Privacy Policy

The protection of your personal data is an important concern for us. Below, we inform you comprehensively about the collection, processing, and use of your data when visiting our website, using our shop, and utilizing our services.

 

Introductory information on the collection of personal data

I) Personal data means all data with which you can be personally identified.

II) You can generally use our website without providing any personal data. If a data subject wishes to use our company’s services via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the data subject’s consent.

III) For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string “https://” and the lock symbol in your browser line.

IV) We generally cooperate with competent authorities and support lawful official or criminal investigations. We transmit personal data to authorities or other third parties if we are legally obliged to do so, or entitled on the basis of a court or official order, or if the transmission in an individual case is permissible on the basis of another legal basis. This can be the case in particular with lawful requests for information from police, public prosecutors, or other competent authorities for the prosecution of criminal offenses or for defense against imminent danger.

 

1) Contact details of the controller and supervisory authority

I) The controller within the meaning of the General Data Protection Regulation (Art. 4 No. 7 GDPR) and national data protection laws is:

KD Solutions OHG
Ladenburger Straße 12a
69198 Schriesheim
E-Mail:

You can find the complete provider identification in the imprint.

II) These contact details apply to all questions regarding data protection on this website as well as for all data protection claims on your part.

III) The controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

IV) Competent supervisory authority:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI)
Heilbronner Straße 35, 70191 Stuttgart (Postal address: Postfach 10 29 32, 70025 Stuttgart)
E-Mail: | Website: www.baden-wuerttemberg.datenschutz.de

 

2) Data collection when visiting our website (server log files)

I) If you use our website only for information purposes, i.e., if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called “server log files”). When you call up our website, we collect the following data that is technically necessary for us to display the website to you:

    • Our visited website
    • Date and time at the time of access
    • Amount of data sent in bytes
    • Source/reference from which you reached the page
    • Browser used
    • Operating system used
    • IP address used (if applicable in an anonymized form)

II) Processing is carried out in accordance with Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the security and improvement of the stability and functionality of our website. A transfer or other use of the data generally does not take place. Our hosting service provider and any security or firewall service providers used may gain access to this data in the course of their technical tasks.
We reserve the right to check the server log files retroactively if concrete indications point to unlawful or security-relevant use. Storage period of regular server log files: max. 7 days, unless a longer storage is necessary for the clarification of a specific security incident or legal violation.

 

3) Cookies & consent management (Complianz | § 25 TDDDG / GDPR)

I) To make visiting our website attractive and to enable the use of certain functions, we use cookies and comparable technologies. These are small text files that are stored on your end device. Some cookies are deleted after the end of the browser session (session cookies), others remain permanently or for a certain time on the end device (persistent cookies).

II) According to § 25 para. 1 TDDDG, the storage of information on the end device or access to information already stored is generally only permissible if the user has actively consented on the basis of clear and comprehensive information. Exceptionally, consent according to § 25 para. 2 TDDDG is not required if the storage or access is strictly necessary in order to provide a digital service expressly requested by the user. This concerns in particular technically necessary functions such as shopping cart, login, or technical execution of an order.
Cookies or comparable technologies for statistics, marketing, or pure convenience functions are not covered by this exception and are only used after prior consent.

III) For consent management, we use the Complianz Privacy Suite (GDPR/CCPA) plugin. For non-essential cookies (statistics, marketing, convenience), we obtain prior voluntary consent via Complianz (Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG). Essential functional cookies that are strictly necessary for a digital service expressly requested by you are used on the basis of § 25 para. 2 TDDDG. To the extent that personal data is processed in the process, the processing is additionally carried out on the respective relevant legal basis according to Art. 6 GDPR.
A current overview of the cookies used, purposes, providers, and storage periods is available in the cookie settings dialog.

IV) In some cases, cookies serve to simplify the ordering process by saving settings (e.g. remembering the contents of a virtual shopping cart for a later visit).

V) Revocation / adjustment: You can adjust or revoke your cookie settings at any time with effect for the future via the “Cookie settings” button directly in the footer of our website. Alternatively, you can control the storage of cookies via the settings of your web browser; common browsers – such as Firefox, Google Chrome, Microsoft Edge, Apple Safari, Opera, Brave, Vivaldi, Startpage, and Ecosia – offer management/deletion functions for this. How you manage cookies in your browser can be found in the respective help menu of your browser.

VI) Please note that the functionality of our website may be restricted if cookies are not accepted.

 

4) Contacting us

I) When contacting us (e.g. via contact form or by e-mail), personal data is collected. Which data is collected in the case of a contact form is evident from the respective contact form. This data is stored and used exclusively for the purpose of answering your concern or for contacting you and the associated technical administration.
Legal basis is:

    • Art. 6 para. 1 lit. b GDPR, if your inquiry is aimed at the conclusion or execution of a contract;
    • Art. 6 para. 1 lit. f GDPR, if it is another type of inquiry;
    • Art. 6 para. 1 lit. c GDPR, insofar as there is a legal obligation.

II) If your contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR. Your data will be deleted after final processing of your inquiry, provided that no statutory retention obligations exist or further storage is required for the assertion, exercise, or defense of legal claims.

III) We may contact you to inform you about the status of your order, to clarify other issues regarding your order, to notify you regarding your account, to resolve problems with your account, to resolve a dispute, to process owed fees or outstanding payments, or to enforce our user agreement and legal obligations. For these purposes, we may contact you via our actually offered communication channels (by e-mail, chat, messenger services (e.g. WhatsApp), or post) (Art. 6 para. 1 lit. b, f GDPR). If you contact us exceptionally by telephone or SMS, we may also contact you via this path insofar as this is necessary to answer or process your concern.
If you use a messenger service like WhatsApp, the information under section 14 and the data protection provisions of the respective provider also apply.

 

5) Data processing when opening a customer account and for contract processing

I) In accordance with Art. 6 para. 1 lit. b GDPR, personal data continues to be collected and processed if you provide us with this for the execution of a contract or when opening a customer account.

II) Which data is collected is evident from the respective input forms. Mandatory information required for contract performance is marked accordingly; failure to provide this data may result in the contract or account opening not being carried out.

III) Deletion of your customer account is possible at any time and can be done by a message to the above-mentioned address of the controller. We store and use the data provided by you for contract processing. After complete processing of the contract or deletion of your customer account, your data will be blocked with regard to tax and commercial retention periods and deleted after expiry of these periods, unless another legal retention obligation, necessary legal defense, or another lawful storage reason stands in the way.

 

6) Data processing for order processing & fulfillment

I) Collected data: We receive, collect, and store all information that you enter on our website or provide to us in any other way (e.g. upon account creation/order). In addition, we collect your IP address, e-mail address, and technical computer and connection information, insofar as this is necessary for order processing, security, or service provision.
We only process data that is required for the respective purpose. In the case of a user account, this may in particular be login data without password as well as order and purchase history. Insofar as analysis or session information is processed, the information on cookies and web analysis also applies.

II) To fulfill our contractual obligations, we work with external intermediaries and subcontractors. For this purpose, we may pass on the link to the publicly accessible social media profile specified in the order and the data strictly required for the specific execution of the order, for example the desired number and type of subscribers, followers, comments, likes, or views, etc.
A publicly accessible profile link can still represent personal data, in particular if you share personal data on your social media profile. The transfer takes place only insofar as it is necessary for the specific contract performance. Legal basis is Art. 6 para. 1 lit. b GDPR. Information on possible third-country transfers is contained in section 9.

 

7) Wallet credit system (TeraWallet)

I) If you use our wallet system (TeraWallet) to top up credit in the customer account, receive cashback, or use credit for partial/full payment of orders, we process the associated transaction data (credit balance, history of top-ups, redemptions, cashback calculations, and refunds).

II) Legal basis is Art. 6 para. 1 lit. b GDPR (contract performance within the framework of the customer account/payment system).

III) The credit data generally remains local in the shop database; a transfer to third parties does not take place in this respect (except for payment processing of the pure credit top-up via the subsequent payment providers).

 

8) Use of payment service providers for payment processing

I) Mollie B.V.: If you decide on a payment method (Sofort-Banking, Giropay, iDEAL) of the payment service provider Mollie, payment processing is carried out via Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands, to whom we pass on your information provided during the ordering process together with the information about your order (name, address, IBAN, BIC, invoice amount, currency, order and transaction number) in accordance with Art. 6 para. 1 lit. b GDPR. Data protection: https://www.mollie.com/de/privacy

II) Nomu Pay Limited: When selecting the payment method “credit card”, payment processing is carried out via Nomu Pay Limited, 5th Floor Rear, Connaught House, 1 Burlington Road, Dublin 4, Ireland, to whom we pass on name, address, credit card data, invoice amount, currency, order, and transaction number in accordance with Art. 6 para. 1 lit. b GDPR. Data protection: https://nomupay.com/privacy-policy/

III) Copecart GmbH: When clicking the button “Pay with PayPal – Buy LikesAndMore credit here”, payment processing is carried out via Copecart GmbH, Rosenstr. 2, 10178 Berlin, Germany, to whom we pass on name, address, e-mail address, invoice amount, currency, order, and transaction number in accordance with Art. 6 para. 1 lit. b GDPR. Data protection: https://copecart.com/de/datenschutz

IV) Qonto: For payments by bank transfer, the data required for the allocation and booking of the payment are processed. This may in particular include the name of the payer, the transmitted IBAN, the intended purpose, the order or transaction number, and, if applicable, a profile name specified in the intended purpose. Payment processing is carried out via QONTO Zweigniederlassung Deutschland, Olinda GmbH, c/o Beyond, Chausseestraße 29, 10115 Berlin. The processing serves payment allocation, contract processing, bookkeeping, and fulfillment of statutory retention obligations. Legal bases are Art. 6 para. 1 lit. b and c GDPR. Data protection: https://legal.qonto.com/de

 

9) Transfer of special order data to third countries (order fulfillment)

I) For certain social media mediation services, it may be necessary for the performance of the service expressly ordered by the customer to transfer a publicly accessible profile link and the performance data required for the specific order to external intermediaries or subcontractors outside the EU or the EEA. This can be the case in particular if the commissioned mediation service is rendered via service providers or networks in the state in which the respective social media offer or the infrastructure required for this is located.

II) The transfer is generally limited to the publicly accessible profile link and the information required for the specific service, for example the ordered number and type of followers, likes, views, or comparable services. Access data, passwords, non-required contact data, and other personal data are not transmitted.

III) Depending on the intermediary used or its further technical infrastructure, processing may take place in various states outside the EU or the EEA. For individual states, there may not be an adequacy decision by the European Commission. Insofar as legally required, a transfer takes place on the basis of an adequacy decision, appropriate safeguards according to Art. 46 GDPR, or a relevant exception according to Art. 49 GDPR. With the order, it is pointed out that in the event of processing in a third country, there may not be a level of data protection comparable to the European Union.

IV) We use external intermediaries and subcontractors only to the extent necessary for the respective service, and select and check them appropriately within the scope of our operational possibilities. The concrete technical processing may be carried out by further service providers or technical networks of the respective intermediary. Insofar as concrete recipients, categories of recipients, or processing locations are known to us, we take these into account within the scope of statutory information obligations.

 

10) Web analytics: Google Analytics 4 (GA4)

I) This website uses Google Analytics 4, a web analytics service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”; EU seat: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

II) Use takes place exclusively after prior, explicit consent according to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG via the cookie consent banner (from Complianz).

III) Third-country transfer / guarantees: Google LLC is certified under the EU-US Data Privacy Framework (DPF); in addition, EU standard contractual clauses (SCC) are used – insofar as this still applies at the time of the respective transfer.

IV) IP anonymization & data processing: IP addresses are recorded shortened/anonymized by default at GA4. The IP address transmitted within the framework of Google Analytics is not merged with other data from Google.

V) Storage period: Configured retention period for user- and event-based data: 14 months.

VI) Revocation/opt-out: You can prevent the storage of your browser by means of a corresponding setting, or install the browser add-on at http://tools.google.com/dlpage/gaoptout?hl=de, or declare the revocation via the consent banner.

 

11) Newsletter / Mailchimp

I) We send newsletters only with consent (Art. 6 para. 1 lit. a GDPR in conjunction with § 7 para. 2 no. 3 UWG) in the double opt-in procedure. Registration and confirmation time are logged.

II) Processor: Dispatch via Mailchimp (The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA). A data processing agreement according to Art. 28 GDPR is concluded.

III) Third-country transfer: USA (EU-US DPF certified). Data protection: https://mailchimp.com/legal/privacy/

IV) Cancellation/deletion: Unsubscribe link in every newsletter. Unsubscription data is stored for up to 3 years based on legitimate interest (defense of claims, Art. 6 para. 1 lit. f GDPR).

 

12) Content management system, plugins & third-party services

  • CMS WordPress (Automattic Inc., USA) – commenting/forwarding deactivated. Data protection: https://automattic.com/privacy/
  • WooCommerce & WooCommerce Germanized (vendidero GmbH, Berlin) – local shop processing without external transmission.
  • Jetpack (Automattic Inc., USA) – security/performance plugin, third-country transfer USA (EU-US DPF). Data protection: https://automattic.com/privacy/
  • Complianz Privacy Suite – local/EU-based consent management (legal basis § 25 para. 2 TDDDG / Art. 6 para. 1 lit. f/a GDPR).
  • WPForms – contact form plugin (processing in hosting context).
  • Google reCAPTCHA (Google LLC, USA) – bot protection for forms based on consent (Art. 6 para. 1 lit. a GDPR / § 25 TDDDG) or legitimate interest with DPF guarantee.
  • Wistia (Wistia, Inc., Cambridge, MA, USA) – video hosting/integration; third-country transfer USA (EU-US DPF / SCC). Data protection: https://wistia.com/privacy
  • Sourcebuster JS – visitor source tracking (attribution script, integrated after statistics consent).
  • Google Fonts: local integration via our own web server (RAIDBOXES), so no connection to Google servers (fonts.googleapis.com) is established.
  • Wordfence Security – security and firewall plugin for protection against brute force/malware (IP logging according to Art. 6 para. 1 lit. f GDPR).
  • WP Mail SMTP – technical mail dispatch (Art. 6 para. 1 lit. b GDPR).
  • WP-Optimize & WP-Sweep – internal database cleanup (no data transfer).

 

13) Hosting and server log files

Hosting service provider: RAIDBOXES GmbH, Hafenstrasse 32, 48153 Münster, Germany (cloud hosting / SaaS). A data processing agreement according to Art. 28 GDPR is concluded. Log files are deleted after a maximum of seven days, and backups and backup copies of our web shop after a maximum of 30 days. Data protection: https://raidboxes.io/datenschutzerklaerung/

 

14) Chat / messenger services (WhatsApp)

I) When using the WhatsApp chat button on our website or when you contact us directly via WhatsApp, personal data is transmitted to the respective WhatsApp or Meta service. This may in particular include your telephone number, your WhatsApp name, your messages, content submitted by you, and technical connection and metadata.

II) Processing is carried out to process your inquiry and to communicate with you. Legal basis is Art. 6 para. 1 lit. b GDPR, if the communication serves contract initiation or contract processing, or Art. 6 para. 1 lit. f GDPR for other inquiries. Our legitimate interest consists in the efficient processing and answering of customer inquiries.

III) Depending on the WhatsApp service used, data may be processed by WhatsApp Ireland Limited, Meta Platforms Ireland Limited, WhatsApp LLC, or other affiliated companies. Insofar as personal data is transmitted to the USA or another third country, this takes place on the basis of the respective relevant transfer mechanism, in particular an adequacy decision or other appropriate safeguards, insofar as these requirements are met. Further information can be found in WhatsApp’s privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea

 

15) Rights of the data subject

I) You are a data subject within the meaning of the GDPR. You have the following rights:

  • Right of access according to Art. 15 GDPR
  • Right to withdraw consent given according to Art. 7 para. 3 GDPR
  • Right to rectification of inaccurate data according to Art. 16 GDPR
  • Right to erasure according to Art. 17 GDPR (observing statutory retention obligations, see i.a. section 17; for registered customer accounts, you can request deletion/anonymization of your account directly via the corresponding functions in your customer area or by message to )
  • Right to restriction of processing according to Art. 18 GDPR
  • Right to notification according to Art. 19 GDPR
  • Right to data portability according to Art. 20 GDPR
  • Right to object to processing according to Art. 6 para. 1 lit. f GDPR / direct marketing according to Art. 21 GDPR. The right to object to direct marketing according to Art. 21 para. 2 and 3 GDPR exists independently of a balancing of interests and can be exercised at any time.
  • Right to lodge a complaint with a supervisory authority according to Art. 77 GDPR (LfDI Baden-Württemberg)

II) Solely automated decision-making including profiling in the sense of Art. 22 GDPR does not take place, provided and insofar as we do not use corresponding procedures.

 

16) Online presences in social media

We maintain online presences in social networks (linking without reactive tracking upon page load). The terms and conditions and privacy policies of the respective operators apply when accessing these platforms.

 

17) Duration of storage of personal data

The duration of storage is measured based on the respective processing purpose. Personal data is deleted as soon as the purpose ceases to apply and there is no statutory retention obligation (e.g. commercial and tax retention periods of 6 or 10 years) or a legitimate interest in longer storage, in particular for the assertion, exercise, or defense of legal claims, exists.
For individual processing operations, the following storage periods or criteria in particular apply:

    • Server log files: generally a maximum of seven days, unless longer storage is required for the clarification of a specific security incident or legal violation.
    • Backups of our webshop: maximum 30 days
    • Analytics data: according to the retention period configured in the respective service;
    • Order, contract, and invoice data: according to the respective applicable commercial and tax retention obligations;
    • Customer account data: until deletion of the account, insofar as no retention obligations or legal claims stand in the way;
    • Newsletter data: until revocation; proofs and barring notices as long as this is necessary to prevent further dispatch and for legal defense;
    • Security and firewall logs: according to the concrete security configuration and the respective clarification or protection requirement.

 

18) Updates to the privacy policy

I) We reserve the right to amend this privacy policy to adapt it to changed legal situations or in the event of changes to the service.

II) It is incumbent upon the user to secure the status valid at the time of orders (no permanent server-side archiving of older statuses per individual purchase by the operator).

III) Status of the privacy policy: September 22, 2026