1.0. Data Controller
The data controller within the meaning of the General Data Protection Regulation (hereinafter: "GDPR") and other national data protection laws as well as other data protection regulations is:

HARO Bikes Europe GmbH 
Max-Planck-Str. 54
32107 Bad Salzuflen
Germany

TEL   +49 (0)170 861 89 17
EMAIL  info@harobikes.de

2.0. General Information on Data Processing
Data protection is of particular importance to us. For this reason, we generally only collect and use personal data of users and visitors of our website to the extent necessary to provide a functional website as well as our content and services. Personal data means all information relating to an identified or identifiable natural person (hereinafter: "data subject").

The collection and use of personal data of our users always takes place in accordance with the GDPR and the applicable country-specific data protection rules. If the processing of personal data is necessary and such processing is not permitted by statutory provisions, we always obtain the consent of the data subject.

Personal data is generally not disclosed to third parties. Transmission only takes place if you have expressly consented (Art. 6(1) lit. a GDPR); there is a legitimate interest in disclosure and no reason to assume that you have an overriding legitimate interest in not disclosing your data (Art. 6(1) lit. f GDPR); there is a legal obligation to disclose (Art. 6(1) lit. c GDPR); or disclosure is permitted in the course of fulfilling a contract with you (Art. 6(1) lit. b GDPR) 

3.0 Collection and Storage of Personal Data When Visiting the Website
Every time you access our website, information is automatically transmitted to our website server by the browser you use. The following information is collected and stored until it is automatically deleted:

• IP address of the requesting computer,
• date and time of access,
• name and URL of the file accessed,
• the referrer URL, i.e. the website from which the access took place,
• information about the browser type used,
• the operating system of your computer,
• the name of the internet service provider.

This data is only temporarily stored in a so-called log file. This does not apply to the user's IP addresses or other data that allow the data to be assigned to a user. This data is not stored together with other personal data of the user. We do not draw any conclusions about the data subject when using this data.

The legal basis for this processing is Art. 6(1) lit. f GDPR. Our legitimate interest lies in providing a functional website with correctly delivered content, in optimizing our systems, and in providing law enforcement agencies with the information necessary for prosecution in the event of a cyberattack. As soon as there is no longer a legitimate interest and no statutory retention obligation, this data will be routinely deleted.

4.0 Cookies
We use cookies on our website. Cookies are small text files that are automatically created by your browser and can be stored on your device. This cookie contains a characteristic string that enables the unique identification of the browser when the website is accessed again. This does not mean that we immediately become aware of your identity.

The use of necessary cookies serves to display our website technically flawlessly. The data processed by these cookies is required for the stated purposes to safeguard our legitimate interests as well as those of third parties pursuant to Art. 6(1) lit. f GDPR. Our legitimate interest lies in providing a functional and user-friendly website.

In addition, we use cookies to optimize the user-friendliness of our offer and for statistical purposes.

We use so-called session cookies to recognize that you have already visited individual pages of our website. These cookies are automatically deleted after you leave our site. In addition, we use temporary cookies that are stored on your device for a specific fixed period. If you visit our site again, it will automatically recognize that you have already been to us and what inputs and settings you have made, so that you do not have to enter them again. The collected data includes the frequency of page views, entered search terms, and the use of website functions.

The use of cookies for statistical collection and evaluation of our offer as well as for marketing purposes is described in more detail in Section 5 and Section 6 of the privacy policy. 

The legal basis for data processing by cookies for statistical purposes and evaluation of our offer as well as for marketing purposes is your consent pursuant to Art. 6(1) lit. a GDPR. When visiting our website, you have the option to give your consent to data processing by cookies for evaluation and marketing purposes. This consent is voluntary and can be revoked by you at any time. If you do not give consent, no cookies will be set for marketing or analysis purposes.

You can also configure your browser so that no cookies are stored on your computer or that a notice always appears before a new cookie is created. However, completely disabling cookies may mean that you cannot use all the functions of our website.

5.0 Google Analytics
For the purpose of tailoring and continuously optimizing our website to meet user needs, we use Google Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"). We use tracking measures to statistically record the use of our website, for the purpose of optimizing our offer, and to evaluate it for you.

The legal basis for this data processing is your consent pursuant to Art. 6(1) lit. a GDPR. When visiting our website, you have the option to give your consent to data processing by cookies for evaluation and marketing purposes. This consent is voluntary and can be revoked by you at any time. If you do not give consent, no cookies will be set for marketing or analysis purposes.

In this context, pseudonymized usage profiles are created and cookies (see Section 4.) are used. The information generated by the cookie about your use of this website, such as

• browser type/version,
• operating system used,
• referrer URL (the previously visited page),
• hostname of the accessing computer (IP address),
• time of the server request,

is generally transmitted to a Google server and stored there. Data may also be transmitted to Google servers in the USA. Due to Google's certification under the EU-US Data Privacy Framework, the European Commission has determined that Google provides an adequate level of data protection.

The above-mentioned information may also be transmitted to third parties if required by law or to the extent that third parties process this data on our behalf. The IP address transmitted by your browser will in no case be combined with other data from Google. The IP addresses are anonymized so that assignment is not possible (IP masking). Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there.

On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activities, and to provide us with further services related to website use and internet use.

You can prevent the installation of cookies through a corresponding setting in your browser software; however, we point out that in this case, not all functions of this website may be fully available. You can also prevent the collection of data generated by the cookie and related to your use of the website (incl. your IP address) as well as the processing of this data by Google by downloading and installing a browser add-on to disable Google Analytics: https://tools.google.com/dlpage/gaoptout?hl=de.

Further information on data protection in connection with Google Analytics can be found in the Google Analytics Help: https://support.google.com/analytics/answer/6004245?hl=de.

6.0 Google AdSense
We use the Google AdSense service on our website. This is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: "Google"), for the inclusion of advertisements. Google AdSense uses cookies. In addition, Google AdSense uses web beacons, invisible graphics that enable Google to analyze clicks on this website, traffic on this website, and similar information.

The legal basis for this data processing is your consent pursuant to Art. 6(1) lit. a GDPR. When visiting our website, you have the option to give your consent to data processing by cookies for evaluation and marketing purposes. This consent is voluntary and can be revoked by you at any time. If you do not give consent, no cookies will be set for marketing or analysis purposes.

The information obtained via cookies and web beacons, your IP address, and the delivery of ad formats are transmitted to a Google server, possibly also located in the USA, and stored there. Google may pass this collected information on to third parties if required by law or if Google provides the data to a data processor commissioned by Google. 

Due to Google's certification under the EU-US Data Privacy Framework, the European Commission has determined that Google provides an adequate level of data protection.

Through corresponding settings in your internet browser, you can prevent the mentioned cookies from being stored on your PC. However, this may mean that the content of this website can no longer be used to the same extent. 

Further information on data protection in connection with Google AdSense can be found in the Google Help: https://support.google.com/adsense/answer/10924669?hl=de.

7.0 Data Processing for Contract and Order Fulfillment as well as Opening a Customer Account

If you provide us with your data when opening a customer account or ordering goods from our online shop, this data will be used and processed for contract fulfillment pursuant to Art. 6(1) lit. b GDPR. The categories of processed data are derived from the respective input forms.

You can delete your customer account at any time; please contact the data controller mentioned in Section 1 for this purpose.

This data is passed on to service providers in the course of processing your order, in particular for delivery and payment purposes.

Your data will be deleted once the contract has been fully fulfilled or terminated and no statutory retention obligations (in particular tax and commercial retention obligations) or other legitimate reasons for further storage exist.

Use of the Shopify Shop System

For the operation of our online shop, we use the Shopify e-commerce platform. The provider for merchants within Europe is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Shopify provides the technical infrastructure for our online shop and processes personal data in this context. This includes technical access data such as IP addresses and browser information, as well as data collected during customer registration and order fulfillment.

Processing takes place on the basis of Art. 6(1) lit. b GDPR, insofar as it is required to fulfill a contract or to take pre-contractual measures. Otherwise, processing takes place on the basis of Art. 6(1) lit. f GDPR. Our legitimate interest lies in the secure and reliable provision of our online shop.

In the course of data processing by Shopify, personal data may be transmitted to third countries outside the European Economic Area, in particular to Canada and the USA. Shopify uses suitable data protection guarantees for this purpose, in particular binding internal data protection rules and, if applicable, standard contractual clauses.

Further information on data processing by Shopify can be found at:

https://www.shopify.com/legal/privacy

8.0    Data Processing by PayPal
When paying via PayPal, by credit card via PayPal, by direct debit via PayPal, or – if offered – by "purchase on account" or "installment payment" via PayPal, we pass on your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") for payment processing. The disclosure takes place on the basis of Art. 6(1) lit. b GDPR for contract fulfillment and only to the extent necessary for payment processing.

PayPal reserves the right to perform a credit check for payment methods such as credit card via PayPal, direct debit via PayPal, or – if offered – "purchase on account" or "installment payment" via PayPal. For this purpose, your payment data may be passed on to credit reporting agencies pursuant to Art. 6(1) lit. f GDPR on the basis of PayPal's legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check regarding the statistical probability of payment default to decide whether to provide the respective payment method. The credit check may contain probability values (so-called score values). As far as score values are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical method. Address data, among other things, but not exclusively, is included in the calculation of the score values. For further data protection information, including regarding the credit reporting agencies used, please refer to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual fulfillment of payment processing.

09. Newsletter 
If you subscribe to our newsletter, we process your email address for the purpose of sending the newsletter. The legal basis for this data processing is your consent pursuant to Art. 6(1) lit. a GDPR. You can revoke your consent at any time with effect for the future.

For signing up for our newsletter, we use the so-called double opt-in procedure. This means that after entering your email address in the corresponding field, you will receive an email asking you to confirm your registration. This confirmation is necessary to ensure that you have entered the correct email address and that it is not misused by unauthorized third parties.

The newsletter registration is logged so that your registration can be documented. For this purpose, we store the time of your registration as well as the IP address on the basis of our legitimate interests pursuant to Art. 6(1) lit. f GDPR.

In addition, we send newsletters to our existing customers for the purpose of advertising similar goods pursuant to § 7(3) UWG, provided that the statutory requirements for this are met. In this case, the legal basis for this data processing is our legitimate interest in advertising and marketing pursuant to Art. 6(1) lit. f GDPR.

Use of Klaviyo

To send our newsletter, carry out automated email marketing campaigns, and analyze the success of our newsletter campaigns, we use the Klaviyo service. This service is provided by Klaviyo, Inc., 125 Summer Street, Boston, MA 02111, USA.

Through Klaviyo, in addition to regular newsletters, we can also send automated emails, for example, reminders about abandoned orders, product recommendations, or information about products that have become available again.

For this purpose, personal data such as name, email address, order history, product interests, and information about the use of our online shop may be processed.

Insofar as this data is used for personalized advertising and automated marketing emails, the processing takes place on the basis of your consent pursuant to Art. 6(1) lit. a GDPR or, if the statutory requirements are met, on the basis of Art. 6(1) lit. f GDPR in conjunction with § 7(3) UWG.

Analysis of User Behavior

To improve our newsletters and marketing measures, we can use Klaviyo to analyze whether sent emails are opened and the links contained therein are clicked. Tracking technologies such as counting pixels and individualized links can be used for this purpose.

In addition, with appropriate consent, Klaviyo can collect information about usage behavior on our website. This includes, for example, visited product pages, viewed products, and items added to the shopping cart. This information can be linked with existing customer profiles to enable personalized product recommendations and marketing measures.

The processing of personal data for these analysis and marketing purposes is based on your consent pursuant to Art. 6(1) lit. a GDPR. To the extent that cookies or comparable technologies are used for this purpose, access to information on your device is based on your consent pursuant to § 25(1) TDDDG.

You can revoke your consent at any time with future effect via the relevant privacy settings on our website.

Data transfer to third countries

In the course of using Klaviyo, personal data is transferred to the USA and processed there.

Klaviyo is certified under the EU-US Data Privacy Framework. For data transfers that cannot be supported by this agreement, Klaviyo provides for the use of the European Commission's standard contractual clauses.

Further information on data protection at Klaviyo can be found at:

https://www.klaviyo.com/legal/data-processing-agreement

Unsubscription and revocation

You can unsubscribe from our newsletter at any time. For example, you can use the unsubscribe link in any newsletter.

In addition, you can revoke your consent to the processing of personal data for marketing purposes at any time with future effect or object to the use of your email address for advertising purposes.

10.0.    Contact via the website
Due to legal requirements, our website contains information that enables quick electronic contact with our company (in particular, an email address). If you contact us by email, your voluntarily submitted personal data will be automatically saved for the purpose of processing or contacting you. This data will not be disclosed.

The data will be deleted when there is no longer a statutory retention period and provided that it is no longer required for the fulfillment or initiation of a contract. The legal basis for the processing of the data submitted in the course of sending an email is Art. 6(1) lit. f GDPR. The legitimate interest within the meaning of the GDPR is the processing and answering of your contact request.

The data will be deleted as soon as it has been used to achieve the purpose. This is the case when the respective conversation with the user has ended. The conversation is considered ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. You have the option to object to the storage of your personal data at any time. To do so, please contact the controller mentioned in Section 1. (in writing, by email, or by telephone). The data from the previous communication will then be deleted, and further conversation will no longer be possible.

11.0.    Data subject rights
As a data subject, you have the following rights against the controller. If you wish to exercise one of these rights, please contact the controller using the contact details mentioned in Section 1.

11.1.  Right of access (Art. 15 GDPR): You can request information from the controller as to whether they are processing personal data concerning you. If processing is taking place, you can request information from the controller about this personal data as well as the purposes of processing; the categories of personal data being processed; the recipients or categories of recipients to whom your personal data has been or will be disclosed; the planned duration for which your personal data will be stored, or, if this is not possible, the criteria used to determine the storage period; whether you have a right to rectification or erasure of your personal data or to restriction of processing by the controller, or a right to object to such processing; whether you have a right to lodge a complaint with a supervisory authority; if the personal data was not collected from you, all available information about the source of the data; whether automated decision-making, including profiling, is taking place pursuant to Art. 22(1) and (4) GDPR and—at least in such cases—meaningful information about the logic involved as well as the significance and intended consequences of such processing for the data subject; the transfer of personal data to a third country or an international organization, as well as the appropriate safeguards for such transfers pursuant to Art. 46 GDPR; request information.

11.2.  Right to rectification (Art. 16 GDPR): You have the right to the immediate rectification and/or completion of your personal data by the controller if the personal data being processed concerning you is inaccurate or incomplete.

11.3.   Right to erasure (Art. 17 GDPR): You can request the erasure of your data stored by us if the data is no longer necessary for the purposes for which it was collected or processed; you have withdrawn your consent and there is no other legal basis for processing; you have objected pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for processing, or you have objected pursuant to Art. 21(2) GDPR; the personal data has been unlawfully processed; erasure is necessary to comply with a legal obligation; or the personal data was collected in relation to the information society services offered pursuant to Art. 8(1) GDPR. This right to erasure does not apply to the extent that processing is necessary for the exercise of the right to freedom of expression and information; compliance with a legal obligation; reasons of public interest; or the establishment, exercise, or defense of legal claims.

11.4.   Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing of your personal data if you contest the accuracy of the personal data while the controller verifies its accuracy; the processing is unlawful and you request restriction instead of erasure; the controller no longer requires the data, but you require it for the establishment, exercise, or defense of legal claims; or you have objected to processing pursuant to Art. 21(1) GDPR and it has not yet been established whether the controller's legitimate grounds override your grounds. If the processing of your personal data has been restricted, this data—apart from its storage—may only be processed with your consent, for the establishment, exercise, or defense of legal claims, for the protection of the rights of another natural or legal person, or for important reasons of public interest of the Union or a Member State. If the restriction of processing has been imposed under the above conditions, you will be informed by the controller before the restriction is lifted.

11.5.   Right to data portability (Art. 20 GDPR): You have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or to request its transmission to another controller.

11.6.   Right to object: If your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1) lit. f GDPR, you have the right to object to the processing of your personal data if you have grounds for doing so arising from your particular situation. If the objection is against direct marketing, you have a general right to object, which we will implement without the need to state a particular situation.

11.7. Right to withdraw consent: You have the right to withdraw your consent at any time from us, with the consequence that we may no longer continue the data processing based on this consent in the future.

11.8.  Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority. You can contact the supervisory authority in your place of residence or workplace, or the supervisory authority responsible for us.

12.0 Data security
To protect your data as best as possible, we use the SSL (Secure Socket Layer) procedure on our website in combination with the highest encryption level supported by your browser. Whether an individual page of our website is transmitted in encrypted form can be identified by the closed key or padlock symbol in your browser's status bar. In addition, we use appropriate technical and organizational security measures to protect your data against manipulation, loss, destruction, or unauthorized access by third parties.

13.0    Timeliness and changes to this privacy policy
This privacy policy is current as of March 2024. Due to the continued development of our website and offerings or due to changes in legal requirements, an amendment to this policy may become necessary.