Privacy Statement

We are happy about your interest in our online shop. The protection of your privacy is very important to us. Below, we have provided explicit information about how we handle your data.
The website www.DRYKORN.com as well as the integrated online shop (hereafter 'Website') is operated by the DRYKORN Modevertriebs GmbH & Co. KG, Rudolf Diesel Straße 1a 97318 Kitzingen, Germany (hereafter 'DRYKORN', 'the controller' or 'we'). DRYKORN attaches great importance to the protection of your personal data and collects, processes and uses your personal data exclusively in compliance with the following principle and by observing the applicable data privacy laws, especially the EU-GDPR.

I. Name and address of the controller

The controller in the context of the General Data Protection Regulation, of other data protection laws valid in other member states of the European Union and other provisions that concern data privacy laws is the:
DRYKORN Modevertriebs GmbH & Co. KG
Rudolf-Diesel-Str. 1a
97318 Kitzingen, Deutschland
Tel: +49 93 21 3003-0
Fax: +49 93 21 3003-33
E-Mail: info@drykorn.com
Website: www.drykorn.com

II. Name and address of the Data Privacy Officer

The data privacy officer of the controller is:
External data privacy officer
SACO Software and Consulting GmbH
Peter Schubertr
Mühlgasse 5
D-97840 Hafenlohr
Tel: 09391 90890-0
E-Mail: datenschutz@saco.info

III. General information on data processing

1. Scope of the processing of personal data

In principle, we process personal data of our users only as far as needed to provide a functioning website, as well as content and services. The processing of personal data of our users only takes place regularly following consent of the user. An exception applies in cases in which prior consent cannot be obtained for actual reasons and the processing of the data is permitted by law.

2. Legal basis for the processing of personal data

Provided that we obtain consent from persons concerned for processing procedures of personal data, Article 6, para. 1 let. a of the EU General Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data that are necessary to fulfil a contract whose contracting party is the person concerned, Article 6, para. 1, let. b of the GDPR serves as the legal basis. This also applies for processing procedures that are necessary for the implementation of precontractual actions.
If the processing is necessary for the protection of a justified interest of our company or a third party, and if the interests, fundamental rights and fundamental freedoms of the person concerned do not outweigh first-mentioned interest, then Article 6, para. 1, let. f of the GDPR serves as the legal basis of the processing.

3. Data deletion and storage period

The personal data of the person concerned are deleted or disabled as soon as the purpose for the storage lapses. Data may also be stored if this is provided for by the European or national legislature in EU regulations, laws or other provisions to which the controller is subject. The data are also disabled or deleted if the storage period provided for by the named standards expires, unless a necessity for the continued storage of the data arises for the conclusion or fulfilment of a contract.

IV. Provision of the Website and Creation of Logfiles

1. Description and scope of the data processing

Any time our internet site is retrieved, our system automatically records data and information from the computer system of the retrieving computer. The following data are collected this way:
(1) Information about the browser type and the version used,
(2) The user's operating system,
(3) The user's internet service provider,
(4) The user's IP address,
(5) Date and time of access
(6) Websites from which the user's system reached our internet site
(7) Websites retrieved by the user's system via our website
These data are also stored in our logfiles. Storage of these data together with other personal data of the user does not occur.

2. Legal basis for the processing of data

The legal basis for the temporary storage of the data and logfiles is Article 6, para. 1, let. f of the GDPR.

3. Purpose of the data processing

The temporary storage of the IP address by the system is necessary in order to enable the delivery of the website to the user's computer. For this, the IP address of the user must be stored for the duration of the session.
Data is stored in logfiles in order to guarantee the functionality of the website. The data also serve to optimise the website and to guarantee the security of our information technology systems. The data are not analysed for marketing purposes.
Our authorised interest also rests in these ends of data processing as per Article 6, para. 1, let. f of the GDPR.

4. Duration of the storage

The data are deleted as soon as they are no longer needed to carry out the objective for which they were collected. In the case of the collection of the data for the provision of the website, this comes into effect once the respective session has ended.
In the case of storage of the data in logfiles, this takes effect no later than after seven days. It is possible that the storage is extended beyond this period. In this case, the IP addresses of the users are deleted or masked so that it is no longer possible to attach the data to a retrieving client.

5. Possibility for objection and elimination

The collection of the data for the provision of the website and the storage of the data in logfiles is absolutely necessary for the operation of the website. There is no possibility for objection on the part of the user.

V. Use of Cookies

1. Description and scope of the data processing

Our website uses cookies. Cookies are text files that are stored in the internet browser and/or by the internet browser on the computer system of the user. If a user retrieves a website, then a cookie can be stored in the operating system of the user. This cookie contains an identifying series of characters that enables a unique identification of the browser in subsequent retrievals of the website.
We use cookies to design our website in a more user-friendly manner. Some elements of our website require that the retrieving browser can also be identified following a page change. The following data are stored and transmitted in the cookies:
(1) Language settings,
(2) Items in a shopping cart
(3) Log-in information
On our website we also use cookies that enable the analysis of users' surfing behaviour. In this way, the following data may be transmitted:
(1) Search terms entered
(2) Frequency of site retrievals
(3) Use of website functions
User data collected in this manner are pseudonymised using technical measures. It is therefore no longer possible to attach the data to the retrieving user. The data are not stored together with other, personal user data. When retrieving our website, users are informed of our use of cookies for analytical purposes and directed to this privacy statement. In this context, there is also a note on how the storage of cookies in the browser settings can be prevented.
[Amendment] On retrieval of our website, the user is informed of our use of cookies for analytical purposes and his or her consent is obtained for the processing of personal data used in this context. In this context there is also a reference to this privacy statement.

2. Legal basis for the processing of data

The legal basis for the processing of personal data using technically necessary cookies is contained in Article 6, para. 1, let. f of the GDPR. Your consent as a user is required for the processing of personal data using cookies for analytical purposes; the legal basis for the processing in that instance is Article 6, para. 1, let. a of the GDPR.

3. Purpose of the data processing

The use of technically necessary cookies is intended to simplify the use of websites for users. Some functions of our website cannot be offered with the use of cookies. For these functions, it is necessary that the browser also be recognised following a page change. We require the use of cookies for the following:
(1) Shopping cart
(2) Acceptance of language settings
(3) Remembering search terms
The user data collected from the technically required cookies will not be used to create a user profile.
The use of analysis cookies serves the purpose of improving the quality of our website and its content. Through the use of analysis cookies we learn how the website is used and can therefore continually optimise our offering. Our legitimate interest also rests in these ends of personal data processing as per Article 6, para. 1, let. f of the GDPR.

4. Duration of data retention, opt-out and disposal option
Cookies are stored on the user's computer and transmitted to our site from there. Therefore, you have full control as the user over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your internet browser. Previously saved cookies can be deleted at any time. This can also be done automatically. If cookies for our website are deactivated, it is possible that certain areas of the website may not be fully functional.
Amendment 1: The transmission of flash cookies cannot be prevented via browser settings, but rather through changes in the settings of the flash player.

VI. Newsletter

1. Description and scope of the data processing

You can receive our newsletter free of charge via our internet site. Upon registering for the newsletter, the data will be transmitted to us from the input mask.
In addition, the following data will be collected upon registration:
(1) IP address of the calling computer
(2) Date and time of registration
We are using the services of the Emarsys eMarketing Systems AG, Hans-Fischer-Str. 10, D-80339 München ("Emarsys") for measuring, personalization and dispatching our newsletter. With these services we are able to measure the performance of our newsletters and the way how our customers are interacting with our products. These information are stored in a pseudonymized user profile. You can opt-out to the creation of a user profile by clicking the opt-out link. For further information, please see Emarsys privacy policy.
Your consent is obtained for the processing of the data within the scope of the registration process and reference will be made to the privacy statement.
If you purchase goods via our website and fill in your email address, it may subsequently be used for sending a newsletter. In such a case, the newsletter sent will be exclusively for direct advertising for similar products or services. No data is transmitted to third parties in connection with data processing for the sending of newsletters. The data are used exclusively for the sending of newsletters.

2. Legal basis for the processing of data

The legal basis for the processing of data after login to newsletters by the user is Article 6, para. 1, let. a of the GDPR when there is consent by the user. Legal basis for the sending of the newsletter as a result of the purchase of goods or services is § 7 Par. 3 of the UWG (German Law against Unfair Business Practices).

3. Purpose of the data processing

The elicitation of the user's email address serves the purpose of delivering the newsletter.
The elicitation of other personal data during the registration process serves the purpose of preventing misuse of the services or the email address provided.

4. Duration of the storage

The data are deleted as soon as they are no longer needed to carry out the objective for which they were collected. The user's email address will thus be retained as long as the subscription to the newsletter is active.
As a rule, the miscellaneous personal data collected during the registration process is deleted after a period of 7 days.

5. Possibility for objection and elimination

The subscription to the newsletter can be cancelled at any time by the affected user. There is a link for this purpose in each newsletter. This also allows for a revocation of the consent to the storage of personal data collected during the registration process, as long as the user registered to subscribe to the newsletter.

VII. Registration

1. Description and scope of the data processing

On our website we offer users the option to register by providing personal data. The data are entered into an input mask in the process and transmitted to us and stored. The nature and extent of the data arise directly from the input mask. A transfer of data to third parties does not take place.
The following data are saved at the time of registration:
(1) The IP address of the user
(2) Date and time of registration
As part of the registration process, consent of the user to process this data is obtained.

2. Legal basis for the processing of data

The legal basis for the processing of data is Article 6, para. 1, let. a of the GDPR when there is consent by the user. If the registration serves the purpose of fulfilment of a contract of which the user is a party or the implementation of pre-contractual measures, then the additional legal basis for the processing of the data is Article 6, para. 1, let. b of the GDPR.

3. Purpose of the data processing

Registration of the user is required to execute a contract with the user or to conduct pre-contractual measures.

4. Duration of the storage

The data are deleted as soon as they are no longer needed to carry out the objective for which they were collected. This is the case during the registration process for the performance of a contract or for conducting pre-contractual measures, if the data for the execution of the contract are no longer required. We only continue to store the personal data of the contractual partner after contract implementation, in order to comply with contractual or legal obligations.

5. Possibility for objection and elimination

As a user, you have the option to cancel the registration at any time. You can have your saved data modified at any time. If the data is required for the fulfilment of a contract or for conducting pre-contractual measures, an early deletion of data is only possible, as long as contractual or legal obligations do not stand in the way of a deletion.

VIII. Email contact

1. Description and scope of the data processing

You can use the e-mail address provided in the CONTACT section (service@drykorn.com) to contact us. In this case, your personal data transmitted with the e-mail is saved. In this context, there is no transfer of data to third parties. The data are used exclusively for processing the conversation.

2. Legal basis for the processing of data

The legal basis for the processing of data that are transmitted as part of sending an email is Article 6, para. 1, let. f of the GDPR. If the email contact is aimed at concluding a contract, then the additional legal basis for the processing is Article, 6, para. 1, let. b of the GDPR.

3. Purpose of the data processing

The processing of the personal data from the input mask is intended solely for the processing of the contact. In the event of a first contact made via e-mail, the necessary legitimate interest in the processing of the data, Article 6, para.1, let. f of the GDPR lies in this.
Other personal data processed during the dispatching process serves to prevent a misuse of the contact form and to ensure the security of our information technology systems.

4. Duration of the storage

The data are deleted as soon as they are no longer needed to carry out the objective for which they were collected. For personal data sent via e-mail, this is the case when the conversation with the user is finished. The conversation is then finished, if it is clear from the circumstances that the issue concerned is conclusively resolved.
The additional personal data collected during the dispatching process will be deleted after no later than a period of seven days.

5. Possibility for objection and elimination

You have the option to revoke your consent for processing personal data at any time and to object to the storage of your personal data. In this case, the dialogue cannot be continued. All personal data that were saved in the course of making contact will then be deleted.

IX. Web analysis by Google Analytics

1. Description and scope of the data processing

We use, provided the user has granted consent, Google Analytics on our website, a web analysis tool by Google Inc.
The use comprises the service Universal Analytics, which makes it possible for us to assign interactions like sessions and data on multiple devices a pseudonym user ID and thus analyse the activities of a user across different devices. Google Analytics uses cookies (text files) that are stored on a user's computer and enable the analysis of how the user uses our website. As a rule, the information generated as a result is transmitted to a Google server in the USA and stored there. If the IP anonymisation is activated via our website, Google shortens the user IP address to be able to use it within European Union Member States or in other contracting states of the agreement across the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. We have expanded the Google Analytics service within our website to include IP anonymisation ,in order to guarantee IP masking, that is, the anonymised gathering of IP addresses. The IP address transmitted from your browser via Google Analytics will not be merged with other Google data. You can find more information on the terms of use and data protection at https://www.google.com/analytics/terms/de.html.

2. Purposes of processing

Google uses this information on our account to evaluate your use of our website, to put together reports on website activities and to provide us with continued services related to website and internet usage.

3. Legal basis

The legal basis for the use of Google Analytics is your consent, Article 6, para. 1, clause 1, let. a GDPR.

4. Recipient / categories of recipients

The recipient of the data collected is Google.

5. Transmission to non-member countries

The personal data generated via Google Analytics are transmitted to the USA under the EU-US Privacy Shield on the basis of the European Commission's suitability resolution. The certificate can be viewed at https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI

6. Duration of data storage

The data linked with cookies, user identification or advertising IDs is automatically deleted after 14 months. Such data deletion is automatically conducted once a month.

X. Social media plug-ins

1. Description, scope and legal basis of data processing

So-called social plug-ins ("plug-ins") from social networks like Facebook, Google, Twitter, Instagram and Pinterest are used on our website. When you retrieve a page within our website that contains such a plug-in, your computer's browser will establish a direct link to the servers of Facebook, Google, Twitter or Instagram. The contents of the plug-in from the respective provider will be transmitted to your browser and integrated into the page. By integrating the plug-in, the providers receive information that your browser retrieved the relevant page of our website, even if you do not have a profile or are not currently logged in. This information (including your IP address) is transmitted from your browser directly to a server of the respective provider (possibly in the USA) and stored there. If you are logged in with one of the services, the provider can directly associate the visit to our website with your profile in the respective social network. If you interact with the plug-ins, e.g. activate the 'like' or 'share' buttons, the respective information is also transmitted directly to one of the provider's servers and saved there. The information is also published in the social network and shown to your contacts there. This serves to safeguard our predominant, legitimate interests in the optimal commercialisation of our range of products in the context of a balancing of interests as per Article 6, para. 1, clause 1, let. f of the GDPR.

2. Purposes of the processing

The purpose and scope of the data collection and the further processing and utilisation of the data by the provider, as well as a contact opportunity and your rights related to this and configuration options for the protection of you privacy are to be taken from the data protection notifications of the respective provider.
In order to prevent the social networks from attaching data collected directly via our web presence to your profile in the respective service, you must log out of our website prior to visiting the corresponding service. You can also completely prevent plug-ins from being loaded by using add-ons, e.g., with the script blocker 'NoScript' (http://noscript.net/).

XI. YouTube Video Plug-ins

We embed content from third-party providers on our website via YouTube. This content is provided by Google LLC ('Provider'). YouTube is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ('Google').
For YouTube videos embedded on our website, the extended privacy setting is activated. That means that no information of visitors to the website is collected and stored by YouTube, unless visitors play the video. The embedding of videos serves to safeguard our predominant, legitimate interests in the optimal commercialisation of our range of products in the context of a balancing of interests as per Article 6, para. 1, clause 1, let. f of the GDPR. The purpose and scope of the data collection and the further processing and utilisation of the data by the provider, as well as a contact opportunity and your rights related to this and configuration options for the protection of you privacy are to be taken from the data protection notifications of Google http://www.google.com/intl/de/+/policy/+1button.html.

XII. Rights of the person concerned

If personal data of yours are processed, then you are the person concerned for the purpose of the GDPR and you are afforded the following rights in regards to us as the controller:

1. Right to information

You can ask us as the controller for a confirmation of whether personal data concerning you are processed by us. If such a processing exists, you can demand disclosure about the following information:
a) the purposes for which the personal data are processed;
b) the categories of personal data that are processed;
c) the recipients and/or categories of recipients to whom was revealed the personal data concerning you or are still being revealed;
d) the planned duration of the storage of the personal data that concern you or, in case concrete details on this are not possible, criteria for the determination of the duration of storage;
e) the existence of a right to rectification or erasure of the personal data concerning you, a right of limitation of the processing by the controller or a right to object against this processing;
f) the existence of a right of appeal with a supervisory authority;
g) all available information about the provenance of the data, if the personal data are not directly collected from you as the person concerned;
h) the existence of an automated decision making, including profiling as per Article 22, paragraphs 1 and 4 of the GDPR and - at least in these instances - meaningful information about the involved rationale and scope and the sought-after effects of such a processing for the person concerned.
i) you have the right to demand information about whether the personal data concerning you are transmitted to a third country or to an international organisation. In this framework, you can demand to be informed about the appropriate guarantees pursuant to Article 46 of the GDPR in the context of the transmission.

2. Right to rectification

You have a right to rectification and/or completion in respect to the controller, insofar as the processed, personal data that affect you are incorrect or incomplete. The controller is required to carry out the correction promptly.

3. Right to limitation of the processing

Under the following conditions, you can demand the limitation of the processing of the personal data that concern you:
a) if you dispute the correctness of the personal data that concern you for a length of time that enables us to verify the correctness of the personal data;
b) the processing is unlawful and you reject the erasure of the personal data and instead demand the limitation of the use of the personal data;
c) we no longer require the personal data for the purpose of the processing, however you require these for the assertion, exercise or defence of legal claims, or
d) if you have filed an objection against the processing pursuant to Article 21, para. 1 of the GDPR and it has not yet been determined, whether the legitimate grounds for the controller outweigh your grounds.
If the processing of the personal data concerning you was limited, these data may - apart from their storage - only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or on the grounds of an important public matter of interest of the state or of a member state of the European Union.
If the limitation of the processing was limited according to the above-mentioned conditions, you will be informed before the limitation is lifted.

4. Right to erasure

a) Obligation to erase
You can require us to erase promptly all personal data that concern you; we are obligated to erase these data promptly, as long as one of the following reasons applies:
(1) The personal data that concern you are for purposes for which they were collected or otherwise processed are no longer ncessary.
(2) You withdraw your consent upon which rests the processing pursuant to Article 6, para. 1, let. a or Article 9, para. 2, let. a of the GDPR and there is not other legal basis for the processing.
(3) You submit an objection pursuant to Article 21, para. 1 of the GDPR against the processing and there are no overriding legitimate grounds for the processing, or you submit an objection pursuant to Article 21, para. 2 of the GDPR against the processing.
(4) The personal data concerning you were processed unlawfully.
(5) The erasure of the personal data concerning you is necessary for the fulfilment of a legal obligation pursuant to EU law or the law of the member states which the controller is subject to.
(6) The personal data concerning you were collected in regard to offered services by the information society pursuant to Article 8, para. 1 of the GDPR.

b) Information to third parties
If we as the controller have made the personal data concerning you public and if we are so obligated pursuant to Article 17, para. 1 of the GDPR, we will take available measures, including technical ones, to inform data controllers, subject to the technology and implementation costs, of erasing all links to such personal data or copies or replications of such personal data that you as the person concerned have requested.

c) Exceptions
The right to erasure does not apply, if the processing is necessary
(1) for the exercise of the right to freedom of expression and information;
(2) to fulfil a legal obligation that requires processing in accordance with EU or Member State law to which the controller is subject, or for the execution of a task of public interest, or in the exercise of official authority conferring on the controller, or
(3) to assert, exercise or defend legal claims.

5. Right to information
If you have asserted your right to correction, erasure or limitation of the processing in respect to the controller, they are obligated to inform all recipients with whom they have shared personal data concerning you of this correction or erasure of the data or the limitation of the processing, unless this proves to be impossible or is associated with an disproportionate expense.
You have the right to be informed by the controller about these recipients.

6. Right to data portability

You have the right to obtain the personal data that concern you which you have provided to us in a structured, accessible and machine-readable format. Furthermore, you have the right to demand that we transfer these data to another controller, as long as
a) the processing is based on consent pursuant to Article 6, para. 1, let a of the GDPR or on a contract pursuant to Article 6, para. 1, let. b of the GDPR and
b) the processing takes place by means an automatic procedure and
c) freedoms and rights of other person may not be adversely affected by this.

7. Right to object

If the processing of you personal data takes place on the basis of Article 6, para. 1, let. e or f of the GDPR, you have the right to submit an objection against the processing at any time on grounds that arise due to your particular situation; this also applies for a profiling that is based on these provisions.
We will then no longer process the personal data that concern you, unless we are able to demonstrate compelling grounds that are worthy of protection for the processing that outweigh your interests, rights and freedoms, or that the processing serves the assertion, exercise or defence of legal claims.
If the personal data concerning you are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is associated with such direct marketing. If you object to the processing for purposes of direct marketing, the personal data concerning you will no longer be used for these purposes.
You have the option, in the context of the use of information society services - regardless of Directive 2002/58/EC - of exercising your right to object through automated procedures that use technical specifications.

8. Right to rescind your data protection consent declaration

You have the right to rescind your data protection consent declaration at any time. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent up to the revocation.

9. Automated decision on a case-by-case basis, including profiling
You have the right to not be subjected to decision based exclusively on an automated processing, including profiling, that has a legal effect in respect to you or significantly, adversely impacts you in a similar manner. This does not apply, if the decision
(1) is necessary for the conclusion or fulfilment of a contract between you and the controller,
(2) is permissible due to legal regulations of the EU or of the Member States to which the controller is subject and these legal regulations contain appropriate measures for the safeguarding of your rights and freedoms, as well as your legitimate interests or
(3) takes place with your explicit consent.
However, these decisions must not be based on special categories of personal data under Article 9, para. 1 of the GDPR, unless Article 9, para. 2 lit. a or g of the GDPR applies and appropriate measures have been taken to protect the rights and freedoms as well as your legitimate interests.
With regard to the cases referred to in (1) and (3), the controller shall take appropriate measures to uphold the rights and freedoms as well as their legitimate interests, including at least the right to obtain the intervention of a person by the controller, to express his or her own position and heard on challenge of the decision.

10. Right of appeal with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to appeal to a supervisory authority, in particular in the Member State of its residence, place of work or place of alleged infringement, if you believe that the processing of the personal data concerning you violates the GDPR.
The supervisory authority in receipt of the appeal informs the complainant of the status and results of the appeal including the possibility of a legal remedy pursuant to Article 78 of the GDPR.

As at: November 2020