Privacy Policy

We are pleased that you are interested in our website. Protecting your privacy is very important to us. Below, we provide detailed information about how your data is handled when you use our website and our online shop.

The controller responsible for data processing is:

MILEI GmbH

Kemptener Str. 91

88299 Leutkirch

Email: info@miju.de

Phone: +49 7561 85 0

You can contact our Data Protection Officer at:

MILEI GmbH, Kemptener Straße 91, 88299 Leutkirch, Germany.

Email: datenschutz@milei.de

Phone: +49 7561 85 0

1. Access Data and Hosting

1.1 Access Data

You can visit our websites without providing any personal information. Each time a webpage is accessed, the web server automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access. This access data is evaluated exclusively for the purpose of ensuring the smooth operation of the site and improving our offering. This serves to safeguard our legitimate interests in the correct presentation of our offering, which prevail in the context of a balancing of interests, in accordance with Art. 6(1) sentence 1 lit. f GDPR. All access data will be deleted no later than seven days after the end of your visit to the site. All access data is only processed for as long as necessary to achieve the processing purposes stated above.

1.2 Hosting

Our online shop is operated via the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (hereinafter “Shopify”).

Shopify provides the technical infrastructure for operating our online shop. When you visit our online shop, information is automatically transmitted from your browser to Shopify’s servers. This includes, in particular, your IP address, date and time of access, browser type and version, operating system used, referrer URL, and the hostname of the accessing computer. This data is stored in so-called server log files.

In addition, Shopify processes personal data as part of the operation of the shop that you provide during the course of an order. This includes, in particular, your name, email address, delivery and billing address, telephone number, and order data (ordered items, time of order, order value). This data is stored by Shopify on servers that may be located, among other places, in Canada and the United States of America.

The processing of the aforementioned data is carried out on the basis of Art. 6(1) sentence 1 lit. b GDPR, insofar as the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures. Insofar as the processing of data serves the proper operation and security of our online shop, it is carried out on the basis of Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the reliable and secure operation of our online shop.

Where personal data is transferred to third countries (in particular Canada or the USA), this is based on adequacy decisions issued by the European Commission pursuant to Art. 45 GDPR, where available, or on appropriate safeguards pursuant to Art. 46 GDPR, in particular the standard contractual clauses of the European Commission concluded by Shopify. We have concluded a data processing agreement (Data Processing Addendum) with Shopify in accordance with Art. 28 GDPR, which ensures that Shopify processes the personal data of our shop visitors and customers only in accordance with our instructions and complies with the requirements of the GDPR.

Further information on data protection at Shopify can be found in Shopify’s privacy policy at: https://www.shopify.com/legal/privacy.

1.3 Design and Creation of the Website

Our website is operated using the software “Webflow.” The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter “Webflow”), with whom we have concluded a data processing agreement.

Webflow is a service for designing and creating websites. When you visit our website, the following data is collected and processed by Webflow: IP address, browser name and browser version, browser fingerprint, screen resolution, HTTP headers, browser language, geographic location (based on the IP address), and log data (log files). This data is also collected using cookies and log files. The data processing serves the operation and provision of our website as well as ensuring the security of the platform, including the detection of fraud attempts and the prevention of data loss. The legal basis for processing is your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) sentence 1 lit. a GDPR.

The data is transferred to Webflow, Inc. in the United States of America. For the transfer of personal data to the USA, Webflow relies on the EU-U.S. Data Privacy Framework as well as the EU Standard Contractual Clauses (SCCs).

The data will be deleted as soon as it is no longer required for the purposes of processing. Further information on data protection at Webflow can be found in Webflow’s privacy policy: https://webflow.com/legal/privacy
‍If you have any questions regarding data protection at Webflow, you can contact Webflow’s data protection officer: https://webflow.com/legal/privacy

2. Data Processing for Contract Fulfilment and Contact

2.1 Data Processing for Contract Fulfilment

For the purpose of contract fulfilment (including handling inquiries regarding and processing any existing warranty and performance disruption claims, as well as any statutory update obligations) in accordance with Art. 6(1) sentence 1 lit. b GDPR, we collect personal data if you voluntarily provide it to us as part of your order.

Mandatory fields are marked as such, as we require this data in these cases for contract fulfilment. If you do not provide the information marked as mandatory, we will not be able to process or ship your order. In this case, you will not be able to use our online shop. The specific data collected can be seen from the respective input forms.

Further information on the processing of your data, in particular regarding the transfer to our service providers for the purpose of order, payment, and shipping processing, can be found in the following sections of this privacy policy.

After full completion of the contract, your data will be restricted for further processing and deleted after the expiry of the retention periods required under tax and commercial law in accordance with Art. 6(1) sentence 1 lit. c GDPR, unless you have expressly consented to further use of your data in accordance with Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this policy.

2.2 Customer Account

We collect personal data if you voluntarily provide it to us when opening a customer account. Mandatory fields are marked as such, as we require this data in these cases to open the customer account, and you cannot complete the account registration without providing it. The data collected can be seen from the respective input forms.

We use the data you provide for contract fulfilment and for processing your inquiries in accordance with Art. 6 (1) sentence 1 lit. b GDPR.

You can delete your customer account at any time, either by sending a message to the contact option described in this privacy policy or by using a function provided for this purpose in your customer account. After deletion of your customer account, your data will be deleted unless you have expressly consented to further use of your data in accordance with Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this policy.

2.3 Contact

In the context of customer communication, we collect personal data in accordance with Art. 6(1) sentence 1 lit. b GDPR for the purpose of processing your inquiries if you voluntarily provide this data when contacting us (e.g. via contact form, live chat tool, or email).

Mandatory fields are marked as such, as we require this data in these cases to process your request. The specific data collected can be seen from the respective input forms.

After your inquiry has been fully processed, your data will be deleted unless you have expressly consented to further use of your data in accordance with Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this privacy policy.

3. Data Processing for Shipping Fulfilment

For the purpose of contract fulfilment in accordance with Art.6(1) sentence 1 lit. b GDPR, we pass your data on to the fulfilment partner commissioned by us to process the order. This is MH direkt e-Commerce + fulfillment GmbH + Co KG, Reitschulstraße 7, 6923 Lauterach, Austria.

If you have given us your explicit consent during or after your order, we will, on the basis of this consent pursuant to Art. 6(1) sentence 1 lit. a GDPR, pass on your email address and telephone number to the fulfilment partner so that the shipping service provider used by them can contact you for the purpose of delivery notification or coordination.

This consent can be revoked at any time for the future by sending a message to the contact option described in this privacy policy. After revocation, we will delete the data provided for this purpose unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this policy.

4. Data Processing for Payment Processing

When processing payments in our online shop, we work with the partners named below:

4.1 Shopify Payments

To process payments in our online shop, we use the payment service Shopify Payments. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. The actual payment processing is carried out by the payment service provider Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland (hereinafter “Stripe”), which acts as a sub-processor of Shopify.

If you choose a payment method during the ordering process that is processed via Shopify Payments (e.g. credit card, debit card, or other supported payment methods), the personal data required for payment processing will be transmitted to Shopify and/or Stripe. This includes, in particular, your name, billing address, email address, order amount, currency, and the payment data you enter (e.g. credit card number, expiry date, card verification code). In addition, further data such as your IP address and device information may be processed for fraud prevention and identity verification.

This data processing is carried out on the basis of Art. 6(1) sentence 1 lit. b GDPR and is necessary for the performance of the purchase contract concluded between you and us, in particular for processing the payment method you selected. Insofar as the data processing serves the detection and prevention of fraud, it is carried out on the basis of Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in preventing payment defaults and fraudulent transactions.

Your payment data is processed exclusively for the purpose of payment processing and fraud prevention. We do not store complete payment card data on our own systems. Shopify Payments and Stripe are certified according to the Payment Card Industry Data Security Standard (PCI DSS) and ensure the secure handling of your payment data.

Where personal data is transferred to third countries in the context of payment processing, the safeguards referred to in Section 1 apply accordingly. Stripe has also committed to complying with the European Commission’s Standard Contractual Clauses.

The payment data is stored for the duration of contract processing and subsequently for the period required to comply with commercial and tax retention obligations (generally six or ten years in accordance with Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code(HGB)). After the respective retention periods have expired, the data will be deleted unless other legal retention obligations or legitimate interests prevent deletion.

Further information on data protection at Stripe can be found at: https://stripe.com/de/privacy

4.2 PayPal

In our online shop, we also offer you the option to process your payment via the payment service provider PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”).

If you choose PayPal as your payment method during the ordering process, the personal data required for payment processing will be automatically transmitted to PayPal. This includes, in particular, your name, email address, billing and delivery address, order amount, currency, and information about the ordered goods. In addition, PayPal may collect further data in the course of payment processing, in particular your IP address, device information, and information about your PayPal account (e.g. account ID, stored payment sources). PayPal may also process this data for credit checks, fraud prevention, and identity verification.

This data processing is carried out on the basis of Art. 6(1) sentence 1 lit. b GDPR and is necessary for the performance of the purchase contract concluded between you and us, in particular for processing the payment method you selected. Insofar as PayPal processes data for credit checks, fraud prevention, or identity verification, this is done on the basis of Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in preventing payment defaults and fraudulent transactions.

PayPal acts as an independent controller within the meaning of Art. 4(7) GDPR when processing your personal data in the context of payment processing. The processing of your data by PayPal is therefore governed byPayPal’s privacy policy. Where PayPal transfers personal data to third countries (in particular the United States), it relies on appropriate safe guards pursuant to Art. 46 GDPR, in particular the European Commission’s Standard Contractual Clauses, or on adequacy decisions pursuant to Art. 45 GDPR.

The data collected in the context of PayPal payment processing is stored for the duration of contract fulfilment and subsequently for the period required to comply with commercial and tax retention obligations (generally six or ten years in accordance with Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB)). After the respective retention periods have expired, the data will be deleted unless other legal retention obligations or legitimate interests prevent deletion.

Further information on data protection at PayPal can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

4.3 Data Processing for the Purpose of Fraud Prevention and Optimisation of Our Payment Processes

Where applicable, we may provide the above-mentioned service providers with additional data, which they use together with the data required for payment processing for the purpose of fraud prevention and optimisation of our payment processes (e.g. invoicing, processing of disputed payments, support of accounting).

This serves, in accordance with Art. 6(1) sentence 1 lit. f GDPR, to protect our overriding legitimate interests within the framework of a balancing of interests, namely our protection against fraud and the efficient management of payments.

5. Advertising via Email, Post, Telephone

5.1 Email Newsletter with Registration, Newsletter Tracking with Separate Consent

If you subscribe to our newsletter, we use the data required for this purpose or separately provided by you to regularly send you our email newsletter on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR.

You can unsubscribe from the newsletter at any time, either by sending a message to the contact option described below or via a dedicated unsubscribe link in the newsletter. After unsubscribing, we will delete your email address from the mailing list unless you have expressly consented to further use of your data in accordance with Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this privacy policy.

If you have additionally given your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR to the analysis of our newsletter, we will also analyse how you interact with our newsletter by measuring, storing, and evaluating open rates and click-through rates for the purpose of designing future newsletter campaigns (“newsletter tracking”).

For this analysis, the sent emails contain single-pixel technologies (e.g. web beacons, tracking pixels) stored on our website. For the evaluations, we link in particular the following “newsletter data”

• the page from which the page was requested (referrer URL),
• the date and time of access,
• the description of the type of web browser used,
• the IP address of the requesting computer,
• the email address,
• the date and time of registration and confirmation

and the single-pixel technologies with your email address or your IP address and, if applicable, an individual ID. Links contained in the newsletter may also include this ID.

You can unsubscribe from newsletter tracking at any time, either by sending a message to the contact option described or via a dedicated link in the newsletter.

The information is stored for as long as you are subscribed to the newsletter.

5.2 Postal Advertising and Your Right to Object

In addition, we reserve the right to use your first and last name and your postal address for our own advertising purposes, for example to send you interesting offers and information about our products by postal mail. This serves to protect our legitimate interests in advertising communication with our customers, which prevail within the framework of a balancing of interests, in accordance with Art. 6(1) sentence 1 lit. f GDPR. You may object to the storage and use of your data for these purposes at any time by sending a message to the contact option described in this privacy policy. After your objection has been received, we will delete your address from the mailing list unless you have expressly consented to further use of your data in accordance with Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this policy.

5.3 Telephone Advertising

If you have given your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR, we use the data required for this purpose or separately provided by you for our own advertising purposes, for example to inform you about interesting offers and our products. You may withdraw your consent at any time, either by sending a message to the contact option described in this privacy policy or by verbally stating your withdrawal during any call. After withdrawal, we will delete your telephone number unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this policy.

6. Cookies and other Technologies

6.1 General Information

In order to make visiting our website attractive and to enable the use of certain functions, we use technologies on various pages, including so-called cookies. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your device and allow us to recognise your browser on your next visit (persistent cookies). The storage duration can be found in the overview in your browser’s cookie settings.

Privacy protection on end devices

When using our online service, we use strictly necessary technologies in order to provide the explicitly requested digital service. The storage of information on your device or access to information already stored on your device does not require consent in this respect (§ 25(2) TDDDG).

For non-essential functions, the storage of information on your device or access to information already stored on your device requires your consent (§ 25(1) TDDDG). Please note that if consent is not given, parts of the website may not be fully usable. Any consent you may have given remains valid until you adjust or reset the respective settings on your device.

Subsequent data processing via cookies and other technologies

We use such technologies that are strictly necessary for the use of certain website functions. Through these technologies, IP address, time of visit, device and browser information, as well as information about your use of our website are collected and processed. This serves, within the framework of a balancing of interests, our overriding legitimate interest in an optimised presentation of our offering pursuant to Art. 6(1) sentence 1 lit. f GDPR.

In addition, we use technologies to fulfil legal obligations to which we are subject (e.g. to be able to document consents to the processing of your personal data), as well as for web analytics and online marketing. Further information on this, including the respective legal basis for data processing, can be found in the following sections of this privacy policy. Where applicable, we also use technologies that are not listed individually in this privacy policy. More detailed information on these technologies, including the respective legal basis for data processing, can be found on the Usercentricsplatform. You can access this by clicking the fingerprint button in the bottom right or left corner of the page.

Cookie settings

You can find the cookie settings for your browser under the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

If you have consented to the use of technologies pursuant to §25(1) TDDDG and Art. 6(1) sentence 1 lit. a GDPR, you may withdraw your consent at any time by sending a message to the contact option described in this privacy policy. Alternatively, you can click the fingerprint button in the bottom right or left corner of the page. If cookies are not accepted, the functionality of our website may be restricted.

6.2 Use of Usercentrics Consent Management Platform for Managing Consents

Our website uses the consent management platform Usercentrics to obtain and manage your consent for the storage of cookies and similar technologies as well as for the associated processing of personal data. The provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany (hereinafter “Usercentrics”).

When you access our website, a so-called consent banner is displayed via Usercentrics, through which you can give or refuse your consent to individual cookies and data processing operations. Your selection is stored by Usercentrics in a cookie on your device so that your preferences are taken into account on subsequent visits and do not need to be requested again. In addition, Usercentrics stores proof of your consent or refusal (so-called consent record), which includes the time and type of consent as well as ananonymised identifier.

The data collected by Usercentrics is not used to personally identify individual website visitors and is not merged with other personal data unless the user has separately consented to this.

Data processing by Usercentrics is carried out on the basis of Art. 6(1) lit. c GDPR in conjunction with Art. 7(1) GDPR, as we are legally obliged as the controller to provide proof of consent given or refused. In addition, processing is based on Art. 6(1) lit. f GDPR. Our legitimate interest lies in the legally compliant management of consents given by our website visitors and compliance with data protection requirements, in particular § 25TDDDG.

We have concluded a data processing agreement with Usercentrics in accordance with Art. 28 GDPR. Data processing by Usercentrics takes place exclusively on servers within the European Union.

The Usercentrics consent cookie is stored for the duration of your visit or until you change your consent settings or manually delete the cookie. Consent records are stored for a period of three years in order to comply with the obligation to provide proof under Art. 7(1) GDPR.

You can access and change your consent settings at any time via the consent banner provided on our website or via the “Cookie Settings” link in the footer of our website.

Further information on data protection at Usercentrics can be found at: https://usercentrics.com/privacy-policy/.

6.3 Content Delivery Network – Amazon CloudFront

‍We use the content delivery network (hereinafter “CDN”) Amazon CloudFront to deliver website content. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (hereinafter “AWS”), a service of Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA. ACDN is a network of regionally distributed servers used to deliver content such as images, videos, or scripts. Its use serves to reduce loading times of our website, increase security (in particular protection against DDoS attacks), and optimise data transmission between our online shop and your device.

When you access our website, your browser establishes a connection to AWS servers. In doing so, personal data is transmitted to AWS, in particular your IP address, user agent data, usage data, device operating system, device information, and browser information. This data is stored by AWS in server log files and may also be processed in the USA or other third countries where AWS maintains server locations.

The processing is carried out on the basis of Art. 6(1) lit. f GDPR. Our legitimate interest lies in the secure, fast, and efficient delivery of our website. In addition, processing is based on Art. 6(1) lit. b GDPR, insofar as the use of the CDN is necessary for the proper provision of the online shop in the context of contract initiation or performance.

We have concluded a data processing agreement (Data Processing Addendum) with AWS in accordance with Art. 28 GDPR. Where personal data is transferred to the USA or other third countries, AWS relies on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and, where applicable, on the European Commission’s adequacy decision for the USA (EU–U.S. Data Privacy Framework) pursuant to Art. 45 GDPR.

The data stored in server log files is generally deleted automatically by AWS after a short period of time, unless it must be retained temporarily for security reasons or for troubleshooting purposes.

Further information on data protection at AWS can be found at: https://aws.amazon.com/de/privacy/

7. Use of Cookies and Other Technologies

We use the following cookies and other technologies from third-party providers on our website. Unless otherwise stated for the individual technologies, this is carried out on the basis of your consent pursuant to § 25(1) TDDDG and Art. 6(1) sentence 1 lit. a GDPR. After the purpose ceases to apply and the use of the respective technology by us ends, the data collected in this context will be deleted. You may withdraw your consent at any time with effect for the future. Further information on your withdrawal options can be found in the section “Cookies and Other Technologies”.

Google Services

We use the technologies described below from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The information automatically collected by Google technologies about your use of our website is generally transmitted to a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there. Unless otherwise stated for the individual technologies, data processing is carried out on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR for the respective technology. Further information on data processing by Google can be found in Google’s privacy policy.

Google LLC processes personal data in the USA. Google LLC is certified under the EU–US Data Privacy Framework for which an adequacy decision by the European Commission exists. In addition, Google LLC uses the European Commission’s Standard Contractual Clauses.

 Google Analytics

For the purpose of website analysis, Google Analytics automatically collects and stores data (IP address, time of visit, device and browser information, and information about your use of our website), from which usage profiles are created using pseudonyms. Cookies may be used for this purpose. When you visit our website from the EU, your IP address is stored on a server located in the EU to derive location data and is then immediately deleted before the traffic is forwarded to other Google servers for processing. Data processing is carried out on the basis of a data processing agreement with Google.

If you do not give us your consent pursuant to § 25(1) TDDDG and Art. 6(1) sentence 1 lit. a GDPR to the use of Google Analytics, no cookies will be stored or read on your device. The data processing described in the previous paragraphs will not take place.

Google Ads

When you visit our website, a so-called Google remarketing cookie is set, which enables interest-based advertising based on the collection and processing of data (IP address, time of visit, device and browser information, and information about your use of our website), using a pseudonymous cookie ID and based on the pages you have visited.

Further data processing only takes place if you have activated the “personalised advertising” setting in your Google account. In this case, if you are logged into Google during your visit to our website, Google uses your data together with Google Analytics data to create and define audience lists for cross-device remarketing.

For website analysis and event tracking, we measure your subsequent usage behaviour via Google Ads Conversion Tracking when you arrive at our website via a GoogleAds advertisement. Cookies may be used for this purpose, and data (IP address, time of visit, device and browser information, and information about your use of our website based on predefined events such as visiting a webpage or newsletter sign-up) may be collected, from which usage profiles are created using pseudonyms.

If you do not give your consent pursuant to § 25 TDDDG and Art. 6(1) sentence 1 lit. a GDPR for the use of Google Ads, no cookies will be stored or read on your device. The data processing described in the previous paragraphs will then not take place.

Google Tag Manager

The Google Tag Manager allows us to manage various codes and services on our website. When implementing individual tags, Google may also process personal data (e.g. IP address, online identifiers, including cookies). Data processing is carried out on the basis of a data processing agreement with Google. The use of the Google Tag Manager enables the integration of various services and technologies. If you do not wish to use individual tracking services and have therefore disabled them, this deactivation remains in place for all affected tracking tags implemented via the Google Tag Manager. The use of the Google Tag Manager requires your consent pursuant to § 25(1) TDDDG and Art. 6(1) sentence 1 lit. a GDPR.

8. Social Media

8.1 Social Buttons from Facebook (by Meta), Instagram (by Meta)

Social buttons from social networks are used on our website. These are only integrated into the site as HTML links, so no connection to the servers of the respective provider is established when you access our website. If you click on one of the buttons, the website of the respective social network opens in a new browser window, where you can then, for example, use the Like or Share button.

8.2 Our Online Presence on Facebook (by Meta), Instagram (by Meta)

We maintain publicly accessible profiles (so-called fan pages) on the social networks Facebook and Instagram. The provider of both platforms is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter “Meta”).

When you visit our fan pages, we and Meta process your personal data as joint controllers within the meaning of Art. 26 GDPR.

Meta provides us with so-called Page Insights in connection with the operation of the fan pages. These are aggregated statistics created based on certain events recorded by Meta’s servers when you interact with our fanpages and their content. Page Insights may be generated based on personal data collected in connection with a visit to or interaction with our fan pages and their content. This includes, in particular, information about page views, likes, page activity, post interactions, video views, reach of posts, comments, shared content, responses, as well as demographic information such as age, gender, location, and language of visitors. In addition, Meta may store cookies and similar technologies on your device or access such technologies in order to collect the aforementioned data and create personal user profiles.

We have entered into an agreement with Meta pursuant to Art. 26 GDPR regarding joint responsibility (so-called “Page Insights Addendum”). This agreement governs which data protection obligations are fulfilled by us and which are fulfilled by Meta. The agreement can be accessed at: https://www.facebook.com/legal/terms/page_controller_addendum. In essence, Meta is responsible for fulfilling the information obligations pursuant to Art. 13 and 14 GDPR with regard to Insights data processing, as well as for ensuring data subject rights regarding Insights data stored by Meta. Nevertheless, you may also assert your rights (access, rectification, erasure, restriction of processing, data portability, and objection) against us. In this case, we will forward your request to Meta without undue delay.

When you interact with our fan pages, for example by commenting on posts, sending us messages, or sharing content, we process the resulting personal data (e.g. your username, profile picture, the content of your comment or message). This processing is carried out for the purpose of communicating with you and managing our fan pages.

The processing of your personal data in connection with the visit and use of our fan pages is based on Art. 6(1) sentence 1 lit. f GDPR. Our legitimate interest lies in modern and user-friendly public relations, communication with customers and interested parties, and the statistical evaluation of the use of our fan pages to optimise our offering. Where you have consented to data processing with Meta, processing is based on Art. 6(1) lit. a GDPR. You may withdraw your consent at any time from Meta.

Meta transfers personal data, among other places, to the United States of America. In this respect, Meta relies on the European Commission’s Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR and, where applicable, on the European Commission’s adequacy decision for the USA (EU–U.S. Data Privacy Framework) pursuant to Art. 45 GDPR.

We would like to point out that, as the operator of the fan pages, we have no full control over Meta’s data processing. Meta’s comprehensive data processing, in particular profiling and the use of data for advertising purposes, is governed by Meta’s privacy policy. Further information can be found at: https://www.facebook.com/privacy/policy/ (for Facebook) and https://privacycenter.instagram.com/policy (for Instagram).

You have the right to object to the processing of your personal data for the aforementioned purposes at any time. You can contact us or Meta directly to do so. In addition, you can influence Meta’s data processing via your Facebook or Instagram account settings and, in particular, restrict the creation of advertising profiles.

9. Retention Period

Unless otherwise expressly stated in this privacy policy, your personal data will be deleted as soon as it is no longer required for the purpose for which it was collected or otherwise processed, and no statutory retention obligations prevent its deletion.

The following principles apply in detail:

Where your data is processed in the context of initiating or performing a contract, it will be restricted for further processing after full completion of the contract and expiry of any warranty and limitation periods. Final deletion takes place after the expiry of statutory retention periods under tax and commercial law, in particular the six-year retention period pursuant to Section 257(1) nos. 2 and 3 of the German Commercial Code (HGB) (commercial letters and accounting documents) and the ten-year retention period pursuant to Section 147(1) of the German Fiscal Code (AO) and Section 257(1) nos. 1 and 4 HGB (annual financial statements, accounting documents, and tax-relevant records), unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we are otherwise legally permitted to retain the data for a longer period.

Where your data is processed on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR, it will be deleted as soon as you withdraw your consent and no other legal basis for further processing exists.

Where your data is processed on the basis of our legitimate interests pursuant to Art. 6(1) sentence 1 lit. f GDPR, it will be deleted as soon as the legitimate purpose ceases to apply or you successfully object to the processing pursuant to Art. 21 GDPR, and no overriding legitimate grounds for processing exist.

Where your data is collected in connection with the use of cookies and similar technologies, the storage period depends on the respective technology and is specified separately, where applicable, in the relevant sections of this privacy policy. Once the purpose ceases to apply and the respective technology is no longer used, the data collected in this context will be deleted.

The above information applies subject to any deviating retention periods expressly stated in the individual sections of this privacy policy for specific processing activities.

10. Contact Options and Your Rights

10.1 Your Rights

As a data subject, you have the following rights

• Pursuant to Art. 15 GDPR, the right to obtain information about your personal data processed by us, to the extent described therein;
• Pursuant to Art. 16 GDPR, the right to obtain without undue delay the rectification of inaccurate personal data or the completion of your personal data stored by us;
• Pursuant to Art. 17 GDPR, the right to obtain the erasure of your personal data stored by us, unless further processing is necessary:
  
  • for exercising the right of freedom of expression and information;
  • for compliance with a legal obligation;
  • for reasons of public interest; or
  • for the establishment, exercise, or defence of legal claims;
• Pursuant to Art. 18 GDPR, the right to request the restriction of processing of your personal data, where:
  
  • you contest the accuracy of the data;
  • the processing is unlawful, but you oppose its erasure;
  • we no longer need the data, but you require it for the establishment, exercise, or defence of legal claims; or
  • you have objected to the processing pursuant to Art. 21 GDPR;
• Pursuant to Art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request the transfer of such data to another controller;
• Pursuant to Art. 7(3) GDPR, the right to withdraw your consent at any time with effect for the future;
• Pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority of your habitual residence, place of work, or our company headquarters.

Right to Object

Where we process personal data on the basis of our overriding legitimate interests within the framework of a balancing of interests as explained above, you may object to this processing with effect for the future.

If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above.

If the processing is carried out for other purposes, you only have the right to object if there are reasons arising from your particular situation.

After exercising your right to object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.

This does not apply if the processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for this purpose.

10.2 Contact Options

If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to request information, rectification, restriction, or deletion of data, or to withdraw granted consents or object to specific data use, please contact us directly using the contact details provided in our legal notice (Imprint) or our Data Protection Officer:

MILEI GmbH

Data Protection Officer Kemptener Str. 91
88299 Leutkirch - Germany
+49 7561 85 0
datenschutz@milei.de