Source: https://www.bingomerch.com/privacypolicy/
Timestamp: 2019-04-20 14:12:21+00:00

Document:
"Helping the touring musician sell rags since 2006"
We process and use personal data of our users and customers only, if this is allowed under applicable laws or if this is neccessary for the purposes of providing you with functioning websites and services, for the purposes of the performance and fulfillment of purchase contracts that are concluded in our onlineshops as well as for advertising purposes. Personal data are only processed if permitted by law or if you consented in the processing of your personal data.
If and to the extent that you have given consent to the processing of your personal data for one or more specific purposes, the legal basis for the processing is Art. 6 (1) lit. a GDPR.
If and to the extent that the processing is neccessary for the performance of a contract to which you are party or in order to take steps at the request of you prior to entering a contract, the legal basis for the processing is Art. 6 (1) lit. b GDPR.
If and to the extent that processing is neccessary for compliance with a legal obligation to which we are subject, the legal basis for the processing is Art. 6 (1) lit. c GDPR.
If and to the extent that processing is neccessary in order to protect the vital interests of you or of another natural person, the legal basis for the processing is Art. 6 (1) lit. d GDPR.
If and to the extent processing is neccessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of you which require protection of personal data, in particular where the data subject is a child, the legal basis for the processing is Art. 6 (1) lit. f GDPR.
The duration of the storage of personal data is determined by the respective legal retention period (e.g. commercial and tax retention periods). After expiry of this period, the corresponding data will be routinely deleted, provided they are no longer necessary for the performance or initiation of a contract and/or there is no longer any legitimate interest on our part in the further storage.
(2) Data processing is carried out in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest of the purposes as listed above. The data will not be used to identify you as our user which is not possible anyway, as only anonymised IP addresses are being processed. However, we reserve the right to check the server log files subsequently, if there are any concrete indications of illegal use.
These service providers support us in the execution of concluded contracts. We will pass on your payment data to one of these service providers within the framework of payment processing and solely for this purpose, if this is necessary for payment handling according to Art. 6 (1) lit. b GDPR. These service providers are obligated to handle your data confidentially and in accordance with applicable data protection laws.
These service companies are assigned with the shipping of your products. We will pass on your name, delivery address and e-mail-address (solely for messages concerning the shipped item) to one of these companies, if this is necessary for delivering your items and informing you on the delivery according to Art. 6 (1) lit. b GDPR. These service companies are obligated to handle your data confidentially and in accordance with applicable data protection laws.
In order to provide a functioning infrastructure of our online-shops and to optimise our services we use the technical services of the onlineshop-platform „Shopify“ within our legitimate interests according to Art. 6 (1) lit. f GDPR. Shopify provides us with an e-commerce-software, with which our online-shops are created and administrated.Shopify is certified for the US-European data protection agreement “Privacy Shield”, which guarantees compliance with the data protection level applicable in the EU.
Shopifyis obligated to handle your data confidentially and in accordance with applicable data protection laws. Shopify processes data within the framework of a data processing commission agreement which clarifies that Shopify may process personal data only for the purposes that are set out herein and only if the processing of personal data is permitted by law.
In order to provide a functioning infrastructure of our online-shops and to optimise our services we also use the ordermanagement-software „Billbee“ within our legitimate interests according to Art. 6 (1) lit. f GDPR.
Billbee processes data within the framework of a data processing commission agreement which clarifies that Billbee may process personal data only for the purposes that are set out herein and only if the processing of personal data is permitted by law.
For this online-shop we and City Slang GmbH & Co. KG are jointly responsible within the meaning of Art. 26 GDPR. The processing of personal data in the aforementioned online-shop is governed by an agreement between City Slang GmbH & Co. KG and us. Data subjects can exercise their data protection rights towards us as well as towards City Slang GmbH & Co. KG.
The legal basis for data processing and data transfer to third parties as listed herein is Art. 6 (1) lit. b and lit. f GDPR.
The processing and transfer of the personal data mentioned herein is neccessary for the conclusion, fulfillmenet and performance of contracts as well as steps at your request prior to entering into such contracts. For the duly fulfillment of contracts between you and us we rely on the processing of your personal data. Any personal data that are processed and transferred will only be used for the purposes that are set out herein.
The processing of personal data when creating a customer account serves the purpose of entering and performing purchase contracts with you. Legal basis for the processing of personal data is Art. 6 (1) lit. b GDPR.
If you are a registered customer you can cancel your customer account at any time with future effect. When you cancel your customer account we will delete your personal data with future effect, so that it will not be possible for you to use your account for purchases in our online-shops. The processing of personal data for purchase contracts that have been concluded through your customer account remains unaffected by a cancellation of your account, which means that we will continue to process such data, if neccessary for the performance and fulfillment of contracts or if we are obligated to do so by law.
You can change or modify your personal data that have been stored for your customer account at any time, if your data are no longer up-to-date.
Just contact us, if you wish to cancel or update your account data or simply correct/change your personal data in your password secured account by yourself.
In order to make your visit to our online-shops comfortable and to enable the use of certain functions, we and our service partners use so-called cookies on various pages. These are small text files that are stored on your end device. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your terminal and enable us or our partner companies (third-party cookies) to recognise your browser on your next visit (persistent cookies). If cookies are set, they collect and process specific user information such as browser and location data as well as IP address values according to individual requirements. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie.
In some cases, cookies are used to simplify the submittal process by saving settings. If personal data are also processed by individual cookies set by us, the processing is carried out in accordance with Art. 6 (1) point b GDPR either for the execution of the contract or in accordance with Art. 6 (1) point f GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.
This Website also uses Google Analytics, a web analysis service of Google Inc. (https://www.google.de/ intl/de/about/) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; hereinafter referred to as "Google"). Google is certified for the US-European data protection agreement “Privacy Shield”, which guarantees compliance with the data protection level applicable in the EU. Google Analytics uses so-called cookies, which are text files stored on your computer, to help the Website analyse how users use the Website. The information generated by the cookies about your use of this Website (including the shortened IP address) is generally transmitted to a Google server in the USA and stored there.
This Website uses Google Analytics exclusively with the extension “anonymizeIp()”, which ensures an anonymization of the IP address by shortening it and excludes a direct personal relationship. As a result of the extension, your IP address will previously be shortened by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases, the full IP address will be transmitted to a Google server in the USA and shortened there. In these exceptional cases, processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in the statistical analysis of user behaviour for optimisation and marketing purposes.
These purposes are legitmate interests to process personal data within the meaning of Art. 6 (1) lit. f GDPR.
If you subscribe to our free e-mail newsletter, we will send you regular information about our products and services. The only mandatory information for sending the newsletter is your e-mail address. The indication of additional possible data is voluntary and is used to be able to address you personally. We use an opt-in procedure for sending the newsletter. This means that we will not send you an e-mail newsletter, unless you have expressly confirmed to us that you agree to the sending of the newsletter.
When you purchase items in our online-shops and you give us your e-mail address and confirm to us that you want to receive news and offers via e-mail, we can use your e-mail address for these purposes. In these cases we will only use your e-mail address to send news and offers to you for similar Bingo Merch products and services.
When you register for the newsletter, we store your IP address entered by the Internet Service Provider (ISP) as well as the date and time of registration so that we can trace any possible misuse of your e-mail address at a later time.
By activating the confirmation link of your newsletter subscription, you give us your consent to the use of your personal data in accordance with Art. 6 (1) lit. a GDPR. Legal basis for the use of your e-mail address for advertising mails when you have purchased items in our online-shops is § 7 (3) Gesetz gegen den unlauteren Wettbewerb (UWG).
The data collected by us when registering for the newsletter will be used exclusively for the purpose of notification by means of the newsletter.
After your cancellation, your e-mail address will immediately be deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use data in excess thereof, which is permitted by law and about which we inform you in this declaration.
These data are stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration. In this context no personal data are transferred to third parties.
(2) The legal basis for processing data is our legitimate interest in responding to your request in accordance with Art. 6 (1) point f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b GDPR.
(3) Your data will be deleted after final processing of your inquiry; this is the case if it can be inferred from the circumstances that the facts in question have been finally clarified, provided that there are no legal storage obligations to the contrary.
Pursuant to Art. 15 GDPR you shall have the right to obtain information from the controller as to whether or not personal data concerning you are being processed, and, where that is the case, access to personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom personal data have been or will be disclosed; where possible, the envisaged period for which the personal data will bestored, or, if not possible, the criteria used to determine that period; the existence of the right to request from us rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; the right to lodga a complaint with a supervisory authority; where the personal data are not collected from the data subject, any available information as to their source; the existence of automated decision-making, including profiling as well as - if applicable - meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Pursuant to Art. 16 GDPR you shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning you or the right to have incomplete personal data completed.
Pursuant to Art. 17 GDPR you shall have the right to obtain from the controller the erasure of personal data concerning you without undue delay, unlessthat processing is neccessary for exercising the right of freedom of expression and information, for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject, for reasons of public interest or for the establishment, exercise or defence of legal claims.
Pursuant to Art. 18 GDPR you shall have the right to obtain from the controller restrisction of processing where one of the following applies: the accuracy of the personal data is contested by you for a period enabling the controller to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; the controller no longer needs the personal data for the purposes of processing but they are required by you for the establishment, exercise or defence of legal claims; you have objected to processing pursuant to Art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of you.
Pursuant to Art. 20 GDPR you shall have the right to receive the personal data concerning you which you have provided to the controller in a structured, commonly used and machine-readable format and have the right to transmit thoses data to another controller without hindrance from the controller to which the personal data have been provided where the processing is based on consent and is carried out by automated means.
Pursuant to Art. 7 (3) GDPR you shall have the right to withdraw your consent for the processing of personal data at any time with the consequence that we may not continue with the processing which was based on your consent.
Pursuant to Art. 77 GDPR you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, place of the alleged infringement or controller‘s residence.
Pursuant to Art. 21 GDPR you shall have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Art. 6 (1) GDPR or where personal data are processed for direct marketing purposes in which case your right to object has to be respected by the controller irrespective of grounds relating to your particular situation.
Please contact us, if you want to exercise your rights in connection with the processing of your personal data.
We solely use data transmission services that offer high security standards to protect the transmission of personal data and other confidential information against loss, alteration and misuse. Especially when sensitive data are transmitted, for example the transmission of credit card and other payment information we and our service partners endeavour to comply with high security standards in order to protect your data. If such data are being transmitted we are using encrypted services. You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 26
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 § 7
 Art. 6
 Art. 6
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 21
 Art. 20
 Art. 7
 Art. 77
 Art. 21
 Art. 6