CCPA Privacy Policy

SCOPE OF THIS PRIVACY NOTICE

The following privacy provisions apply exclusively to the website www.joop-living.com and its subpages. They do not apply to other websites or internet offers to which merely a link is provided on our website. We are not responsible for data processing in the context of using such external websites.

PRIVACY AT A GLANCE

I. Name and address of the controller

The controller responsible for data processing on this website is:

JOOP! LIVING
Brand Supply & Logistics GmbH

- Data protection officer-
Harvestehuder Weg 22
20149 Hamburg
Germany

Email: customercare@joop-living.com

II. Contact details of the data protection officer

The data protection officer can be reached as follows:

JOOP! LIVING
Brand Supply & Logistics GmbH
Harvestehuder Weg 22
20149 Hamburg
Germany

Email: privacypolicy@joop-living.com

III. Processing of personal data

1. GENERAL INFORMATION AND MANDATORY INFORMATION

Data protection

The operator of these pages (hereinafter "JOOP! LIVING") takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy notice. When you use this website, various personal data are collected. Personal data are data with which you can be personally identified. This privacy notice explains which data we collect and what we use it for. It also explains how and for what purpose this is done. We point out that data transmission on the internet (e.g. in communication by email) may have security gaps. Complete protection of data against access by third parties is not possible.

1.1 Information on the controller

The controller is the natural or legal person who decides alone or jointly with others on the purposes and means of processing personal data (e.g. names, email addresses, etc.).

Revocation of your consent to data processing

Many data processing operations are only possible with your express consent. You can revoke a consent you have already given at any time. To do this, simply send us an informal notification by email (customercare@joop-living.com). The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6 PARA. 1 LETT. E OR F GDPR, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR SPECIAL SITUATION, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RELEVANT LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY NOTICE. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA, UNLESS WE CAN DEMONSTRATE COMPULSORY PROTECTIVE GROUNDS FOR PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS OR THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 PARA. 1 GDPR). IF YOUR PERSONAL DATA ARE PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING PURPOSES; THIS ALSO APPLIES TO PROFILING TO THE EXTENT IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL THEREAFTER NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21 PARA. 2 GDPR).

1.2 Right to complain to the competent supervisory authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged violation. The right to complain exists without prejudice to other administrative or judicial remedies.

The Hamburg Commissioner for Data Protection and Freedom of Information is responsible for us, Ludwig-Erhard-Straße 22, 20459 Hamburg (Email: mailbox@datenschutz.hamburg.de).

1.3 Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract made available to you or to a third party in a commonly used, machine-readable format. If you request the direct transmission of data to another controller, this will only be done insofar as it is technically feasible.

1.4 Information, erasure and rectification

Within the framework of the applicable statutory provisions, you have the right at any time to receive free information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, if applicable, the right to the rectification or erasure of this data. For this and other questions on the subject of personal data, you can contact us at any time using the contact details provided above.

1.5 Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time using the address provided in the legal notice. The right to restriction of processing exists in the following cases:

- If you contest the accuracy of your personal data stored with us, we generally need time to check this. For the duration of the check, you have the right to request the restriction of the processing of your personal data.

- If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure.

- If we no longer need your personal data, but you need it for the exercise, defense or establishment of legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.

- If you have lodged an objection pursuant to Art. 21 para. 1 GDPR, a balancing of your and our interests must be carried out. As long as it is not yet clear whose interests prevail, you have the right to request the restriction of the processing of your personal data.

- If you have restricted the processing of your personal data, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

2. DATA COLLECTION ON THIS WEBSITE – TYPE, PURPOSE AND LEGAL BASIS

When using our website for purely informational purposes, i.e. simply accessing our website www.joop-living.com information is automatically sent to the server of our website – due to technical necessity – by the browser used on your end device. This information is temporarily stored in a so-called log file. The following information is collected without your involvement and stored until it is automatically deleted:

IP address of the requesting computer,
Date and time of access,
Name and URL of the file accessed,
Website from which access is made (referrer URL),
browser used and, if applicable, the operating system of your computer,
Name of the access provider.

We process the data mentioned above for the following purposes:

seamless connection establishment and convenient use of the website,
evaluation of system security and stability
defense against attacks and support with connection problems

For security reasons (e.g. to investigate acts of misuse or attacks on our web server), the information is stored for the period required for this purpose (usually a few days; in the case of targeted attack or misuse detection, up to several weeks). After that, it is deleted.

The legal basis for this data processing is Art. 6 para. 1 sentence 1 lett. f GDPR. Our legitimate interest follows from the purposes of data processing listed above. This data is not combined with other data sources for the purpose of creating user profiles. Shopify processes the log files on our behalf (No. 4).

2.1 Cookies

Our websites use so-called "cookies". Cookies are small text files and do not damage your end device. They are either stored temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your end device. Session cookies are automatically deleted after your visit ends. Permanent cookies remain stored on your end device until you delete them yourself or they are automatically deleted by your web browser. Some cookies are set by third parties (third-party cookies).

Necessary cookies: Without your consent, we only set cookies that are absolutely necessary to provide a service expressly requested by you. This includes, e.g., the shopping cart, checkout, login, saving your cookie selection, and security (§ 25 para. 2 no. 2 TDDDG). The subsequent processing is carried out pursuant to Art. 6 para. 1 lett. b GDPR, insofar as it is necessary for the contract, and otherwise pursuant to Art. 6 para. 1 lett. f GDPR. Our legitimate interest is the technically error-free provision of the shop.

All other cookies: We only set cookies for statistics, reach measurement, personalization, or marketing with your consent (§ 25 para. 1 TDDDG, Art. 6 para. 1 lett. a GDPR). We obtain your consent via our cookie banner. There you can revoke or change it at any time with future effect via the "cookie" icon in the footer.

You can find an overview of the cookies used, including the provider, purpose, and duration, in our cookie banner. You can also set your browser so that cookies are only allowed on a case-by-case basis, generally rejected, or deleted when the browser is closed. In that case, the functionality of our website may be limited.

2.2 Request by email or telephone

If you contact us by email or telephone, your request, including all personal data arising therefrom (name, request), is stored and processed by us for the purpose of handling your concern.

The processing of this data is carried out on the basis of Art. 6 para. 1 lett. b GDPR, provided that your request is related to the fulfillment of a contract or is required for the performance of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in effectively handling the requests directed to us (Art. 6 para. 1 lett. f GDPR) or on your consent (Art. 6 para. 1 lett. a GDPR), provided that this has been requested.

We delete the data when your concern has been conclusively handled, unless there are statutory retention obligations to the contrary.

2.3 Contact form

If you use our contact form, we process your details to handle your request: [email address, order number, message]. The mandatory fields are marked. The legal basis corresponds to No. 2.2. The form is provided via the Shopify app "Forms" and Shopify processes the data on our behalf (No. 4). We delete the data when your request has been conclusively handled, unless there are statutory retention obligations to the contrary.

2.4 Order and customer account

When placing an order, we process the data you provide in the ordering process: name, billing and delivery address, email address, telephone number, ordered items, and selected payment method.

For business customers, the company and VAT ID are added.

We process this data to process the purchase contract, including shipping, payment, customer service, revocation, returns, and warranty. The legal basis is Art. 6 para. 1 lett. b
GDPR. For retention, it is Art. 6 para. 1 lett. c GDPR in conjunction with § 257 HGB and § 147 AO. Without the information marked as mandatory fields, we cannot accept your order.

You can create a customer account with us. There we store your master data, addresses, and your order history so that you can complete orders faster and view
them. The legal basis is Art. 6 para. 1 lett. b GDPR. The customer account is provided by Shopify (No. 4). You can request the deletion of your account at any time. If statutory retention periods prevent complete deletion, we restrict the processing of this data (blocking) and delete it after the respective statutory
retention periods expire.

We store contract data until the expiration of the warranty and limitation periods and thereafter in accordance with the statutory retention periods.

2.5 Payment processing

So that your payment can be processed, we pass the required data to the payment service provider you have chosen: name, address, email address, order amount, and
order number. The legal basis is Art. 6 para. 1 lett. b GDPR. The
payment service providers usually act as their own controllers. They also process your data to fulfill statutory obligations, e.g. for anti-money laundering purposes. We do not receive full credit card data.

Shopify Payments
(credit card, Apple Pay, Google Pay, etc.): Shopify International Limited
(No. 4). Payment processing is carried out by Stripe
Payments Europe Ltd., Dublin, Ireland

PayPal: PayPal (Europe) S.à r.l. et
Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy notice: https://www.paypal.com/de/legalhub/privacy-full

2.7 Shipping

So that we can deliver the goods, we pass your address data to the appointed shipping company (Art. 6 para. 1 lett. b GDPR): DHL Paket GmbH, Sträßchensteinweg 10, 53113 Bonn.

[Freight forwarder for furniture and large items, address]

2.8 B2B area

For business customers, we offer a closed B2B area. For this, we process the following data: company, business address, name and contact details of the contact person, sales channels, VAT ID. The purpose is to check the business status, enable access, and process contracts. The legal basis is Art. 6 para. 1 lett. b GDPR. We store the data for the duration of the business relationship and in accordance with the statutory retention periods.

2.9 Newsletter

On our website, you can sign up for our newsletter. For this, we need your email address. The registration is carried out using the double opt-in procedure: After you register, you will receive an email with a confirmation link. Only when you click this link do we add you to our mailing list and send you the newsletter. This ensures that no one can sign up a third-party email address. The legal basis for sending is your consent (Art. 6 para. 1 lett. a GDPR, § 7 para. 2 no. 2 UWG). We are obliged to be able to prove your consent.
Therefore, we store the time of your registration and confirmation as well as your IP address (Art. 6 para. 1 lett. c in conjunction with Art. 7 para. 1 GDPR).

You can revoke your consent at any time with future effect. To do this, use the unsubscribe link in every newsletter email or write to marketing@joop-living.com. The lawfulness of the processing until the revocation remains unaffected.

After you unsubscribe, we remove your email address from the mailing list. So that you do not receive any further newsletters, we add it to a block list (Art. 6 para. 1 lett. f GDPR; interest: observance of your revocation). We keep the evidence data of your consent and its revocation until the expiration of three years after the end of the year in which you unsubscribed, the legal basis being Art. 6 para. 1 lett. f GDPR.

For sending the newsletter, we use the Brevo service of Brevo SAS, 17 rue Salneuve, 75017 Paris, France. Brevo processes your data on our behalf (Art. 28 GDPR).

3. SOCIAL MEDIA

3.1 Social media plugins with Shariff

Social media plugins (e.g. Facebook, Instagram) are used on this website.

You can generally recognize the plugins by the respective social media logos. To ensure data protection on this website, we only use these plugins together with the so-called “Shariff” solution. This application prevents the plugins integrated on this website from transmitting data to the respective provider upon the first visit to the page.

Only when you activate the respective plugin by clicking the associated button is a direct connection established with the provider's server (consent). Once you activate the plugin, the respective provider receives information that you visited this website with your IP address.

If you are simultaneously logged into your respective social media account (e.g. Facebook), the respective provider may be able to link your visit to this website to your user account. Activating the plugin constitutes consent within the meaning of Art. 6(1)(a) GDPR. You can revoke this consent at any time with future effect.

3.2 Facebook plugins

Plugins from the Facebook social network are integrated on this website. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected may also be transferred to the USA and other third countries.

Meta Platforms, Inc. (USA) is certified under the U.S. Data Privacy Framework (EU Commission adequacy decision of 10 July 2023, Art. 45 GDPR).

You can recognize the Facebook plugins by the Facebook logo. An overview of the Facebook plugins can be found here:
https://developers.facebook.com/docs/plugins/?locale=de_DE

Only when you actively click the Facebook button is – in accordance with the Shariff solution described in section 3.1 – a direct connection established between your browser and Meta's server. Meta therefore receives information that you visited this website with your IP address.

We point out that as the website provider, we do not receive any information about the content of the transmitted data or its use by Facebook. Further information on this can be found in Facebook's privacy policy at:
https://de-de.facebook.com/privacy/explanation.

If you do not want Facebook to be able to link your visit to this website to your Facebook user account, please log out of your Facebook user account. The transmission of your data to Meta – as described in section 3.1 – only takes place after you activate the plugin and is based on your consent under Art. 6(1)(a) GDPR. The consent can be revoked at any time with future effect.

3.3 Instagram plugin

Functions of the Instagram service are integrated on this website. These functions are provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (with redirection to Meta Platforms, Inc. USA).

As described in section 3.1, a connection to Meta's servers is only established after you actively click the plugin. Regarding the transfer of data to the USA, section 3.2 applies accordingly.

If you are logged into your Instagram account, you can link the content of this website to your Instagram profile by clicking the Instagram button. This allows Instagram to link your visit to this website to your user account. We point out that as the website provider, we do not receive any information about the content of the transmitted data or its use by Instagram.

The transmission of your data – as described above – is based on your consent under Art. 6(1)(a) GDPR. The consent can be revoked at any time with future effect.

Further information on this can be found in Instagram's privacy policy:
https://instagram.com/about/legal/privacy/

3.4 Data security

To secure your data, we use the widely used SSL (Secure Socket Layer) protocol during your visit to the website, combined with the highest encryption level supported by your browser. This is usually 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted using encryption by the closed key or padlock symbol in the status bar at the bottom of your browser.

4. Hosting by Shopify (data processing)

This website is operated on the platform of Shopify International Limited, 2nd Floor, 1 Grand Canal Square, Dublin 2, Ireland (hereinafter “Shopify”). Shopify collects and processes, on our behalf as a data processor under Art. 28 GDPR, in particular IP addresses, device and browser information, and all customer, order, and payment data arising in the course of order processing to ensure the technical operation, security, and order processing of our shop. The legal basis is Art. Abs. 1 lit. b and lit. f GDPR.

Further information on data processing by Shopify and options to object to certain processing activities (including within so-called “Enhanced Services”) can be found at https://privacy.shopify.com

To the extent that Shopify uses its own additional functions without a separate third-party provider (e.g. native checkout extensions or internal automation workflows), no processing takes place by an additional recipient; the processing is carried out by Shopify within the scope of the data processing agreement described above.

5. Third-party applications used (Shopify apps)

To provide individual additional functions, we use the following applications obtained from the Shopify App Store, which access personal data to the extent stated below. We have concluded contracts with providers acting as data processors in accordance with Art. 28 GDPR, or will conclude them before commissioning; for providers based outside the EU/EEA, we rely on EU standard contractual clauses (Art. 46(2)(c) GDPR) for the transfer of data where no adequacy decision exists.

App Avada Accessibility Widget