bananass

Privacy Policy

1. Access Data and Hosting

You can visit our websites without providing any personal information. With each visit to a website, the web server automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, date and time of retrieval, the amount of data transferred, and the requesting provider (access data) and documents the retrieval. This access data is evaluated exclusively for the purpose of ensuring the trouble-free operation of the site and improving our offer. This serves to protect our legitimate interests in a correct presentation of our offer, which are overriding in the context of a balancing of interests, in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. All access data is processed only for as long as is necessary to achieve the aforementioned processing purposes.

Hosting

The services for hosting and displaying the website are partly provided by our service providers as part of processing on our behalf. Unless otherwise explained in this privacy policy, all access data and all data collected in forms provided on this website are processed on their servers. For questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

Our service providers are located and/or use servers in the following countries, for which the European Commission has determined an adequate level of data protection by decision: United Kingdom, Canada, USA.

A decision by the European Commission on an adequate level of data protection for the USA exists as a basis for a third country transfer, as far as the respective service provider is certified. Until certification by our service providers, the data transfer continues to be based on this: Standard data protection clauses of the European Commission

Our service providers are located and/or use servers in these countries: Australia.
There is no adequacy decision by the European Commission for these countries. Our cooperation with you is based on these guarantees: Standard data protection clauses of the European Commission.

2. Data Processing for Contract Fulfillment and Contact

2.1 Data Processing for Contract Fulfillment

For the purpose of contract fulfillment (including inquiries and processing of any existing warranty and performance disruption claims as well as any legal update obligations) in accordance with Art. 6 Para. 1 S. 1 lit. b GDPR, we collect personal data when you voluntarily provide it to us as part of your order. Mandatory fields are marked as such, because in these cases we absolutely need the data for contract fulfillment and cannot ship the order without their provision. Which data is collected can be seen from the respective input forms.

Further information on the processing of your data, in particular on the transfer to our service providers for the purpose of order, payment and shipping processing, can be found in the following sections of this privacy policy. After complete processing of the contract, your data will be restricted for further processing and deleted after the expiry of tax and commercial retention periods in accordance with Art. 6 Para. 1 S. 1 lit. c GDPR, unless you have expressly consented to further use of your data in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR or we reserve the right to further data use that is legally permitted and about which we inform you in this statement.

2.2 Customer Account

If you have given your consent to this in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR by deciding to open a customer account, we will use your data for the purpose of opening the customer account and for storing your data for further future orders on our website. Your customer account can be deleted at any time, either by sending a message to the contact option described in this privacy policy or by using a dedicated function in the customer account. After your customer account has been deleted, your data will be deleted unless you have expressly consented to further use of your data in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to further data use that is legally permitted and about which we inform you in this statement.

Contact

As part of customer communication, we collect personal data to process your inquiries in accordance with Art. 6 Para. 1 S. 1 lit. b GDPR, if you voluntarily provide this to us when contacting us (e.g., via contact form, live chat tool, or email). Mandatory fields are marked as such, as in these cases we absolutely need the data to process your contact request. Which data is collected can be seen from the respective input forms. After your inquiry has been fully processed, your data will be deleted, unless you have expressly consented to further use of your data in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR or we reserve the right to further data use that is legally permitted and about which we inform you in this statement.

3. Data Processing for Shipping Purposes

For the fulfillment of the contract in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR, we pass on your data to the shipping service provider commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods. For questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this privacy policy.

Data Transfer to Shipping Service Providers for Shipping Notification Purposes

If you have given us your explicit consent for this during or after your order, we will, based on this, forward your e-mail address to the selected shipping service provider in accordance with Art. 6 Para. 1 S. 1 lit. a GDPR, so that they can contact you for the purpose of delivery announcement or coordination before delivery.
Consent can be revoked at any time by sending a message to the contact option described in this data protection declaration. After revocation, we will delete the data you provided for this purpose, unless you have expressly consented to further use of your data or we reserve the right to further data use that is legally permitted and about which we inform you in this declaration. For questions about our service providers and the basis of our cooperation with them, please contact the contact option described in this data protection declaration.

4. Data Processing for Payment Processing

When processing payments in our online shop, we work with the following partners: technical service providers, credit institutions, payment service providers.

4.1 Data Processing for Transaction Processing

Depending on the selected payment method, we transfer the data necessary for processing the payment transaction to our technical service providers or to the commissioned credit institutions or to the selected payment service provider, insofar as this is necessary for processing the payment. This serves the fulfillment of the contract in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR. In some cases, the payment service providers collect the data required for payment processing themselves, e.g. on their own website or via technical integration in the ordering process. The data protection declaration of the respective payment service provider applies in this regard.

Depending on the selected payment method, data transfers to third countries outside the EU/EEA may occur, for which the European Commission has determined an adequate level of data protection by decision. Insofar as a data transfer to third countries outside the EU/EEA takes place for which the European Commission has not issued a decision on an adequate level of data protection, the cooperation is based on standard data protection clauses of the European Commission.

If you have any questions about our payment processing partners or the basis of our cooperation with them, please contact the contact option mentioned in this privacy policy.

4.2 Data Processing for Fraud Prevention and Optimization of Our Payment Processes

We may pass on further data to the aforementioned service providers, which they use together with the data necessary for payment processing for the purpose of fraud prevention and optimization of our payment processes (e.g., invoicing, processing of disputed payments, accounting support). This serves to protect our legitimate interests in protecting ourselves against fraud and in efficient payment management, which are overriding in the context of a balancing of interests, in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR.

5. Cookies and Other Technologies

5.1 General Information

To make visiting our website attractive and to enable the use of certain functions, we use technologies, including so-called cookies, on various pages. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e., after closing your browser (so-called session cookies). Other cookies remain on your device and enable us to recognize your browser on your next visit (persistent cookies). You can find the duration of storage in the overview in your web browser's cookie settings.

Protection of privacy on end devices

When using our online offering, we use strictly necessary technologies to provide the expressly requested telemedia service. The storage of information in your terminal device or access to information already stored in your terminal device does not require consent in this respect.

For non-strictly necessary functions, the storage of information on your device or access to information already stored on your device requires your consent. We point out that if consent is not given, parts of the website may not be fully usable. Any consent you have given will remain valid until you adjust or reset the respective settings on your device.

Possible subsequent data processing through cookies and other technologies

We use technologies that are absolutely necessary for the use of certain functions of our website. Through these technologies, IP address, time of visit, device and browser information, and information about your use of our website are collected and processed. This serves our overriding legitimate interests in an optimized presentation of our offer, in the context of a balancing of interests, in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR.

In addition, we use technologies to fulfill the legal obligations to which we are subject (e.g., to be able to prove consent to the processing of your personal data) as well as for web analysis and online marketing. Further information on this, including the respective legal basis for data processing, can be found in the following sections of this privacy policy.

Cookie Settings

You can find the cookie settings for your browser at the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

If you have consented to the use of technologies in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, you can revoke your consent at any time by sending a message to the contact option described in the privacy policy. Alternatively, you can also access the following link: http://www.bananass.de/policies/privacy-policy. If cookies are not accepted, the functionality of our website may be limited.

5.2 Consent Manager Platform (CMP)

On our website, we use a consent management service ("Consent Manager Platform (CMP)") to inform you about the cookies and other technologies we use on our website, and to obtain, manage, and document your potentially required consent to the processing of your personal data by these technologies. This is necessary in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR to fulfill our legal obligation under Art. 7 para. 1 GDPR to be able to prove your consent to the processing of your personal data, which we are subject to. The Consent Manager Platform (CMP) used is an offer from Shopify International Ltd., Shopify International Ltd., Victoria Buildings, 2nd Floor, Haddington Road, Ireland, which processes your data on our behalf.

After submitting your cookie declaration on our website, the web server stores the following data: IP address, device information, browser information, language setting, accessed website or its URL, date and time of your consent declaration, and information about your consent behavior.

In addition, the following technologies are used, which contain information about your consent behavior: Cookies

Your data will be deleted after one year, unless you have expressly consented to further use of your data in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to further data use that is legally permitted and about which we inform you in this statement.

5.3 Information on Third-Country Transfer (Data Transfer to Third Countries)

We use technologies from service providers on our website, whose registered offices and/or server locations may be in third countries, outside the EU or the EEA. If there is no adequacy decision from the EU Commission for this country, an adequate level of data protection must be ensured through other suitable guarantees.

Suitable guarantees in the form of standard contractual clauses agreed upon by the EU Commission or binding corporate rules are generally possible but require prior review by the contracting parties to determine whether an adequate level of protection can be guaranteed. According to the case law of the ECJ, it may be necessary to take additional protective measures.
 
We have generally agreed to the standard data protection clauses issued by the EU Commission with the technology providers we use who process personal data in a third country. Where possible, we also agree to additional guarantees that are intended to ensure adequate data protection in third countries without an adequacy decision. 

Nevertheless, it may happen that, despite all contractual and technical measures, the level of data protection in the third country does not correspond to that of the EU. In these cases, if necessary, we ask for your consent within the framework of the cookie consent, in accordance with Art. 49 para. 1 lit. a GDPR, for the transfer of your personal data to a third country.
In particular, there is a risk that local authorities in the third country may, from a European data protection perspective, not have sufficiently restricted access rights to your personal data, that we as the data exporter or you as the data subject may not be aware of this, and/or that you may not have sufficient legal remedies available to prevent this and/or to take action against such access. 

In particular, the following countries are currently considered third countries without an adequacy decision by the EU Commission (example list): 

• China 
• Russia 
• Taiwan 

Information on which third countries we transfer data to can be found in the data protection notices for the respective tool used and/or the consent management service/Consent Manager Platform (CMP) we use. 

6. Use of cookies and other technologies

We use the following cookies and other third-party technologies on our website. Unless otherwise stated for individual technologies, this is done on the basis of your consent according to Art. 6 para. 1 sentence 1 lit. a GDPR. After the purpose ceases and the use of the respective technology by us ends, the data collected in this context will be deleted. You can withdraw your consent at any time with effect for the future. Further information on your withdrawal options can be found in the "Cookies and other technologies" section. Further information, including the basis of our cooperation with the individual providers, can be found with the individual technologies. If you have any questions about the providers and the basis of our cooperation with them, please contact us using the contact details described in this privacy policy.

Use of Google services

We use the technologies of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google") shown below. The information automatically collected by Google technologies about your use of our website is generally transferred to a Google LLC server, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA, and stored there. Unless otherwise specified for individual technologies, data processing is carried out on the basis of a joint controller agreement for the respective technology in accordance with Art. 26 GDPR. Further information about data processing by Google can be found in Google's data protection notices.

Our service providers are based and/or use servers in countries outside the EU and the EEA for which the European Commission has issued an adequacy decision.

Our service providers are based and/or use servers in countries outside the EU and the EEA. For these countries, there is no adequacy decision from the European Commission. Our cooperation with them is based on standard data protection clauses from the European Commission. 

YouTube Video Plugin

To embed third-party content, data (IP address, time of visit, device and browser information) is collected via the YouTube Video Plugin in the extended privacy mode we use, transmitted to Google, and then processed by Google, only when you play a video.

7. Contact options and your rights

7.1 Your rights

As a data subject, you have the following rights:

• in accordance with Art. 15 GDPR, the right to request information about your personal data processed by us to the extent specified therein;
• in accordance with Art. 16 GDPR, the right to demand the immediate rectification of inaccurate or completion of your personal data stored by us;
• in accordance with Art. 17 GDPR, the right to demand the erasure of your personal data stored by us, unless further processing is necessary for
  • the exercise of the right to freedom of expression and information;
  • compliance with a legal obligation;
  • reasons of public interest or
  • the establishment, exercise, or defense of legal claims;
• in accordance with Art. 18 GDPR, the right to demand the restriction of the processing of your personal data, if
  • the accuracy of the data is contested by you;
  • the processing is unlawful, but you oppose its erasure;
  • we no longer need the data, but you require it for the establishment, exercise, or defense of legal claims or
  • you have objected to the processing in accordance with Art. 21 GDPR;
• in accordance with Art. 20 GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format or to request transmission to another controller;
• in accordance with Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company's registered office.

Right to object Insofar as we process personal data as explained above to protect our legitimate interests which override in a balancing of interests, you can object to this processing with effect for the future. If processing is carried out for direct marketing purposes, you can exercise this right at any time as described above. If processing is carried out for other purposes, you only have a right to object if there are reasons arising from your particular situation. After exercising your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the establishment, exercise, or defense of legal claims. This does not apply if processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for this purpose.

7.2 Contact options

For questions regarding the collection, processing, or use of your personal data, for information, correction, restriction or erasure of data, as well as revocation of granted consents or objection to a specific data use, please contact us directly using the contact details in our imprint.