicable data protection law grants you the following rights as a data subject in relation to the controller’s processing of your personal data:

* The right of access in accordance with Article 15 GDPR
* The right to rectification in accordance with Article 16 GDPR
* The right to erasure in accordance with Article 17 GDPR
* The right to restriction of processing in accordance with Article 18 GDPR
* The right to information in accordance with Article 19 GDPR
* The right to data portability in accordance with Article 20 GDPR
* The right to withdraw consent in accordance with Article 7(3) GDPR
* The right to lodge a complaint in accordance with Article 77 GDPR

11.2 Right to Object

If we process your personal data on the basis of our overriding legitimate interest as part of a balancing of interests, you have the right to object to this processing at any time, on grounds relating to your particular situation, with effect for the future.

If you exercise your right to object, we will stop processing the data concerned.

However, we may continue processing if we can demonstrate compelling legitimate grounds for the processing that override your interests, fundamental rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such purposes.

You may exercise your right to object as described above.

If you exercise your right to object, we will stop processing the data concerned for direct marketing purposes.

⸻

12. Duration of Personal Data Storage

The duration for which personal data is stored is determined on the basis of the relevant legal basis, the purpose of the processing, and, where applicable, the relevant statutory retention period, such as retention periods under commercial and tax law.

Where personal data is processed on the basis of your explicit consent in accordance with Article 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.

Where statutory retention periods apply to data processed in connection with contractual or quasi-contractual obligations on the basis of Article 6(1)(b) GDPR, such data will routinely be deleted after the retention periods have expired, provided that:

* the data is no longer required for the performance or initiation of a contract; and
* we have no legitimate interest in continuing to store the data.

Where personal data is processed on the basis of Article 6(1)(f) GDPR, the data will be stored until you exercise your right to object in accordance with Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Article 6(1)(f) GDPR, the data will be stored until you exercise your right to object in accordance with Article 21(2) GDPR.

Unless otherwise stated in the other information contained in this Privacy Policy regarding specific processing situations, stored personal data will be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

⸻