Source: https://windsor.de/brand/en/privacy
Timestamp: 2019-04-24 16:27:54+00:00

Document:
windsor values the protection of your data and collects, processes, and uses your personal data exclusively in compliance with the applicable data protection laws, e.g. the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the Telemedia Act (TMG), as well as in accordance with the principles described below.
The controller for the operation of this website (hereinafter: “website”) is Strellson AG, Sonnenwiesenstrasse 21, 8280 Kreuzlingen, Switzerland (hereinafter: windsor). It is also the operator of the online shop (hereinafter: “online shop”), however, its subsidiary, Lenox AG, Sonnenwiesenstrasse 21, 8280 Kreuzlingen, Switzerland is the contractual partner of the customers for online shop purchases.
Lenox AG is also the controller for the data needed for contract implementation.
The data protection officer can be reached at: Datenschutz.de@windsor.de.
What data do we collect and for which purpose and on which legal basis?
Personal data are all information related to an identified or identifiable natural person. This includes, for example, your name, your phone number, and your mailing and e-mail addresses.
We collect, process and use your personal data in connection with the operation of the website, setting up and operating a customer account, and providing the services offered in connection with the customer account.
Our subsidiary, Lenox AG, collects, processes, and uses the data collected in the scope of an order in the online shop or released by you for this purpose in your customer account to establish, implement, and process the purchase agreements in the online shop.
Furthermore, we (and Lenox AG as well) collect, process, and use your personal data only within the extent permitted by law, in particular if you consented to this. This may be the case, e.g., if you subscribed to receive newsletters.
The provision of the website by windsor requires the handling of personal data (IP addresses) to retrieve the website content.
In addition, you have the option of contacting us using the contact form. For this purpose, we collect your name and e-mail address.
For the provision of this website and for communication with windsor, your personal data is handled on the basis of our legitimate interest pursuant to Art. 6 (1) f) GDPR. For the provision of this website, it is technically necessary for us to process certain personal data (e.g. IP address). For your communication with windsor, it is necessary for us to handle the above-mentioned personal data.
In the scope of the required balancing of interests, we have weighed up your interest in the confidentiality of your personal data against our interests in providing this website and contact with you. In both cases, your interest in confidentiality is waived. Otherwise, we could not provide this website to you or respond to your contact request.
This website offers you the option of creating a personal customer account. In your customer account, which is managed by Strells, you can save personal information for convenient shopping in the online shop. In addition, in the customer account, Strellson offers you access to your purchase history and the option of creating a wish list to save articles for a later purchase.
To create the customer account, your first and last name, your e-mail address, mailing address and a freely chosen password are required. The provision of other data (telephone number, date of birth) is, of course, voluntary. You can update these data anytime or delete the account.
Your personal data in the scope of the “customer account” online service is handled for the establishment, implementation, and processing of the corresponding user agreement in accordance with Art. 6 (1) b) GDPR.
The online shop is operated by windsor; however, our subsidiary, Lenox AG, is responsible for processing the transactions and it is also the sole contractual partner for the purchases made therein.
If you are logged into your customer account, the information required to process your order, which is stored in your customer account, will be filled in automatically in the order form. windsor provides this information to Lenox AG, but exclusively for this purpose of contract performance. Of course, it is also possible to place an order without using a customer account. Lenox AG processes and uses the information in any case only to process the order, and, moreover, insofar as you have given your consent.
If you are logged into the online shop during the order, your wish lists and the information about the purchases (articles, price and time of purchase) will be saved in your customer account.
If, instead of a personal customer account, you would like to make a purchase from us as a guest, your data (same data as in your personal customer account is collected in this case) will be saved only for as long as necessary to process the respective purchase, and will then be deleted or blocked.
Your personal data in the scope of the online shop is handled for the establishment, implementation and processing of the corresponding contracts in accordance with Art. 6 (1) b) GDPR.
If you have given us consent to process personal data for specific additional purposes (e.g. credit check, prevention of misuse and fraud, newsletter, preference center), these data are processed on the basis of your consent. When requesting consent, windsor provides details about the content of that consent. You can find any granted consent of relevance for data protection and additional information about this here.
Consent is always voluntary. If the processing of personal data is based on consent given by you, you have the right to withdraw this consent at any time. This applies also to consent given to us before the entry into force of the GDPR, that is, before May 25, 2018. You can declare your withdrawal also by e-mailing datenschutz.de@windsor.de. The legality of the data processed on the basis of consent before the withdrawal remains unaffected by your withdrawal. The legal basis for the data processing based on consent is Art. 6 (1) a) GDPR and Art. 9 (2) a) GDPR.
We do not transfer your data to third parties, unless we are legally obligated to do so or you have given us your consent to this.
However, to process orders, certain personal data must be provided to our service providers in the EU and Switzerland, e.g. logistics companies, but also for credit checks and payment processing. In this process, known as contract data processing, the service providers are also contractually obligated to process your personal data only in adherence to the data protection regulations and the required security measures.
If you have given your express consent, we obtain credit-related information about your previous payment history, information to assess the risk of payment default using mathematical/statistical methods by means of scores, and data to verify your address (deliverability check) from or through infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden.
For this purpose, we send your data (name, address and, if applicable, date of birth) to the company indicated above. This company will use these data for the purposes of address verification and/or identity checks with other companies, as well as for corresponding scoring applications. The score is the calculation of probabilities of a specific future behavior, using mathematical/statistical methods, and the corresponding data are used for this purpose.
As part of the credit check, all available data will be checked to determine what payment methods could be offered for an order and, also, whether an order can be made. In this process, all previous orders in my customer account may be checked as well.
If you have given your express consent, the above-mentioned data will also be sent to the Device Transaction Pool (DTP) to be stored there. The purpose of the DTP is to protect DTP member companies from misuse and bad debt due to fraud, which may result during the provision of commercial, paid-for telecommunication services, or telemedia services to contracting partners that are unwilling or unable to pay, especially as a result of fraud. The transmitted data are stored, processed and used for these purposes only. If a member company makes a request to the DTP, only the results of the investigation in connection with the request will be sent to this member company. Positive data may also be used, i.e. that devices that are used, for example, for payment often and on-time, are assessed positively. Data concerning the results are not stored by the individual member companies beyond the specific case of individual usage. The DTP is operated by infoscore Tracking Solutions (ITS), Kaistraße 7, 40221 Dusseldorf, as the contract data processor of the member companies.
If necessary, we use certain data in accordance with the legal regulations in the scope of pseudonymous user profiles for purposes of advertising, market research, or customized design of our offers.
Our “cookie bar” is regularly updated and provides you with the option to freely decide whether and, if yes, which cookie types can be used.
Some cookies are placed by third parties that appear on our pages.
You can change or withdraw your consent to the cookie declaration on our website at any time.
For this purpose, delete the local data in your browser. The next time you visit our website, you can specify your cookie preferences in Cookiebot again.
Plugins of the Instagram social network, [provided by Instagram], Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA (“Instagram”) are integrated in this website. You can identify the Instagram plugin by the “Instagram” button.
If you visit a website offered by us that uses such plugins, your browser connects to the services of the plugin provider, if necessary in the USA. We have no influence on the scope of the data collected by the providers via the plugin. According to the providers, personal data, including the IP address, are collected and processed only if users are logged in. Please note that we receive no knowledge of the content of the transmitted data or their use by Instagram.
If you are a member of the respective network, but do not want the provider to collect data relating to you through our website and, if applicable, link them to other stored data, please always log out completely from the respective network before visiting other websites and delete any saved cookies as well.
windsor saves and processes your personal data only for as long as necessary for the intended purpose (see “What data do we collect and for what purpose and on what legal basis?”). In all other cases, we delete your personal data; data that we have to store in order to fulfill legal obligations (e.g. tax or commercial retention obligations) constitute an exception to this.
As a data subject, you have a right of access pursuant to Art. 15 GDPR, a right to rectification pursuant to Art. 16 GDPR, a right to data erasure pursuant to Art. 17 GDPR, a right to restriction of processing pursuant to Art. 18 GDPR, and the right to data portability pursuant to Art. 20 GDPR. The limitations in accordance with Sections 34 and 35 BDSG apply to the rights of access and data erasure.
For reasons arising from your particular situation, you have the right to object anytime to the processing of your personal data, which is done on the basis of Article 6 (1) lit. e) GDPR (data processing in the public interest) and Article 6 (1) lit. f) GDPR (data processing on the basis of a balance of interests). If you object, we will no longer process your personal data, unless we are able to demonstrate compelling legitimate reasons for processing, which override your interests, rights and freedoms, or the processing is done in order to assert, exercise, or defend legal claims.
If you believe that the processing of your personal data violates legal requirements, you have the right to lodge a complaint with a data protection supervisory authority competent in our case (Art. 77 GDPR in conjunction with Section 19 BDSG).
Datenschutz.de@windsor.de or using the contact details provided in the legal notice.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 9
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 20