Source: https://service.spreadshirt.com/hc/en-gb/articles/115000978409/?shop_name=brewski&shop_id=100305914
Timestamp: 2019-04-24 10:27:27+00:00

Document:
Thank you for your interest in our website. In the following, we will inform you in detail about the processing of personal data when using this website. Personal data means all data that can be personally related to you, e.g. name, address, telephone number, email address or user behaviour.
You can reach our external data protection officer at ISiCO Datenschutz GmbH, Am Hamburger Bahnhof 4, 10557 Berlin, Germany; telephone + 49 (0) 30 213 002 850 or e-mail: berlin@isico-datenschutz.de.
The data is technically necessary for us to display our website to you. It is also evaluated to make the website user-friendly and to ensure stability and security. For this purpose, we partly use the external web hosting service providers Akamai Technologies, Inc. and Amazon Web Services, Inc. In the event that data is also transferred to the USA, both service providers have subjected themselves to the EU-US Privacy Shield (https://www.privacyshield.gov/EU-US-Framework/). The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR.
Session cookies store what’s called a session ID, which can be used to assign different requests of your browser to a common session. This allows your device to be recognised when you return to our website. For example, this lets you store certain information you have entered (such as log-in information, language settings) in such a way that you do not have to repeat it constantly. Session cookies are automatically deleted when you log out or close your browser.
Long-term cookies remain on your device for the time being, so that we can recognise your browser on your next visit and we can, for example, assign your preferred information and settings. Long-term cookies are automatically deleted after a specified period, which may vary depending on the cookie.
When you visit our website, our partner companies also store third-party cookies on your device. The cookies contain information about how our website is used, e.g. which pages and products were visited. The data is collected in a pseudonymised form by assigning an identification number, which is not combined with any other personal data you may have provided to us.
To prevent unauthorised access to your personal data by third parties, the order process is encrypted using TLS technology.
In the case of trackable parcels, we also pass on your order and address data to parcelLab GmbH, Landwehrstraße 39, 80336 Munich, Germany, to make it possible to track your parcel and to inform you about delivery deviations or delays, for example.
We also use your data to collect outstanding debts. For this we involve KSP Kanzlei Dr. Seegers, Dr. Frankenheim Rechtsanwaltsgesellschaft mbH, Kaiser-Wilhelm-Straße 40, 20355 Hamburg, Germany or EOS Deutscher Inkasso-Dienst GmbH, Steindamm 71, 20099 Hamburg, Germany.
The legal bases for the processing of personal data as part of order processing are Art. 6(1) Sentences 1(b) and (f) GDPR. Due to commercial and tax regulations, we are obliged to store your order, address and payment data for a period of ten years.
b) During the order process we also conduct a fraud prevention check via our bank Adyen, which involves using your IP address to carry out a geolocalisation and compare your data with previous experience. This may mean that an order cannot be placed with the selected payment method. Our aim in this regard is to prevent any abuse of your chosen payment method by third parties and to protect ourselves from payment defaults. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR.
The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR.
d) After you place an order, we will process your order and address data to send you a personalised email asking you to rate our products. By obtaining ratings, our aim is to improve our services and adapt them to our customers’ wishes. We use the feedback software of eKomi Ltd, Markgrafenstraße 11, 10969 Berlin, Germany (“eKomi”). For the purpose of sending the feedback email (and in the event that a moderation or conciliation procedure is conducted via eKomi following negative feedback), we pass on your email address, name, order number, product types and a unique ID to eKomi for identification purposes and in order to generate a feedback link.
The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR. If you no longer want your data to be used for this purpose, you can object to this at any time. Just click on the unsubscribe link included with each email or send a message using the contact details provided under Section 1.
a) If you want to offer designs on our marketplace or operate a shop, it is necessary for the conclusion of a contract with us that you use your email address to open a password-protected user account and store your name and address there. For the payout of earnings, it is necessary that you additionally provide your bank details or your PayPal information as well as information about your tax status. Any other information you may provide to us when using the account is voluntary. You do not have to enter a real name when choosing your username. You can manage and change this information in your account. You can also deactivate or erase it – or the entire user account. If this affects data necessary for the performance of the contract, we may retain that data for a longer period in accordance with commercial and tax regulations (standard period of ten years). We process this data to conduct the contractual relationship that exists with you; the legal bases are Art. 6(1) Sentences 1(b) and (f) GDPR.
b) Within the scope of the contractual relationship, we also process the email address provided by you in order to send you emails at irregular intervals containing information and tips about the Marketplace and your shops (“Partner Newsletter”). We use your name to allow us to personalise these emails. To this end, the data is passed on to the software company Emarsys eMarketing Systems AG, Hans-Fischer-Straße 10, 80339 Munich, Germany (“Emarsys”), which handles the technical side of the mailing on our behalf. You can unsubscribe from the Partner Newsletter at any time by clicking on the unsubscribe link provided in each email, informing us via the contact details specified in Section 1, or changing your newsletter settings in your user account (“Account Settings” – “Newsletter subscriptions”).
When sending the Partner Newsletter, we use Emarsys to statistically evaluate your user behaviour in order to optimise the design. To enable this evaluation, the emails contain what are called web beacons or tracking pixels. These are single-pixel image files that establish a connection to our website und thus permit a log file analysis. The web beacons are linked with the data mentioned in Section 2.1 a and an individual ID. The links contained in the email also contain this ID. For example, we can see if and when an email has been opened and which links have been clicked on. The data is stored on the Emarsys servers for 13 months and collected pseudonymously, meaning the IDs are not linked to other personal data at this point, thus ruling out any possibility of direct personal reference. You can object to the recording of your usage behaviour at any time by clicking on the unsubscribe link provided in each email, informing us via the contact options listed in Section 1, or changing the newsletter settings in your user account (“Account settings” – “Newsletter subscriptions”). Recording is not possible if you have disabled the display of images in your email settings. In this case, the newsletter will not be displayed to you in full and you may not be able to use all functions. If you choose to display the images manually, recording will take place as described above.
The legal bases for the processing are Art. 6(1) Sentences 1(a), (b) and (f) GDPR.
If you contact us via a contact form, letter, fax, email, social media or telephone, we process the data provided by you for the purpose of processing your enquiry and – only in the legally permissible cases when communicating with entrepreneurs – for advertising purposes. We use the software of Sematell GmbH, Neugrabenweg 1, 66123 Saarbrücken, Germany, to coordinate and process emails, which means that Sematell GmbH gains access to the data. We use the management software of Hootsuite Media, Inc, 5 East 8th Avenue, Vancouver, BC, Canada to coordinate and process enquiries via our social media channels Twitter, Facebook and Instagram. The EU Commission has established the adequacy of the level of data protection in Canada. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR. If the aim of establishing contact is to conclude a contract, then an additional legal basis is Art. 6(1) Sentence 1(b) GDPR.
In our blog, where we publish various articles on topics related to our activities, you can post public comments. Your comment will be published along with your chosen username. We recommend using a pseudonym instead of your real name. It is necessary to provide a username and email address, while all other information is voluntary. The necessary information is processed to run the Forum. We need your email address to contact you if a third party should complain that your comment is unlawful. We reserve the right to delete comments if third parties complain that they are unlawful. The legal basis for the processing is Art. 6(1) Sentence 1(f) GDPR.
With the exception of a few sections, our Forum can be read without the need to register. If you wish to actively participate in the Forum under your chosen username, you must log in using your Spreadshirt user account access data. To open a Spreadshirt user account, only your email address and a password are required. We process your activities (public posts, private messages, likes, profile information, activity logs) and your IP address in order to operate the Forum. The legal basis is Art. 6(1) Sentence 1(f) GDPR. If you deactivate or delete your user account, your public posts will continue to be visible. If you would like your public posts to be deleted, please contact us using the contact details provided in Section 1. When writing a comment and in the Forum settings (under “Preferences” – “Emails” and “Notifications”), you can specify in which cases and to what extent you would like to be notified by email about new activities in the Forum. You can unsubscribe again at any time, either in the Forum settings or by clicking on the unsubscribe link contained in the respective notification email.
We use Google Analytics to analyse and regularly improve the use of our website. The statistics this yields allow us to improve our website and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Google LLC has subjected itself to the EU-US Privacy Shield (https://www.privacyshield.gov/EU-US-Framework). The legal bases for our use of Google Analytics are Art. 6(1) Sentences 1(a) and (f) GDPR.
To allow us to analyse and regularly improve the use of our website, our website also uses the Adobe Analytics web analytics service. The statistics this yields allow us to improve our website and make it more interesting for you as a user. For the exceptional cases in which personal data is transferred to the USA, Adobe has subjected itself to the EU-US Privacy Shield (https://www.privacyshield.gov/EU-US-Framework). The legal bases for our use of Adobe Analytics are Art. 6(1) Sentences 1(a) and (f) GDPR.
The analysis involves storing cookies (see Section 2.1 b) on your device. The information collected in this way is stored on servers, including in the USA. We would like to point out that if you prevent the storage of cookies, you may not be able to use this website in its entirety. You can adjust your browser settings to prevent the storage of cookies. You can also prevent Adobe Analytics from recording your data on this website by clicking here: DisableEnable Adobe Analytics. This will place an opt-out cookie which prevents recording when you visit our website in future. Please note that if you delete all cookies on your device, this opt-out cookie will also be deleted; in this case, if you still wish to object then you must place the cookie again using the above button. The opt-out cookie is set per top-level domain, per browser and per device and only prevents the recording of data for this website. How to prevent the recording of your data on other websites is explained on the respective sites and at https://www.adobe.com/privacy/opt-out.html.
Our website also uses the analytics service of SessionCam Ltd.(“SessionCam”). Cookies (see Section 2.1 b) are used to record and analyse your mouse movements, click behaviour, scrolling and text input on the website. Personal data such as your name or bank data is masked during recording. IP addresses are pseudonymised and not linked to the respective recording. The information generated by the cookie is transferred to a SessionCam server and stored there. The data collected by SessionCam is for our internal analysis only. It is used to improve the user experience on our website. The legal bases for this are Art. 6(1) Sentences 1(a) and (f) GDPR.
Our partners can also use the Google Analytics web analytics service (see Section 2.5 a) in their Spreadshirt shops themselves, as a rule to analyse use of the shop and improve their offer in the shop. In this case, they determine the purposes and means of processing personal data. The name and contact details of our partners are stored in the legal information section of the respective shop.
You can revoke your consent to the sending of the newsletter at any time (without this affecting the lawfulness of the processing up to the point of revocation). You can declare your revocation by clicking on the link provided in every newsletter email, by emailing privacy@spreadshirt.net or by sending a message to the contact details provided in Section 1.
When sending the newsletter, we use Emarsys to statistically evaluate your user behaviour in order to measure how successful the newsletter is and to optimise its design. To enable this evaluation, the emails contain what are called web beacons or tracking pixels. These are single-pixel image files that establish a connection to our website und thus permit a log file analysis. The web beacons are linked with the data mentioned in Section 2.1 a and an individual ID. The links contained in the newsletter also contain this ID. For example, we can see if and when an email has been opened and which links have been clicked on. The data is stored on the Emarsys servers for 13 months and collected pseudonymously, meaning the IDs are not linked to other personal data at this point, thus ruling out any possibility of direct personal reference. You can object to the recording of your usage behaviour at any time by clicking on the unsubscribe link provided in each email or by informing us using the contact details provided in Section 1. Recording is not possible if you have disabled the display of images in your email settings. In this case, the newsletter will not be displayed to you in full and you may not be able to use all functions. If you choose to display the images manually, recording will take place as described above.
The legal bases for the processing are Art. 6(1) Sentences 1(a) and (f) GDPR.
As a Spreadshirt customer, so if you order something in our online shop (see Section 2.2 a), we process the email address you provide in order to send you regular email recommendations for products that might be of interest to you based on your previous orders from us. We also use your name to allow us to personalise these emails. The data is passed on to the software company Emarsys (see Section 2.6 a), which handles the technical side of the mailing on our behalf. The legal bases are Section 7(3) of the German Act against Unfair Competition (UWG) and Art. 6(1) Sentence 1(f) GDPR.
When sending the product recommendations, we use Emarsys to statistically evaluate your user behaviour in order to measure their success and to optimise their design. The legal bases for the processing are Art. 6(1) Sentences 1(a) and (f) GDPR. To enable this evaluation, the emails contain what are called web beacons or tracking pixels. These are single-pixel image files that establish a connection to our website und thus permit a log file analysis. The web beacons are linked with the data mentioned in Section 2.1 a and an individual ID. The links contained in the email also contain this ID. For example, we can see if and when an email has been opened and which links have been clicked on. The data is stored on the Emarsys servers for 13 months and collected pseudonymously, meaning the IDs are not linked to other personal data at this point, thus ruling out any possibility of direct personal reference. You can object to the recording of your usage behaviour at any time by clicking on the unsubscribe link provided in each email, informing us via the contact options listed in Section 1, or – if you have a user account with us – changing the newsletter settings in your user account (“Account settings” – “Newsletter subscriptions”). Recording is not possible if you have disabled the display of images in your email settings. In this case, the newsletter will not be displayed to you in full and you may not be able to use all functions. If you choose to display the images manually, recording will take place as described above.
The legal basis for the processing is Art. 6(1) Sentence 1(a) GDPR.
Our website uses various conversion tracking and retargeting technologies made available by other service providers. We use these technologies to make our website interesting for you. The information also helps us to address users who have already shown an interest in our products with individually tailored advertising on the websites of our partner companies. We assume that the display of personalised, interest-based advertising is generally more interesting for the internet user than advertising that has no such personal relevance. At the same time, we want to avoid inappropriate and intrusive advertising.
These ads are deployed by Google via so-called ‘ad servers’. For this purpose, we use ad server cookies, which enable the tracking of certain parameters for measuring success, such as the display of ads or clicks by users. If you arrive at our website via a Google ad, Google AdWords will store a cookie on your device. These cookies usually expire after 30 days and are not intended to identify you personally. Analysis values usually stored for this cookie are the unique cookie ID, the number of ad impressions per placement (frequency), the last impression (relevant for post-view conversions) and opt-out information (marker showing that the user no longer wishes to be targeted).
These cookies allow Google to recognise your internet browser. If a user visits certain pages of an AdWords customer’s website (in this case ours) and the cookie stored on their device has not yet expired, Google and the customer can recognise that the user has clicked on the ad and has been redirected to this site. Each AdWords customer is assigned a different cookie. Cookies cannot therefore be tracked via the websites of AdWords customers. We do not collect and process any personal data in the aforementioned advertising activities. Google merely provides us with statistical evaluations. On the basis of these evaluations we can identify which of the advertising activities used are particularly effective. We do not receive any further data from the use of ads; in particular we cannot identify users on the basis of this information.
Besides AdWords Conversion, we also use Google’s remarketing feature. This is a process we use in an attempt to contact you again. After visiting our website, this feature makes it possible to show you our ads when you continue to use the internet. This is done by means of cookies stored in your browser, which Google uses to record and evaluate your usage behaviour when visiting various websites. This is how Google can determine that you have previously visited our website. According to its own information, Google does not combine the data collected in the context of remarketing with your personal data, which may be processed by Google. Specifically, according to Google, pseudonymisation is used during remarketing.
The legal bases for the processing of your data are Art. 6(1) Sentences 1(a) and (f) GDPR.
Third-party provider information: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For further information about privacy at Google, please refer to: https://policies.google.com/privacy?hl=policies and https://services.google.com/sitestats/en.html. Alternatively, you can visit the website of the Network Advertising Initiative (NAI) at: http://www.networkadvertising.org. Google has subjected itself to the EU-US Privacy Shield (https://www.privacyshield.gov/EU-US-Framework).
The legal bases for the processing of data when using the functions specified above are Art. 6(1) Sentences 1(a) and (f) GDPR.
Our website also uses the “LinkedIn website retargeting” feature. After visiting our website, this feature makes it possible to show you our ads when you continue to use the internet. Our intention here is to show you ads that are of interest to you. This is done by means of a cookie stored in your browser (see above for more information), which is used to record and evaluate your usage behaviour. No personal information is transmitted to us about individual website visitors, and we can only specifically deploy ads to website custom audiences if the custom audience has reached a critical size. This makes it impossible for us to determine the individual identities of visitors.
Our online offering also uses the “Bing Ads remarketing” feature. After visiting our website, this feature allows us to show you our ads when you continue to use the internet. Our intention here is to show you ads that are of interest to you. This is done by means of a cookie stored in your browser (see above for more information), which is used to record and evaluate your usage behaviour. No personal information is transmitted to us about individual website visitors, and we can only specifically deploy ads to website custom audiences if the custom audience has reached a critical size. This makes it impossible for us to determine the individual identities of visitors.
Our website also uses the feature “Nextperf Retargeting” from Nextperf. After visiting our website, this feature allows us to show you our ads when you continue to use the internet. Our intention here is to show you ads that are of interest to you. This is done by means of a cookie stored in your browser by Nextperf, which is used to pseudonymously record and evaluate your usage behaviour (e.g. which products were clicked on). No personal information is transmitted to us about individual website visitors. This makes it impossible for us to determine the individual identities of visitors.
There are various ways in which you can disable this tracking. You can adjust your browser settings to prevent the storage of cookies, although this may result in a restriction of the functionality of our website for you. You also can prevent Nextperf from recording your data on this website by clicking here: DisableEnable Nextperf retargeting. This will place an opt-out cookie which prevents recording when you visit our website in future. Please note that if you delete all cookies on your device, this opt-out cookie will also be deleted; in this case, if you still wish to object then you must place the cookie again using the above button. The opt-out cookie is set per top-level domain, per browser and per device and only prevents the recording of data for this website. In addition, you can disable interest-based ads from providers who are part of the “YourAdChoices” self-regulation initiative (http://optout.aboutads.info/?c=2#!/) or e.g. part of the Network Advertising Initiative (http://optout.networkadvertising.org/?c=1#!/); please note that this setting will be erased if you erase your cookies. It is also possible to disable interest-based ads from Nextperf on other sites at http://www.nextperf.com/privacy/.
Saxon Data Protection Commissioner, Bernhard-von-Lindenau-Platz 1, 01067 Dresden.
If you have given your consent to the processing of your data (within the meaning of Art. 6(1) Sentence 1(a) or Art. 9(2)(a) GDPR), you can revoke this consent with future effect at any time. This does not affect the lawfulness of processing carried out on the basis of the consent before you revoke your consent.
If we base the processing of your personal data on the balancing of interests (Art. 6(1) Sentence 1(f) GDPR), you are entitled to object to the processing. This is the case if the processing is not necessary in particular for the performance of a contract with you, which was described by us in each case with the description of the individual functions. When exercising such a right of objection, we ask that you explain the reasons why we should not process your personal data as carried out by us. In the event that your objection is justified, we will examine the situation and either stop or adjust the data processing or point out to you the compelling legitimate reasons on the basis of which we will continue processing.
The personal data processed by us is generally erased or blocked as soon as the purpose of storage ceases to apply. Data may be stored for a longer period if this has been provided for by the European or national legislator in EU regulations, laws or other rules to which we as the controller are subject. The data will also be blocked or erased once a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 9