An Overview of Our Privacy Policy and Cookie Policy

With us, you’ll be free from Facebook and other advertising giants that seek to access your personal data and track your purchasing behavior. This also means that these providers cannot track your online activity via so-called “fingerprinting” on our site.

We have deliberately chosen not to use Google analytics software or social media plugins, as these often collect a vast amount of data that frequently extends beyond the use of the individual website. We want to win you over with our products and enable you to purchase them with the greatest possible level of privacy. Therefore, unlike many other websites, we do not need to ask for your consent to allow third parties to collect your data. We simply do not permit it.

We cannot avoid the use of certain cookies from our own shop system, which are absolutely necessary so that you can shop with us without any functional limitations and so that we can obtain basic statistical data about the use of our site. However, we do this without relying on the widely used “Google Analytics”; instead, we use only locally installed software (Matomo), which fully anonymizes visits to our site and thus does not allow any identification of you. The few cookies that make it easier for you to use our online store are set exclusively by our own server, which is operated in Germany, and are deleted at the end of your visit or, at the latest, after you manually clear your browser cache.

We collect personal data only when you make a purchase through our website and only to the extent necessary for order processing.

Unfortunately, we have no influence over the cookie policy of the payment provider PayPal. However, we have taken precautions and are giving you the choice here: If you wish to use PayPal as a payment method, you can enable it during our ordering process (you will be explicitly notified of this at that time). Until that point, PayPal also has no access to your (or our) data.

In this way—contrary to the general trend in online retail—we ensure that your personal data is handled conscientiously and with care.

1. Data Protection at a Glance
2. Hosting and Web Application Firewall (WAF)
3. General Information and Mandatory Disclosures
4. Data Collection on Our Website
5. Analytics Tools
6. Payment Providers
7. Newsletter
8. Video Service

1. Privacy Policy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to personally identify you. For detailed information on data protection, please refer to our Privacy Policy listed below this text.

Data Collection on Our Website

Who Is Responsible for Data Collection on This Website?

Data processing on this website is carried out by the website operator. You can find the operator’s contact information in the legal notice section of this website.

How do we collect your data?

Your data is collected, on the one hand, when you provide it to us. This may include, for example, data you enter into a contact form.

Other data is collected automatically by our IT systems when you visit the website. This consists primarily of technical data (e.g., internet browser, operating system, or time the page was accessed). This data is collected automatically as soon as you access our website.

What do we use your data for?

Some of the data is collected to ensure the website functions properly. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to receive information, free of charge, regarding the origin, recipients, and purpose of your stored personal data. You also have the right to request the correction, restriction, or deletion of this data. For this and any other questions regarding data protection, you can contact us at any time at the address provided in the legal notice. Furthermore, you have the right to file a complaint with the competent supervisory authority.

Analytics Tools and Third-Party Tools

When you visit our website, your browsing behavior may be statistically analyzed. This is primarily done using cookies and so-called analytics programs. The analysis of your browsing behavior is generally anonymous; your browsing behavior cannot be traced back to you. You can object to this analysis or prevent it by not using certain tools. Detailed information on this can be found in the following privacy policy.

You can object to this analysis. We will inform you about the options for objecting in this privacy policy.

2. Hosting and Web Application Firewall (WAF)

We host the content of our website with the following provider:

External Hosting

This website is hosted externally. The personal data collected on this website is stored on the host’s servers. This may primarily include IP addresses, contact requests, metadata and communication data, contractual data, contact information, names, website visits, and other data generated through a website.

External hosting is carried out for the purpose of fulfilling our contractual obligations to our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of ensuring the secure, fast, and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR). If consent has been obtained, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

Our hosting provider(s) will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data.

We use the following hosting provider(s):

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

Data Processing

We have entered into a Data Processing Agreement (DPA) for the use of the service mentioned above. This is a contract required by data protection law that ensures that the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Cloudflare

We use the “Cloudflare” service. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter “Cloudflare”).

Cloudflare offers a globally distributed content delivery network with DNS. Technically, this routes the transfer of information between your browser and our website through Cloudflare’s network. This enables Cloudflare to analyze the data traffic between your browser and our website and to act as a filter between our servers and potentially malicious traffic from the Internet.

Our use of Cloudflare is based on our legitimate interest in providing our website as error-free and secure as possible (Art. 6(1)(f) GDPR).

Data transfers to the U.S. are based on the European Commission’s Standard Contractual Clauses. Details can be found here: https://www.cloudflare.com/privacypolicy/.

Further information on security and data protection at Cloudflare can be found here: https://www.cloudflare.com/privacypolicy/.

Data Processing

We have entered into a data processing agreement (DPA) for the use of the aforementioned service. This is a contract required under data protection law that ensures the service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Friendly Captcha

We use Friendly Captcha (hereinafter “Friendly Captcha”) on this website. The provider is Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany.

Friendly Captcha is used to verify whether data entry on this website (e.g., in a contact form) is performed by a human or by an automated program. To do this, Friendly Captcha analyzes the website visitor’s behavior based on various characteristics. For this analysis, Friendly Captcha evaluates various pieces of information (e.g., anonymized IP address, referrer, time of visit, etc.). For more information, please visit: https://friendlycaptcha.com/legal/privacy-end-users/.

The storage and analysis of the data are based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in protecting its web offerings from abusive automated scraping and from spam. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG, provided that the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time.

3. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations as well as this Privacy Policy.

When you use this website, various types of personal data are collected. Personal data is data that can be used to personally identify you. This Privacy Policy explains what data we collect and how we use it. It also explains how and for what purpose this is done.

Please note that data transmission over the Internet (e.g., when communicating via email) may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties.

Information on the Data Controller

The entity responsible for data processing on this website is:

Harald Daub
Thomas Hoof Produktgesellschaft mbH & Co. KG
Bahnhofstraße 3
59348 Lüdinghausen

Phone: +49 2591 2590-210
Email: info@thpg.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. To do so, simply send us an informal email. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal.

Right to File a Complaint with the Competent Supervisory Authority

In the event of violations of data protection laws, the data subject has the right to file a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the State Data Protection Commissioner of the federal state in which our company is headquartered. A list of data protection officers and their contact information can be found at the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Right to Data Portability

You have the right to have data that we process automatically—based on your consent or in fulfillment of a contract—provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another data controller, this will only take place to the extent that it is technically feasible.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content—such as orders or inquiries you send to us as the website operator—this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar.

When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.

Encrypted Payment Transactions on This Website

If, after entering into a paid contract, you are required to provide us with your payment information (e.g., account number for direct debit authorization), this information is necessary for processing the payment.

Payment transactions using standard payment methods (Visa/MasterCard, direct debit) are processed exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock icon in your browser’s address bar.

With encrypted communication, the payment data you transmit to us cannot be read by third parties.

Access, Restriction, Deletion

In accordance with applicable legal provisions, you have the right at any time to receive, free of charge, information about your stored personal data, its origin, recipients, and the purpose of data processing, as well as the right to have this data corrected, restricted, or deleted, if applicable. For this and any other questions regarding personal data, you may contact us at any time at the address provided in the legal notice.

Objection to Advertising Emails

We hereby object to the use of contact information published in accordance with the legal requirement to provide an “Imprint” for the purpose of sending unsolicited advertising and informational materials. The operators of this website expressly reserve the right to take legal action in the event of the unsolicited transmission of advertising information, such as via spam emails.

4. Data Collection on Our Website

Cookies

Some parts of this website use so-called cookies. Cookies do not harm your computer and do not contain viruses. Cookies serve to make our website more user-friendly, effective, and secure. Cookies are small text files that are stored on your computer and saved by your browser.

Most of the cookies we use are so-called “session cookies.” They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognize your browser the next time you visit.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

Cookies that are necessary for carrying out the electronic communication process or for providing specific functions you have requested (e.g., the shopping cart function) are stored on the basis of Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in storing cookies to ensure the technically error-free and optimized provision of its services. To the extent that other cookies (e.g., cookies used to analyze your browsing behavior) are stored, these are addressed separately in this Privacy Policy.

Server Log Files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:

• Browser type and browser version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not combined with other data sources.

The legal basis for data processing is Article 6(1)(f) of the GDPR, which permits the processing of data for the purpose of fulfilling a contract or taking pre-contractual measures.

Contact Form

If you submit inquiries to us via the contact form, the information you provide in the form—including the contact details you enter there—will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not share this data without your consent.

The processing of the data entered into the contact form is therefore based exclusively on your consent (Article 6(1)(a) of the GDPR). You may revoke this consent at any time. To do so, simply send us an informal email. The lawfulness of the data processing operations carried out prior to revocation remains unaffected by the revocation.

The data you enter in the contact form will remain with us until you request that we delete it, revoke your consent to its storage, or the purpose for storing the data no longer applies (e.g., after your inquiry has been fully processed). Mandatory legal provisions—in particular retention periods—remain unaffected.

Electronic Withdrawal Function (Withdrawal Button)

In accordance with Section 356a of the German Civil Code (BGB), we provide an electronic withdrawal function on our website that allows you to withdraw from your distance sales contract online.
What data is collected?
As part of the withdrawal process, we collect only the data necessary for contract identification and processing:

First and last name
Order number / Contract number
Email address (for the legally required confirmation of receipt)

Purpose of processing
The data is used exclusively to process your cancellation and to send the acknowledgment of receipt in accordance with Section 356a(4) of the German Civil Code (BGB).
Legal basis
Processing is based on Article 6(1)(c) of the GDPR in conjunction with Section 356a of the German Civil Code (BGB) (fulfillment of a legal obligation).
Retention period
The data collected in connection with the cancellation will be stored in accordance with the retention periods under commercial and tax law, generally for a period of 10 years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)), unless a longer retention obligation applies.

Registration on This Website

You can register on our website to use additional features on the site. We use the data you provide for this purpose solely for the purpose of using the specific offer or service for which you have registered. The required information requested during registration must be provided in full. Otherwise, we will reject the registration.

For important changes—such as changes to the scope of our offerings or technically necessary modifications—we will use the email address you provided during registration to notify you.

The processing of the data entered during registration is based on your consent (Art. 6(1)(a) GDPR). You may revoke your consent at any time. To do so, simply send us an informal email. The lawfulness of any data processing that has already taken place remains unaffected by the revocation.

We store the data collected during registration for as long as you remain registered on our website; it is subsequently deleted. Statutory retention periods remain unaffected.

Processing of Data (Customer and Contract Data)

We collect, process, and use personal data only to the extent necessary to establish, define the terms of, or modify the legal relationship (master data). This is done on the basis of Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. We collect, process, and use personal data regarding the use of our website (usage data) only to the extent necessary to enable the user to access the service or to bill for it.

The collected customer data is deleted upon completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Data Transfer Upon Conclusion of a Contract for Online Stores, Retailers, and Shipping

We transfer personal data to third parties only if this is necessary for the fulfillment of the contract, such as to companies entrusted with the delivery of goods or to the financial institution responsible for processing payments. No further transfer of data takes place, or only if you have expressly consented to such transfer. Your data will not be disclosed to third parties without your express consent, for example for advertising purposes.

The legal basis for data processing is Article 6(1)(b) of the GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

5. Analytics Tools

Matomo (formerly Piwik)

This website uses the open-source web analytics service Matomo. Matomo uses technologies that enable cross-page recognition of users to analyze user behavior (e.g., cookies or device fingerprinting). The information collected by Matomo regarding the use of this website is stored on our server. The IP address is anonymized before storage.

With the help of Matomo, we are able to collect and analyze data about how website visitors use our website. This allows us, among other things, to determine when specific pages were viewed and from which region the visitors are coming. In addition, we collect various log files (e.g., IP address, referrer, browsers and operating systems used) and can measure whether our website visitors perform certain actions (e.g., clicks, purchases, etc.).

The use of this analytics tool is based on Article 6(1)(f) of the GDPR. The website operator has a legitimate interest in the anonymized analysis of user behavior in order to optimize both its website and its advertising. If consent has been obtained (e.g., consent to the storage of cookies), processing is carried out exclusively on the basis of Article 6(1)(a) of the GDPR; consent may be revoked at any time.

IP Anonymization

When analyzing data with Matomo, we use IP anonymization. This involves truncating your IP address prior to analysis so that it can no longer be uniquely associated with you.

6. Payment Providers

PayPal

On our website, we offer payment via PayPal, among other options. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).

If you select payment via PayPal, the payment details you enter will be transmitted to PayPal.

The transfer of your data to PayPal is based on Art. 6(1)(a) of the GDPR (consent) and Art. 6(1)(b) of the GDPR (processing necessary for the performance of a contract). You have the option to withdraw your consent to data processing at any time. A revocation does not affect the lawfulness of data processing operations that have already taken place.

7. Newsletter

Newsletter Data

If you subscribe to our newsletter (information letter), we use the email address you provided for this purpose to send you our email newsletter on a regular basis based on your consent in accordance with Article 6(1)(a) of the GDPR.

If we receive your email address in connection with the sale of a product and you have not objected to this, we reserve the right to periodically send you offers via email for products similar to those you have already purchased from our product range, based on Section 7(3) of the German Unfair Competition Act (UWG). This serves to protect our legitimate interests—which prevail following a balancing of interests—in sending promotional communications to our customers in accordance with Article 6(1)(f) of the GDPR.

We use the so-called double opt-in procedure for subscribing to our newsletter. This means that after you provide your email address, we will send a confirmation email to the address you provided, asking you to confirm that you wish to receive the newsletter. If you do not confirm this, your subscription will be automatically deleted. If you confirm your wish to receive the newsletter, we will store your email address until you unsubscribe from the newsletter. This data is stored solely for the purpose of sending you the newsletter. Furthermore, we store your IP addresses and the times of your registration and confirmation to prevent misuse of your personal data.

You may revoke your consent to receive the newsletter at any time. You can revoke your consent by clicking the link provided in every newsletter email, by sending an email to info@THPG.de, or by sending a message using the contact information provided in the legal notice. You will incur no costs other than the standard transmission fees.

We use a newsletter service provider, described below, to manage the newsletter.

Brevo

This website uses Brevo to send newsletters. The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo is a service that can be used, among other things, to organize and analyze the distribution of newsletters. The data you provide for the purpose of subscribing to the newsletter is stored on the servers of Sendinblue GmbH in Germany.

Data Analysis by Brevo

With the help of Brevo, we are able to analyze our newsletter campaigns. For example, we can see whether a newsletter message was opened and which links, if any, were clicked. This allows us, among other things, to determine which links were clicked particularly often.

In addition, we can determine whether certain predefined actions were taken after the newsletter was opened or a link was clicked (conversion rate). For example, we can see whether you made a purchase after clicking a link in the newsletter.

Brevo also allows us to segment newsletter recipients into different categories (“cluster” them). For example, newsletter recipients can be segmented by age, gender, or location. This enables us to better tailor the newsletters to the respective target groups.

If you do not want Brevo to analyze your data, you must unsubscribe from the newsletter. We provide a link for this purpose in every newsletter message.

For detailed information on Brevo’s features, please visit the following link: https://www.brevo.com/de/newsletter-software/.

Anonymized Tracking

We use Brevo’s anonymized tracking, which does not allow your identity to be identified, provided you have expressly consented to this in advance.

Legal Basis

Data processing is based on your consent (Art. 6(1)(a) GDPR). You may revoke this consent at any time with future effect.

Retention Period

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter, and will be deleted from the newsletter distribution list after you unsubscribe or once the purpose for which it was collected no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our sole discretion within the scope of our legitimate interest pursuant to Article 6(1)(f) of the GDPR. Data stored by us for other purposes remains unaffected by this.

After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider on a blacklist, if necessary, to prevent future mailings. The data from the blacklist is used solely for this purpose and is not combined with other data. This serves both your interest and our interest in complying with legal requirements when sending newsletters (legitimate interest within the meaning of Article 6(1)(f) of the GDPR). There is no time limit on storage in the blacklist. You may object to this storage if your interests outweigh our legitimate interest.

Data Processing on Behalf of Others

We have entered into a data processing agreement (DPA) with the provider mentioned above. This is a contract required under data protection law that ensures the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

8. Video Service

Video Embedding via Ignite

We use Ignite Video, a service provided by Ignite Video GmbH, Immermannstraße 59, 40210 Düsseldorf, Germany, to deliver video content.

Ignite Video is used to technically deliver and play video content on our website. The video files are delivered via Ignite’s content delivery network.

Ignite Video does not store IP addresses and does not set cookies for the provision of video content. Processing takes place within the European Union.

Ignite processes data on our behalf to the extent necessary for the technical provision and delivery of video content. We have a contract with Ignite for data processing in accordance with Article 28 of the GDPR.

Processing is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in the technical provision and user-friendly presentation of video content on our website.

Website Cookies

The following table shows which cookies we use and what information they store. All cookies are technically necessary and are used to ensure the technical performance of the website.