Privacy Policy

1. Introduction

Below, we provide information about the processing of personal data when using

  • our website https://ingarden.de
  • our social media profiles.

Personal data is any data that can be related to a specific natural person, e.g. their name or IP address.

1.1. Contact details

The controller within the meaning of Art. 4(7) of the EU General Data Protection Regulation (GDPR) is ingarden GmbH, Mühlenstraße 8a, 14167 Berlin, Germany, email: info.de@ingarden.com. We are legally represented by Christian Saitner.

1.2. Scope of data processing, purposes and legal bases

We explain the scope of data processing, the purposes and the legal bases in detail below. The following legal bases generally apply:

  • Art. 6(1)(a) GDPR is our legal basis for processing operations for which we obtain consent.
  • Art. 6(1)(b) GDPR is the legal basis insofar as the processing of personal data is necessary for the performance of a contract, e.g. when a visitor purchases a product from us or we provide a service for them. This legal basis also applies to processing necessary for pre-contractual measures, such as enquiries about our products or services.
  • Art. 6(1)(c) GDPR applies where we process personal data to comply with a legal obligation, as may be the case under tax law, for example.
  • Art. 6(1)(f) GDPR is the legal basis where we can rely on legitimate interests for processing personal data, e.g. for cookies that are necessary for the technical operation of our website.

1.3. Data processing outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, the security of the data during the transfer is guaranteed by adequacy decisions of the European Commission (Art. 45(3) GDPR), where available, e.g. for Canada, Israel and the United Kingdom.

For recipients in the USA that are certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR).

Where no adequacy decision exists or the recipient is not certified, the legal basis for the transfer is generally – unless we state otherwise – standard contractual clauses. These are a set of rules adopted by the European Commission and form part of the contract with the respective third party. Under Art. 46(2)(c) GDPR, they ensure the security of the data transfer. Many providers have given contractual guarantees that go beyond the standard contractual clauses, e.g. regarding the encryption of data or an obligation of the third party to notify data subjects if law enforcement authorities wish to access data.

1.4. Storage period

Unless expressly stated otherwise in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and no statutory retention obligations prevent deletion. If the data is not deleted because it is required for other and legally permissible purposes, its processing will be restricted, i.e. the data will be blocked and not processed for other purposes. This applies, for example, to data that we must retain for commercial or tax law reasons.

1.5. Rights of data subjects

Data subjects have the following rights vis-à-vis us with regard to the personal data concerning them:

  • right of access,
  • right to rectification or erasure,
  • right to restriction of processing,
  • right to object to processing,
  • right to data portability,
  • right to withdraw consent at any time.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority about the processing of their personal data.

1.6. Obligation to provide data

Within a business or other relationship, customers, prospective customers or third parties only need to provide us with the personal data that is necessary for establishing, performing and terminating the business or other relationship, or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude a contract or provide a service, or will no longer be able to perform an existing contract or other relationship.

Mandatory information is marked as such.

1.7. No automated individual decision-making

We generally do not use fully automated decision-making pursuant to Art. 22 GDPR to establish and conduct a business or other relationship. Should we use such procedures in individual cases, we will inform you separately where required by law.

1.8. Contacting us

When you contact us, e.g. by email or telephone, we store the data you provide (e.g. names and email addresses) in order to answer your questions. The legal basis for this processing is our legitimate interest in answering enquiries addressed to us (Art. 6(1)(f) GDPR). We delete the data arising in this context once storage is no longer necessary, or restrict processing if statutory retention obligations apply.

1.9. Prize draws

From time to time, we offer prize draws via our website or in other ways. We process the data requested in this context to determine and notify the winners. We then delete the data. We may also offer prize draws only to existing customers. In that case, we only process the name to determine the winners and the contact details to notify them. It is in our legitimate interest to offer prize draws to acquire customers or interact with existing customers. The legal basis for the data processing is Art. 6(1)(f) GDPR.

1.10. Customer surveys

From time to time, we conduct customer surveys to get to know our customers and their wishes better. We collect the data requested in each case. It is in our legitimate interest to get to know our customers and their wishes better, so the legal basis for the associated data processing is Art. 6(1)(f) GDPR. We delete the data once the survey results have been evaluated.

2. Newsletter

We reserve the right to inform customers who have already used our services or purchased goods from us about our offers from time to time by email or other electronic means, unless they have objected to this. The legal basis for this data processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in direct marketing (Recital 47 GDPR). Customers can object to the use of their email address for advertising purposes at any time without incurring additional costs, for example via the link at the end of each email or by email to our email address stated above.

Interested parties can subscribe to a free newsletter. We process the data provided during registration exclusively for sending the newsletter. Registration takes place by selecting the corresponding field on our website, by ticking the corresponding box in a paper document or by another unambiguous action by which interested parties consent to the processing of their data, so the legal basis is Art. 6(1)(a) GDPR. Consent can be withdrawn at any time, e.g. by clicking the corresponding link in the newsletter or by notifying us at the email address stated above. The processing of data up to the withdrawal remains lawful.

Based on the recipients’ consent (Art. 6(1)(a) GDPR), we also measure the open and click rates of our newsletters to understand which content is relevant to our recipients.

We send newsletters with the Klaviyo tool from Klaviyo, Inc., 125 Summer St, Floor 6, Boston, MA 02111, USA (privacy information: https://www.klaviyo.com/legal/dpa). The provider processes content, usage, meta/communication and contact data in the USA.

3. Data processing on our website

3.1. Informational use of the website

When the website is used for information purposes only, i.e. when visitors do not otherwise transmit information to us, we collect the personal data that the browser transmits to our server in order to ensure the stability and security of our website. This is our legitimate interest, so the legal basis is Art. 6(1)(f) GDPR.

This data is: IP address, date and time of the request, time zone difference to Greenwich Mean Time (GMT), content of the request (specific page), access status/HTTP status code, amount of data transferred, website from which the request comes, browser, operating system and its interface, language and version of the browser software.

This data is also stored in log files. It is deleted when its storage is no longer necessary, at the latest after 14 days.

3.2. Web hosting and provision of the website

Our website is hosted by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (privacy information: https://www.shopify.com/legal/privacy). The provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication or contact data. It is our legitimate interest to provide a website, so the legal basis for the data processing is Art. 6(1)(f) GDPR.

We use a content delivery network that helps us provide our website. The provider is Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA (privacy information: https://aws.amazon.com/privacy/). The provider processes the personal data transmitted via the website, e.g. content, usage, meta/communication or contact data. It is our legitimate interest to provide a website, so the legal basis for the data processing is Art. 6(1)(f) GDPR.

3.3. Contact form

When you contact us via the contact form on our website, we store the data requested there and the content of the message. The legal basis for the processing is our legitimate interest in answering enquiries addressed to us (Art. 6(1)(f) GDPR). We delete the data arising in this context once storage is no longer necessary, or restrict processing if statutory retention obligations apply.

3.4. Job advertisements

We publish vacancies in our company on our website, on pages linked to the website or on third-party websites.

The data provided in the application is processed to carry out the application procedure. Insofar as this data is necessary for our decision to establish an employment relationship, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). We have marked or indicated the data required to carry out the application procedure. If applicants do not provide this data, we cannot process the application.

Further data is voluntary and not required for an application. If applicants provide further information, this is based on their consent (Art. 6(1)(a) GDPR).

We ask applicants not to include information on political opinions, religious beliefs or similarly sensitive data in their CV and cover letter. Such information is not required for an application. If applicants nevertheless provide such information, we cannot prevent its processing as part of processing the CV or cover letter. Its processing is then also based on the applicants’ consent (Art. 9(2)(a) GDPR).

Finally, we process applicants’ data for further application procedures if they have given us their consent to do so. In this case, the legal basis is Art. 6(1)(a) GDPR.

We pass applicants’ data on to the responsible employees in the HR department, to our processors in the field of recruiting and to other employees involved in the application process.

If we enter into an employment relationship with the applicant following the application procedure, we only delete the data after the employment relationship has ended. Otherwise, we delete the data no later than six months after rejecting an applicant. If applicants have consented to their data also being used for further application procedures, we only delete their data one year after receipt of the application.

3.5. Customer account

Visitors can open a customer account on our website. We process the data requested in this context to perform the user agreement concluded for the account, so the legal basis for the processing is Art. 6(1)(b) GDPR.

3.6. Offering goods or services

We offer goods or services via our website. We involve service providers in the ordering process or shipping who only receive the personal data required in each case to provide their service. The data is processed to perform the contract concluded with the respective visitor (Art. 6(1)(b) GDPR).

3.7. Payment service providers

To process payments, we use payment processors that are themselves controllers within the meaning of Art. 4(7) GDPR. Insofar as they receive data entered in the ordering process and payment data from us, we thereby perform the contract concluded with our customers (Art. 6(1)(b) GDPR). These payment processors are:

  • PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
  • Braintree (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
  • Shopify International Limited, Ireland
  • Amazon Payments Europe S.C.A., Luxembourg
  • Klarna Bank AB (publ), Sweden

3.8. Third-party tools

Insofar as the processing described below is based on consent (Art. 6(1)(a) GDPR), data subjects can withdraw their consent at any time with effect for the future, e.g. via the cookie settings on our website or using the contact details stated above. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

3.8.1. Later
For our social media presence, we use the analytics tool “Later” from Victory Square Media Inc., 88 E Pender Street, #500 Vancouver, Canada, to review the effectiveness of our advertising based on user behaviour. The legal basis is Art. 6(1)(f) GDPR. The data collected in this way is anonymous for us, i.e. we do not see the personal data of individual users. The provider has concluded a data processing agreement with us. According to a decision of the European Commission, Canada has an adequate level of data protection.

3.8.2. Shopify
We use Shopify to operate our online shop. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. The provider processes meta/communication data (e.g. device information, IP addresses) in the EU. Insofar as cookies or similar technologies that are not technically necessary are used for this, the processing is based on your consent (Art. 6(1)(a) GDPR). The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents deletion. Further information: https://www.shopify.com/legal/privacy.

3.8.3. Microsoft Advertising (Bing Ads)
We use Microsoft Advertising for analysis and advertising. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. The provider processes meta/communication data (e.g. device information, IP addresses) and usage data (e.g. websites visited, interest in content, access times) in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which the provider is certified. We delete the data when the purpose of its collection no longer applies. Further information: https://privacy.microsoft.com/en-gb/privacystatement.

3.8.4. Meta Custom Audiences
We use Custom Audiences for advertising. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times), including in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). We delete the data when the purpose of its collection no longer applies. Further information: https://www.facebook.com/privacy/policy.

3.8.5. Google Web Fonts
We use Google Web Fonts for fonts on the website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes meta/communication data (e.g. device information, IP addresses), including in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). Further information: https://policies.google.com/privacy?hl=en.

3.8.6. Google Ads
We use Google Ads for advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses), including in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). We delete the data when the purpose of its collection no longer applies. Further information: https://policies.google.com/privacy?hl=en.

3.8.7. Google Analytics
We use Google Analytics for analysis. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses), including in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents deletion. Further information: https://policies.google.com/privacy?hl=en.

3.8.8. Google Marketing Platform
We use Google Marketing Platform for analysis and advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times) and meta/communication data (e.g. device information, IP addresses), including in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). We delete the data when the purpose of its collection no longer applies. Further information: https://policies.google.com/privacy?hl=en.

3.8.9. Google Tag Manager
We use Google Tag Manager to manage analytics and advertising tools. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times), including in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). We delete the data when the purpose of its collection no longer applies. Further information: https://policies.google.com/privacy?hl=en.

3.8.10. Meta Pixel
We use the Meta Pixel for analysis. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times), including in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents deletion. Further information: https://www.facebook.com/privacy/policy.

3.8.11. Pinterest conversion tracking
Our website uses the conversion tracking technology of the social network Pinterest (Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland), which enables us to show visitors to our website who have already shown interest in our website and our content/offers and who are Pinterest members relevant advertising and offers on Pinterest. For this purpose, a so-called conversion tracking pixel from Pinterest is integrated into our pages, which informs Pinterest when you visit our website that you have accessed our website and which parts of our offer you were interested in. The legal basis is your consent (Art. 6(1)(a) GDPR). You can also object to the collection of data for interest-based advertising on Pinterest at any time in your Pinterest account settings at https://www.pinterest.com/settings.

3.8.12. Google BigQuery
We use the multi-cloud data warehouse Google BigQuery to store our y42 data. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. websites visited, interest in content, access times), including in the USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), supplemented by standard contractual clauses (Art. 46(2)(c) GDPR). We delete the data when the purpose of its collection no longer applies. Further information: https://policies.google.com/privacy.

3.8.13. Front
We use Front to communicate with our customers. The provider is FrontApp, SARL, 15 Rue Saint-Martin, 75003 Paris, France. The legal basis for the processing is our legitimate interest in answering customer enquiries efficiently (Art. 6(1)(f) GDPR). The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents deletion. Further information: https://front.com/privacy-policy.

3.8.14. ausgezeichnet.org
We use a rating seal from AUBII GmbH, Alsterufer 34, 20354 Hamburg, Germany (“ausgezeichnet.org”). The provider processes usage data (e.g. websites visited, interest in content, access times). The legal basis for the processing is our legitimate interest in displaying customer reviews (Art. 6(1)(f) GDPR). The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents deletion. Further information: https://www.ausgezeichnet.org/datenschutz/.

3.8.15. y42
We use a cloud-based data processing program to store, aggregate and retrieve data of all kinds. The provider is Datos-Intelligence GmbH, Lohmühlenstr. 65, 12435 Berlin, Germany. The legal basis for the processing is our legitimate interest in analysing our business data (Art. 6(1)(f) GDPR). The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents deletion. Further information: https://www.y42.com/legal/privacy.

3.8.16. Airtable
We use a cloud-based data processing program to store, aggregate and retrieve data of all kinds. The provider is Formagrid, Inc., 799 Market Street, 8th Floor, San Francisco, California 94103, USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is standard contractual clauses (Art. 46(2)(c) GDPR) agreed with the provider. The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents deletion. Further information: https://www.airtable.com/privacy.

3.8.17. Zapier
We use a tool to import email addresses from other platforms or sources for our email service providers. The provider is Zapier, Inc., 548 Market St #62411, San Francisco, California 94104, USA. The legal basis for the processing is your consent (Art. 6(1)(a) GDPR). The legal basis for the transfer to the USA is standard contractual clauses (Art. 46(2)(c) GDPR) agreed with the provider. The data is deleted when the purpose of its collection no longer applies and no retention obligation prevents deletion. Further information: https://zapier.com/privacy.

3.8.18. Meta Pixel: automatic advanced matching
As part of the Meta Pixel, we have also activated automatic advanced matching. This function allows us to send hashed email addresses, names, gender, city, state, postcode, date of birth and telephone numbers to Meta as additional information, provided you have given us this data. This allows us to tailor advertising campaigns on Facebook and Instagram even more precisely to people who are interested in our services or products. The legal basis is your consent (Art. 6(1)(a) GDPR).

4. Data processing on social media platforms

We are present on social media networks to present our company and our services. The operators of these networks regularly process their users’ data for advertising purposes. Among other things, they create user profiles based on online behaviour, which are used, for example, to show advertising on the networks’ pages and elsewhere on the internet that matches users’ interests. To do this, the network operators store information on usage behaviour in cookies on users’ computers. It cannot be ruled out that the operators combine this information with other data. Users can find further information and details of how to object to processing by the site operators in the operators’ privacy policies listed below. The operators or their servers may also be located in non-EU countries and process data there. This may result in risks for users, e.g. because it is more difficult to enforce their rights or because government agencies may access the data.

When users of these networks contact us via our profiles, we process the data provided to answer their enquiries. This is our legitimate interest, so the legal basis is Art. 6(1)(f) GDPR.

4.1. Facebook
We maintain a profile on Facebook. The operator is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The privacy policy is available here: https://www.facebook.com/privacy/policy. You can object to data processing via the ad settings: https://www.facebook.com/settings?tab=ads.

On the basis of an agreement, we are jointly responsible with Meta within the meaning of Art. 26 GDPR for processing the data of visitors to our profile. Meta explains exactly which data is processed at https://www.facebook.com/legal/terms/information_about_page_insights_data. Data subjects can exercise their rights against both us and Meta. However, under our agreement with Meta, we are obliged to forward requests to Meta. Data subjects will therefore receive a faster response if they contact Meta directly.

4.2. Instagram
We maintain a profile on Instagram. The operator is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The privacy policy is available here: https://privacycenter.instagram.com/policy.

4.3. TikTok
We maintain a profile on TikTok. The operator for users in the EEA is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. The privacy policy is available here: https://www.tiktok.com/legal/privacy-policy-eea.

4.4. Pinterest
We maintain a profile on Pinterest. The operator is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. The privacy policy is available here: https://policy.pinterest.com/en/privacy-policy.

4.5. YouTube
We maintain a profile on YouTube. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The privacy policy is available here: https://policies.google.com/privacy?hl=en.

4.6. LinkedIn
We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The privacy policy is available here: https://www.linkedin.com/legal/privacy-policy. You can object to data processing via the ad settings: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

5. Changes to this privacy policy

We reserve the right to amend this privacy policy with effect for the future. The current version is always available here.

6. Questions and comments

If you have any questions or comments about this privacy policy, please contact us using the contact details stated above.