Privacy policy

Foreword

We, Argoa GmbH (hereinafter “the company”, “we” or “us”), take the protection of your personal data seriously and would like to inform you about data protection in our company.

Within the scope of our data protection responsibilities, the entry into force of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: “GDPR”) has imposed additional obligations on us to ensure the protection of personal data of the data subject (we will also refer to you as “customer”, “user”, “you”, “your” or “data subject” below).

Insofar as we decide, either alone or jointly with others, on the purposes and means of data processing, this primarily includes the obligation to inform you transparently about the type, scope, purpose, duration, and legal basis of the processing (see Articles 13 and 14 GDPR). With this statement (hereinafter: “Data Protection Notice”), we inform you about how your personal data is processed by us.

This privacy notice has two parts. Part A (General information) applies to all processing of personal data and the processing that takes place whenever you visit a website. Part B (Visiting our websites) covers the specific processing described for the relevant offering or product, particularly when you use our websites.

A. General information

(1) Definitions

This privacy notice uses the following definitions, based on Article 4 GDPR:

• “Personal data” (Art. 4 No. 1 GDPR) means any information relating to an identified or identifiable natural person (“data subject”). A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or to information relating to their physical, physiological, genetic, mental, economic, cultural or social identity. Identifiability can also be achieved through a combination of such information or other additional knowledge. The method of collection, form or embodiment of the information is irrelevant (photos, video or audio recordings can also contain personal data).
• “Processing” (Art. 4 No. 2 GDPR) means any operation performed on personal data, whether or not by automated (i.e., technical) means. This includes, in particular, the collection (i.e., acquisition), recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data, as well as the modification of the purpose for which the data were originally processed.
• “Controller” (Art. 4 No. 7 GDPR) is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• “Third party” (Art. 4 No. 10 GDPR) means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data; this also includes other legal persons belonging to the group.
• “A ”processor” (Art. 4 No. 8 GDPR) is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular according to the controller’s instructions (e.g. IT service providers). In the context of data protection law, a processor is specifically not a third party.
• “Consent” (Art. 4 No. 11 GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

(2) Name and address of the data controller

We are the controller responsible for processing your personal data within the meaning of Article 4(7) GDPR:

Argoa GmbH
Rudolf-Diesel-Str. 12
86551 Aichach

Tel.: 08251-9369040

Further information about our company can be found in the legal notice on our website (https://www.argoa.de/impressum/).

(3) Contact details of the data protection officer

For all questions and as a contact person regarding data protection at our company, our data protection officer is available at any time. His contact details are:

[the company]
[address for service of process]
[E-mail address]

(4) Legal bases for data processing

By law, processing personal data is generally prohibited unless one of the following legal grounds applies:

• Article 6 paragraph 1 sentence 1 letter a GDPR (“Consent”): Where the data subject has freely, in an informed and unambiguous indication of his or her consent to the processing of personal data relating to him or her for one or more specific purposes;
• Article 6(1), sentence 1, point (b), GDPR: where the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
• Article 6(1), sentence 1, point (c), GDPR: where the processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. a statutory retention obligation);
• Article 6(1), sentence 1, point (d), GDPR: where the processing is necessary to protect the vital interests of the data subject or of another natural person;
• Article 6(1), sentence 1, point (e), GDPR: where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or
• Article 6 paragraph 1 sentence 1 letter f GDPR (“Legitimate interests”): If the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party (in particular legal or economic interests), except where such interests are overridden by the interests or rights of the data subject (in particular where the data subject is a minor).

Information may only be stored on an end user’s device, or accessed if it is already stored there, on one of the following legal grounds:

• Section 25(1) TTDSG: where the end user has given consent based on clear and comprehensive information. This consent must be given in accordance with Article 6(1), sentence 1, point (a), GDPR;
• Section 25(2), no. 1, TTDSG: where the sole purpose is the transmission of a message via a public telecommunications network or
• Section 25 Paragraph 2 No. 2 TTDSG: If the storage or access is absolutely necessary so that the provider of a telemedia service can provide a telemedia service expressly requested by the user.

We set out the legal basis for each type of processing below. More than one legal basis may apply.

(5) Data deletion and retention periods

For each type of processing, we explain below how long we keep your data and when we delete or block it. If no specific retention period is given, we delete or block your personal data as soon as the purpose or legal basis for keeping it no longer applies. As a rule, we store your data only on our servers in Germany. Any transfers are subject to the provisions in A.(7) and A.(8).

We may keep data beyond the stated period if a legal dispute with you exists or is anticipated, if other legal proceedings take place, or if legislation that applies to us as the controller requires it. Examples include section 257 of the German Commercial Code (HGB) and section 147 of the German Fiscal Code (AO). Once the statutory retention period ends, we block or delete the personal data unless we need to keep it for longer and have a legal basis for doing so.

(6) Data security

We use appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction and unauthorised access by third parties. This includes, for example, TLS encryption on our website. We take account of the state of the art, implementation costs and the nature, scope, context and purpose of the processing. We also consider the risks of a data breach for the person concerned, including its likelihood and impact. We continually improve our security measures in line with technological developments.

We will gladly provide you with further information upon request. Please contact our data protection officer (see section A.(3)).

(7) Working with data processors

Like other larger companies, we use external service providers in Germany and abroad to support our business, for example in IT, logistics, telecommunications, sales and marketing. They act only on our instructions and are contractually required to comply with data protection rules under Article 28 GDPR.

If personal data concerning you is passed on by us to our parent company or by our parent company and its affiliated companies, namely …, to us (e.g. for advertising purposes), this is done on the basis of existing data processing agreements.

(8) Conditions for the transfer of personal data to third countries

As part of our business relationship, your personal data may be transferred or disclosed to other companies. These may also be outside the European Economic Area (EEA), in what are known as third countries. We carry out this processing only to meet contractual and business obligations and maintain our business relationship with you. The legal basis is Article 6(1)(b) or (f), in conjunction with Article 44 and the following articles of the GDPR. Details of these transfers are provided in the relevant sections below.

Einigen Drittländern bescheinigt die Europäische Kommission durch sog. Angemessenheitsbeschlüsse einen Datenschutz, der dem EWR-Standard vergleichbar ist (eine Liste dieser Länder sowie eine Kopie der Angemessenheitsbeschlüsse erhalten Sie hier: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). In anderen Drittländern, in die ggf. personenbezogene Daten übertragen werden, herrscht aber unter Umständen wegen fehlender gesetzlicher Bestimmungen kein durchgängig hohes Datenschutzniveau. Soweit dies der Fall ist, achten wir darauf, dass der Datenschutz ausreichend gewährleistet ist. Möglich ist dies über bindende Unternehmensvorschriften, Standard-Vertragsklauseln der Europäischen Kommission zum Schutz personenbezogener Daten gem. Art. 46 Abs. 1 , 2 lit. c DS-GVO (die Standard-Vertragsklauseln von 2021 sind verfügbar unter https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32021D0915&locale-en), Zertifikate oder anerkannte Verhaltenskodizes. Bitte wenden Sie sich an unseren Datenschutzbeauftragten (siehe unter A.(3)), wenn Sie hierzu nähere Informationen erhalten möchten.

(9) No automated decision-making (including profiling)

We do not intend to use personal data collected from you for any automated decision-making process (including profiling).

(10) No obligation to provide personal data

You do not have to provide personal data in advance to enter into a contract with us. As a customer, you are generally under no legal or contractual obligation to give us your personal data. However, without certain necessary details, we may be able to provide some products or services only to a limited extent, or not at all. If this exceptionally applies to any of the products described below, we will let you know separately.

(11) Legal obligation to disclose certain data

We may be subject to a specific legal or statutory obligation to provide lawfully processed personal data to third parties, in particular public authorities (Art. 6 para. 1 sentence 1 lit. c GDPR).

(12) Your rights

You can exercise your rights regarding the personal data we process about you at any time. Please use the contact details in A.(2). You have the following rights:

• to request access to the data we process about you under Article 15 GDPR. In particular, you can ask about the purposes of processing, the categories of data and the categories of recipients to whom your data has been or will be disclosed. You can also ask about the planned retention period, your rights to rectification, erasure, restriction of processing and objection, and your right to lodge a complaint. You can request information about the source of your data if it was not collected by us, and whether automated decision-making, including profiling, takes place, together with meaningful details where applicable;
• to request rectification of inaccurate data or completion of the data we hold about you without undue delay under Article 16 GDPR;
• to request the erasure of the data we hold about you under Article 17 GDPR, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• to request restriction of the processing of your data under Article 18 GDPR if you contest its accuracy or the processing is unlawful;
• In accordance with Article 20 GDPR, you have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller (“data portability”);
• Pursuant to Article 21 of the GDPR, you have the right to object to the processing of your personal data if the processing is based on Article 6(1)(e) or (f) of the GDPR. This is particularly relevant if the processing is not necessary for the performance of a contract with you. Unless your objection concerns direct marketing, we request that you explain the reasons why we should not process your data as we have been doing. In the event of a justified objection, we will review the situation and either cease or adjust the data processing, or demonstrate to you our compelling legitimate grounds for continuing the processing.;
• to withdraw any consent you have given us at any time under Article 7(3) GDPR. This also applies to consent given before the GDPR became applicable, namely before 25 May 2018. Consent means your freely given, informed and unambiguous agreement to the processing of the personal data concerned for one or more specific purposes, expressed through a statement or another clear affirmative action. Once you withdraw consent, we may no longer continue the processing based on it; and
• to lodge a complaint under Article 77 GDPR with a data protection supervisory authority regarding the processing of your personal data in our company, for example with the data protection supervisory authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht, P.O. Box 1349, 91504 Ansbach, Germany, Email: poststelle@lda.bayern.de, Tel.: +49 981 180093-0, Fax: +49 981 180093-800

(13) Changes to this privacy notice

As data protection law evolves and technological or organizational changes occur, our privacy policy is regularly reviewed to determine if it needs to be updated or supplemented. You will be notified of any changes, in particular on our German website at [Address of company website]. This privacy policy is current as of April 2024.

B. Visiting our websites

(1) How it works

Information about our company and the services we offer can be found in particular at www.argoa.de and its associated subpages (hereinafter collectively referred to as "websites"). When you visit our websites, your personal data may be processed.

(2) Personal data we process

When you use our websites for informational purposes, we collect, store and process the following categories of personal data:

“Log data”: When you visit our websites, a so-called log data record (server log files) is temporarily and anonymously stored on our web server. This consists of:

• the page the visitor came from (the referrer URL)
• the name and URL of the requested page
• the date and time the page was requested
• a description of the type, language and version of the web browser used
• the IP address of the computer making the request, shortened so that it can no longer be linked to a specific person
• the amount of data transferred
• the operating system
• the message indicating whether the request was successful (access status/HTTP status code)
• the time difference from GMT

“Contact form data”: When using contact forms, the data transmitted is processed (e.g. gender, name and surname, address, company, email address and the time of transmission).

In addition to simply browsing our website, we offer a newsletter subscription to keep you informed about current developments in commercial law and upcoming events. When you subscribe to our newsletter, we collect, store, and process the following "newsletter data":

• the page the visitor came from (the referrer URL)
• the date and time the page was requested
• a description of the type of web browser used
• the IP address of the computer making the request, shortened so that it can no longer be linked to a specific person
• the email address
• the date and time of registration and confirmation

We analyse how you use our newsletter. The emails we send contain web beacons or tracking pixels for this purpose: single-pixel image files stored on our website. For the analysis, we link the data mentioned above and the web beacons to your email address and a unique ID. The links in the newsletter also contain this ID. Data is collected only in pseudonymised form. This means that the IDs are not linked to your other personal data, ruling out direct identification of individuals.

(3) Purpose and legal basis of data processing

We process the personal data described above in accordance with the provisions of the GDPR, other applicable data protection regulations, and only to the extent necessary. Where the processing of personal data is based on Article 6(1), sentence 1, point (f), GDPR, these purposes also represent our legitimate interests.

We process log data for statistics and to improve the quality of our website, particularly the stability and security of the connection. The legal basis is Article 6(1), sentence 1, point (a) or (f), GDPR.

We process contact form data to handle customer enquiries. The legal basis is Article 6(1), sentence 1, point (b) or (f), GDPR.

The processing of newsletter data is carried out for the purpose of sending the newsletter. By subscribing to our newsletter, you consent to the processing of your personal data (legal basis is Art. 6 para. 1 lit. a GDPR). We use the so-called double opt-in procedure for newsletter subscriptions. This means that after you subscribe, we will send an email to the email address you provided, asking you to confirm that you wish to receive the newsletter. The purpose of this procedure is to verify your subscription and, if necessary, to investigate any potential misuse of your personal data. You can withdraw your consent to receive the newsletter and unsubscribe at any time. You can do this by clicking on the link provided in every newsletter email, by sending an email to [company email address], or by contacting us using the contact details provided in the legal notice.

If processing your data requires us to store information on your device or access information already stored there, the legal basis is section 25(1) and (2) TTDSG.

(4) Duration of data processing

Your data will only be processed for as long as necessary to achieve the processing purposes mentioned above; the legal bases specified within the context of these processing purposes apply accordingly. Regarding the use and storage duration of cookies, please refer to section A.(5) and the Cookie Policy [Link to the Cookie Policy].

Third parties we engage keep your data on their systems for as long as they need it to provide the services we have commissioned.

Further details regarding the storage period can be found under A.(5) and the Cookie Policy [Link to the Cookie Policy].

(5) Transfer of personal data to third parties; legal basis

The following categories of recipients, who are usually data processors (see A.(7)), may have access to your personal data:

• Service providers for the operation of our website and the processing of data stored or transmitted by the systems (e.g., for data centre services, payment processing, IT security). The legal basis for this transfer is then Article 6(1), sentence 1, point (b) or (f) GDPR, unless the service providers are data processors;
• Public bodies and authorities where disclosure is needed to meet a legal obligation. The legal basis is Article 6(1), sentence 1, point (c), GDPR;
• People and organisations involved in running our business (e.g., auditors, banks, insurance companies, legal advisers, supervisory authorities, parties involved in company acquisitions or the establishment of joint ventures). The legal basis for this transfer is then Article 6(1), sentence 1, point (b) or (f) GDPR.

See A.(8) for the safeguards used to ensure an adequate level of data protection when data is transferred to third countries.

Beyond this, we only disclose your personal data to third parties if you have given explicit consent under Article 6(1), sentence 1, point (a), GDPR.

(6) Use of cookies, plugins and other services on our website

a) Cookie

We use cookies on our websites. Cookies are small text files that are stored on your hard drive and assigned to your browser by a unique string of characters. These files allow the website that sets the cookie to receive certain information. Cookies cannot run programs or transmit viruses to your computer and therefore cannot cause any damage. They make our website easier and more efficient to use, giving you a better browsing experience.

Cookies can contain data that allows the device being used to be recognised. However, some cookies only contain information about certain settings that are not personally identifiable. Cookies cannot directly identify a user.

Session cookies are deleted when you close your browser. Persistent cookies remain stored after the session ends. Cookies can also be grouped by what they do:

• Technical cookies: These are strictly necessary to navigate the website, use basic functions and ensure the website's security; they do not collect information about you for marketing purposes nor do they store which websites you have visited;
• Performance cookies: These collect information about how you use our website, which pages you visit, and whether errors occur during website use; they do not collect any information that could identify you – all information collected is anonymous and is only used to improve our website and find out what interests our users;
• Advertising and targeting cookies: these show website visitors relevant advertisements on our website or offers from third parties and measure how effective those offers are. Advertising and targeting cookies are kept for a maximum of 13 months;
• Sharing cookies: These are used to improve the interactivity of our website with other services (e.g. social networks); sharing cookies are stored for a maximum of 13 months.

The legal basis for cookies that are strictly necessary to provide you with the service you have expressly requested is Section 25 Paragraph 2 No. 2 of the German Telecommunications and Telemedia Data Protection Act (TTDSG). Any use of cookies that is not technically essential for this purpose constitutes data processing that is only permitted with your explicit and active consent in accordance with Section 25 Paragraph 1 TTDSG in conjunction with Article 6 Paragraph 1 Sentence 1 Letter a of the GDPR. This applies in particular to the use of performance, advertising, targeting, or sharing cookies. Furthermore, we will only disclose your personal data processed by cookies to third parties if you have given your explicit consent in accordance with Article 6 Paragraph 1 Sentence 1 Letter a of the GDPR.

b) Cookie policy

For more information about which cookies we use and how you can manage your cookie settings and disable certain types of tracking, please see our Cookie Policy [Link to Cookie Policy].

c) Social media plugins

We do not use social media plugins on our websites. If our websites contain icons from social media providers (e.g., [name of social media provider with icons on the company website]), we use these solely for passive linking to the respective providers' pages.

(7) Payment processing

a) Mollie

(1) If you choose to pay at checkout by credit or debit card, on invoice through Klarna, or by Sofortüberweisung via payment service provider Mollie B.V. (referred to below as “Mollie”), Mollie processes the payment. We pass on the information you entered when ordering, together with your order details: name, address, account number, bank code, credit card number where applicable, invoice amount, currency and transaction number. We share these details solely to process the payment through the payment service provider.

(2) Mollie then authenticates the transaction using the authentication method set up with your bank for this purpose. The payment amount is then transferred from your account to ours. Neither we nor third parties have access to your account details.

(3) You can find more information about paying with Mollie in its terms and conditions and privacy policy: https://www.mollie.com/de/privacy

b) Instant bank transfer

(1) Provided you choose the “Sofortüberweisung” payment method, the payment is processed by Sofort GmbH, Theresienhöhe 12, 80339 Munich (following „"Sofort GmbH"“ named) instead of. If If you select payment via instant bank transfer, the payment details you enter will be transmitted to Sofort GmbH.

(2) Through the process „With "Sofortüberweisung" (instant bank transfer), we receive real-time payment confirmation from Sofort GmbH and can immediately begin fulfilling our obligations.

(3) The transaction will by The transaction is executed by Sofort GmbH using your PIN and a valid TAN. In addition to the PIN and TAN, the payment details you enter, as well as your personal data, will be transmitted to Sofort GmbH. This personal data includes your first and last name, address, telephone number(s), and email address.-MEmail address, IP address and possibly other information for payment processing. necessary Data. The transmission of this data is necessary to establish your identity beyond doubt and to prevent fraud.

(4) Data processing is carried out on the basis of Article 6(1). lit. a GDPR (consent) and Art. 6 para. 1 lit. b GDPR (processing for (fulfillment of a contract).

(5) More Details regarding payment via instant bank transfer can be found at the following links: https://www.sofort.de/datenschutz.html and https://www.klarna.com/sofort/.

(8) Use of our Customer account

(1) If you wish to use our online shop via a customer account, You must register by providing your email address, a password of your choice, and your billing address. We use the so-called double-entry authentication method for registration.opt-in procedure, i.e. your registration is only complete when you have confirmed your registration by clicking on the link in the confirmation email sent to you for this purpose. If If we do not receive your confirmation within 24 hours, your registration will be automatically deleted from our database. The previously providedThe aforementioned data is mandatory for using the customer account. AYou can voluntarily obtain further information when using our online shops provide.

(2) If you would like to online shop via customer account to use want, We store your data required for contract fulfillment, including payment information, until you permanently delete your account. We also store any voluntary data you provide for the duration of your account use, unless you delete it beforehand. You can manage and change all information in the secure customer area. The legal basis for this is Article 6 Paragraph 1. lit. f GDPR.

(3) To prevent unauthorised access by third parties to your personal data, especially financial data, the connection is encrypted using TLS technology.

(9) Reviews – ValuedShops

We collect reviews via the ValuedShops platform. When you submit a review through ValuedShops, you are required to provide your name and email address. ValuedShops shares this information with us so that we can link the review to your order. ValuedShops also publishes your name on its own website. In some cases, ValuedShops may contact you to provide an explanation regarding your review. If we ask you to submit a review, we will share your name and email address with ValuedShops. ValuedShops uses this data solely to request a review from you. ValuedShops has implemented appropriate technical and organizational measures to protect your personal data. ValuedShops reserves the right to engage third parties to provide services for which we have granted ValuedShops permission. All of the above guarantees for the protection of your personal data also apply to those parts of the service for which ValuedShops engages third parties.

(10) Email newsletter

When you subscribe to our newsletter, we process your email address solely for the purpose of sending you information about our products, offers, and promotions. The legal basis for this processing is your freely given consent in accordance with Article 6(1)(a) of the GDPR. Your consent will be logged and stored.

We use double opt-in: after signing up, you receive an email asking you to confirm your subscription.

Our newsletter is sent via our newsletter service provider, CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany. We have entered into a data processing agreement (DPA) with CleverReach in accordance with Article 28 of the GDPR. CleverReach processes your data exclusively on our behalf and in accordance with our instructions.

When sending the newsletter, pseudonymised open and click data may be evaluated in order to improve the newsletter and adapt it to your interests.

You can unsubscribe at any time using the link in the newsletter. We will then remove your data from the mailing list unless a legal retention requirement applies. You can also request access to, correction of or erasure of your data at any time.

Further information on data processing by CleverReach can be found in the [CleverReach privacy policy] (https://www.cleverreach.com/en-de/privacy-policy/).