Privacy policy

1) Information about the collection of personal data and the controller’s contact details

1.1 Thank you for visiting our website and for your interest. The following information explains how we handle your personal data when you use our website. Personal data means any data that can identify you personally.

1.2 The controller responsible for data processing on this website under the General Data Protection Regulation (GDPR) is Carme GmbH, Altonaer Strasse 59, 13581 Berlin, Germany, tel.: 017610010830, email: info@carme.online. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

1.3 For security and to protect the transmission of personal data and other confidential content, such as orders or enquiries, this website uses SSL or TLS encryption. An encrypted connection is indicated by “https://” and the padlock symbol in your browser.

2) Data collected when you visit our website

When you use our website for information only, without registering or otherwise submitting information, we collect only the data that your browser sends to our server (server log files). When you access our website, we collect the following data needed to display it:

  • The page visited on our website
  • Date and time of access
  • Amount of data transferred in bytes
  • Source or referral from which you reached the page
  • Browser used
  • Operating system used
  • IP address used (anonymised where applicable)

Processing is carried out under Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used for other purposes. We reserve the right to review server log files retrospectively if there are specific indications of unlawful use.

3) Cookies

We use cookies on various pages to make our website attractive and enable certain functions. Cookies are small text files stored on your device. Some cookies are deleted at the end of the browser session when you close your browser (session cookies). Other cookies remain on your device and allow your browser to be recognised on your next visit (persistent cookies). Depending on the individual cookie, information such as browser and location data and IP address values may be collected and processed. Persistent cookies are deleted automatically after a specified period, which varies by cookie. Your browser’s cookie settings show the relevant storage periods.

Some cookies store settings to simplify the ordering process, for example by remembering the contents of a virtual cart for a later visit. Where individual cookies process personal data, processing is carried out under Art. 6(1)(b) GDPR to perform a contract, under Art. 6(1)(a) GDPR where consent has been given, or under Art. 6(1)(f) GDPR to protect our legitimate interests in providing the best possible website functionality and a customer-friendly, effective visit.

You can configure your browser to notify you when cookies are set, decide whether to accept them individually, or reject cookies in specific cases or generally. Each browser manages cookie settings differently. Its help menu explains how to change these settings. Information for common browsers is available at the following links:

Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Chrome: https://support.google.com/chrome/answer/95647?hl=de&hlrm=en
Safari: https://support.apple.com/de-de/guide/safari/sfri11471/mac
Opera: https://help.opera.com/de/latest/web-preferences/#cookies

Please note that rejecting cookies may restrict the functionality of our website.

4) Contacting us

When you contact us, for example through a contact form or by email, personal data is collected. The relevant contact form shows which data is collected. This data is stored and used solely to respond to your enquiry, contact you and carry out the related technical administration. Processing is based on our legitimate interest in responding to your enquiry under Art. 6(1)(f) GDPR. If your contact is intended to enter into a contract, Art. 6(1)(b) GDPR provides an additional legal basis. Your data is deleted once your enquiry has been conclusively resolved, unless statutory retention obligations apply.

5) Data processing when opening a customer account and performing a contract

Under Art. 6(1)(b) GDPR, personal data is collected and processed when you provide it to perform a contract or open a customer account. The relevant forms show which data is collected. You may request deletion of your customer account at any time by contacting the controller at the address above. We store and use the data you provide to perform the contract. Once the contract is complete or the account is deleted, the data is restricted for the applicable tax and commercial retention periods and deleted when those periods expire, unless you have consented to further use or the law permits us to retain it.

6) Data processing for order handling

6.1 To handle your order, we work with the service providers listed below, who support us in performing contracts. Certain personal data is transferred to these providers as described below.

Where necessary for delivery, personal data collected by us is passed to the transport company commissioned with delivery. Payment data is passed to the commissioned financial institution where necessary to process payment. Any payment service providers used are identified below. The legal basis for these disclosures is Art. 6(1)(b) GDPR.

6.2 Use of payment service providers

– PayPal
When paying through PayPal, a card through PayPal, PayPal direct debit or, where offered, PayPal payment on invoice or instalments, we pass your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”) as part of payment processing. This disclosure is made under Art. 6(1)(b) GDPR and only to the extent necessary to process payment.
For card payments through PayPal, PayPal direct debit and, where offered, PayPal payment on invoice or instalments, PayPal may carry out a credit check. For this purpose, PayPal may disclose your payment data to credit agencies under Art. 6(1)(f) GDPR on the basis of its legitimate interest in determining your ability to pay. PayPal uses the result concerning the statistical probability of non-payment to decide whether to provide the relevant payment method. The credit report may include probability values (scores) based on a scientifically recognised mathematical and statistical method. Address data may be included in the calculation. Further privacy information, including the credit agencies used, is available in PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
You may object to this processing at any time by contacting PayPal. PayPal may nevertheless remain entitled to process your personal data where this is necessary for contractual payment processing.

7) Tools and other services

7.1 Borlabs
This website uses the Borlabs cookie consent tool provided by Benjamin A. Bornschein, Georg-Wilhelm-Str. 17, 21107 Hamburg (“Borlabs”). It sets two technically necessary cookies (“borlabsCookie” and “borlabsCookieUnblockContent”) to store your cookie preference. This processing is carried out under Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing cookie preference management for website visitors.
The “Borlabs Cookie” does not process personal data. The “borlabsCookie” stores the preference selected when you entered the website. The “borlabsCookieUnblockContent” stores which external media or content you always want to unblock automatically. To withdraw these settings, delete the cookies in your browser. You will be asked for your preference again when you revisit or reload the website.

7.2 - Google Web Fonts
This site uses web fonts provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”) to display fonts consistently. When you access a page, your browser loads the required web fonts into its cache to display text and fonts correctly.
For this purpose, your browser must connect to Google servers. Personal data may also be transferred to Google LLC servers in the United States. Google thereby learns that our website was accessed through your IP address. We use Google Web Fonts in the interest of presenting our online services consistently and attractively, which is a legitimate interest under Art. 6(1)(f) GDPR. If your browser does not support web fonts, a standard font from your computer is used.
Further information about Google Web Fonts is available at https://developers.google.com/fonts/faq and in Google’s privacy policy: https://www.google.com/policies/privacy/

8) Rights of the data subject

8.1 Applicable data protection law grants you comprehensive rights against the controller regarding the processing of your personal data. These rights are described below:

  • Right of access under Art. 15 GDPR: in particular, you have the right to information about the personal data we process, its purposes and categories, recipients, intended storage period, rights to rectification, erasure, restriction, objection and complaint, the source of data not collected from you, automated decision-making including profiling and its logic and effects, and safeguards under Art. 46 GDPR for transfers to third countries;
  • Right to rectification under Art. 16 GDPR: you have the right to prompt correction of inaccurate data concerning you and completion of incomplete data held by us;
  • Right to erasure under Art. 17 GDPR: you may request erasure where the conditions of Art. 17(1) GDPR are met. This right does not apply where processing is necessary for freedom of expression and information, compliance with a legal obligation, public interest, or legal claims;
  • Right to restriction under Art. 18 GDPR: you may request restriction while contested data is checked, where you oppose erasure after unlawful processing, where you need the data for legal claims after we no longer need it, or while it is determined whether our legitimate grounds override your objection;
  • Right to notification under Art. 19 GDPR: where you exercise the right to rectification, erasure or restriction, the controller must inform recipients unless this is impossible or involves disproportionate effort. You have the right to be informed about those recipients.
  • Right to data portability under Art. 20 GDPR: you have the right to receive personal data you provided in a structured, commonly used and machine-readable format or request its transmission to another controller where technically feasible;
  • Right to withdraw consent under Art. 7(3) GDPR: you may withdraw consent at any time with future effect. We will then delete the relevant data promptly unless another legal basis permits processing. Withdrawal does not affect prior lawful processing;
  • Right to lodge a complaint under Art. 77 GDPR: if you believe that processing infringes the GDPR, you may lodge a complaint with a supervisory authority, particularly where you live, work or where the alleged infringement occurred, without prejudice to other remedies.

8.2 RIGHT TO OBJECT

WHERE WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTERESTS, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.
IF YOU OBJECT, WE WILL STOP PROCESSING THE DATA. PROCESSING MAY CONTINUE WHERE WE DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR WHERE PROCESSING IS NEEDED TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS.

WHERE YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING, YOU MAY OBJECT TO THAT PROCESSING AT ANY TIME AS DESCRIBED ABOVE.

IF YOU OBJECT, WE WILL STOP PROCESSING YOUR DATA FOR DIRECT MARKETING.

9) Retention period for personal data

The retention period for personal data depends on the applicable legal basis, purpose and, where relevant, statutory commercial and tax retention periods.

Where processing is based on explicit consent under Art. 6(1)(a) GDPR, the data is stored until the data subject withdraws consent.

Where statutory retention periods apply to data from contractual or similar obligations under Art. 6(1)(b) GDPR, the data is routinely deleted when those periods expire unless it remains necessary to perform or prepare a contract or we have a legitimate interest in retaining it.

Where processing is based on Art. 6(1)(f) GDPR, the data is stored until the data subject objects under Art. 21(1) GDPR, unless compelling legitimate grounds override the objection or processing is needed for legal claims.

For direct marketing based on Art. 6(1)(f) GDPR, the data is stored until the data subject objects under Art. 21(2) GDPR.

Unless this policy states otherwise, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.