1. Data protection at a glance

Data collection on this website

Who is responsible for the data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Note on the responsible body" in this privacy policy.

How do we collect your information?

On the one hand, your data is collected when you provide it to us. This can be, for example, data that you enter into a contact form.

Other data is collected automatically or with your consent when you visit the website by our IT systems. This is mainly technical data (e.g. Internet browser, operating system or time of page access). The collection of this data takes place automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure that the website is provided without errors. Other data may be used to analyze your user behavior.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipient and purpose of your

stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data in certain circumstances. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time for this and other questions on the subject of data protection.

Analytics and third-party tools

When you visit this website, your surfing behaviour can be statistically evaluated. This is mainly done with so-called analysis programs.

Detailed information about these analysis programs can be found in the following privacy policy.

2. Hosting + Content Delivery

External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the hoster/hosters. This can include, but is not limited to, IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses and other data generated via a website.

The external hosting is carried out for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR).

If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

Our hoster(s) will only process your data to the extent necessary to fulfil its performance obligations and follow our instructions with regard to this data.

We use the following host(s):

Accell IT B.V.
Industrieweg 4,
NL-8444 AR Heerenveen

Order processing

We have concluded a contract processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Unpkg

On our website, a web service of the company Npm, Inc., 1999 Harrison Street #1150, CA 94612 Oakland, United States of America (hereinafter: Unpkg) is loaded. If you have activated Java Script in your browser and have not installed a Java Script blocker, your browser may transmit personal data to Unpkg. Further information on the handling of the transmitted data can be found in Unpkg's privacy policy: https://www.npmjs.com/policies/privacy

You can prevent the collection and processing of your data by Unpkg by disabling the execution of script code in your browser or by installing a script blocker in your browser.

ELASTIC-CLOUD

We use the services of the company Elastic-Search B.V., United States of America (hereinafter: ELASTIC) in order to be able to provide them as high-performance as possible worldwide and to optimize loading times.

ELASTIC receives knowledge of personal data of the call (e.g. IP address). Information on the implementation of the GDPR by this service provider can be found here. General information on data protection can be found here.

CLOUDIMAGE. IO by SCALAFLEX

We use the services of the company Scalaflex based in the United States of America (hereinafter: SCALAFLEX) in order to be able to provide images as performantly as possible worldwide and to optimize loading times.

SCALAFLEX receives knowledge of personal data of the call (e.g. IP address).

We have concluded an order processing agreement with SCALAFlEX. The contents of this agreement can be found here. Information on the implementation of the GDPR by this service provider can be found here. General information on data protection can be found here.

3. General information and mandatory information

Privacy

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this data protection declaration.

When you use this website, various personal data is collected.

Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

We would like to point out that data transmission on the Internet (e.g. when communicating by e-mail) may have security gaps. It is not possible to completely protect the data from access by third parties.

Note on the responsible body

The person responsible for data processing on this website is:

WINORA-STAIGER GmbH
Max-Planck-Straße 6
97526 Sennfeld

Phone: +49 9721-65 01-0

E-Mail: info@winora-group.de

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.).

Storage period

Unless a specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which the data is processed no longer applies. If you assert a justified request for erasure or revoke consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the deletion takes place after these reasons have ceased to exist.

General information on the legal basis of data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR, insofar as special categories of data are processed in accordance with Art. 9 (1) GDPR. In the case of explicit consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49 (1) (a) GDPR. If you have consented to the storage of cookies or access to information in your device (e.g. via device fingerprinting), data processing will also be carried out on the basis of Section 25 (1) TTDDG. The consent can be revoked at any time. If your data is required for the performance of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6 (1) (b) GDPR. Furthermore, we process your data if it is necessary to comply with a legal obligation on the basis of Art. 6 (1) (c) GDPR.

Data processing may also be carried out on the basis of our legitimate interest in accordance with Art. 6 (1) (f) GDPR. Information on the relevant legal bases in each individual case is provided in the following paragraphs of this data protection declaration.

Data protection supervisor

We have appointed a data protection officer.

Dipl.-Ing. Lars Ebertz on behalf of EBERTZ DATENSCHUTZ GmbH
Ober den Wiesen 17
35756 Mittenaar

E-Mail: lars@ebertz-datenschutz.de

Recipients of personal data

As part of our business activities, we work together with various external bodies. In some cases, it is also necessary to transmit personal data to these external bodies. We only pass on personal data to external bodies if this is necessary in the context of the performance of a contract, if we are legally obliged to do so (e.g. disclosure of data to tax authorities), if we have a legitimate interest in the disclosure in accordance with Art. 6 (1) (f) GDPR or if another legal basis allows the data transfer. When using

We only pass on personal data of our customers to processors on the basis of a valid contract for order processing. In the case of joint processing, a joint processing contract is concluded.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You can revoke any consent you have already given at any time. The lawfulness of the data processing carried out up to the time of revocation remains unaffected by the revocation.

Right to object to data collection in special cases as well as to direct marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6 PARA. 1 LIT. E OR F GDPR

YOU HAVE THE RIGHT AT ANY TIME TO WITHDRAW FROM THE

SITUATION AGAINST THE PROCESSING OF YOUR PERSONAL DATA

TO LODGE AN OBJECTION; THIS SHALL ALSO APPLY TO AN APPLICATION BASED ON THESE PROVISIONS

PROFILING. THE RESPECTIVE LEGAL BASIS ON WHICH THE PROCESSING IS BASED,

PLEASE REFER TO THIS PRIVACY POLICY. IF YOU FILE AN OBJECTION,

IF WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED, IT WILL BE

UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING OF

EVIDENCE THAT OUTWEIGHS YOUR INTERESTS, RIGHTS AND FREEDOMS OR THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 PARA. 1 GDPR).

YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING,

YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOU AT ANY TIME

CONCERNING PERSONAL DATA FOR THE PURPOSE OF SUCH ADVERTISING

; THIS ALSO APPLIES TO PROFILING, INSOFAR AS IT IS RELATED TO SUCH DIRECT ADVERTISING IN

CONNECTION. IF YOU OBJECT, YOUR PERSONAL DATA WILL THEN NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21 PARA. 2 GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a

supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The right of appeal exists without prejudice to other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent that it is technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right to free use of the

Information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to rectification or deletion of this data. You can contact us at any time for this and other questions on the subject of personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us at any time for this. The right to restriction of processing exists in the following cases:

 If you contest the accuracy of your personal data stored by us, we will need

usually time to check this. For the duration of the audit, you have the right to request the restriction of the processing of your personal data.

 If the processing of your personal data was/is unlawful, you may demand the restriction of data processing instead of deletion.

 If we no longer need your personal data, but you have used it to exercise it, if you need to defend or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure.

 If you have filed an objection in accordance with Art. 21 (1) GDPR, a balancing of your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data may only be processed with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as

Orders or inquiries that you send to us as the site operator require an SSL or TLS

Encryption. You can recognize an encrypted connection by the fact that the address bar of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to advertising e-mails

The use of contact details published in the context of the imprint obligation for the sending of unsolicited advertising and information material is hereby contradicted. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam e-mails.

4. Data collection on this website

Cookies

Our websites use so-called "cookies". Cookies are small data packets and target

Your device will not be harmed. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or until your web browser automatically deletes them.

Cookies can come from us (first-party cookies) or from third-party companies (so-called third-party cookies).

cookies). Third-party cookies enable the integration of certain services of third-party companies within websites (e.g. cookies used to process payment services).

Cookies have different functions. Many cookies are technically necessary because certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies may be used to evaluate user behavior or for advertising purposes.

Cookies that are necessary to carry out the electronic communication process, to provide certain functions that you have requested (e.g. for the shopping cart function) or to optimise the website (e.g. cookies to measure the web audience) (necessary cookies) are stored on the basis of Art. 6 (1) (f) GDPR, unless another legal basis is indicated. The website operator has a legitimate interest in the storage of necessary cookies for the technically error-free and optimized provision of its services. If consent to the storage of cookies and comparable recognition technologies, the processing is carried out exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG); consent can be revoked at any time.

You can set your browser to inform you about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general as well as enable the automatic deletion of cookies when the browser is closed. If you disable cookies, the functionality of this website may be limited.

You can find out which cookies and services are used on this website in this privacy policy.

OneTrust Consent Management

We offer you the opportunity to decide for yourself in detail in which cases you want to consent to tracking via cookies and other technologies - in order to display content relevant to you and offers tailored to you.

The processing of your data for the purposes stated here is partly based on legitimate interest, but in part we also require your consent. For this purpose, we use the Consent Management Platform (CMP) of OneTrust, LLC, 1350 Spring St NW, Atlanta, GA 30309, as a processor.

Onetrust's CMP enables you to give us data protection-compliant and self-determined consent to the processing of your data and to revoke it at any time. You can also object to data processing based on our legitimate interest. For more information on Onetrust's privacy and CMP, click here. 

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and browser version operating system used

Referrer URL

Hostname of the accessing computer

Time of the server request IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website – for this purpose, the server log files must be recorded.

Contact

If you send us inquiries via the contact form, your information from the

Enquiry form including the contact details you provide there for the purpose of processing the enquiry

and stored with us in the event of follow-up questions. We do not pass on this data without your consent.

The processing of this data is carried out on the basis of Art. 6 (1) (b) GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the

Effective processing of the requests addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), if this has been requested; consent can be revoked at any time.

The data you enter in the contact form will remain with us until you ask us to delete it, revoke your consent to its storage or the purpose for which the data is stored no longer applies

(e.g. after your request has been processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.

Anfrage for E-Mail, Telefon or Telefax

If you contact us by e-mail, telephone or fax, your enquiry, including all personal data resulting from it (name, enquiry), will be stored and processed by us for the purpose of processing your request. We do not pass on this data without your consent.

The processing of this data is carried out on the basis of Art. 6 (1) (b) GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the

Effective processing of the requests addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), if this has been requested; consent can be revoked at any time.

The data you send to us via contact requests will remain with us until you ask us to delete it, revoke your consent to its storage or the purpose for which the data is stored no longer applies

(e.g. after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

Salesforce Sales Cloud

We use Salesforce Sales Cloud to manage customer data. The provider is salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich (hereinafter referred to as "Salesforce").

Salesforce Sales Cloud is a CRM system and allows us, among other things, to manage existing and potential customers as well as customer contacts and to organize sales and communication processes. The use of the CRM system also enables us to analyse our customer-related processes. Customer data is stored on Salesforce's servers. In this context, personal data may also be transmitted to the parent company of salesforce.com Germany GmbH, salesforce.com inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA.

Details on Salesforce Sales Cloud features can be found here.

The use of Salesforce Sales Cloud is based on Art. 6 (1) (f) GDPR. The Website operator has a legitimate interest in the most efficient customer administration and customer communication possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

Salesforce has Binding Corporate Rules (BCR) approved by the French Data Protection Authority. These are binding internal company regulations that legitimize intra-company data transfers to third countries outside the EU and the EEA. Details can be found here.

For details, see  Salesforce's privacy policy.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Order processing

We have concluded a contract processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

5. Analytics Tools and Advertising

Bing Ads

This website uses Bing Ads. Bing Ads is an online advertising program of Microsoft Corporation, One Microsoft Way, Redmond WA 94043, USA ("Microsoft"). As part of Microsoft Bing Ads, we use so-called conversion tracking. When you click on an ad served by Bing, a cookie is set for conversion tracking. Cookies are small text files that the Internet browser stores on the user's computer. These cookies expire after 30 days and are not used to personally identify users. If the user visits certain pages of this website and the cookie has not expired, Microsoft and we can tell that the user clicked on the ad and was redirected to that page. Each Microsoft Bing Ads customer receives a different cookie. The cookies cannot be tracked through the websites of Bing Ads customers. The information collected using the conversion cookie is used to compile conversion statistics for Bing Ads customers who have opted for conversion tracking. Customers will see the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that can be used to personally identify users. If you do not wish to participate in tracking, you can object to this use by slightly deactivating the Bing Ads conversion tracking cookie via your Internet browser under User Settings. They will then not be included in the conversion tracking statistics. The storage of "conversion cookies" is based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the analysis of user behaviour in order to optimise both its website and its advertising.

More information about Microsoft Bing Ads can be found in the privacy policy of

Microsoft: https://privacy.microsoft.com/de-de/privacystatement.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies in certain cases or in general, and activate the automatic deletion of cookies when you close the browser. If you disable cookies, the functionality of this website may be limited.

Clarity

Diese Website nutzt Clarity. Anbieter ist die Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Irland, https://docs.microsoft.com/en-us/clarity/ (im Folgenden „Clarity“).

Clarity is a tool for analysing user behaviour on this website. In particular, Clarity records mouse movements and creates a graphical representation of which part of the website users scroll to particularly frequently (heat maps). Clarity may also record sessions so that we can view site usage in the form of videos. We also receive information about general user behavior within our website.

Clarity uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or the use of device fingerprinting). Your personal data is stored on Microsoft's servers (Microsoft Azure Cloud Service) in the USA.

If consent has been obtained, the use of the above-mentioned service is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 TDDDG. The consent can be revoked at any time. If no consent has been obtained, the use of this service is based on Art. 6 (1) (f) GDPR; the website operator has a legitimate interest in effective user analysis.

Further details on Clarity's data protection can be found here.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Order processing

We have concluded a contract processing agreement (DPA) for the use of the above-mentioned service. This is a contract required by data protection law that ensures that it processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

Google DoubleClick

This website uses functions of Google DoubleClick. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland, (hereinafter referred to as "DoubleClick").

DoubleClick is used to show you interest-based ads across the Google Network. With the help of DoubleClick, the advertisements can be tailored to the interests of the respective viewer. For example, our advertising may appear in Google search results or in banner ads associated with DoubleClick.

In order to be able to display interest-based advertising to users, DoubleClick must use the respective viewer and tell them about their visited websites, clicks and other information about the

user behavior. To do this, DoubleClick uses cookies or comparable

recognition technologies (e.g. device fingerprinting). The information collected is used to pseudonymous user profile in order to display interest-based advertising to the user in question.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

Further information on objection options against the advertisements displayed by Google can be found at the following links: and here.

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tool that allows us to create tracking or statistics tools and other

technologies on our website. The Google Tag Manager itself does not create

user profiles, does not store cookies and does not carry out independent analyses. It only serves to

Administration and playout of the tools integrated via him. However, Google Tag Manager does collect your IP address, which may also be transmitted to Google's parent company in the United States.

The use of Google Tag Manager is based on Art. 6 para. 1 lit. f GDPR. The Website operators have a legitimate interest in the quick and uncomplicated integration and management of various tools on their website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google Analytics

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, dwell time, operating systems used and origin of the user. This data is transferred to the respective terminal of the Users. There is no assignment to a user ID.

Furthermore, we can use Google Analytics to, among other things: Record your mouse and scroll movements and clicks. In addition, Google Analytics uses various modeling approaches to complement the collected data sets and uses machine learning technologies in data analysis.

Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is usually transmitted to a Google server in the USA and stored there.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

IP anonymization

Google Analytics IP anonymization is activated. As a result, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before it is transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide further information with the website.

website use and internet use to provide services to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google.

Browser Plugin

You can prevent the collection and processing of your data by Google by  downloading and installing the browser plugin available at the following link.

You can find more information about the handling of user data by Google Analytics in  Google's privacy policy.

Order processing

We have concluded a contract processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Ads enables us to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting). In addition, targeted advertisements can be processed based on user data held by Google (e.g. location data and interests) (target group targeting). As a website operator, we can evaluate this data quantitatively, for example by analysing which search terms led to the display of our advertisements and how many ads led to corresponding clicks.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here and here .

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google Ads Remarketing

This website uses the functions of Google Ads Remarketing. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With Google Ads Remarketing, we can assign people who interact with our online offer to specific target groups in order to then display interest-based advertising in the Google advertising network (remarketing or retargeting).

Furthermore, the advertising audiences created with Google Ads Remarketing can be linked to Google's cross-device functions. In this way, interest-based, personalised advertising messages that have been adapted to you depending on your previous usage and surfing behaviour on one device (e.g. mobile phone) can also be displayed on another of your devices (e.g. tablet or PC).

If you have a Google account, you can object to personalized advertising at the following link .

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

Further information and the privacy policy can be found in Google's privacy policy here.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The

DPF is an agreement between the European Union and the USA that aims to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Target group creation with customer matching

For target group formation, we use, among other things, the customer match of Google Ads Remarketing.

In doing so, we transfer certain customer data (e.g. email addresses) from our customer lists to Google. If the customers in question are Google users and are logged in to their Google Account, they will be

Displays relevant advertising messages within the Google network (e.g. on YouTube, Gmail or in the search engine).

Google Conversion-Tracking

This website uses Google Conversion Tracking. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can see whether the user has taken certain actions. For example, we can evaluate which buttons on our website have been clicked on how often and which products have been viewed or purchased particularly often. These Information is used to compile conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information that allows us to personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG. The consent can be revoked at any time.

You can find more information about Google conversion tracking in  Google's privacy policy:

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Data protection Google Lead Ads

PRIVACY POLICY FOR OUR GOOGLE ADS LEAD FORM EXTENSION

General information on data protection

Protecting your private rights and freedoms is important to us; We only use your data for the intended purposes. Since it is important to us that you always know to what extent we collect, use and, if necessary, transfer your data to third parties, we will inform you below in detail about the processing of your personal data (collected via our lead form).

When processing personal data, we strictly adhere to the requirements of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) and, if necessary, other data protection-relevant regulations.

scope

This privacy policy applies exclusively to our Google Lead Form extension. It does not apply to Google's own content; You can find Google’s privacy policy here

Name and address of the person responsible for processing:

WINORA-STAIGER GmbH

Max-Planck-Straße 6

97526 Sennfeld

Phone:09721-65 01-0
Fax:09721-65 01-45
E-mail:info@winora-group.de

Name and address of the data protection officer

Dipl.-Ing. Lars Ebertz on behalf of EBERTZ DATENSCHUTZ GmbH
Ober den Wiesen 17
35756 Mittenaar

email: lars(at)ebertz-datenschutz.de

If you have any questions about the processing of your personal data, or if you wish to assert your data subject rights (such as the right to information, correction, blocking or deletion of data) or if you wish to revoke your consent, please contact our data protection officer directly.

Information about Google Ads (provider of the lead form extension)

Google Ireland Limited Gordon House, Barrow Street Dublin 4 Ireland Tel:+353 1 543 1000Fax:+353 1 686 5660Email: support-deutschland(at)google.com

You can find Google's data protection information here.

Google’s data protection officer

To reach Google's data protection officer, you can use the following link fill out a corresponding contact form:

Operation of our Google Ads lead form extension

Within the lead form extension, Google collects personal data for us. In particular, this includes all the data you have entered there.

Interaction with our lead form

As soon as you enter data in our lead form, it will be saved in our Google Ads profile. Through our profile we can download the data in aggregate (manually or automatically) and use it for the purpose stated in the form. The data will not be passed on to third parties.

We transfer the data to our CRM system (see SALESFORECE SALES CLOUD) and also compare it with any existing data records in order to be able to assign them correctly.

As part of the Google Enhanced Conversion Tracking function, Google receives a so-called hash of the email identifier - there is no plain text transmission - for later recognition and correct assignment. See also the general chapter “GOOGLE (ENHANCED) CONVERSION TRACKING”.Data protection.

SALESFORCE SALES CLOUD

We use Salesforce Sales Cloud to manage customer data. provider issalesforce.comGermany GmbH, Erika-Mann-Str. 31, 80636 Munich (hereinafter “Salesforce”).

Salesforce Sales Cloud is a CRM system and allows us, among other things, to manage existing and potential customers as well as customer contacts - such as Google LeadAd accounts - and to organize sales and communication processes. The use of the CRM system also enables us to analyze our customer-related processes. The customer data is stored on Salesforce’s servers. Personal data may also be sent to the parent companysalesforce.comGermany GmbH, thesalesforce.cominc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA.

Salesforce has Binding Corporate Rules (BCR) approved by the French Data Protection Agency. These are binding internal company regulations that legitimize internal company data transfer to third countries outside the EU and the EEA.

You can find details here.

You can find details here Data protection from Salesforce:

Salesforce order processing

We have concluded an order processing contract (AVV) with SALESFOREC. This is a contract required by data protection law that ensures that we only process the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

Basic information on the deletion or blocking of personal data

We only store your personal data for the period necessary to fulfill the specified purpose. Once the purpose no longer applies and any existing retention periods have expired, your data will be deleted immediately. If deletion is not possible, the data will be blocked instead.

Rights of data subjects

The EU General Data Protection Regulation (GDPR) provides extensive rights for data subjects in Chapter III, which we will explain to you below with regard to the processing of your personal data:

1) Right to information This requirement applies in particular to information on the following details of data processing:

2) Right to correction if necessary. We will correct incorrect data sets immediately as long as you inform us of the situation accordingly.

3) Right to deletion (right to be forgotten) If the processing is no longer necessary and one of the following conditions is met:

As part of the deletion request, we will, if necessary, pass on your request to those third parties to whom your data was previously transmitted.

4) Right to restriction of processing If one of the following conditions is met:

5) Right to data portability If it is technically possible and does not affect the rights and freedoms of other people, we will - at your request - transfer your data to another recipient (person responsible).

6) Right to object If we collect or have collected and process personal data from you (on the basis of Art. 6 Para. 1 e or f or Art. 9 Para. 2 a GDPR), you have the right to to object to data processing (including profiling) at any time (with effect for the future). In exceptional cases the objection may be invalid, e.g. B. if we can demonstrate compelling legitimate interests for the processing that outweigh your interests or the processing serves to assert, exercise or defend legal claims. If we process your personal data to conduct direct advertising, you have the right to object to this processing at any time. This also applies to profiling insofar as it is connected to such direct advertising. You also have the right to object to the processing of your data concerning you, which is carried out by us for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 Para. 1 GDPR, unless such processing is necessary Fulfillment of a task in the public interest is required.

7) Automated decisions in individual cases, including profiling If we collect or have collected and process personal data from you, you have the right not to be subject to a decision based solely on automated processing - including profiling - that has legal effect on you or significantly affects you in a similar way. Exceptions to this requirement apply if the decision is necessary for the conclusion or performance of a contract between you and us or if you have expressly consented to the processing. In any case, we will take appropriate measures to protect your rights and freedoms as well as your legitimate interests, which include at least the right to obtain human intervention on our part, to express one's own point of view and to challenge the decision.

8) Right to revoke your data protection consent You have the right to revoke your consent to the processing of personal data at any time.

9) Right to complain to a supervisory authority You can find a list of the supervisory authorities responsible in Germany on the website of the Federal Commissioner for Data Protection or under the following link:
https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/AufsBehordFuerDennichtOeffRaum/AufsichtsbehoerdennichtOeffRaum_liste.html

Legal basis for processing

We process personal data in accordance with the requirements of the GDPR, depending on the type and purpose of processing as follows:

Informed consent

Art. 6 Para. 1 a

Safeguarding our legitimate interest

Art. 6 Para. 1 f

Our legitimate interest

Our legitimate interest, as defined in Article 6 Para. 1 f GDPR, is based on carrying out our business activities to maintain our operational capability and secure the employment of our employees.

Existence of automated decision making

We do not use automatic decision-making and do not use techniques to carry out profiling measures.

Google marketing service provider

If we use service providers to process the data on our Google lead forms, we conclude corresponding contracts for order processing (AVV) with them. In the course of this, we regulate to what extent and under what security conditions the data is processed and determine the necessary authority to issue instructions in accordance with Art. 28 GDPR

GOOGLE (ENHANCED) CONVERSION TRACKING

This website uses Google Conversion Tracking. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

With the help of Google conversion tracking, Google and we can recognize whether the user has carried out certain actions. For example, we can evaluate which buttons on our website were clicked how often and which products were viewed or purchased particularly frequently.

Information is used to create conversion statistics. We learn the total number of users who clicked on our ads and what actions they took. We do not receive any information with which we can personally identify the user. Google itself uses cookies or comparable recognition technologies for identification.

If you give your consent, we will transmit the email address provided when purchasing one of our products to Google using a secure (hashed) process in order to be able to carry out a possible conversion (so-called ENHANCED CONVERSION). This conversion can then, for example, generate statistics that give us information about the course and development of a purchase in order to optimize our processes.

You can find more information about Google conversion tracking in the Privacy Policy from Google: The use of this service is based on your consent in accordance with Article 6 Paragraph 1 Letter a GDPR and Section 25 Paragraph 1 TTDSG. Consent can be revoked at any time with future effect.

Meta pixel (formerly Facebook Pixel)

This website uses the Facebook/Meta visitor action pixel to measure conversion. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. However, according to Facebook, the data collected will also be transferred to the USA and other third countries.

In this way, the behavior of the site visitors can be tracked after they have clicked on a

Facebook ad was redirected to the provider's website. This allows the effectiveness of Facebook ads to be evaluated for statistical and market research purposes and future advertising measures to be optimized.

The data collected is anonymous for us as the operator of this website, we cannot draw any conclusions about the identity of the users. However, the data is stored and processed by Facebook so that a connection to the respective user profile is possible and Facebook can use the data for its own advertising purposes, in accordance with the Facebook Data Use Policy). This allows Facebook to enable the placement of advertisements on and off Facebook pages. This use of the data cannot be influenced by us as the site operator.

The use of this service is based on your consent in accordance with Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. The consent can be revoked at any time.

We use the function of advanced matching within the meta pixels.

Advanced matching allows us to submit to Meta (Facebook) different types of data (e.g., city, state, zip code, hashed email addresses, names, gender, date of birth, or phone number) of our customers and prospects that we collect through our website. This activation allows us to tailor our advertising campaigns on Facebook even more precisely to people who are interested in our offers. In addition, advanced matching improves website conversion attribution and expands Custom Audiences.

Insofar as personal data is collected on our website with the help of the tool described here, and sent to

Facebook, we and Meta Platforms Ireland Limited, 4 Grand Canal Square,

Grand Canal Harbour, Dublin 2, Ireland is jointly responsible for this data processing (Art. 26

GDPR). The joint responsibility is limited exclusively to the recording of the

Data and its disclosure to Facebook. The processing by Facebook after the transfer is not part of the joint responsibility. The obligations incumbent on us together

have been set out in a joint processing agreement. The text of the agreement can be found here. According to this agreement, we are responsible for the provision of data protection information when using the Facebook tool and for the implementation of the tool on our website in a manner that is secure under data protection law. Facebook is responsible for the data security of Facebook's products. You can assert the rights of data subjects (e.g. requests for information) regarding the data processed by Facebook directly with Facebook. If you assert your rights as a data subject with us, we are obliged to forward them to Facebook.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here:

and here.

In Facebook's privacy policy you will find further information on how to protect your privacy.

You can also turn off the Custom Audiences remarketing feature in the Ads Settings section of . To do this, you must be logged in to Facebook.

If you do not have a Facebook account, you can opt out of Facebook's usage-based advertising on the European Interactive Digital Advertising Alliance website: /.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

SMARTFIT – Onlinesizing.bike

You can use Smartfit Online Sizing on our website. Smartfit is a solution from Radlabor GmbHHeinrich-von-Stephan-Str. 5c, 79100 Freiburg (https://www.onlinesizing.bike/).

You can download the application on our website.

To get a size recommendation for a specific bike, you can submit the following information through the application:

1.                  Gender (mandatory)

2.                  Height (required)

3.                  Leg length (optional)

4.                  Arm length (optional)

Smartfit calculates a specific size recommendation for a bike using algorithms that find the right bike size based on your anthropometric data and gender. In some cases, you can transfer your preferred bike size from the application to your personal shopping cart via a button on the results screen.

USE OF PERSONAL INFORMATION FROM OUR APPLICATION

We will only use your personal data from the Application for the following purposes:

·         Recommendation of bike sizes in real time.

·         Providing fit prediction services in our partners' online stores.

·         Optimizing the overall quality of our referral mechanisms.

·         Statistical analysis of the number of bike sizes over time.

All personal data is processed anonymously and Smartfit never collects or processes personal data (e.g. real name, address data, payment information). All data is stored on servers and databases located either in Frankfurt, Germany, or in Nuremberg, Germany. No data will be transferred outside the European Union. All data is automatically deleted after a certain retention period.

We do not use data for marketing or advertising purposes.

COOKIES

We use a local storage cookie to store the following information:

1.                  Gender (mandatory)

2.                  Height (required)

3.                  Leg length (if specified by the user)

4.                  Arm length (if specified by the user)

We store this data along with a session identifier in your local storage. The cookie is considered necessary for technical reasons. Without the cookie, the Online Sizing Widget cannot be used sensibly. The cookie allows us to identify returning users so that you do not have to re-enter your basic information when you use the application again. The token (JWT) is renewed after a user has been inactive for 4 hours.

In some cases, the cookie allows the immediate display of size recommendations on the product detail pages of our partners' webshops without using the application again. In some cases, our application transmits the recommended size to a partner store (i.e. so that the recommended size is automatically selected in a drop-down on the product page). When the Smartfit recommendation engine is enabled, you don't have to re-enter your basic information, with the recommended bikes displayed in new browser tabs.

SAFETY AND SECURITY

We use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss and/or destruction as well as against access by unauthorised persons. Our security measures are subject to continuous improvement in line with current technological developments.

Further data processing by Radlabor GmbH – in the sense of independent or instruction-bound data processing – does not take place!

New Relic

On this website, we use a plugin from New Relic's web analytics service. It enables us to collect statistical evaluations of the speed of the website, to determine whether the website can be accessed and how quickly the respective page is displayed when it is accessed. This service is provided by New Relic Inc. (188 Spear Street, Suite 1200 San Francisco, CA 94105, USA; "New Relic").

New Relic uses cookies. When a user visits a website that contains a New Relic plugin, their browser establishes a direct connection to New Relic's servers.

By integrating the plugin, New Relic receives the information that a user has called up the corresponding page of the offer. If the user is logged in to New Relic, New Relic can associate the visit with their New Relic account. However, if a user is not a member of New Relic, New Relic will store his or her IP address.The purpose and scope of the data collection and the further processing and use of the data by New Relic, as well as the related rights and setting options to protect the privacy of the users, can be found in New Relic's privacy policy: https://newrelic.com/privacy.

If a user is a New Relic member and does not want New Relic to collect information about them through this offering and link it to their New Relic membership information, they must log out of New Relic before visiting the New Relic Site.

You can object to the collection and storage of data for the purpose of web analysis at any time with effect for the future by deactivating cookies in your browser settings. To do this, consult the appropriate help file or help function of your browser.

Storyblok

We use the services of the processor Storyblok GmbH, Peter-Behrens-Platz 2, A-4020 Linz, for our CMS and for CDN services. Server connections to the USA can be established. We have concluded a data processing agreement with Storyblok. Storyblok is required to enter into EU Standard Contractual Clauses with its subcontractors. This offers sufficient guarantees for appropriate data protection within the meaning of Art. 46 GDPR.

6. Newsletter

Newsletter data

If you would like to subscribe to the newsletter offered on the website, we require an email address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. Other data is not collected or is only collected on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.

The data entered in the newsletter registration form will be processed exclusively on

Basis of your consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent to the storage of the data, the e-mail address and its use for sending the newsletter at any time, for example via the "unsubscribe" link in the newsletter. The lawfulness of the data processing operations that have already taken place remains unaffected by the revocation.

The data you provide to us for the purpose of subscribing to the newsletter will be processed by us until your

unsubscribe from the newsletter is stored by us or the newsletter service provider and deleted from the newsletter distribution list after unsubscribing from the newsletter or after the purpose has ceased to exist. We reserve the right to delete or block e-mail addresses from our newsletter distribution list at our own discretion within the scope of our legitimate interest in accordance with Art. 6 (1) (f) GDPR.

Data that has been stored by us for other purposes remains unaffected by this.

After you have unsubscribed from the newsletter distribution list, your e-mail address will be sent to us or the

Newsletter service providers may be stored in a blacklist, if this is necessary to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements when sending newsletters (legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR). The storage in the blacklist is not limited in time. You can object to the storage if your interests outweigh our legitimate interest.

We use the Salesforce Sales Cloud to send our newsletter emails. For more information, see the Salesforce Sales Cloud chapter  .

7. Plugins and Tools

YouTube

This website embeds videos from the YouTube website. The website is operated by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our websites on which YouTube is integrated, a connection to YouTube's servers is established. The YouTube server is informed which of our pages you have visited.

Furthermore, YouTube may store various cookies on your device or use comparable technologies for recognition (e.g. device fingerprinting). This allows YouTube to obtain information about visitors to this website. This information is provided, inter alia:

used to collect video statistics, improve the user experience and prevent fraud attempts.

If you are logged in to your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.

YouTube is used in the interest of an appealing presentation of our online offerings.

This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Provided that a corresponding

consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a

GDPR and § 25 (1) TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

For more information on how user data is handled, please see YouTube's privacy policy here.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The

DPF is an agreement between the European Union and the USA that aims to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google Fonts

This site uses so-called Google Fonts, which are provided by Google, for the uniform display of fonts. When you call up a page, your browser loads the required fonts into your browser cache in order to display texts and fonts correctly.

For this purpose, the browser you use must connect to Google's servers. This makes Google aware that this website has been accessed via your IP address. The use of Google Fonts is based on Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the uniform presentation of the typeface on its website. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

If your browser does not support Google Fonts, a default font will be used by your computer.

You can find more information about Google Fonts at and in Google's privacy policy.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google Maps

This site uses the Google Maps map service. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

In order to use the functions of Google Maps, it is necessary to store your IP address. These

Information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. If Google Maps is enabled, Google may use Google Fonts for the purpose of displaying fonts consistently. When you call up Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.

The use of Google Maps is in the interest of an appealing presentation of our online offers and to make it easy to find the places we indicate on the website. This constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. Provided that a corresponding

consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a

GDPR and § 25 (1) TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here and here.

You can find more information on the handling of user data in  Google's privacy policy:

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

Google reCAPTCHA

We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on this website. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to verify whether data is entered on this website (e.g. in a contact form) by a human or by an automated program. To do this, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis begins automatically as soon as the website visitor enters the website. For analysis,

reCAPTCHA collects various information (e.g. IP address, time spent on the website by the website visitor or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses run completely in the background. Website visitors are not informed that an analysis is taking place.

The storage and analysis of the data is carried out on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in protecting its websites from abusive automated spying and spam. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and § 25 para. 1

TTDDG, insofar as the consent includes the storage of cookies or access to information in the user's end device (e.g. device fingerprinting) within the meaning of the TTDDG. The consent can be revoked at any time.

For more information about Google reCAPTCHA, please refer to the Google Privacy Policy and the Google Terms of Service at the following links.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

BIDEX BIKELOCAL PLUGIN

For the online reservation function, we use a plugin from BIDEX GmbH, Talsperrenweg 72, 58256 Ennepetal (hereinafter: BIDEX BikeLocal). With the BIDEX BikeLocal plugin, we offer you the opportunity to reserve the products displayed on our website via a convenient reservation function at the nearest dealer in order to be able to buy the item directly in the shop. You can also use a callback service within the plugin to be called back directly by the corresponding merchant. Legal basis for the use of the BIDEX BikeLocal plugin and the following under section 2.) the means described for processing your personal data is Art. 6 para. 1 sentence 1 lit. f GDPR.

PROCESSING OF RESERVATIONS AND CALLBACK SERVICE

You can use the BIDEX BikeLocal plugin for non-binding reservations of our products or a callback service through which the selected specialist dealer can contact you directly. In this case, BIDEX as a service provider provides these services for you and assumes the function of an intermediary in order to forward your reservation request to the corresponding specialist dealer. To reserve an item, it is necessary to enter the following data: first name, last name, e-mail address, telephone number (mandatory fields). This data is required for your reservation to be processed. The indication of the telephone number serves in particular the purpose of being able to reach you at short notice if the reserved article is exceptionally not yet ready for presentation (e.g. in unassembled condition) or, for example, must first be procured from the stock of another branch. In such a case, we would also like to be able to contact you if you have already made your way to one of our dealers and, if necessary, if necessary. by e-mail can no longer be reached in time. Failure to provide your data would mean that you would not be able to use the reservation function of the BIDEX BikeLocal plugin. Via the comment function in the reservation form you still have the possibility to write a message, which we will take into account when making the reservation.

For the callback service, the following data is required: name, telephone number. You can optionally enter a desired date for the callback by the dealer and also a comment in the form. Your data will first be transmitted to BIDEX via the form (SSL encryption) and processed there. Your data will then be sent by BIDEX by e-mail to the dealer you have selected for this purpose. BIDEX also receives, stores and processes the transmitted data for the further processing of the reservation request or callback request

BIDEX is solely responsible for the phases of the collection of your data via the form, their transmission to BIDEX and their forwarding to the selected dealer for the processing of your reservation

In order to protect your personal data for the processing of reservations or callback requests via the BIDEX BikeLocal plugin, we have concluded an agreement with BIDEX on joint responsibility for processing and on the technical and organizational measures for the protection of your personal data. This agreement ensures that your personal data will be processed for the phases of joint responsibility exclusively for the processing of your reservation or callback request and will not be used without your express consent, in particular for advertising and analysis purposes that go beyond the scope described below.

In the agreement, we have also stipulated that BIDEX fulfils the existing information obligations towards you under the GDPR and is the joint contact person for the exercise of your rights. Detailed information on data protection when processing reservations via the BIDEX BikeLocal plugin with detailed information on your rights can be found here: local.bidex.bike/Datenschutz.

The legal basis for the processing of your data in connection with a reservation is Art. 6 para. 1 sentence 1 lit b GDPR. BIDEX processes your data for the processing of your reservation of our products in the selected specialist shop. BIDEX deletes the data processed in this context after storage is no longer necessary or restricts processing if there are statutory retention obligations.

PROVISION OF THE BIDEX BIKELOCAL PLUGIN

Data transmission when calling up the reservation function When the reservation function on our website is called, an automatic connection to the BIDEX servers is established. For technical reasons, your IP address will be transmitted to BIDEX in order to display the reservation function in your browser, but will only be temporarily stored in the log files of the BIDEX server. The data and information collected anonymously in the log files are evaluated by BIDEX only statistically, with the aim of increasing the data protection and data security of the BIDEX BikeLocal plugin and ensuring an optimal level of protection for the personal data processed. For technical reasons, we have no influence on these evaluations.

Use of cookies BIDEX uses session cookies to operate the plugin. Session cookies are small text files that are temporarily stored on your computer system until you leave our website. For technical reasons, we have no influence on the use of these cookies. You can individually configure your browser settings for accepting or rejecting cookies. We would like to point out that in this case you may not be able to use all the functions of the BIDEX BikeLocal plugin.

8. Our social media presences

This privacy policy applies to the following social media presences

https://www.facebook.com/winorabikes https://www.instagram.com/winorabikes/ https://www.youtube.com/@winora_bikes

Data processing through social networks

We maintain publicly accessible profiles on social networks. The social networks we use in detail can be found below.

Social networks such as Facebook, X, etc. can usually analyze your user behavior comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous data protection-relevant processing operations. In detail:

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection is carried out, for example, via cookies that are stored on your device or by recording your IP address.

With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be shown to you on and off the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are logged in or were logged in.

Please also note that we cannot track all processing processes on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the

operators of the social media portals. Details can be found in the terms of use and privacy policy of the respective social media portals.

Legal basis

Our social media presences are intended to ensure the widest possible presence on the Internet. This is a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. The social

networks may be based on different legal bases, which must be indicated by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a

GDPR).

Controller and exercise of rights

If you visit one of our social media presences (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle, you can assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) against us as well as against the operator of the respective social media portal (e.g. against Facebook).

Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing processes of the social media portals. Our options are largely based on the corporate policy of the respective provider.

Storage period

The data collected directly by us via the social media presence will be deleted from our systems as soon as you ask us to delete it, revoke your consent to its storage or the purpose for which it was stored no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions – esp. retention periods – remain unaffected.

We have no influence on the storage period of your data, which is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Your rights

You have the right at any time to obtain information free of charge about the origin, recipient and purpose of your

stored personal data. They also have the right to object, to

data portability and a right to lodge a complaint with the competent supervisory authority. You can also request the rectification, blocking, deletion and, in certain circumstances, the restriction of the processing of your personal data.

Social networks in detail

Facebook

We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as Meta). According to Meta, the data collected will also be transferred to the USA and other third countries.

We have concluded a joint processing agreement (Controller Addendum) with Meta. This Agreement sets out which data processing operations we or Meta are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

You can adjust your advertising settings independently in your user account. To do this, click on the following link and log in:.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here and here.

Details can be found in  Facebook's privacy policy:

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link:

Instagram

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission.

Details can be found here.

Details on their handling of your personal data can be found in  Instagram's privacy policy.

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link.

YouTube

We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Details on their handling of your personal data can be found in YouTube'  s privacy policy:

The company is certified according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards for data processing in the USA. Every company certified according to the DPF is committed to complying with these data protection standards. Further information on this can be obtained from the provider under the following link: