Privacy policy

1) Introduction and Contact Information of the Data Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how we handle your personal data when you use our website. Personal data refers to any data that can be used to personally identify you.

1.2 The data controller for this website within the meaning of the General Data Protection Regulation (GDPR) is Christian Schramm, Dorfstr. 15a, 91096 Möhrendorf, Germany, Tel.: 0171 / 1429021, Email: shop@orthorad.de. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
2) Data Collection When Visiting Our Website

2.1 When you use our website solely for informational purposes—that is, if you do not register or otherwise provide us with information—we collect only the data that your browser transmits to the website server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

The website you visited
Date and time of access
Amount of data transmitted in bytes
Source/link from which you accessed the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Data processing is carried out in accordance with Article 6(1)(f) of the GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the “https://” prefix and the padlock icon in your browser’s address bar.
3) Cookies

To make your visit to our website more enjoyable and to enable the use of certain features, we use cookies—small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your device for a longer period and allow page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

If personal data is processed through individual cookies we use, such processing is carried out in accordance with Article 6(1)(b) of the GDPR either for the performance of a contract, in accordance with Article 6(1)(a) of the GDPR if consent has been given, or in accordance with Article 6(1)(f) of the GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a user-friendly and effective experience for visitors.

You can configure your browser to notify you when cookies are set and decide on a case-by-case basis whether to accept them, or to block the acceptance of cookies in specific cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.
4) Contacting Us

When you contact us (e.g., via the contact form or email), personal data is processed—exclusively for the purpose of handling and responding to your inquiry and only to the extent necessary for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) of the GDPR. If your contact is aimed at entering into a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. Your data will be deleted once it is clear from the circumstances that the matter in question has been conclusively resolved, provided that no statutory retention obligations preclude this.
5) Data Processing When Opening a Customer Account

In accordance with Article 6(1)(b) of the GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. You can find out which data is required to open an account by referring to the input fields of the corresponding form on our website.

You may delete your customer account at any time by sending a message to the address of the data controller listed above. After your customer account is deleted, your data will be deleted provided that all contracts concluded through it have been fully fulfilled, there are no statutory retention periods that prevent this, and we no longer have a legitimate interest in continuing to store the data.
6) Use of Customer Data for Direct Marketing

Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only required information for receiving the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. To send the newsletter, we use the so-called double opt-in procedure, which ensures that you will only receive the newsletter once you have expressly confirmed your consent to receive it by clicking on a verification link sent to the email address you provided.

By clicking the confirmation link, you give us your consent to use your personal data in accordance with Article 6(1)(a) of the GDPR. In doing so, we store your IP address as provided by your Internet Service Provider (ISP), as well as the date and time of registration, so that we can investigate any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time by clicking the link provided in the newsletter or by sending a message to the data controller named at the beginning of this notice. Once you have unsubscribed, your email address will be deleted immediately from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this scope, which is permitted by law and about which we inform you in this statement.
7) Data Processing for Order Fulfilment

7.1 To the extent necessary for the fulfillment of the contract for delivery and payment purposes, the personal data we collect will be transferred to the contracted shipping company and the contracted financial institution in accordance with Article 6(1)(b) of the GDPR.

If, based on a relevant contract, we are obligated to provide you with updates for goods containing digital elements or for digital products, we will process the contact information you provided when placing your order (name, address, email address) to personally inform you, in accordance with our legal obligations to provide information under Article 6(1)(c) of the GDPR, via an appropriate communication channel (such as by mail or email) about upcoming updates within the timeframe prescribed by law. Your contact information is used strictly for the specific purpose of notifying you about updates we are obligated to provide and is processed by us for this purpose only to the extent necessary to provide the respective information.

To process your order, we also work with the following service provider(s), who assist us, in whole or in part, in fulfilling concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

7.2 Use of Payment Service Providers

- Apple Pay

If you choose the “Apple Pay” payment method offered by Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment will be processed via the “Apple Pay” feature on your iOS, watchOS, or macOS device by charging a payment card stored in “Apple Pay.” Apple Pay uses security features built into your device’s hardware and software to protect your transactions. To authorize a payment, you must therefore enter a code you have previously set and verify your identity using your device’s “Face ID” or “Touch ID” feature.

For the purpose of processing the payment, the information you provided during the ordering process, along with details about your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data using a developer-specific key before transmitting it to the payment service provider associated with the payment card stored in Apple Pay to complete the transaction. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.

To the extent that personal data is processed in connection with the transfers described above, such processing is carried out exclusively for the purpose of payment processing in accordance with Article 6(1)(b) of the GDPR.

Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was successfully completed. Anonymization completely precludes any link to an individual. Apple uses the anonymized data to improve “Apple Pay” and other Apple products and services.

When you use Apple Pay on your iPhone or Apple Watch to complete a purchase you initiated via Safari on your Mac, the Mac and the authorization device communicate via an encrypted channel through Apple’s servers. Apple does not process or store any of this information in a format that could be used to identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone’s Settings. Go to “Wallet & Apple Pay” and turn off “Allow Payments on Mac.”

For more information about Apple Pay’s privacy practices, visit the following website: https://support.apple.com/de-de/HT203027

- PayPal

This website offers one or more online payment methods from the following provider: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method from this provider that requires you to pay in advance, your payment details provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be shared with the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method where we cover the cost upfront, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, ZIP code, city, date of birth, email address, phone number, and, if applicable, details regarding an alternative payment method).

In order to safeguard our legitimate interest in determining your creditworthiness in such cases, we will forward this data to the provider in accordance with Article 6(1)(f) of the GDPR for the purpose of a credit check. Based on the personal data you have provided, as well as additional data (such as your shopping cart, invoice amount, order history, and payment history), the provider assesses whether the payment option you have selected can be granted in light of the risks of non-payment and/or bad debt.

The credit report may contain probability values (so-called “score” values). To the extent that score values are included in the credit report’s results, they are based on a scientifically recognized mathematical-statistical method. The calculation of these score values includes, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.
- SOFORT

This website offers one or more online payment methods from the following provider: SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany

If you select a payment method from this provider that requires you to pay in advance (such as credit card payment), your payment details provided during the ordering process (including name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be shared with the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.
8) Web Analytics Services

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables an analysis of your use of our website.

By default, when you visit the website, Google Analytics 4 sets cookies, which are small text files stored on your device and collect certain information. This information includes your IP address; however, Google truncates the last few digits of your IP address to prevent direct identification of individuals.

The information is transmitted to Google’s servers and processed there. This may also involve transfers to Google LLC, which is headquartered in the United States.

Google uses the information collected on our behalf to analyze your use of the website, compile reports on website activity for us, and provide other services related to website and internet usage. The IP address transmitted by your browser as part of Google Analytics and truncated is not combined with other data held by Google. The data collected through the use of Google Analytics 4 is stored for a period of two months and then deleted.

All processing described above, in particular the placement of cookies on the device you are using, takes place only if you have given us your explicit consent in accordance with Art. 6(1)(a) of the GDPR.
Without your consent, Google Analytics 4 will not be used during your visit to the site. You may revoke your consent at any time with future effect. To exercise your right to withdraw consent, please disable this service using the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with Google that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For additional legal information regarding Google Analytics 4, please visit https://policies.google.com/privacy?hl=de&gl=de and https://policies.google.com/technologies/partner-sites

Demographic Characteristics
Google Analytics 4 uses the special “demographic characteristics” feature to generate statistics that provide insights into the age, gender, and interests of website visitors. This is done by analyzing advertising and third-party information. This allows target groups to be identified for marketing activities. However, the collected data cannot be attributed to any specific individual and is deleted after being stored for a period of two months.

Google Signals
As an extension to Google Analytics 4, Google Signals can be used on this website to generate cross-device reports. If you have enabled personalized ads and linked your devices to your Google Account, Google may—subject to your consent to the use of Google Analytics pursuant to Article 6(1)(a) of the GDPR—analyze your usage behavior across devices and create database models, including those related to cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can disable the “Personalized Ads” feature in your Google Account settings. To do so, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de For more information about Google Signals, please visit the following link: https://support.google.com/analytics/answer/7532985?hl=de

UserIDs
As an extension of Google Analytics 4, the “UserIDs” feature may be used on this website. If you have consented to the use of Google Analytics 4 in accordance with Art. 6(1)(a) of the GDPR, have set up an account on this website, and log in to this account on various devices, your activities—including conversions—can be analyzed across devices.

For data transfers to the U.S., the provider has joined the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.
9) Retargeting/Remarketing and Conversion Tracking

Facebook Pixel for creating Custom Audiences with extended data matching (with cookie consent tool)

Within our online platform, we use the “Facebook Pixel” service from the following provider in extended data matching mode: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”)

If a user clicks on an advertisement we have placed on Facebook, “Facebook Pixel” adds a parameter to the URL of our linked page. After the user is redirected, this URL parameter is then stored in the user’s browser via a cookie set by our linked page itself. In addition, this cookie collects specific customer data—such as the email address—that we collect on our website linked to the Facebook ad during processes such as purchase transactions, account logins, or registrations (extended data matching). The cookie is then read, enabling the transmission of the data—including the specific customer data—to Facebook.

We use “Facebook Pixel” with advanced data matching to make our Facebook ads more effective and to ensure that they align with users’ interests or reflect specific characteristics (e.g., interests in certain topics or products, as determined by the websites they visit), which we transmit to Facebook (so-called “Custom Audiences”).

In addition, we analyze the effectiveness of our ads by tracking whether users were redirected to our website after clicking on an ad (conversion). Compared to the standard version of “Facebook Pixel,” the extended data matching feature helps us better measure the effectiveness of our advertising campaigns by capturing more attributed conversions.

All transmitted data is stored and processed by Facebook, enabling it to be associated with the respective user profile and allowing Facebook to use the data for its own advertising purposes in accordance with Facebook’s Data Use Policies (https://www.facebook.com/about/privacy/). The data may enable Facebook and its partners to serve ads on and off Facebook.

All processing described above—in particular, the setting of cookies to read information from the device you are using—will only be carried out if you have given us your explicit consent in accordance with Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by deactivating this service in the “Cookie Consent Tool” provided on the website.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

The information generated by Facebook is generally transmitted to and stored on a Facebook server; in this context, it may also be transferred to servers operated by Meta Platforms Inc. in the United States.

- Lexoffice

To handle our bookkeeping, we use the cloud-based accounting software service provided by the following vendor: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany

The provider processes incoming and outgoing invoices, as well as our company’s bank transactions where applicable, to automatically capture invoices, match them to the corresponding transactions, and use this data to prepare financial accounting records through a semi-automated process.

To the extent that personal data is processed in this context, such processing is carried out in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest in the efficient organization and documentation of our business processes.
11) Rights of the Data Subject

11.1 Applicable data protection law grants you the following rights as a data subject (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data; please refer to the cited legal basis for the respective conditions for exercising these rights:

Right of access pursuant to Article 15 of the GDPR;
Right to rectification pursuant to Article 16 of the GDPR;
Right to erasure pursuant to Article 17 of the GDPR;
Right to restriction of processing pursuant to Article 18 of the GDPR;
Right to be informed pursuant to Article 19 of the GDPR;
Right to data portability pursuant to Article 20 of the GDPR;
Right to withdraw consent pursuant to Article 7(3) of the GDPR;
Right to lodge a complaint pursuant to Article 77 of the GDPR.

11.2 RIGHT TO OBJECT

IF, AS PART OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR SPECIFIC SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE RELEVANT DATA. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THIS RIGHT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE RELEVANT DATA FOR DIRECT MARKETING PURPOSES.
12) Retention Period for Personal Data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing, and—where applicable—the respective statutory retention period (e.g., retention periods under commercial and tax law).

When processing personal data based on explicit consent pursuant to Article 6(1)(a) of the GDPR, the data in question will be stored until you withdraw your consent.

If there are statutory retention periods for data processed in connection with contractual or quasi-contractual obligations pursuant to Article 6(1)(b) of the GDPR, this data will be routinely deleted upon expiration of the retention periods, provided that it is no longer necessary for the performance of a contract or for entering into a contract and/or we no longer have a legitimate interest in continuing to store it.

When processing personal data based on Article 6(1)(f) of the GDPR, this data will be stored until you exercise your right to object under Article 21(1) of the GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

When processing personal data for the purpose of direct marketing based on Article 6(1)(f) of the GDPR, this data will be stored until you exercise your right to object under Article 21(2) of the GDPR.

Unless otherwise specified in the other information contained in this statement regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.