Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Best und Nestler GbR, represented by Benjamin Best and Eric Nestler
Grasserstr. 10
80339 Munich
Germany
Email: beachvolleyball.cardgame@gmail.com

2. General Information on Data Processing

We process personal data only where this is necessary to operate our website, answer enquiries, process orders, ship products, issue invoices, manage payments, and comply with legal obligations.

Personal data means any information that can identify you personally, such as your name, address, email address, order details, payment information, or communication with us.

3. Hosting and Server Log Files

Our website is hosted by:

ALL-INKL.COM – Neue Medien Münnich
Hauptstraße 68
02742 Friedersdorf
Germany

When you visit our website, technical data is automatically processed by our hosting provider and web server. This may include:

• IP address
• date and time of access
• pages visited
• referrer URL
• browser type and browser version
• operating system used
• amount of data transferred
• access status / HTTP status code

This data is processed to provide the website technically, ensure stability and security, and prevent misuse.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable, and reliable operation of our website.

Server log files are generally deleted no later than after 7 days. Longer storage may take place in individual cases, for example to investigate attacks against our technical systems.

Where required, we have concluded a data processing agreement with our hosting provider pursuant to Art. 28 GDPR.

4. Contact by Email or Contact Form

If you contact us by email or through the contact form, we process the information you provide, in particular:

• name
• email address
• message content
• any additional information you voluntarily provide

We use this data only to process your enquiry and respond to any follow-up questions.

Legal basis:

For enquiries related to a contract or pre-contractual measures, Art. 6(1)(b) GDPR.

In all other cases, Art. 6(1)(f) GDPR, as we have a legitimate interest in responding to enquiries.

The data will be deleted once your enquiry has been fully processed, unless legal retention obligations apply or further storage is necessary to establish, exercise, or defend legal claims.

5. Orders in Our Online Shop

When you place an order in our online shop, we process the data necessary to handle your order. This may include:

• name
• billing address
• shipping address
• email address
• products ordered
• order date
• invoice and payment data
• shipping and delivery status
• telephone number, if required for delivery-related queries

We use this data to process your order, deliver the goods, process payment, issue invoices, handle customer service enquiries, and comply with legal retention obligations.

Legal bases:

Art. 6(1)(b) GDPR for fulfilling the purchase contract.

Art. 6(1)(c) GDPR for compliance with legal obligations, especially tax and commercial retention obligations.

Art. 6(1)(f) GDPR for legitimate interests, such as order documentation, fraud prevention, and customer support.

Without the required order data, we cannot process your order.

6. Payment Processing with Stripe

We use Stripe for payment processing.

Provider:

Stripe Payments Europe, Limited
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
Ireland

Depending on the payment method selected, Stripe may process the following data:

• name
• email address
• billing address
• payment amount
• order number
• payment reference
• payment method
• payment status
• card or account information, where applicable
• technical information required for fraud prevention and payment security

We do not store full credit card details ourselves.

Payment data is processed in order to complete your purchase, verify and process payments, prevent fraud, and comply with legal obligations.

Legal bases:

Art. 6(1)(b) GDPR for payment processing required to perform the purchase contract.

Art. 6(1)(c) GDPR for legal obligations.

Art. 6(1)(f) GDPR for fraud prevention and secure payment processing.

Stripe may also process certain data under its own responsibility. Please refer to Stripe’s privacy information for further details.

Where required, Stripe’s data processing terms apply.

7. Shipping and Delivery with DHL

We use DHL to ship orders.

Provider:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

To deliver your order, we pass on the data required for delivery to DHL. This usually includes:

• name
• shipping address
• shipment details
• email address, if required for shipment notifications or if you have consented to this
• telephone number, if required for delivery

The data is shared only to the extent necessary for delivery.

Legal basis: Art. 6(1)(b) GDPR.

If we transmit your email address or telephone number to DHL for delivery notifications that are not strictly required for shipment, this will only happen if you have given your consent.

Legal basis for optional shipment notifications: Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

8. Use of Billbee

We use Billbee for order management, processing customer data, organising orders, and supporting shipping and invoicing processes.

Provider:

Billbee GmbH
Arolser Straße 10
34477 Twistetal
Germany

The following data may be processed in Billbee:

• name
• address
• email address
• order data
• product data
• payment and shipping status
• invoice and delivery information

This processing is carried out to efficiently process your order and manage our internal business operations.

Legal bases:

Art. 6(1)(b) GDPR for contract performance.

Art. 6(1)(c) GDPR for legal obligations.

Art. 6(1)(f) GDPR for our legitimate interest in efficient and reliable order management.

Where required, Billbee is used as a processor under Art. 28 GDPR.

9. Use of Lexoffice / Lexware Office

We use Lexoffice / Lexware Office for accounting, invoicing, and tax documentation.

Provider:

Haufe-Lexware GmbH & Co. KG
Munzinger Straße 9
79111 Freiburg
Germany

The following data may be processed:

• name
• billing address
• email address
• order data
• invoice number
• invoice amount
• payment status
• tax-relevant accounting data

This processing is carried out for issuing and storing invoices, bookkeeping, and complying with tax and commercial law obligations.

Legal bases:

Art. 6(1)(c) GDPR for compliance with legal obligations.

Art. 6(1)(b) GDPR where processing is necessary to handle your order.

Art. 6(1)(f) GDPR for our legitimate interest in proper accounting and business administration.

Where required, Lexoffice / Lexware Office is used as a processor under Art. 28 GDPR.

10. Legal Retention Obligations

We store order, invoice, and accounting data for as long as necessary to process the contract, comply with legal obligations, and document business transactions.

Tax and commercial law retention periods may require us to store certain documents for several years. In Germany, business and tax records may generally have to be retained for 6, 8, or 10 years, depending on the type of document.

After the applicable retention periods expire, the data will be deleted unless further legal grounds for storage exist.

11. Customer Reviews and Testimonials

If you voluntarily provide us with a review, testimonial, or feedback and allow us to publish it, we may process the information you provide, such as:

• name or first name
• country or location, if provided
• review content
• image or profile information, if voluntarily provided

Publication takes place only if you voluntarily provide the review or have given us your consent.

Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

If customer reviews are displayed on our website, we will provide information on whether and how we verify that reviews come from customers who have actually purchased or used our products.

12. Social Media Links

Our website may contain links to our social media profiles. If you click such a link, you leave our website and are redirected to the respective provider.

Only when you access the external social media page does the respective provider process personal data under its own responsibility. Please refer to the privacy policies of the respective platforms.

We do not currently use embedded social media plugins that automatically transmit data to social media providers when you visit our website.

13. Cookies and Similar Technologies

Our website uses only technically necessary cookies and similar technologies unless you have given your consent to additional cookies.

Technically necessary cookies may be required for:

• website functionality
• shopping cart functionality
• checkout
• payment processing
• security
• fraud prevention
• cookie consent management

Technically necessary cookies are not used for analytics or advertising.

Legal basis for processing personal data: Art. 6(1)(f) GDPR.

Legal basis for storing or accessing information on your device: Section 25(2) TDDDG, where such cookies are strictly necessary.

For all non-essential cookies, especially analytics, marketing, tracking, retargeting, or external media cookies, we obtain your prior consent through a cookie consent banner.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

You can withdraw or change your consent at any time with effect for the future via the cookie settings on our website.

We do not set analytics, marketing, or tracking cookies before you have given your consent.

14. No Newsletter or Advertising Without Consent

We do not use your customer data for newsletters, email advertising, or personalised advertising unless you have expressly consented to this.

If we offer a newsletter in the future, it will only be sent on the basis of your express consent. You may withdraw such consent at any time with effect for the future.

15. Recipients of Personal Data

We only share personal data where this is necessary for the purposes described above. Recipients may include:

• hosting provider
• technical service providers
• Billbee
• Lexoffice / Lexware Office
• Stripe
• DHL
• tax advisors
• public authorities, where legally required

We do not sell personal data. We do not share customer data with third parties for advertising purposes without consent.

16. Data Transfers to Third Countries

We generally process personal data within the European Union or the European Economic Area.

Some service providers, especially payment providers or technical service providers, may process data outside the EU or EEA. Where this occurs, we ensure that an appropriate legal basis exists, such as an adequacy decision by the European Commission or suitable safeguards such as EU Standard Contractual Clauses.

17. Security of Processing

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure.

Our website is intended to be accessible via encrypted HTTPS. Nevertheless, please ensure that confidential information is transmitted only through secure communication channels.

18. Your Rights

Under the GDPR, you have the following rights in particular:

• right of access to your personal data
• right to rectification of inaccurate data
• right to erasure
• right to restriction of processing
• right to data portability
• right to object to certain types of processing
• right to withdraw consent with effect for the future
• right to lodge a complaint with a data protection supervisory authority

To exercise your rights, you can contact us at any time at:

beachvolleyball.cardgame@gmail.com

19. Right to Object

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defence of legal claims.

20. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority.

For private companies based in Bavaria, the competent authority is generally:

Bavarian State Office for Data Protection Supervision
Promenade 18
91522 Ansbach
Germany

21. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy if our website, service providers, business processes, or legal requirements change.