Privacy Policy

Controller responsible for data processing:
Combo-Shops GmbH
Kärntner Straße 391
8054 Graz
Austria

Hotline: 08007995544
E-mail: [email protected]

Thank you for your interest in our online shop. Protecting your privacy is very important to us. Below, we provide detailed information on how we process your personal data.

1. Access Data and Hosting
You may visit our websites without providing any personal information. Each time a webpage is accessed, the web server automatically stores a server log file containing, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), thereby documenting the access. This access data is evaluated exclusively for the purpose of ensuring the uninterrupted operation of the website and improving our services. This serves to safeguard our legitimate interests, which prevail in the context of a balancing of interests, in the correct presentation of our services pursuant to Article 6(1), sentence 1, point (f) GDPR. All access data is deleted no later than seven days after the end of your visit to the website. Access data is processed only for as long as is necessary to achieve the processing purposes stated above.

Hosting
The hosting and website display services are provided in part by our service providers acting on our behalf as data processors. Unless otherwise stated in this Privacy Policy, all access data and all data collected through the designated forms on this website are processed on their servers. If you have any questions regarding our service providers or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy. Our service providers are located in and/or use servers in the following countries, for which the European Commission has issued an adequacy decision confirming an adequate level of data protection: United Kingdom, Canada, and the United States. For transfers to the United States, an adequacy decision of the European Commission serves as the legal basis for transfers to third countries, provided that the respective service provider is certified. Until our service providers obtain such certification, data transfers continue to be based on the European Commission’s Standard Contractual Clauses (SCCs). Our service providers are also located in and/or use servers in Australia. No adequacy decision by the European Commission exists for this country. Our cooperation with these service providers is based on the European Commission’s Standard Contractual Clauses (SCCs).

2. Collection of Data for Contract Processing and Customer Inquirie
Data Processing for Contract Performance
For the purpose of contract performance (including the handling of inquiries and the processing of any warranty claims, claims arising from defective performance, and any statutory update obligations) pursuant to Article 6(1), sentence 1, point (b) GDPR, we collect personal data when you voluntarily provide it to us as part of your order. Mandatory fields are marked as such because we require this information to process the contract and cannot ship your order without it. The specific data collected can be seen from the respective input forms.

Further information on the processing of your data, in particular regarding the disclosure of your data to our service providers for the purposes of order processing, payment processing, and shipping, can be found in the following sections of this Privacy Policy. Once the contract has been fully performed, the processing of your data will be restricted. After the expiration of the retention periods required under tax and commercial law, your data will be deleted pursuant to Article 6(1), sentence 1, point (c) GDPR, unless you have expressly consented to the further use of your data pursuant to Article 6(1), sentence 1, point (a) GDPR, or we reserve the right to use your data beyond this where permitted by law and as explained in this Privacy Policy.

Customer Account
If you have given your consent pursuant to Article 6(1), sentence 1, point (a) GDPR by choosing to create a customer account, we will use your data for the purpose of creating and maintaining your customer account and for storing your information for future orders placed through our website. You may delete your customer account at any time, either by contacting us using the contact details provided in this Privacy Policy or by using the dedicated account deletion function available within your customer account. Once your customer account has been deleted, your personal data will also be deleted, unless you have expressly consented to the further use of your data pursuant to Article 6(1), sentence 1, point (a) GDPR, or we reserve the right to use your data beyond this where permitted by law and as explained in this Privacy Policy.

Contacting Us
As part of our customer communications, we collect personal data for the purpose of processing your inquiries pursuant to Article 6(1), sentence 1, point (b) GDPR when you voluntarily provide such data to us by contacting us (e.g. via our contact form, live chat tool, or email). Mandatory fields are marked as such because we require this information to process your request. The specific data collected can be seen from the respective input forms. Once your inquiry has been fully processed, your personal data will be deleted, unless you have expressly consented to the further use of your data pursuant to Article 6(1), sentence 1, point (a) GDPR, or we reserve the right to use your data beyond this where permitted by law and as explained in this Privacy Policy.

3. Disclosure of Data for Shipping Purposes
For the purpose of fulfilling the contract pursuant to Article 6(1), sentence 1, point (b) GDPR, we disclose your personal data to the shipping service provider responsible for the delivery, insofar as this is necessary for the delivery of the goods you have ordered. If you have any questions regarding our service providers or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy.

Disclosure of Data to Shipping Service Providers for Delivery Notifications If you have given your explicit consent during or after placing your order, we will, on the basis of your consent pursuant to Article 6(1), sentence 1, point (a) GDPR, disclose your email address and telephone number to the selected shipping service provider.

This enables the shipping provider to contact you before delivery for the purpose of notifying you of the delivery and/or coordinating a delivery time. You may withdraw your consent at any time by contacting us using the contact details provided in this Privacy Policy or directly by contacting the shipping service provider at the contact address listed below. Upon withdrawal of your consent, we will delete the data you provided for this purpose, unless you have expressly consented to the further use of your data pursuant to Article 6(1), sentence 1, point (a) GDPR, or we reserve the right to use your data beyond this where permitted by law and as explained in this Privacy Policy. If you have any questions regarding our service providers or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy.

Österreichische Post Aktiengesellschaft
Rochusplatz 1
A-1030 Wien

DHL Paket (Austria) GmbH
Brunner Straße 65
A-1230 Wien

4. Data Processing for Payment Processing
To process payments in our online shop, we work together with the following categories of partners: technical service providers, financial institutions, and payment service providers.

Data Processing for Payment Transactions
Depending on the payment method you select, we disclose the data required to process the payment transaction to our technical service providers acting as data processors on our behalf, to the commissioned financial institutions, or to the selected payment service provider, insofar as this is necessary for processing the payment. This is done for the purpose of fulfilling the contract pursuant to Article 6(1), sentence 1, point (b) GDPR. In some cases, the payment service providers collect the data required to process the payment themselves, for example through their own website or via a technical integration within the ordering process. In such cases, the privacy policy of the respective payment service provider applies. If you have any questions regarding our payment processing partners or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy.

Data Processing for Fraud Prevention and the Optimization of Our Payment Processes
Where appropriate, we provide our service providers with additional data which, together with the data required to process the payment transaction, they process on our behalf as data processors for the purposes of fraud prevention and the optimization of our payment processes (e.g. invoicing, handling disputed payments, and accounting support). This processing is carried out pursuant to Article 6(1), sentence 1, point (f) GDPR in order to safeguard our legitimate interests, which prevail following a balancing of interests, in protecting our business against fraud and ensuring efficient payment management.

Identity and Creditworthiness Check
When Selecting Klarna Payment Services Purchase on Invoice via Klarna
If you choose the payment services of Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter "Klarna"), we will transfer your personal data to Klarna as part of the payment and contract processing in accordance with Article 6(1), sentence 1, point (b) GDPR. This data is transferred so that Klarna can issue an invoice for your chosen payment method and carry out an identity and creditworthiness assessment. Please note that we can only offer the respective Klarna payment method if it is available based on the results of the credit assessment. Detailed information about this process and the credit reference agencies used can be found in Klarna's Privacy Notice.

5. Email Marketing
Email Newsletter with Subscription and Newsletter
Tracking If you subscribe to our newsletter, we will use the data required for this purpose, or any additional data you provide separately, to send you our email newsletter on a regular basis based on your consent pursuant to Article 6(1), sentence 1, point (a) GDPR. You may unsubscribe from the newsletter at any time, either by contacting us using the contact details provided below or by clicking the unsubscribe link included in each newsletter. Once you unsubscribe, we will remove your email address from our mailing list unless you have expressly consented to the further use of your data pursuant to Article 6(1), sentence 1, point (a) GDPR, or we reserve the right to use your data beyond this where permitted by law and as explained in this Privacy Policy.

Please note that when sending our newsletter, we analyze your user behavior. For this purpose, we evaluate your interaction with our newsletters by measuring, storing, and analyzing open rates and click-through rates in order to optimize future newsletter campaigns ("Newsletter Tracking").,

For this purpose, the newsletters we send contain single-pixel technologies (e.g. web beacons or tracking pixels) that are stored on our website. For the purpose of this analysis, we link the following newsletter data in particular:

the webpage from which the page was requested (the so-called referrer URL)
the date and time of access
the type of web browser used
the IP address of the requesting device
the email address
the date and time of subscription and confirmation

…together with your email address or IP address and, where applicable, a unique identifier. Links contained in the newsletter may also include this identifier. If you do not wish to be subject to newsletter tracking, you may unsubscribe from the newsletter at any time as described above. The information is stored for as long as you remain subscribed to the newsletter.

Newsletter Distribution
The newsletter and the newsletter tracking described above may also be carried out by our service providers acting on our behalf as data processors. If you have any questions regarding our service providers or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy.

Our service providers are located in and/or use servers in the following countries, for which the European Commission has issued an adequacy decision confirming an adequate level of data protection: United States and Canada.

For transfers to the United States, an adequacy decision of the European Commission serves as the legal basis for transfers to third countries, provided that the respective service provider is certified. Until our service providers obtain such certification, data transfers continue to be based on the European Commission's Standard Contractual Clauses (SCCs). Our service providers are also located in and/or use servers in India. No adequacy decision by the European Commission exists for this country. Our cooperation with these service providers is based on the European Commission's Standard Contractual Clauses (SCCs).

6. Cookies and Other Technologies
General Information
To make your visit to our website more convenient and to enable the use of certain website features, we use various technologies on different pages, including so-called cookies. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted automatically at the end of your browser session, i.e. when you close your browser (so-called session cookies). Other cookies remain stored on your device and allow us to recognize your browser the next time you visit our website (so-called persistent cookies). The storage period for cookies can be found in the overview provided in your web browser's cookie settings.

Protection of Privacy on End Devices
When you use our online services, we employ technologies that are strictly necessary to provide the telemedia service you have expressly requested. The storage of information on your device or access to information already stored on your device does not require your consent for these purposes.

For functions that are not strictly necessary, the storage of information on your device or access to information already stored on your device requires your consent. Please note that if you do not provide your consent, certain parts of the website may not function properly or may only be available to a limited extent. Any consent you have given will remain valid until you change or reset the relevant settings on your device.

Subsequent Data Processing by Cookies and Other Technologies
We use technologies that are strictly necessary for the operation of certain functions of our website (e.g. the shopping cart function). Through these technologies, we collect and process your IP address, the time of your visit, device and browser information, as well as information about your use of our website (e.g. information about the contents of your shopping cart). This processing is carried out pursuant to Article 6(1), sentence 1, point (f) GDPR in order to safeguard our legitimate interests, which prevail following a balancing of interests, in the optimized presentation of our services.

In addition, we use technologies to comply with legal obligations to which we are subject (e.g. to demonstrate that consent has been given for the processing of your personal data), as well as for web analytics and online marketing purposes. Further information, including the respective legal basis for the processing of your personal data, can be found in the following sections of this Privacy Policy.

Cookie Settings
You can manage your browser's cookie settings by visiting the following links:
Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

If you have consented to the use of technologies pursuant to Article 6(1), sentence 1, point (a) GDPR, you may withdraw your consent at any time by contacting us using the contact details provided in this Privacy Policy. Alternatively, you may also visit the following website: https://www.datareporter.eu/de/. Please note that if you do not accept cookies, the functionality of our website may be limited.

7. Use of Cookies and Other Technologies
We use the following cookies and other third-party technologies on our website. Unless otherwise stated for a specific technology, these technologies are used on the basis of your consent pursuant to Article 6(1), sentence 1, point (a) GDPR. Once the purpose for processing no longer applies and we discontinue the use of the respective technology, the data collected in this context will be deleted. You may withdraw your consent at any time with effect for the future. Further information on your right to withdraw consent can be found in the section "Cookies and Other Technologies." Additional information, including the legal basis of our cooperation with the individual providers, is provided in the descriptions of the respective technologies. If you have any questions regarding the providers or the basis of our cooperation with them, please contact us using the contact details provided in this Privacy Policy.

Use of Google Services for Web Analytics and Advertising
Purposes We use the Google technologies described below, provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The information automatically collected by Google technologies about your use of our website is generally transferred to and stored on a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Unless otherwise specified for a particular technology, data processing is carried out on the basis of an agreement between joint controllers concluded for the respective technology pursuant to Article 26 GDPR. Further information about Google's processing of personal data can be found in Google's Privacy Policy.

Our service providers are located in and/or use servers in countries outside the European Union (EU) and the European Economic Area (EEA) for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection.

Our service providers are also located in and/or use servers in countries outside the EU and the EEA for which no adequacy decision has been adopted by the European Commission. Our cooperation with these service providers is based on the European Commission's Standard Contractual Clauses (SCCs).

Google Analytics
For the purpose of website analytics, Google Analytics automatically collects and stores data such as your IP address, the time of your visit, device and browser information, and information about your use of our website. This data is used to create pseudonymized user profiles. Cookies may be used for this purpose. If you access our website from the European Union, your IP address is stored on a server located within the EU for the purpose of deriving location data and is then immediately deleted before the traffic is forwarded to other Google servers for further processing. The data is processed on the basis of a data processing agreement concluded with Google.

To optimize the marketing of our website, we have enabled the data sharing settings for "Google Products and Services." This allows Google to access the data collected and processed through Google Analytics and to use it for the improvement of Google services. The sharing of data with Google under these data sharing settings is based on an additional agreement between joint controllers. We have no influence over Google's subsequent processing of this data.

To optimize the marketing of our website, we use the User ID feature. This feature enables us to assign a unique, permanent identifier to your interaction data across one or more sessions on our online services, allowing us to analyze your user behavior across multiple devices and sessions.

For web analytics purposes, the Google Signals feature of Google Analytics enables so-called cross-device tracking. If your internet-enabled devices are linked to your Google account and you have enabled the "Personalized Advertising" setting in your Google account, Google may generate reports about your usage behavior—particularly cross-device user statistics—even if you switch between devices. We do not process any personal data in this context. We only receive aggregated statistical reports generated by Google Signals.

For web analytics and advertising purposes, the DoubleClick cookie, enabled through the Google Analytics extension, allows your browser to be recognized when you visit other websites. Google uses this information to compile reports on website activity and to provide other services related to the use of the website.

Google Ads
For advertising purposes in Google Search results and on third-party websites, a Google Remarketing cookie is placed when you visit our website. This cookie enables interest-based advertising by automatically collecting and processing data (such as your IP address, the time of your visit, device and browser information, and information about your use of our website) using a pseudonymous cookie ID and based on the pages you have visited. Further data processing will only take place if you have enabled the "Personalized Advertising" setting in your Google account. If, in this case, you are logged into your Google account while visiting our website, Google will use your data together with Google Analytics data to create and define audience lists for cross-device remarketing.

For website analytics and event tracking purposes, we use Google Ads Conversion Tracking to measure your subsequent user behavior when you access our website via a Google Ads advertisement. Cookies may be used for this purpose, and data such as your IP address, the time of your visit, device and browser information, as well as information about your use of our website based on events defined by us (e.g. visiting a webpage or subscribing to our newsletter), may be collected. This data is used to create pseudonymized user profiles.

Google reCAPTCHA
To protect our web forms against misuse and spam by automated software (so-called bots), Google reCAPTCHA collects data such as your IP address, the time of your visit, browser information, and information about your use of our website. Using JavaScript and cookies, Google reCAPTCHA analyzes your interaction with our website. In addition, other cookies stored in your browser by Google services may also be evaluated. No personal data entered into the input fields of the respective form is read or stored.

Google Fonts
To ensure the consistent display of content on our website, the Google Fonts script collects data such as your IP address, the time of your visit, and device and browser information. This data is transmitted to Google and subsequently processed by Google. We have no influence over Google's subsequent processing of this data.

Google Tag Manager
Google Tag Manager enables us to manage various codes and services on our website. When implementing individual tags, Google may also process personal data (e.g. IP addresses and online identifiers, including cookies). The data is processed on the basis of a data processing agreement concluded with Google.

By using Google Tag Manager, we can integrate various services and technologies into our website. If you do not wish to use certain tracking services and therefore disable them, the deactivation will remain effective for all affected tracking tags implemented through Google Tag Manager.

YouTube Video Plugin
To embed third-party content, the YouTube Video Plugin used on our website in Enhanced Privacy Mode collects data such as your IP address, the time of your visit, and device and browser information. This data is transmitted to Google and subsequently processed by Google only if you play a video.

Use of Microsoft Services
We use the Microsoft technologies described below, provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland ("Microsoft"). The processing of personal data is carried out on the basis of an agreement between joint controllers pursuant to Article 26 GDPR. The information automatically collected by Microsoft technologies about your use of our website is generally transferred to and stored on a server operated by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Further information about Microsoft's processing of personal data can be found in Microsoft's Privacy Statement.

Our service providers are located in and/or use servers in countries outside the European Union (EU) and the European Economic Area (EEA) for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection.

Our service providers are also located in and/or use servers in countries outside the European Union (EU) and the European Economic Area (EEA). For these countries, no adequacy decision has been adopted by the European Commission. Our cooperation with these service providers is based on the European Commission's Standard Contractual Clauses (SCCs).

Microsoft Advertising
For advertising purposes in Bing, Yahoo, and MSN search results, as well as on third-party websites, a Microsoft Advertising Remarketing cookie is placed when you visit our website. This cookie enables interest-based advertising by automatically collecting and processing data (such as your IP address, the time of your visit, device and browser information, and information about your use of our website) using a pseudonymous cookie ID and based on the pages you have visited.

For website analytics and event tracking purposes, we use Microsoft Advertising Universal Event Tracking (UET) to measure your subsequent user behavior when you access our website via a Microsoft Advertising advertisement. Cookies may be used for this purpose, and data such as your IP address, the time of your visit, device and browser information, as well as information about your use of our website based on events defined by us (e.g. visiting a webpage or subscribing to our newsletter), may be collected. This data is used to create pseudonymized user profiles. If your internet-enabled devices are linked to your Microsoft account and you have not disabled the "Interest-based advertising" setting in your Microsoft account, Microsoft may generate reports about your usage behavior—particularly cross-device user statistics—even if you switch between devices (so-called cross-device tracking). We do not process any personal data in this context. We only receive aggregated statistical reports generated by Microsoft UET.

Use of Meta Services
Meta Pixel
We use the Meta Pixel as part of the technologies described below, provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Facebook (by Meta)" or Meta Platforms Ireland). The Meta Pixel automatically collects and stores data such as your IP address, the time of your visit, device and browser information, and information about your use of our website based on events defined by us (e.g. visiting a webpage or subscribing to our newsletter). This data is used to create pseudonymized user profiles. As part of the so-called Advanced Matching feature, additional information that may be used to identify individuals (e.g. names, email addresses, and telephone numbers) is collected, hashed, and stored for matching purposes. When you visit our website, the Meta Pixel automatically places a cookie that enables your browser to be recognized on other websites by means of a pseudonymous cookie ID. Facebook (by Meta) combines this information with other data from your Facebook account and uses it to compile reports on website activity and to provide other services related to website usage, in particular personalized and audience-based advertising.

The information automatically collected by Facebook (by Meta) technologies about your use of our website is generally transferred to and stored on a server operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Further information about the processing of personal data by Facebook (by Meta) can be found in the Facebook (by Meta) Privacy Policy.

Our service providers are located in and/or use servers in the following countries, for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection: United States, Canada, Japan, South Korea, New Zealand, United Kingdom, and Argentina.

The adequacy decision for the United States serves as the basis for the transfer of data to a third country, provided that the respective service provider is certified. Such certification is in place.

Our service providers are located in and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, and Mexico. The European Commission has not adopted an adequacy decision for these countries. Our cooperation with these service providers is based on the following safeguards: the European Commission’s Standard Contractual Clauses (SCCs).

Meta Ads Manager
We use Meta Ads Manager to advertise this website on Facebook (by Meta) and on other platforms. We determine the parameters of each advertising campaign. Meta Platforms Ireland is responsible for the specific implementation, particularly for deciding where advertisements are shown to individual users. Unless otherwise specified for the individual technologies, data processing is carried out on the basis of an agreement between joint controllers pursuant to Article 26 GDPR. Joint controllership is limited to the collection of data and its transfer to Meta Platforms Ireland. Any subsequent processing of the data by Meta Platforms Ireland is not covered by this joint controllership. Based on the statistics generated by the Meta Pixel regarding visitor activity on our website, we use Custom Audiences to display audience-based advertising on Facebook (by Meta) by defining the characteristics of the respective target audience. As part of the advanced matching process described above, which is used to identify the relevant target audience, Meta Platforms Ireland acts as a data processor on our behalf. Based on the pseudonymous cookie ID placed by the Meta Pixel and the data collected about your use of our website, we use Custom Audiences to display personalized advertising. Using conversion tracking via the Meta Pixel or the Conversions API, we measure your subsequent user behavior for web analytics and event-tracking purposes when you access our website through an advertisement placed via Meta Ads Manager. The data is processed on the basis of a data processing agreement concluded with Meta Platforms Ireland.

8. Integration of the Trusted Shops Trustbadge / Other Widgets
To display Trusted Shops services (e.g. the Trustmark, collected customer reviews) and to offer Trusted Shops products to buyers after an order has been placed, Trusted Shops widgets are integrated into this website.

This serves to safeguard our overriding legitimate interests in the optimal marketing of our services by enabling a secure shopping experience, in accordance with Article 6(1)(f) GDPR. The Trusted Shops Trustbadge and the services advertised through it are provided by Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne, Germany ("Trusted Shops"), with whom we act as joint controllers pursuant to Article 26 GDPR.

In the following privacy information, we provide you with the essential contents of this joint controllership agreement in accordance with Article 26(2) GDPR. Within the scope of the joint controllership between us and Trusted Shops SE, we recommend that you contact Trusted Shops directly regarding data protection matters and the exercise of your rights using the contact details provided in their Privacy Policy. However, you may also contact either controller at any time. If necessary, your request will be forwarded to the other controller for further handling.

Data Processing When Integrating the Trustbadge / Other Widgets
The Trusted Shops Trustbadge is provided through a U.S.-based Content Delivery Network (CDN) provider. An adequate level of data protection is ensured by an adequacy decision of the European Commission, which for the United States can be accessed here. Service providers based in the United States are generally certified under the EU–U.S. Data Privacy Framework (DPF). Further information is available here. Where service providers are not certified under the DPF, Standard Contractual Clauses (SCCs) have been concluded as appropriate safeguards. When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which also contains your IP address, the date and time of access, the amount of data transferred, and the requesting internet service provider (access data), and documents the request. Your IP address is anonymized immediately after collection so that the stored data can no longer be associated with you personally. The anonymized data is used in particular for statistical purposes and for error analysis.

Data Processing After Completion of an Order
If you have given your consent, the Trusted Shops Trustbadge accesses the order information stored on your device after the completion of your order (order total, order number, and, where applicable, the purchased product), as well as your email address. Your email address is hashed using a one-way cryptographic function before being transmitted. The resulting hash value, together with the order information, is transmitted to Trusted Shops on the basis of your consent in accordance with Article 6(1)(a) GDPR. This serves to verify whether you are already registered for Trusted Shops services. If you are, any further processing will be carried out in accordance with the contractual agreement concluded between you and Trusted Shops. If you are not yet registered for these services or do not consent to automatic recognition via the Trustbadge, you will subsequently have the opportunity to register manually for the services or to activate buyer protection under an existing user agreement. For this purpose, after you complete your order, the Trustbadge accesses the following information stored on your device: the order total, order number, and email address. This is necessary so that we can offer you Buyer Protection. Your data will only be transmitted to Trusted Shops if you actively choose to activate Buyer Protection by clicking the corresponding button in the Trustcard. If you decide to use these services, any further processing is carried out in accordance with the contractual agreement between you and Trusted Shops pursuant to Article 6(1)(b) GDPR, in order to complete your Buyer Protection registration, insure your order, and, where applicable, send you review invitation emails. Trusted Shops uses service providers for hosting, monitoring, and logging. The legal basis for this processing is Article 6(1)(f) GDPR, serving the legitimate interest of ensuring the reliable operation of its services. Data may be processed in third countries, including the United States, the United Kingdom, and Israel. An adequate level of data protection is ensured through adequacy decisions adopted by the European Commission for each of these countries. Service providers located in the United States are generally certified under the EU–U.S. Data Privacy Framework (DPF). Where a service provider is not certified under the DPF, Standard Contractual Clauses (SCCs) have been concluded as appropriate safeguards.

9. Social Media
Our Online Presence on Facebook (by Meta), Instagram (by Meta), YouTube, Pinterest, LinkedIn, and Xing If you have given your consent to the respective social media platform operator in accordance with Article 6(1)(a) GDPR, your data will be automatically collected and stored for market research and advertising purposes when you visit our online profiles on the social media platforms listed above. Pseudonymized user profiles are created from this data, which may be used, for example, to display advertisements both within and outside the respective platforms that are likely to match your interests. Cookies are generally used for this purpose. Detailed information on how your data is processed and used by the respective social media platform operator, as well as contact details, your rights, and the available privacy settings, can be found in the privacy policies linked below. If you require any further assistance in this regard, you are welcome to contact us.

Facebook (by Meta) is a service provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland ("Meta Platforms Ireland"). The information automatically collected by Meta Platforms Ireland about your use of our Facebook (by Meta) page is generally transferred to and stored on a server operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. The processing of personal data in connection with your visit to our Facebook (by Meta) page is based on an agreement between joint controllers pursuant to Article 26 GDPR. Further information (including information on Insights data) is available here. Our service providers are located in and/or use servers in the following countries, for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection: United States, Canada, Japan, South Korea, New Zealand, United Kingdom, and Argentina. The adequacy decision for the United States serves as the basis for transfers of personal data to a third country, provided that the respective service provider is certified. Such certification is in place. Our service providers are also located in and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, and Mexico. The European Commission has not adopted an adequacy decision for these countries. Our cooperation with these service providers is based on the European Commission's Standard Contractual Clauses (SCCs).

Instagram (by Meta) is a service provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland ("Meta Platforms Ireland"). The information automatically collected by Meta Platforms Ireland about your use of our Instagram presence is generally transferred to and stored on a server operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. The processing of personal data in connection with your visit to our Instagram (by Meta) page is based on an agreement between joint controllers pursuant to Article 26 GDPR. Further information (including information on Insights data) is available here. Our service providers are located in and/or use servers in the following countries, for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection: United States, Canada, Japan, South Korea, New Zealand, United Kingdom, and Argentina. The adequacy decision for the United States serves as the basis for transfers of personal data to a third country, provided that the respective service provider is certified. Such certification is in place. Our service providers are also located in and/or use servers in the following countries: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, and Mexico. The European Commission has not adopted an adequacy decision for these countries. Our cooperation with these service providers is based on the European Commission's Standard Contractual Clauses (SCCs).

YouTube is a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The information automatically collected by Google about your use of our YouTube presence is generally transferred to and stored on a server operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Our service providers are located in and/or use servers in countries outside the European Union (EU) and the European Economic Area (EEA) for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection. Our service providers are also located in and/or use servers in countries outside the EU and the EEA for which the European Commission has not adopted an adequacy decision. Our cooperation with these service providers is based on the European Commission's Standard Contractual Clauses (SCCs).

Pinterest is a service provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest"). The information automatically collected by Pinterest about your use of our Pinterest presence is generally transferred to and stored on a server operated by Pinterest, Inc., 505 Brannan St., San Francisco, CA 94107, USA. Our service providers are located in and/or use servers in countries outside the European Union (EU) and the European Economic Area (EEA) for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection. Our service providers are also located in and/or use servers in countries outside the EU and the EEA for which the European Commission has not adopted an adequacy decision. Our cooperation with these service providers is based on the European Commission's Standard Contractual Clauses (SCCs).

LinkedIn is a service provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland ("LinkedIn"). The information automatically collected by LinkedIn about your use of our LinkedIn presence is generally transferred to and stored on a server operated by LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. Our service providers are located in and/or use servers in the United States, for which the European Commission has adopted an adequacy decision confirming an adequate level of data protection. The adequacy decision for the United States serves as the basis for transfers of personal data to a third country, provided that the respective service provider is certified. Such certification is in place.

Xing is a service provided by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.

Competitions on Social Media Accounts / Registration for Product Tests on Social Media Accounts
If you participate in a competition or register for a product test published on our Facebook or Instagram page, we will ask you to provide your name, email address, and residential address so that we can send you the prize. We process the above-mentioned data exclusively for the purpose of sending the prize and not for market research or opinion polling. For this purpose, your data will be disclosed to the shipping service providers listed in Section 3.

10. Contact Information and Your Rights
As a data subject, you have the following rights:

Pursuant to Article 15 GDPR, you have the right to request information about your personal data processed by us, to the extent specified therein.
Pursuant to Article 16 GDPR, you have the right to request the immediate correction of inaccurate personal data or the completion of your personal data stored by us.
Pursuant to Article 17 GDPR, you have the right to request the deletion of your personal data stored by us, unless further processing is required: to exercise the right to freedom of expression and information; to comply with a legal obligation; for reasons of public interest; or for the establishment, exercise, or defense of legal claims.
Pursuant to Article 18 GDPR, you have the right to request the restriction of the processing of your personal data where: you contest the accuracy of the data; the processing is unlawful, but you oppose the deletion of the data; we no longer need the data, but you require it for the establishment, exercise, or defense of legal claims; or you have objected to the processing pursuant to Article 21 GDPR.
Pursuant to Article 20 GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format or to request its transmission to another controller
Pursuant to Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority at your habitual place of residence, your place of work, or our company's registered office. If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to request information, correction, restriction, or deletion of your data, withdraw any consent you have given, or object to a particular use of your data, please contact:

Combo-Shops GmbH
Kärntner Straße 391
A-8054 Graz

Austria Hotline: 0800 799 5544 (Monday–Thursday: 7:00 AM–4:00 PM, Friday: 8:00 AM–12:00 PM)
Email: [email protected]

Right to Object
Where we process your personal data on the basis of our overriding legitimate interests following a balancing of interests, as explained above, you have the right to object to such processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. If the processing is carried out for other purposes, you have the right to object only on grounds relating to your particular situation. Once you have exercised your right to object, we will no longer process your personal data for those purposes unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defense of legal claims. This does not apply where the processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for such purposes.

11. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy at any time in accordance with the applicable data protection laws.