Privacy policy

Welcome to our website, and thank you for your interest. Protecting your personal data is very important to us. We therefore conduct our activities in accordance with the applicable legal provisions on the protection of personal data and data security. Below, we would like to inform you which data from your visit is used and for what purposes.

Controller responsible for processing under the GDPR

The controller within the meaning of the General Data Protection Regulation and other data protection laws applicable in the member states of the European Union, as well as other provisions relating to data protection, is:

Snocks GmbH

Glücksteinallee 43

68163 Mannheim

Germany

https://snocks.com

support@snocks.com

Data Protection Officer

Nils Möllers

Keyed GmbH

Siemensstraße 12

48341 Altenberge, Westphalia, Germany

info@keyed.de

+49 (0) 2505 - 639797

https://keyed.de

What is personal data?

The term "personal data" is defined in the German Federal Data Protection Act (BDSG) and in the EU GDPR. According to these, personal data is any information relating to the personal or factual circumstances of an identified or identifiable natural person. This includes, for example, your full name, your address, your telephone number or your date of birth. Learn more about what data protection means here (in German).

Scope of anonymous data collection and data processing

Unless otherwise stated in the following sections, no personal data is generally collected, processed or used when you use our websites. However, through the use of analysis and tracking tools, we obtain certain technical information based on the data transmitted by your browser (for example, browser type/version, operating system used, pages visited on our website including time spent, previously visited website). We evaluate this information for statistical purposes only.

Relevant legal bases for the processing of personal data

Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis for the processing of personal data.
Where the processing of personal data is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to take steps prior to entering into a contract.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or of another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
If the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, and the interests, fundamental rights and freedoms of the data subject do not override the first-mentioned interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

Use of cookies

The websites of Snocks GmbH use cookies. Cookies are data stored by the internet browser on the user's computer system. Cookies can be transmitted to a page when it is accessed and thus enable the user to be identified. Cookies help to make the use of websites easier for users.

You can object to the setting of cookies at any time by changing the corresponding settings in your internet browser. Cookies that have already been set can be deleted. Please note that if cookies are deactivated, you may not be able to use all functions of our website to their full extent. The user data collected in this way is pseudonymised by technical precautions. It is therefore no longer possible to assign the data to the accessing user. The data is not stored together with other personal data of the users. When accessing our website, users are informed about the use of cookies for analysis purposes by an information banner and referred to this privacy policy. In this context, users are also informed how they can prevent the storage of cookies in their browser settings. The legal basis for the processing of personal data using technically necessary cookies is Art. 6(1)(f) GDPR. The legal basis for the processing of personal data using cookies for analysis purposes is Art. 6(1)(a) GDPR, provided the user has given consent to this effect. Whether and to what extent cookies are used on our website can be found in our cookie banner and in the information provided in this privacy policy.

Creation of log files

Each time the website is accessed, Snocks GmbH collects data and information through an automated system. This data is stored in the server's log files. The data is also stored in the log files of our system. This data is not stored together with other personal data of the user.
The following data may be collected:

(1) Information about the browser type and version used
(2) The user's operating system
(3) The user's internet service provider
(4) The user's IP address
(5) Date and time of access
(6) Websites from which the user's system reaches our website (referrer)
(7) Websites accessed by the user's system via our website

Duration of storage of personal data

Personal data is stored for the duration of the respective statutory retention period. After this period has expired, the data is routinely deleted, unless it is required for the initiation or performance of a contract.

Ways to contact us

The Snocks GmbH website contains a contact form that can be used to contact us electronically. Alternatively, you can contact us via the e-mail address provided. If the data subject contacts the controller via one of these channels, the personal data transmitted by the data subject is stored automatically. This data is stored solely for the purpose of processing the request or contacting the data subject. The data is not passed on to third parties. The legal basis for processing the data is Art. 6(1)(a) GDPR if the user has given consent. The legal basis for processing data transmitted in the course of sending an e-mail is Art. 6(1)(f) GDPR. If the e-mail contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the input mask of the contact form and data sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation has ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved.

1. Newsletter based on consent (double opt-in)

You can subscribe to our newsletter by registering via the corresponding form. Registration takes place using the double opt-in procedure: after registering, you will receive a confirmation e-mail asking you to confirm your registration. This serves to prevent improper registrations.

When you register, we store your IP address and the date and time of registration in order to be able to prove the registration. The data is used exclusively for sending the newsletter. It is only passed on to third parties if this is necessary for sending the newsletter (e.g. to service providers) or if there is a legal obligation to do so.

Legal basis: Art. 6(1)(a) GDPR (consent).
You can withdraw your consent at any time with effect for the future. A corresponding link can be found in every e-mail.

2. Direct marketing under soft opt-in (Section 7(3) of the German Act Against Unfair Competition, UWG)

If you have provided us with your e-mail address in connection with a registration or purchase, we may use it in accordance with Section 7(3) UWG to send you information about similar products from our range.
According to the current case law of the Court of Justice of the European Union (judgment of 13 November 2025, C-654/23), no additional legal basis under Art. 6 GDPR is required for this, as Art. 13(2) of the ePrivacy Directive and Section 7(3) UWG apply as lex specialis.

We only send advertising for products that are considered "similar" within the meaning of Section 7(3) UWG. This includes our entire range of clothing and fashion items.

Objection:
You can object to the use of your e-mail address for direct marketing at any time free of charge. A corresponding unsubscribe link can be found in every e-mail. The objection does not affect the use of your customer account or existing contractual relationships.

Klaviyo Inc.

Description and purpose

To send our newsletter, we use the cloud-based service provider Klaviyo Inc. on our website. Klaviyo is used to create, send and manage newsletters and marketing e-mails. When you subscribe to our newsletter, we process your personal data in the form of IP address, e-mail address, date and time, action type, metadata, object and profile reference. Through an integrated data platform and AI, Klaviyo combines marketing automation, analytics and customer service in a unified solution, which makes it easier for us to get to know our customers better and to grow faster.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR and Art. 6(1)(f) GDPR. Our overriding legitimate interest lies in direct marketing for the acquisition of new customers.

Recipient

The recipient of your personal data is Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA, 02110, USA.

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded contractual clauses approved by public authorities, such as the standard contractual clauses approved by the European Commission, with the data importer pursuant to Art. 46(2)(c) GDPR. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In addition, the data is deleted if you exercise your right to erasure within the meaning of Art. 17(1) GDPR.

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on data protection at Klaviyo can be found here: https://www.klaviyo.com/legal/data-processing-agreement

Newsletter tracking and performance measurement

Description and purpose

If you have given separate consent to this, we use functions to measure and analyse the performance of our newsletter campaigns. For this purpose, we use the service provider Klaviyo Inc. (125 Summer St Floor 6, Boston, MA 02111, USA).

Our newsletters contain so-called tracking pixels (web beacons) and personalised links. This allows us in particular to record

whether and when a newsletter was opened,
which links were clicked,
technical information about the device and e-mail client used,
as well as reach and interaction data.

The processing is carried out for the analysis, statistical evaluation and optimisation of our newsletter content and marketing measures.

Legal basis

The storage of, or access to, information on your device is based on your consent pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

The subsequent processing of personal data is based on your consent pursuant to Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Klaviyo Inc. (125 Summer St Floor 6, Boston, MA 02111, USA).

Transfer to third countries

When using Klaviyo, a transfer of personal data to the United States of America cannot be ruled out.

Since 10 July 2023, an adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) has been in place for the USA. Klaviyo Inc. is certified under the EU-U.S. Data Privacy Framework, so the data transfer takes place in accordance with Art. 45 GDPR.

In addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR have been concluded with Klaviyo.

Duration of data storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected or you have withdrawn your consent, provided there are no statutory retention obligations to the contrary.

Withdrawal

You have the right to withdraw your consent at any time with effect for the future, cf. Art. 7(3) sentence 1 GDPR.

You can withdraw your consent in particular via the unsubscribe link in the newsletter or by contacting us.

The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of personal data by Klaviyo can be found at: https://www.klaviyo.com/legal/privacy-policy

Charles (WhatsApp communication and marketing)

Description and purpose

We use the software solution of Charles GmbH ("charles"), Gartenstraße 86–87, 10115 Berlin, Germany, to offer you communication via the messenger service WhatsApp. Through this service – provided you have consented – we send marketing messages (e.g. information about offers, promotions or products) as well as automated message flows (e.g. welcome messages or reminders about an uncompleted purchase). In addition, you can use WhatsApp to contact us and in connection with the initiation or processing of an order.

To provide this service, charles processes in particular your mobile phone number, your profile name (if provided by you), the time and source of your consent (opt-in), the content of the messages exchanged with us, and delivery and interaction data. Where necessary for the respective communication, this data may be linked with information from our shop or CRM system, for example to assign orders or to provide you with content tailored to your interests.

You can sign up for the WhatsApp channel, for example, via a sign-up form or widget on our website or via a separate opt-in link.

Legal basis

The legal basis for sending marketing messages and automated message flows via WhatsApp is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 7(2) UWG. Where you use WhatsApp to contact us or in connection with the initiation or performance of an order, the processing is based on Art. 6(1)(b) GDPR.

Recipient

The recipient of your personal data is Charles GmbH. For the technical provision of the messenger service, charles uses the WhatsApp Business Platform of WhatsApp Ireland Limited and, where applicable, other companies of the Meta group.

Transfer to third countries

The personal data processed by charles is generally stored on servers within the European Union. However, when using the WhatsApp Business Platform, it cannot be ruled out that personal data may also be transferred by companies of the Meta group to third countries, in particular the USA.

Where such a transfer takes place, it is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR, provided the respective recipients are certified accordingly. Where necessary, standard contractual clauses pursuant to Art. 46(2)(c) GDPR are additionally used.

Duration of data storage

Your personal data is only stored for as long as is necessary to provide the WhatsApp channel or to fulfil the respective communication purposes. If you withdraw your consent, your mobile phone number will be removed from the WhatsApp marketing list. Statutory retention obligations remain unaffected.

Withdrawal

Where the processing is based on your consent, you have the right to withdraw it at any time with effect for the future pursuant to Art. 7(3) GDPR. To do so, it is sufficient, for example, to send a message saying "Stop" within the WhatsApp conversation or to notify us using the contact details provided in this privacy policy.

The withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Further information on your rights as a data subject can be found in the section "Rights of the data subject" of this privacy policy.

Contractual and statutory obligation

Providing your mobile phone number is neither required by law nor by contract. However, the WhatsApp channel cannot be used without providing your mobile phone number and without your consent.

Further data protection information

Please note that WhatsApp or companies of the Meta group may also process personal data for their own purposes in the course of providing the messenger service. We have no influence on this data processing. Further information on the processing of your personal data can be found in the privacy notice of Charles GmbH (https://www.hello-charles.com/de-de/datenschutz) and in the WhatsApp Privacy Policy for the EEA (https://www.whatsapp.com/legal/privacy-policy-eea).

Online shop

We use your personal data to process your online purchases (your orders and returns are processed via our online services) and to send you updates on the delivery status or notifications if there are problems with the delivery of your items. We use your personal data to process your payments. We also use your data to handle complaints and product warranty claims. Your personal data is used to verify your identity, to ensure that you have reached the legal minimum age for online purchases, and to check your address with external partners. We would like to offer you several payment methods and carry out analyses to determine which payment options are available to you, including your payment history and credit checks.

Disclosure of data when using online payment service providers

If, during the ordering process, you choose to pay using one of the online payment service providers we offer, your contact details will be transmitted to that provider as part of the order placed. The lawfulness of this disclosure results from Art. 6(1)(b) GDPR, for the execution of the payment method you have chosen, and from our legitimate interests pursuant to Art. 6(1)(f) GDPR in enabling user-friendly and straightforward payment processing. The personal data transmitted to the online payment service provider usually comprises first name, last name, address, IP address, e-mail address or other data required to process the order, as well as data related to the service, such as type of service, identity of the recipient, invoice amount and tax rate in percent, invoice information, etc. This transmission is necessary to provide the service with the payment method you have selected, in particular to confirm your identity and to administer your payment and the customer relationship. Please note, however: personal data may also be passed on by the online payment service provider to service providers, subcontractors or other affiliated companies, insofar as this is necessary to fulfil the contractual obligations arising from your order or the personal data is to be processed on its behalf. Depending on the payment method selected, e.g. invoice or direct debit, the personal data transmitted to the provider will be passed on by the provider to credit reference agencies. This transmission serves to verify your identity and creditworthiness in relation to the... [truncated]

American Express: American Express Services Europe Limited, Frankfurt am Main branch, Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany, at https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html
Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium, at https://www.mastercard.de/de-de/datenschutz.html
Visa Europe Services Inc., London branch, 1 Sheldon Square, London W2 6TT, United Kingdom, at https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html
PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, at https://www.paypal.com/de/webapps/mpp/ua/privacy-full
Stripe, Inc., 185 Berry Street, Suite 550, San Francisco, CA 94107, USA, at https://stripe.com/de/privacy#translation g. micropayment GmbH, Scharnweberstrasse 69, D-12587 Berlin, Germany, at https://www.micropayment.de/about/privacy/
Klarna AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
(Apple Pay) Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland;
Shopify Payments, 126 York Street, Suite 200, Ottawa, ON, Canada, K1N 5T5;
Google Pay (Europe), Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
UnionPay International Youxian Gongsi German Branch, An der Welle 4, 60322 Frankfurt am Main, Germany, at
https://www.unionpayintl.com/en/privacyNotice/?utm_source=chatgpt.com
Bancontact Payconiq Company, Rue d’Arlon 82, 1040 Brussels, Belgium, at
https://help.xe.com/hc/de/sections/19601578205457-Hinweis-zum-Datenschutz
(BLIK) Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland, at
https://www.blik.com/media/PRIVACY_POLICY_AND_COOKIES_POLICY.pdf
(Przelewy24) PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland, at
https://www.przelewy24.pl/en/information-obligation-gdpr-payer
TWINT AG, Stauffacherstrasse 41, CH-8004 Zurich, Switzerland, at
https://www.twint.ch/datenschutz/
iDeal Currence Holding B.V., Beethovenstraat 300, 1077 Amsterdam, Netherlands, at
https://ideal.nl/en/ideal-privacy-cookiestatement

Transfer to third countries

We would like to inform you that your personal data may also be transferred to a server in a third country and thus processed outside the EU.

Duration

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In addition, the data is deleted if you withdraw your consent or request the erasure of your personal data. Contractual or statutory obligation to provide personal data: the provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide the personal data. However, not providing it may mean that you cannot use this service, or cannot use it to its full extent.

Registration on our website

If the data subject makes use of the option to register on the controller's website by providing personal data, the data entered in the respective input mask is transmitted to the controller. The data is stored exclusively for internal use by the controller. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. When registering, the user's IP address and the date and time of registration are stored. This serves to prevent misuse of the services. The data is not passed on to third parties, unless there is a legal obligation to do so. Registration of the data is required for the provision of content or services. Registered persons have the option of having the stored data deleted or amended at any time. The data subject can obtain information about the personal data stored about them at any time.

Routine deletion and blocking of personal data

The controller processes and stores personal data of the data subject only for as long as is necessary to achieve the purpose of storage. Storage may also take place if this has been provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. As soon as the purpose of storage no longer applies or a storage period prescribed by the aforementioned provisions expires, the personal data is routinely blocked or deleted.

Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

Right of access pursuant to Art. 15 GDPR

You can request confirmation from the controller as to whether personal data concerning you is being processed by us. If such processing takes place, you can request information from the controller about the following:

the purposes for which the personal data is processed;
the categories of personal data being processed;
the recipients or categories of recipients to whom your personal data has been or will be disclosed;
the planned duration of storage of your personal data or, if specific information on this is not possible, the criteria for determining the storage period;
the existence of a right to rectification or erasure of your personal data, a right to restriction of processing by the controller or a right to object to such processing;
the existence of a right to lodge a complaint with a supervisory authority;
all available information about the source of the data if the personal data is not collected from the data subject;
the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

You have the right to request information as to whether your personal data is transferred to a third country or to an international organisation. In this context, you can request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

Right to rectification pursuant to Art. 16 GDPR

You have a right to rectification and/or completion vis-à-vis the controller if the personal data processed concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

Right to erasure pursuant to Art. 17 GDPR

(1) You can request the controller to erase your personal data without undue delay, and the controller is obliged to erase this data without undue delay if one of the following grounds applies:

The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
The personal data concerning you has been processed unlawfully.
The erasure of the personal data concerning you is necessary for compliance with a legal obligation under Union law or the law of the member states to which the controller is subject.
The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8(1) GDPR.

(2) If the controller has made your personal data public and is obliged to erase it pursuant to Art. 17(1) GDPR, the controller shall take reasonable steps, including technical measures, taking into account available technology and the cost of implementation, to inform controllers processing the personal data that you, as the data subject, have requested the erasure by them of any links to, or copies or replications of, this personal data.

(3) The right to erasure does not exist insofar as the processing is necessary

for exercising the right of freedom of expression and information;
for compliance with a legal obligation which requires processing under Union or member state law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89(1) GDPR, insofar as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
for the establishment, exercise or defence of legal claims.

Right to restriction of processing pursuant to Art. 18 GDPR

You can request the restriction of the processing of your personal data under the following conditions:

if you contest the accuracy of your personal data, for a period enabling the controller to verify the accuracy of the personal data;
the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
the controller no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; or
if you have objected to the processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.

Where processing of your personal data has been restricted, such data – with the exception of storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a member state. If processing has been restricted under the above conditions, you will be informed by the controller before the restriction is lifted.

Right to notification pursuant to Art. 19 GDPR

If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.

Right to data portability pursuant to Art. 20 GDPR

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, provided that

the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and
the processing is carried out by automated means. In exercising this right, you also have the right to have your personal data transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be adversely affected by this. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to object pursuant to Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. The controller will no longer process your personal data unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing; this also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes. In connection with the use of information society services – notwithstanding Directive 2002/58/EC – you have the option of exercising your right to object by automated means using technical specifications.

Right to withdraw consent under data protection law pursuant to Art. 7(3) GDPR

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

is necessary for entering into, or the performance of, a contract between you and the controller,
is authorised by Union or member state law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
is based on your explicit consent.

However, these decisions must not be based on special categories of personal data pursuant to Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) applies and suitable measures to safeguard your rights and freedoms and legitimate interests have been taken.

In the cases referred to in (a) and (c), the controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

Integration of other third-party services and content

Description and purpose

Content from third parties, such as videos, fonts or graphics from other websites, may be integrated into this online offering. This always requires the providers of this content (hereinafter referred to as "third-party providers") to be aware of the users' IP address, since without the IP address they could not send the content to the respective user's browser. The IP address is therefore required to display this content. We endeavour to use only content whose providers use the IP address solely to deliver the content. However, we have no influence on whether third-party providers store the IP address, e.g. for statistical purposes. Insofar as we are aware of this, we inform users accordingly. Through these integrations, we aim to provide and improve our online offering.

Legal bases

The legal basis for the integration of other third-party services and content is Art. 6(1)(f) GDPR. Our overriding legitimate interest lies in an appropriate presentation of our online presence and in user-friendly and economically efficient services on our part. Further information can be found in the respective providers' data protection information.

Contractual or statutory obligation to provide personal data

The provision of personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide the personal data. However, not providing it may mean that you cannot use this function, or cannot use it to its full extent.

Data transfer to third countries

The controller may transfer personal data to a third country. In principle, the controller can ensure an adequate level of protection for the processing through various appropriate safeguards. Data transfers may take place on the basis of an adequacy decision, binding corporate rules, approved codes of conduct, standard data protection clauses or an approved certification mechanism pursuant to Art. 46(2)(a)–(f) GDPR.

If the controller carries out a transfer to a third country on the legal basis of Art. 49(1)(a) GDPR, you are hereby informed about the possible risks of a data transfer to a third country.

There is a risk that the third country receiving your personal data may not be able to provide a level of protection equivalent to that for personal data in the European Union. This may be the case, for example, if the EU Commission has not adopted an adequacy decision for the respective third country or if certain agreements between the European Union and the respective third country are declared invalid. Specifically, in some third countries there are risks regarding the effective protection of EU fundamental rights due to the use of surveillance laws (for example, the USA). In such a case, it is the responsibility of the controller and the recipient to assess whether the rights of data subjects in the third country enjoy a level of protection equivalent to that in the Union and can also be effectively enforced.

However, the level of protection of natural persons guaranteed throughout the Union by the General Data Protection Regulation should not be undermined when personal data is transferred from the Union to controllers, processors or other recipients in third countries or to international organisations, including in cases of onward transfers of personal data from the third country or international organisation to controllers or processors in the same or another third country or international organisation.

Further functions of the website

Google Analytics 4

Description and purpose

This website uses the "Google Analytics 4" service offered by Google LLC to analyse how users use the website. The service uses "cookies" – text files that are stored on your device. First-party cookies are used for this purpose. With a first-party cookie, the user can only be recognised by the site from which the cookie originates, not across multiple domains. The information collected by the cookies is usually sent to a Google server in the USA and stored there. Where applicable, Google Analytics is used on this website with the extension "gat._anonymizeIp();" to ensure anonymised collection of IP addresses (so-called IP masking). Please also note the following information on the use of Google Analytics: users' IP addresses are shortened within the member states of the EU and the European Economic Area. This shortening removes the personal reference of your IP address. For EU citizens, the IP address is also only used to derive location data and is then deleted. You also have the option of activating or deactivating the collection of detailed location and device data for individual regions (tracking settings). Under the data processing agreement that the website operators have concluded with Google LLC, Google uses the information collected to create an evaluation of website usage and website activity and to provide services related to internet usage.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard contractual clauses with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://support.google.com/analytics/answer/6004245?hl=en https://policies.google.com/privacy?hl=en.

Google Ads and conversion tracking

Description and purpose

In order to draw attention to our current projects and developments, planned activities and services, we place Google AdWords ads and use Google conversion tracking in this context. Google AdWords (Google Ads) is a service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). These ads are displayed after search queries on websites of the Google advertising network. We have the option of combining our ads with specific search terms. In addition, we use AdWords remarketing lists for search ads. This allows us to adapt search ad campaigns for users who have already visited our website. These services allow us to combine our ads with specific search terms or to show ads to previous visitors that, for example, advertise services that visitors have viewed on our website. Interest-based offers require an analysis of online user behaviour. To carry out this analysis, Google uses cookies. When a user clicks on an ad or visits our website, Google sets a cookie on the user's computer. This information is used to address the visitor specifically during a later search query. Further information on the cookie technology used can also be found in Google's notes on website statistics and in its privacy policy. With the help of this technology, Google and we as a customer receive information that a user has clicked on an ad and was redirected to our website in order to contact us via the contact form. Likewise, using Google forwarding numbers, Google and we as a customer receive information that a user on the internet has... [truncated]

Legal basis

The legal basis for the processing of your personal data is consent pursuant to Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The data controller responsible for processing your information depends on your habitual residence, unless otherwise stated in the privacy notice of a specific service:

Google Ireland Limited for users of Google services with their habitual residence in the European Economic Area or Switzerland
Google LLC for users of Google services with their habitual residence in the United Kingdom.

Transfer to third countries

The personal data is transferred to the USA (server location). The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard contractual clauses pursuant to Art. 46(2)(c) GDPR with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: www.google.com/policies/privacy/. Information on how Google as a company handles personal data in a business context can also be found on Google's Business Data Responsibility site: https://business.safety.google/privacy/.

Google Ads remarketing service

Description and purpose

Our website uses the Google Ads remarketing service of Google LLC. This service allows us to show interest-based advertising to visitors to our website. For this purpose, Google sets cookies and processes information about your usage behaviour (e.g. pages visited, click behaviour, technical data such as IP address). The purpose is to analyse user behaviour in order to show you personalised advertising on other websites.

Through the use of cookies or pixels, the system recognises returning users and segments them based on their behaviour, such as which pages they visited or how long they stayed there.

As part of these remarketing measures, Google processes various personal data. This includes in particular the IP address, information about the device and browser used, and the specific usage behaviour on the website. This data is collected via cookies and tracking IDs and transmitted to Google.

The data collected is used primarily to personalise advertising, measure the success of campaigns and optimise ads and target groups.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have, where necessary, concluded appropriate safeguards within the meaning of Art. 46(2) GDPR with the data importer. In addition, Google LLC is certified under the Data Privacy Framework. Furthermore, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

Withdrawal

You have the right to withdraw your consent under Art. 6(1)(a) GDPR at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://policies.google.com/privacy?hl=en

Google Maps

Description and purpose

This website uses the Google Maps API of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to display geographical information visually. When Google Maps is used, Google also collects, processes and uses data about visitors' use of the map functions.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have, where necessary, concluded appropriate safeguards within the meaning of Art. 46(2) GDPR with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual or statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://policies.google.com/privacy?hl=en

Microsoft Clarity

Description and purpose

We use the Microsoft Clarity service of Microsoft Corporation on our website. Microsoft Clarity serves to give us better insights into how our website is used, in order to further increase user-friendliness. The service can create heatmaps and overviews of cursor and scroll movements and process data such as access times and IP addresses.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Transfer to third countries

Duration of data storage

Withdrawal

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on data protection at Microsoft can be found here: https://privacy.microsoft.com/en-us/privacystatement

Microsoft Ads

Description and purpose

On our website, we use technologies from Microsoft Ads (bingads.microsoft.com), which are provided and operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). Microsoft sets a cookie on your device if you have reached our website via a Microsoft Bing ad. This allows Microsoft Bing and the website operator to recognise that someone has clicked on an ad, was redirected to our website and reached a previously defined target page (conversion page). We only learn the total number of users who clicked on a Bing ad and were then redirected to the conversion page. Microsoft collects, processes and uses information via the cookie from which usage profiles are created using pseudonyms (Microsoft Conversion Tracking). These usage profiles are used to analyse visitor behaviour and to display advertisements. No personal information about the identity of the user is processed.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

Your personal data is transferred to and stored by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft").

Transfer to third countries

The personal data is transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have, where necessary, concluded appropriate safeguards within the meaning of Art. 46(2) GDPR with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://privacy.microsoft.com/en-US/privacystatement

Meta Pixel

Description and purpose

To recognise your user behaviour, we use the so-called Meta Pixel of Meta Platforms Inc., 1 Hacker Way, Menlo Park, California 94025, USA. This is an analysis tool that can be used to measure the effectiveness of advertising. It is a code snippet for the website with which audiences for advertising campaigns can be measured, optimised and built. With conversion measurement, we can track across devices (including mobile phones, tablets and desktop computers) which actions people take after seeing our Facebook ads. By creating a Meta Pixel and adding it to our pages on which conversions take place (e.g. the purchase confirmation page), we can determine which people perform conversions as a result of our Facebook ads. The pixel further monitors the actions people take after clicking on our ads. We can determine on which device our customers saw the ad and on which devices they ultimately completed the conversion. According to Facebook, the data collected includes:

HTTP headers
HTTP headers contain a range of information sent via a standard web protocol between any browser request and any server on the internet. HTTP headers contain information such as IP addresses (which in Germany can only be evaluated at a general country level), information about the web browser, page location, document, URI reference and the user agent of the web browser.
Pixel-specific data
This includes the pixel ID and Facebook cookie data used to link events to a specific Facebook ad account and to assign them to a person known to Facebook.
Optional values
Developers and marketers can optionally send additional information about the visit via standard and custom data events. Typical custom data events include, for example, information on whether a purchase was made on a page, the conversion value and much more. With your consent, we use the "visitor action pixel" of Meta Platforms Inc., 1 Hacker Way, Menlo Park, California 94025, USA, or, if you are resident in the EU, Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, within our website. With this conversion tool, we can track your actions after you have seen or clicked on a Facebook ad. This serves to monitor and analyse the effectiveness of our Facebook ads for statistical and market research purposes. Although we can only see this data in anonymised form, it is also stored and processed by Facebook. We do not know exactly what Facebook does with this data, but it can be assumed that Facebook can and will link this data to your Facebook account. Facebook may therefore use this information for advertising, market research and the needs-based design of Facebook pages. For this purpose, Facebook and its partners create usage, interest and relationship profiles, e.g. to evaluate your use of our website with regard to the ads shown to you on Facebook, to inform other Facebook users about your activities on our website and to provide other services associated with the use of Facebook. For this purpose, cookies may also be stored on your... [truncated]

Advanced matching

Advertisers can optionally activate the Meta Pixel's advanced matching function by sending encrypted information such as e-mail address or telephone number to Facebook. Advertisers can send one or more of the following identifiers for matching: e-mail address, telephone number, first name, last name, city, state, postcode, date of birth or gender.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipients of your personal data are Meta Platforms Inc. (1 Hacker Way, Menlo Park, California 94025, USA) and Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).

Transfer to third countries

The personal data is transferred to the USA. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard contractual clauses pursuant to Art. 46(2)(c) GDPR with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://www.facebook.com/about/privacy

Further information on the Meta Pixel can be found here: https://www.facebook.com/business/help/742478679120153?id=1205376682832142

Shopify International Ltd.

Description and purpose

We use the Shopify service on our website, provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify is a tool for creating and hosting websites. When you visit our website, Shopify collects your IP address as well as information about the device and browser you are using. Shopify also analyses visitor numbers, visitor sources and customer behaviour and creates user statistics. When you make a purchase on our website, Shopify also collects your name, e-mail address, delivery and billing addresses, payment data and other data related to the purchase (e.g. telephone number, amount of sales made, etc.). For the analyses, Shopify stores cookies in your browser.

Legal basis

The legal basis for the processing of your personal data is consent pursuant to Art. 6(1)(a) GDPR. In addition, the processing is also based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our overriding legitimate interest lies in the attractive and simple presentation of content on our website.

Recipient

The recipient of your personal data is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Transfer to third countries

Your personal data is not transferred to a third country. However, we are aware of our responsibility and regularly review the framework conditions and legal changes. In the event that a transfer to a third country takes place, we will update this information as quickly as possible.

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Right to object

Pursuant to Art. 21(1) GDPR, you have the right to object to the processing of your personal data at any time. If you exercise this right, processing for this purpose will no longer take place. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://www.shopify.com/legal/privacy

Description and purpose

Reddit is a social news aggregator, a website on which registered users can post/offer content. Content can consist of either a link or a text post. Other users can rate posts positively or negatively. The ratings determine the position of the post on the respective Reddit page and on the home page. This service is provided by reddit, Inc., c/o Wired, 520 Third St., San Francisco, CA 94107.

Legal basis

The legal basis for the processing of personal data is consent pursuant to Art. 6(1)(a) GDPR.

Recipient

The recipient is reddit, Inc., c/o Wired, 520 Third St., San Francisco, CA 94107.

Transfer to third countries

Data is transferred to the USA.

Duration of data storage

Right to object

You have the option of withdrawing your consent to data processing at any time. A withdrawal does not affect the effectiveness of data processing operations carried out in the past.

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information via link

https://www.redditinc.com/policies/privacy-policy

SMS / WhatsApp

Description and scope of data processing

Users have the option of subscribing to the SMS newsletter via our online forms (sign-up forms). In doing so, we process the data you provide, in particular your mobile phone number, in order to send you information about promotions, special offers and news.

For the collection, storage and sending of SMS, we use the service provider Klaviyo, Inc., 125 Summer St, Boston, MA 02110, USA. Klaviyo processes the data required for sending SMS on our behalf. Further information can be found in Klaviyo's privacy policy: https://www.klaviyo.com/legal/privacy.

We do not pass on your mobile phone number or your opt-in to the SMS newsletter to third parties for their own advertising purposes. Data is only passed on to the service providers involved in providing our messaging services (e.g. platform operators, mobile network operators).

Note on abandoned carts:
If you use our website and add items to your shopping cart, we use cookies to recognise when a purchase has been abandoned. In this case, we may send you reminders by SMS, provided you have consented to receiving such messages.

Purpose of data processing

Your mobile phone number is processed exclusively for the purpose of sending you our SMS newsletter with information about offers, promotions and products.

Legal basis for data processing

The legal basis for sending SMS is your consent pursuant to Art. 6(1)(a) GDPR.
Where data is processed in connection with abandoned carts, this is done on the basis of Art. 6(1)(f) GDPR in conjunction with your consent to receive SMS.

Duration of storage

Your data is stored for the purpose of sending SMS for as long as you are subscribed to the SMS newsletter. As soon as you withdraw your consent, we will delete your mobile phone number from the SMS distribution list. Storage beyond this may take place if required for legal reasons.

Right to object and removal

You can withdraw your consent to receiving SMS at any time with effect for the future. To do so, simply send an informal e-mail to support@snocks.com or – where technically provided – click on the unsubscribe link contained in the SMS (reply "STOP"). After withdrawal, your data will no longer be used for sending SMS.

Hotjar

Description and purpose

We use Hotjar (Hotjar Ltd, Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 3155, Malta) to better understand the needs of our users and to optimise the experiences and services offered on this website. Hotjar's technology helps us to better understand our users' experiences (e.g. time spent on pages, links clicked, etc.), and this helps us to tailor our offerings to our users' feedback. Hotjar uses cookies and other technologies to collect information about the behaviour of our users and their devices, including the device's IP address (which is only collected and stored anonymously while the website is being used), screen size, device type (unique device identifiers), information about the browser used, location (country only) and the preferred language for displaying our website. Hotjar stores this information on our behalf in a pseudonymised user profile.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Hotjar Ltd (Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 3155, Malta).

Transfer to third countries

Through the use of the service, personal data may be transferred to a third country. In the event of a transfer of personal data, the provider ensures the level of protection of the GDPR by complying with Art. 44 et seq. GDPR. If there is no adequacy decision for the third country in which the data importer is based, the transfer is subject to appropriate safeguards. If you have any questions, please contact our data protection officer.

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://www.hotjar.com/legal/policies/privacy/

Pinterest conversion

Description and purpose

Within our online offering, the so-called "Pinterest Tag" of Pinterest Inc. is used for the analysis, optimisation and economic operation of our online offering. With the help of the Pinterest Tag, Pinterest is able to determine visitors to our online offering as a target group for the display of ads (so-called "Pinterest Ads"). Accordingly, we use the Pinterest Tag to show the Pinterest Ads we place only to those Pinterest users who have shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products, determined on the basis of the websites visited) that we transmit to Pinterest (so-called "ActALike Audiences"). With the help of the Pinterest Tag, we also want to ensure that our Pinterest Ads correspond to the potential interest of users and are not perceived as intrusive. The Pinterest Tag also allows us to track the effectiveness of Pinterest ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Pinterest ad (so-called "conversion"). The Pinterest Tag is integrated directly by Pinterest when our web pages are accessed and can store a so-called cookie, i.e. a small file, on your device. If you subsequently log in to Pinterest or visit Pinterest while logged in, the visit to our online offering will be noted in your profile. The data collected about you is anonymous to us, so it does not allow us to draw any conclusions about the identity of the users. The data is processed by Pinterest within the framework of Pinterest's data use policy.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient is Pinterest Inc., 651 Brannan Street, San Francisco, CA, 94107, USA.

Transfer to third countries

The personal data is transferred to the USA. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded contractual clauses approved by public authorities, such as the standard contractual clauses approved by the European Commission, with the data importer pursuant to Art. 46(2)(c) GDPR. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://policy.pinterest.com/en/privacy-policy

Matomo web analytics service

Description and purpose

Our website uses Matomo (formerly Piwik), open-source software for the statistical evaluation of visitor access. The provider of Matomo is InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand. Matomo uses cookies that are stored on your computer and that enable an anonymised analysis of your use of the website. As a rule, it is not possible to draw conclusions about a specific person, as your IP address is anonymised immediately after processing and before storage. Matomo is used for the purpose of improving the quality of our website and its content. This tells us how the website is used and allows us to continuously optimise our offering. When individual pages of our website are accessed, the following data is stored: 1. Two bytes of the IP address of the user's accessing system 2. The web page accessed 3. The website from which the user reached the accessed web page (referrer) 4. The subpages accessed from the accessed web page 5. The time spent on the website 6. The frequency with which the website is accessed. The software runs exclusively on the servers of our website. The users' personal data is stored only there. The data is not passed on to third parties. The software is set so that IP addresses are not stored in full, but 2 bytes of the IP address are masked. In this way, it is no longer possible to assign the shortened IP address to the accessing computer. The processing of users' personal data enables us to analyse the surfing behaviour of our users.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Matomo, InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand.

Transfer to third countries

Duration of data storage

Option to withdraw

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://matomo.org/privacy-policy/

Kameleoon

Description and purpose

The website uses the Kameleoon service of Kameleoon GmbH to analyse website usage and to optimise the user experience for all visitors. The Kameleoon service does not collect any personal data, but only processes the data collected by Google Analytics.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Kameleoon GmbH, Beim Alten Ausbesserungswerk 4, 77654 Offenburg, Germany.

Transfer to third countries

Duration of data storage

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here: https://www.kameleoon.com/en/privacy-policy

Taboola

Description and purpose

On our website, we use the Taboola service, which makes it possible to display user-specific recommendations for content and ads based on browsing behaviour and customer interests in order to improve the user-friendliness of our offering. The provider of this service is Taboola Germany GmbH, Alt-Moabit 2, 10557 Berlin, Germany. The usage profiles are created using pseudonyms; they are not merged with data about the bearer of the pseudonym and do not allow any conclusions to be drawn about personal data. Taboola collects the following user information by means of cookies: the user's operating system, web pages/content accessed on our websites, referrer/link via which the user came to our website, time and number of website visits, visits to error pages, location information (city and state), IP addresses in shortened form.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Taboola Germany GmbH, Alt-Moabit 2, 10557 Berlin, Germany.

Transfer to third countries

The personal data is transferred to Israel. An adequacy decision pursuant to Art. 45(1) GDPR exists for this third country, certifying a comparable and therefore adequate level of protection. In addition, in the event of a change in the legal situation, we will take further measures as quickly as possible to ensure the protection of personal data.

The personal data is also transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded standard data protection clauses pursuant to Art. 46(2)(c) GDPR with the data importer. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

According to Taboola's privacy policy, the data is deleted 13 months after the user's last interaction: https://www.taboola.com/policies/privacy-policy#users.

Withdrawal

You have the right to withdraw your consent at any time, cf. Art. 7(3) sentence 1 GDPR. This can be done informally, without giving reasons, and takes effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Further information can be found above in our privacy policy under "Rights of the data subject".

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on the processing of your personal data can be found here:

https://www.taboola.com/policies/privacy-policy

Outbrain targeted advertising

Description and purpose

Visitor pixels and cookies of Outbrain Inc., 39 West 13th Street, 3rd floor, New York, NY 10011, USA are used on this website for conversion measurement. This allows the behaviour of users to be tracked after they have been redirected to the provider's website by clicking on an Outbrain ad. This procedure serves to evaluate the effectiveness of Outbrain ads for statistical and market research purposes and can help to optimise future advertising measures. The data collected is anonymous to us, so it does not allow us to draw any conclusions about the identity of the users.

Legal basis

The legal basis for the processing of personal data is consent pursuant to Art. 6(1)(a) GDPR.

Recipient

The recipient is Outbrain Inc., 39 West 13th Street, 3rd floor, New York, NY 10011, USA.

Transfer to third countries

Data is transferred to the USA.

Duration of data storage

Right to object

You have the option of withdrawing your consent to data processing at any time. A withdrawal does not affect the effectiveness of data processing operations carried out in the past.

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information via link

For the purpose and scope of data collection and the further processing and use of data by Outbrain, as well as your related rights and setting options to protect your privacy, please refer to Outbrain's privacy policy: https://www.outbrain.com/legal/privacy#privacy-policy

Criteo SA

Description and purpose

We use the Criteo SA service on our website. Criteo SA is an internationally active provider of performance marketing and personalised online advertising.
The service is used to show visitors personalised ads based on their previous browsing behaviour and interests. This service collects information about usage behaviour on the website via cookies, pixels or similar tracking technologies. This data is processed in pseudonymised form and used to obtain a precise analysis of user behaviour.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Criteo SA, 32 Rue Blanche, 75009 Paris, France.

Transfer to third countries

Duration of data storage

Withdrawal

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on data protection at Criteo SA can be found here: https://www.criteo.com/privacy/

Adtriba (now Funnel AB)

Description and purpose

We use the services of Adtriba on our website; Adtriba now belongs to Funnel AB. Funnel acquired Adtriba in June 2024, combining Adtriba's advanced marketing measurement technology with Funnel's marketing intelligence platform. This combination enables Funnel to offer a more comprehensive solution to its customers who want to increase the effectiveness of their marketing activities across all channels.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Funnel AB, Klarabergsgatan 29, 111 21 Stockholm, Sweden.

Transfer to third countries

The personal data may be transferred to the United States. The transfer is subject to appropriate safeguards pursuant to Art. 46 GDPR. For this purpose, we have concluded contractual clauses approved by public authorities, such as the standard contractual clauses approved by the European Commission, with the data importer pursuant to Art. 46(2)(c) GDPR. In addition, we are aware of our responsibility and, where necessary, take further measures to protect the rights and freedoms of natural persons and ensure the protection of personal data.

Duration of data storage

Withdrawal

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on data protection at Adtriba (Funnel) can be found here:

https://funnel.io/legal/adtriba/terms-and-conditions-german

https://funnel.io/privacy

Insider

Description and purpose

We use the Insider service on our website. Insider is an omnichannel and customer engagement platform that helps companies create and automate personalised marketing campaigns across various communication channels. This service collects, analyses and uses data from website and app users to enable personalised customer experiences and targeted marketing measures. User data from various sources may be combined to create a unified, cross-channel customer profile.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipient of your personal data is Insider, 1 Scotts Road #24-10 Shaw Centre, Singapore (2282208).

Transfer to third countries

Duration of data storage

Withdrawal

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on data protection at Insider can be found here:

https://useinsider.com/privacy-policy-for-roundtables/?utm_source=chatgpt.com#privacy-policy

TVSquared / Innovid

Description and purpose

We use the TVSquared service on our website, which belongs to Innovid. Innovid supports us in advertising, personalisation and measurement in the field of Connected TV (CTV). Through a global infrastructure that enables data-driven personalisation, real-time decision-making, ad serving at scale and accredited measurement, Innovid offers its customers and partners optimised solutions that maximise the value of advertising investments across screens and devices.

Legal basis

The legal basis for the processing of your personal data is Art. 6(1)(a) GDPR.

Recipient

The recipients of your personal data are TV Squared Limited, Fifth Floor, 1 Exchange Crescent, Conference Square, Edinburgh EH3 8UL, and Innovid LLC, 30 Irving Place, 12th Floor, New York, NY 10003.

Transfer to third countries

Duration of data storage

Withdrawal

Contractual and statutory obligation

There is no contractual or statutory obligation to provide the data.

Further data protection information

Further information on data protection at TVSquared and Innovid can be found here:

https://1-demo-clients.tvsquared.com/u/tcs/read#%2F

https://www.innovid.com/privacy-policy

Applications (apprenticeships & job vacancies)

By submitting an application to us, applicants consent to the processing of their data for the purposes of the application process in the manner and to the extent set out in this privacy policy. The legal basis for processing applicant data is Art. 88 GDPR, Section 26 BDSG (new) and Art. 9(2)(b) GDPR. Insofar as special categories of personal data within the meaning of Art. 9(1) GDPR are voluntarily disclosed during the application process, they are additionally processed in accordance with Art. 9(2)(b) GDPR (e.g. health data, such as severe disability status, or ethnic origin). Insofar as special categories of personal data within the meaning of Art. 9(1) GDPR are requested from applicants during the application process, they are additionally processed in accordance with Art. 9(2)(a) GDPR (e.g. health data, if this is required for the performance of the job). If provided, applicants can submit their applications to us using an online form on our website. The online form is provided by Personio and embedded on our website. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Personio.

The data is transmitted to us in encrypted form in accordance with the state of the art. Applicants can also send us their applications by e-mail. Please note, however, that e-mails are generally not sent in encrypted form and applicants must ensure encryption themselves. We therefore cannot accept any responsibility for the transmission path of the application between the sender and receipt on our server and therefore recommend using an online form or sending the application by post. Instead of applying via the online form or by e-mail, applicants still have the option of sending us their application by post. In the event of a successful application, the data provided by applicants may be further processed by us for the purposes of the employment relationship. Otherwise, if the application for a job vacancy is unsuccessful, the applicants' data will be deleted. Applicants' data will also be deleted if an application is withdrawn, which applicants are entitled to do at any time. Deletion takes place after a period of six months has elapsed, so that we can answer any follow-up questions regarding the application and comply with our obligations to provide evidence under the German General Equal Treatment Act (AGG). Invoices for any reimbursement of travel expenses are archived in accordance with tax law requirements.

Data recipients

Insofar as this is permitted or required by law or insofar as you have consented, we also share your personal data with other recipients who provide services for us. We limit the disclosure of your personal data to what is necessary. In some cases, our service providers receive your personal data as processors and are then strictly bound by our instructions when handling your personal data (data processing agreement pursuant to Art. 28 GDPR). In some cases, the recipients act independently with the data we transmit to them. The following categories of service providers/recipients may receive your data:

Providers of e-mail marketing via newsletter
Providers of hosting services for the operation of our servers
Service providers in the area of applications to support the selection of applicants
Service providers for development work, including programming, development, maintenance and support of software applications
Service providers for postal services
External legal advisors
Marketing agencies / website support
Other IT service providers (e.g. system integrators)
Other services and tools

The service providers we commission must meet strict confidentiality requirements. They only receive the access to your data necessary to perform the tasks assigned to them.

In the event of suspicion of a criminal offence, data may be passed on to law enforcement authorities.

Security

We have taken extensive technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorised persons. Our security procedures are regularly reviewed and adapted to technological progress. In addition, data protection is continuously ensured through ongoing auditing and optimisation of our data protection organisation.

Final provisions

Snocks GmbH reserves all rights to make changes and updates to this privacy policy. This privacy policy was created by the data protection management system as part of hellotrust, a brand of Keyed GmbH.

This is a translation of the German privacy policy. In the event of any discrepancies, the German version shall prevail.