Privacy policy

This policy explains how we collect, use and share personal data when you visit or buy from www.atoliovegas.com. It applies worldwide. Where we name provisions of German or European law, these apply to you if you are in the European Union, the EEA or the United Kingdom.

Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation is:

Atolio Vegas, owner Birhat Shahin
Sutthauser Str. 206
49080 Osnabrück
Germany
Email: support@atoliovegas.de
Phone: +49 1551 0572574

We are not required to appoint a data protection officer, because we do not regularly employ twenty or more persons in the processing of personal data.

What personal data is

Personal data means any information relating to an identified or identifiable natural person. This includes your name, your address, your email address, your phone number, your order history and online identifiers such as your IP address.

Legal bases we rely on

Where we ask for your consent, Art. 6 (1) (a) GDPR is the legal basis.
Where processing is necessary to perform a contract with you or to take steps before entering into a contract, Art. 6 (1) (b) GDPR applies.
Where processing is necessary to comply with a legal obligation, Art. 6 (1) (c) GDPR applies.
Where processing is necessary for our legitimate interests or those of a third party, and your interests and fundamental rights do not override them, Art. 6 (1) (f) GDPR applies.
Where information is stored on or read from your device, Section 25 TDDDG applies in addition. Storage and access that is strictly necessary to provide the service you requested is covered by Section 25 (2) no. 2 TDDDG and does not require consent. Everything else requires your consent under Section 25 (1) TDDDG.

Server log files

Every time this website is called up, our hosting provider records the following in server log files: browser type and version, operating system, internet service provider, IP address, date and time of access, the page from which you reached us, and the pages you open on our site. This data is not merged with other personal data. It is processed to operate the site securely and to detect and defend against attacks. Legal basis: Art. 6 (1) (f) GDPR.

Cookies

Cookies are small files stored on your device by your browser. We use two kinds.

Strictly necessary cookies keep the shop working: shopping cart, checkout, login, country and language selection, and fraud prevention. Storage and access are covered by Section 25 (2) no. 2 TDDDG and require no consent. The subsequent processing of the data is based on Art. 6 (1) (b) and (f) GDPR.

Analytics and marketing cookies are set only if you consent. Storage and access are based on Section 25 (1) TDDDG, the subsequent processing on Art. 6 (1) (a) GDPR. You can change or withdraw your choice at any time through the cookie settings on our website. You can also delete cookies and block them in your browser settings. If you block them, parts of the shop may stop working.

Consent management

Purpose. We use a consent management tool to obtain, record and document your cookie choices and to make them changeable at any time.

Legal basis. Art. 6 (1) (c) GDPR, because we are legally required to demonstrate consent, and Section 25 (2) no. 2 TDDDG for the storage of your choice on your device.

Recipient. A specialist provider of consent management software, established in the European Union, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. We will name the provider on request.

Third country transfer. None. Processing takes place inside the European Union.

Retention. Consent records are kept for as long as we must be able to demonstrate your consent, and for up to three years after it ends.

Obligation to provide. Recording your choice is a legal requirement. Without it we cannot set any non essential cookies.

What we collect and why

Device information. Browser type, IP address, time zone, language, the pages and products you view, the site or search term that brought you to us, and how you interact with the shop. Collected through cookies, log files, web beacons, tags and pixels.

Order information. Your name, billing address, delivery address, email address, phone number and payment information. Full card numbers are processed by the payment provider and are never stored by us.

Communication data. If you write to us by email, through a contact form or through our chat, we process the content of your message and your contact details in order to reply. Legal basis: Art. 6 (1) (b) GDPR where your message concerns an order or a possible order, otherwise Art. 6 (1) (f) GDPR. We delete this data once the matter is closed and no retention period requires us to keep it.

Newsletter data. If you subscribe, we store your email address, the date and time of your sign up and the IP address used, so that we can demonstrate your consent. Legal basis: Art. 6 (1) (a) GDPR. Every email contains an unsubscribe link. We keep your address until you unsubscribe.

Shop platform

Purpose. Our shop is hosted on Shopify. Shopify provides the store, the checkout and the customer account, and processes the data described above on our behalf.

Legal basis. Art. 6 (1) (b) GDPR for the performance of your order and Art. 6 (1) (f) GDPR for the secure and reliable operation of the shop. Strictly necessary cookies are covered by Section 25 (2) no. 2 TDDDG.

Recipient. Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Third country transfer. Shopify may process data outside the European Economic Area, in particular in Canada and the United States. Canada is covered by an adequacy decision of the European Commission. For the United States, the transfer is based on the EU-U.S. Data Privacy Framework or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.

Retention. Order and invoice data for the periods required by German commercial and tax law, up to ten years. Other data until it is no longer needed.

Obligation to provide. Providing your order data is necessary to conclude the contract. Without it we cannot process an order.

More information. www.shopify.com/legal/privacy

We also use certain enhanced Shopify features that draw on data from your interactions with our shop, with other merchants and with Shopify. For those features Shopify is the controller in its own right, including for responding to requests to exercise your rights. See www.shopify.com/legal/privacy/app-users and privacy.shopify.com.

Payment providers

Purpose. To process your payment with the method you choose at checkout.

Legal basis. Art. 6 (1) (b) GDPR.

Recipients. Depending on your choice: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Shopify Payments (Europe) Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland; Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes your payment data under its own responsibility and its own privacy policy.

Third country transfer. Depending on the provider, data may be transferred to third countries. The providers state Standard Contractual Clauses or an adequacy decision as the basis.

Retention. As required by commercial and tax law, up to ten years.

Obligation to provide. Payment data is necessary to perform the contract. Without it the order cannot be completed.

Depending on the payment method, for example invoice or direct debit, the provider may pass your data to credit agencies for identity and credit checks. This is done by the provider under its own responsibility.

Shipping

Purpose. To deliver your order and to send delivery notifications.

Legal basis. Art. 6 (1) (b) GDPR.

Recipients. The carrier delivering your parcel, for example Deutsche Post DHL Group, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany. We pass on your name, your delivery address and, where needed for notifications, your email address or phone number.

Third country transfer. For deliveries outside the European Union, your data is passed to the carrier and to the customs authorities of the destination country, as required by customs law.

Retention. As required by commercial and tax law.

Obligation to provide. A delivery address is necessary to perform the contract.

Google Analytics 4

Purpose. To understand how visitors use the website and to improve it. Google Analytics uses cookies and processes device information as described above.

Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.

Recipients. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Third country transfer. Data may be transferred to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer is covered by an adequacy decision under Art. 45 GDPR. In addition, Standard Contractual Clauses under Art. 46 (2) (c) GDPR are in place.

Retention. Device data collected for analytics is stored for a maximum of fourteen months.

Withdrawal. You can withdraw your consent at any time with effect for the future through the cookie settings on our website, or by using the browser add-on at tools.google.com/dlpage/gaoptout. Withdrawal does not affect the lawfulness of processing carried out before it.

Obligation to provide. None. There is no contractual or legal obligation to provide this data.

More information. policies.google.com/privacy

Google Ads, conversion tracking and remarketing

Purpose. To advertise our products in Google services, including Google Search, Google Shopping, the Google Display Network and YouTube, to measure whether an advertisement led to a purchase, and to show advertising to people who have already visited our shop. Google sets cookies and processes your usage behaviour, including pages viewed, click behaviour and technical data such as your IP address. We also use the Google sales channel for Shopify, so that our products can appear in Google Shopping and other Google services.

Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.

Recipients. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Third country transfer. As described for Google Analytics.

Retention. Remarketing cookies have a lifetime of up to 540 days. Data is deleted once it is no longer needed for the purpose, or when you exercise your right to erasure.

Withdrawal. At any time through the cookie settings on our website, or in your Google ad settings at adssettings.google.com.

Obligation to provide. None.

More information. policies.google.com/technologies/ads

Meta pixel and the Facebook and Instagram sales channel

Purpose. We use the Meta pixel and the Facebook and Instagram sales channel for Shopify. This lets us measure whether an advertisement on Facebook or Instagram led to a visit or a purchase, build audiences for advertising, and show our products in Meta services. Meta receives HTTP header information including your IP address, browser information and the page you are on, pixel specific data including the pixel ID and Meta cookie data, and event data such as products viewed and purchases completed. If you have a Meta account, Meta can link this to your account.

Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.

Recipients. Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. We and Meta are joint controllers for the collection and transfer of this data within the meaning of Art. 26 GDPR. Meta processes the data further under its own responsibility.

Third country transfer. Data may be transferred to the United States. Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. In addition, Standard Contractual Clauses under Art. 46 (2) (c) GDPR are in place.

Retention. Data is deleted once it is no longer needed for the purpose, or when you exercise your right to erasure. Meta states its own retention periods in its privacy policy.

Withdrawal. At any time through the cookie settings on our website, and in your Meta ad settings.

Obligation to provide. None.

More information. www.facebook.com/privacy/policy

TikTok pixel

Purpose. We use the TikTok pixel so that we can measure whether an advertisement or a post on TikTok led to a visit or a purchase, build audiences for advertising, and improve our campaigns. The pixel processes device and browser information, your IP address, the pages you view and events such as adding a product to the cart or completing a purchase. If you have a TikTok account, TikTok can link this to your account.

Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.

Recipients. TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Aviation House, 125 Kingsway, London, WC2B 6NH, United Kingdom. We and TikTok are joint controllers for the collection and transfer of this data within the meaning of Art. 26 GDPR. TikTok processes the data further under its own responsibility.

Third country transfer. TikTok stores data of European users in data centres in Europe. TikTok states that staff in third countries, including China, Singapore and the United States, can access this data for maintenance and support. The United Kingdom is covered by an adequacy decision under Art. 45 GDPR. For China and other third countries without an adequacy decision, TikTok relies on Standard Contractual Clauses under Art. 46 (2) (c) GDPR together with additional measures. We point out that the level of protection in those countries may not correspond to that in the European Union, and that effective legal remedies may not be available to the same extent. You can find TikTok's own information on this in its privacy policy.

Retention. Data is deleted once it is no longer needed for the purpose, or when you exercise your right to erasure. TikTok states its own retention periods in its privacy policy.

Withdrawal. At any time through the cookie settings on our website, and in your TikTok ad settings.

Obligation to provide. None.

More information. www.tiktok.com/legal/page/eea/privacy-policy/en

Further advertising platforms

Purpose. We advertise our products on the platforms named above. We may extend our advertising to further platforms, for example Pinterest, Snapchat or Microsoft Advertising. Where we do, those platforms use the same kind of technology as described above: a pixel or tag that processes device and browser information, your IP address, the pages you view and events such as adding a product to the cart or completing a purchase, in order to measure advertising and to build audiences.

Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. No advertising technology is loaded on our website unless you have consented to it.

How you can always see what is active. Every advertising provider we use is listed by name in the cookie settings on our website, together with its purpose, before you give consent. The cookie settings are therefore always the complete and current list. We also update this policy with a separate section for each provider before we start using it.

Third country transfer. Where a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision under Art. 45 GDPR or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR. The details are given in the section for the provider concerned.

Withdrawal. At any time through the cookie settings on our website.

Obligation to provide. None.

Marketing attribution

Purpose. We use an attribution service to measure which channel a visit and a purchase came from, so that we can assess where our marketing works. It sets a first party identifier and processes device information, pages viewed and order events.

Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.

Recipient. A specialist provider of marketing attribution software, established in the United States, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. We will name the provider on request.

Third country transfer. Data is transferred to the United States. The provider is certified under the EU-U.S. Data Privacy Framework, so the transfer is covered by an adequacy decision under Art. 45 GDPR. In addition, Standard Contractual Clauses under Art. 46 (2) (c) GDPR are in place.

Retention. Data is deleted once it is no longer needed for the purpose, or when you exercise your right to erasure.

Withdrawal. At any time through the cookie settings on our website.

Obligation to provide. None.

Omnisend, newsletter, email and SMS marketing

Purpose. We use Omnisend and, for individual campaigns, a further marketing platform, to create and send our newsletter, SMS messages and transactional emails, and to manage our subscriber list. They process your email address, your mobile number where you have given it, the date, time and IP address of your sign up, and interaction data. Our emails contain tracking pixels and personalised links, so that we can see whether an email was opened and which links were clicked, and improve our content accordingly.

Legal basis. Art. 6 (1) (a) GDPR for the newsletter and for open and click measurement. Where we send you information about goods similar to ones you have already bought, we may also rely on Section 7 (3) UWG. Storage and access on your device for open and click measurement are based on Section 25 (1) TDDDG.

Recipient. UAB Omnisend, Verkių g. 25C-1, LT-08223 Vilnius, Lithuania.

Third country transfer. Omnisend also operates entities in the United Kingdom and the United States. Where data is transferred there, the transfer is based on the adequacy decision for the United Kingdom or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.

Retention. Until you unsubscribe or withdraw your consent. Records of your consent are kept for up to three years after that, so that we can demonstrate it.

Withdrawal. At any time with effect for the future, through the unsubscribe link in every email or by writing to support@atoliovegas.de. You can object to direct marketing at any time and free of charge.

Obligation to provide. None. Without your email address we cannot send you a newsletter.

More information. www.omnisend.com/privacy

Reviews and ratings

Purpose. After a purchase we may invite you by email to review the product and our shop. For this we pass your email address, your order number and the items you bought to the review provider, which sends the invitation. If you submit a review, we publish your first name, your rating, your review text and any photo you upload, on our website and, in the case of the shop rating, on the review platform itself.

Legal basis. Art. 6 (1) (f) GDPR for the review invitation, our legitimate interest being to obtain feedback and to inform other customers. Art. 6 (1) (a) GDPR for the publication of your review and any photo. Where a review widget stores information on or reads it from your device, this happens only with your consent under Section 25 (1) TDDDG.

Recipients. Specialist providers of product review and shop rating software, acting as our processors under data processing agreements pursuant to Art. 28 GDPR. Where a review platform publishes shop ratings under its own responsibility, it acts as a controller in its own right. We will name the providers on request.

Third country transfer. Processing takes place inside the European Economic Area or in a country for which the European Commission has issued an adequacy decision under Art. 45 GDPR.

Retention. Published reviews are kept until you ask us to remove them. Invitation data is deleted once the invitation has been sent and the period for a reminder has passed.

Withdrawal and objection. You can object to the review invitation at any time, and withdraw the publication of your review at any time, by writing to support@atoliovegas.de.

Obligation to provide. None. Submitting a review is entirely voluntary.

Affiliate programme

Purpose. We operate an affiliate programme. If you reach our shop through an affiliate link, a cookie or a comparable identifier records which partner referred you, so that the partner can be credited for a purchase. Device information, the referring link and order events are processed.

Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.

Recipient. A specialist provider of affiliate tracking software, established in India, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. We will name the provider on request.

Third country transfer. Data is transferred to India. There is no adequacy decision of the European Commission for India. The transfer is therefore based on Standard Contractual Clauses approved by the European Commission under Art. 46 (2) (c) GDPR. We point out that the level of data protection in India may not correspond to that in the European Union and that effective legal remedies may not be available to the same extent.

Retention. Affiliate identifiers expire after the attribution window and are deleted once they are no longer needed to settle a commission.

Withdrawal. At any time through the cookie settings on our website.

Obligation to provide. None.

Error monitoring and website stability

Purpose. We use an error monitoring service that records technical faults on our website, so that we can find and fix them. It processes the type of error, the page on which it occurred, your browser and operating system and your IP address. It does not create user profiles and is not used for advertising.

Legal basis. Art. 6 (1) (f) GDPR. Our legitimate interest is to operate a functioning and secure shop.

Recipient. A specialist provider of error monitoring software, established in the United States, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. We will name the provider on request.

Third country transfer. Data is transferred to the United States, based on the EU-U.S. Data Privacy Framework under Art. 45 GDPR or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.

Retention. Error reports are deleted after 90 days at the latest.

Objection. You may object at any time under Art. 21 GDPR by writing to support@atoliovegas.de.

Obligation to provide. None.

Session analysis and heatmaps

Purpose. To understand how the shop is actually used, so that we can find problems and improve it, we use a session analysis service. It records how you move through the site: mouse movement, clicks, scrolling and the time spent on a page. From this it produces heatmaps and session recordings that replay a visit. It also processes access times, device information and your IP address. Text you type into form fields, and payment data, are masked and are not recorded.

Legal basis. Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. We use it only with your consent.

Recipient. A specialist provider of session analysis software, established in the United States, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. We will name the provider on request.

Retention. Recordings are deleted after thirteen months at the latest.

Withdrawal. At any time through the cookie settings on our website.

Obligation to provide. None.

Chat and customer support

Purpose. We offer a chat and a support helpdesk so that you can reach us quickly. We process the content of your messages, the contact details you give us and, where you refer to an order, the details of that order, in order to reply and to keep a record of the conversation.

Legal basis. Art. 6 (1) (b) GDPR where your message concerns an order or a possible order, otherwise Art. 6 (1) (f) GDPR, our legitimate interest being to answer enquiries efficiently.

Recipients. The provider of our shop platform, and a specialist provider of helpdesk software, both acting as our processors under data processing agreements pursuant to Art. 28 GDPR. We will name the providers on request.

Retention. Until the matter is closed and no retention period requires us to keep the conversation.

Obligation to provide. None. You can also reach us by email.

Other service providers

We use further providers for individual shop functions. They process only what their function requires and only on our instructions, under data processing agreements pursuant to Art. 28 GDPR. These are:

a provider for back in stock notifications, which processes the email address you enter for that purpose, on the basis of Art. 6 (1) (a) GDPR;
a provider for the display of trust, guarantee and delivery information, which processes your IP address in order to deliver the display, on the basis of Art. 6 (1) (f) GDPR;
the provider of the withdrawal button in our footer, which processes the name, order number and email address you enter, on the basis of Article 6(1)(b) GDPR in conjunction with Section 355 of the German Civil Code (BGB)
a provider for the automatic display of prices in your local currency, which processes your IP address in order to determine your country, on the basis of Art. 6 (1) (f) GDPR;
a provider for building and displaying individual landing pages, which processes device information and the pages you view in order to render the page, on the basis of Art. 6 (1) (f) GDPR;
a provider for the display of recent shop activity, which shows anonymised purchase notifications and processes device information, on the basis of Art. 6 (1) (f) GDPR;
content delivery networks that deliver scripts, fonts, images and stylesheets to your browser and necessarily receive your IP address for that purpose, on the basis of Art. 6 (1) (f) GDPR.

Where any of these providers processes data outside the European Economic Area, in particular in the United States, the transfer is based on an adequacy decision under Art. 45 GDPR or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR. Where a function stores information on or reads it from your device beyond what is strictly necessary to provide the service you requested, this happens only with your consent under Section 25 (1) TDDDG.

Under Art. 15 (1) (c) GDPR you may ask us at any time for the identity of every recipient of your personal data. Write to support@atoliovegas.de and we will name them.

Beyond this, we may disclose personal data in order to comply with applicable law, to respond to lawful requests from authorities, or to establish, exercise or defend legal claims. We do not sell your personal data.

Third party content

Our website embeds content from third parties: videos, fonts, and a feed of our own social media posts. To deliver that content to your browser, the provider necessarily receives your IP address. We select providers that use the IP address only for delivery, but we have no influence over whether a provider stores it for its own statistics. If you are logged in to the social network concerned, it can link the visit to your account there. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest being an appealing and functional website. Where storage on or access to your device is involved, this takes place only with your consent under Section 25 (1) TDDDG. Where a provider is established outside the European Economic Area, the transfer is based on an adequacy decision under Art. 45 GDPR or on Standard Contractual Clauses under Art. 46 (2) (c) GDPR.

Transfers to third countries

Some of our providers process data outside the European Economic Area, in particular in the United States and Canada. In those cases the transfer is based on an adequacy decision of the European Commission under Art. 45 GDPR, for example for Canada, the United Kingdom and for United States companies certified under the EU-U.S. Data Privacy Framework, or on Standard Contractual Clauses approved by the European Commission under Art. 46 (2) (c) GDPR.

Please note that in some third countries, in particular the United States, public authorities may have access rights that go beyond what European law allows, and that effective legal remedies may not be available to the same extent. Where we transfer data on this basis, we take additional measures where necessary to protect your rights.

How long we keep your data

Order and invoice data: for the periods required by German commercial and tax law, up to ten years.
Communication data: for as long as needed to handle your enquiry and any follow up questions.
Newsletter data: until you unsubscribe. Consent records for up to three years afterwards.
Device data collected for analytics: a maximum of fourteen months.
Consent records for cookies: up to three years.
Where no retention obligation applies, we delete personal data once the purpose has been achieved, or on request.

Is providing data required

Providing the data marked as required in the order process is necessary in order to enter into and perform a contract with us. Without it we cannot accept or deliver an order. Retaining order and invoice data is a legal obligation under commercial and tax law. All other data, in particular for analytics, advertising, the newsletter and reviews, is provided entirely voluntarily. If you do not provide it, or withdraw your consent, you suffer no disadvantage and can continue to use the shop, although individual functions may then be unavailable.

Automated decision making and profiling

We do not use automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. Where you have consented to advertising cookies, advertising is selected for you based on your usage behaviour. This does not produce legal effects for you and you can withdraw your consent at any time. Payment providers may carry out automated identity or credit checks for certain payment methods. Those checks are carried out by the provider under its own responsibility and you can find the details in its privacy policy.

Your rights

If you are in the European Economic Area or the United Kingdom you have the following rights in relation to us:

Access to the personal data we hold about you, Art. 15 GDPR
Rectification of inaccurate or incomplete data, Art. 16 GDPR
Erasure, Art. 17 GDPR
Restriction of processing, Art. 18 GDPR
To be informed about recipients of any rectification, erasure or restriction, Art. 19 GDPR
Data portability in a structured, commonly used and machine readable format, Art. 20 GDPR
To withdraw consent at any time with effect for the future, Art. 7 (3) GDPR

Right to object, Art. 21 GDPR. Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop processing your data for that purpose unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. Where we process your data for direct marketing, you may object at any time without giving reasons, and we will stop.

To exercise any of these rights, write to support@atoliovegas.de.

Right to complain, Art. 77 GDPR. You may lodge a complaint with a supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

If you are outside the EEA and the United Kingdom

We apply the same standards to your data. The rights available to you under your local data protection law are unaffected. If you are a resident of a United States state with its own privacy law, you may have the right to know what personal data we collect, to request access to it, to request its deletion or correction, and to opt out of the sale or sharing of personal data and of targeted advertising. We do not sell personal data. To opt out of targeted advertising, use the cookie settings on our website. To exercise any other right, write to support@atoliovegas.de. We will not discriminate against you for exercising these rights.

Minors

This website is not intended for persons under the age of eighteen. We do not knowingly collect personal data from minors. If you believe that a minor has provided us with personal data, please contact us and we will delete it.

Security

We use technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction and access by unauthorised persons. Data is transmitted in encrypted form. We review our measures regularly and adapt them as technology develops.

Changes to this policy

We may update this policy from time to time to reflect changes to our practices, or for operational, legal or regulatory reasons. The current version is always available on this page.

Contact

For any question about this policy or about how we handle your data, or to make a complaint, write to us:

Atolio Vegas, owner Birhat Shahin
Sutthauser Str. 206
49080 Osnabrück
Germany
support@atoliovegas.de
+49 1551 0572574

Name
E-Mail
Bestellnummer
Alternative E-Mail
Grund (freiwillig)
Zurückzugebende Artikel