Privacy Policy
This Privacy Policy applies to the processing of data by mitte.co a brand from Sodabaer EU e.K. ("Mitte", "Controller", "we", or "us") when you visit our website https://mitte.co.
When you visit our website, create an account there, and order Mitte products, this involves the processing of your personal data. Personal data is any information relating to an identified or identifiable natural person, e.g. name, address, email address.
When processing your personal data, we comply with the applicable data protection laws, in particular the European General Data Protection Regulation ("GDPR") and the Federal Data Protection Act ("BDSG").
With this Privacy Policy, we would like to inform you which personal data we process, for which purposes, and on which legal basis.
We take the protection of your personal data very seriously. We only process your data for the purposes clearly specified in this Privacy Policy. Should we process data for other purposes and/or disclose your data to third parties for other purposes, we will only do so with your explicit consent.
1 Name and contact details of the party responsible for data protection
Responsible for the processing of your data is Sodabaer EU e.K., Gruenstr. 12, 79232 March, Germany, email: support@mitte.co.
2 Name and contact details of our Data Protection Officer
You can reach our Data Protection Officer at the following contact details: Sodabaer EU e.K., Gruenstr. 12, 79232 March, Germany, email: support@mitte.co.
3 Collection and storage of personal data, as well as the nature and purpose of its processing, the relevant legal basis, and storage period
3.1 Visiting our website
When you use our website purely for information purposes, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called server log files), whereby logging only takes place to the extent technically necessary. The following information is collected:
• IP address of the requesting internet-enabled device
• Date and time of access
• Name and URL of the file accessed
• Website from which access occurs (referrer URL)
• The browser you use, and
• if applicable, the operating system of your internet-enabled device as well as the name of the access provider.
The legal basis for collecting this data is Art. 6(1)(f) GDPR. Our legitimate interest in collecting this data follows from the following purposes:
• Ensuring optimal use of our website,
• Ensuring a smooth connection setup,
• Evaluating system security and stability.
3.2 Setting up a Mitte account and ordering products
If you would like to order a product from us via our website, you can do so either (i) as a guest or (ii) as a registered customer with a Mitte account. Setting up a Mitte account allows you to order products from us without having to re-enter your personal data each time. In addition, you can view the status of an order at any time.
In both cases, we collect the following data from you:
- Your title
- Your name
- Your address
- Your email address
- Your phone number
- Your payment method and payment details
We also ask you for a username and password, which you can use to log into your account at any time in the future.
We process the aforementioned data in order to fulfil the usage agreement for your Mitte account as well as the purchase agreement for the products with you. The legal basis for the data processing is therefore Art. 6(1)(b) GDPR.
3.3 Data processing for personal contact by email
If you give us your explicit consent, we will send you information about our services and offers by email. For this purpose, we process your name and email address. When signing up for our newsletter, we use the so-called double opt-in procedure. This means that after you sign up with your email address, we send an email to the address provided asking you to confirm that you do indeed wish to receive the newsletter.
The legal basis for sending our information is Art. 6(1)(a) GDPR.
3.4 Storage period
We delete the data collected and stored in connection with the creation of your Mitte account at the latest when you delete your Mitte account. However, early deletion of your personal data is not possible if and to the extent that your data is still required to process an order.
Independently of this, we store the data processed when you purchase our products until the expiry of the statutory or, where applicable, contractual warranty rights. After this period expires, we retain the information required under commercial and tax law regarding the contractual relationship for the legally prescribed periods. During this period, the data is processed again solely in the event of an audit by the tax authorities.
3.5 Website optimization
(a) Cookies
Our website uses cookies, which are stored either temporarily in memory ("session cookie") or permanently on your hard drive ("permanent cookie"). Cookies are small text files that are automatically created by your browser and stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. These files enable us to make the website more efficient. Most of the cookies we use are session cookies, which are only stored in memory and not on your hard drive, and whose validity expires when you close your internet browser and which are therefore automatically deleted. Session cookies enable us to recognize that you have already visited individual pages of our website or that you have already logged into your account. Other cookies remain on the device you use, so that you are recognized on your next visit.
Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer, or so that a notice always appears before a new cookie is set. Please note, however, that in this case you may not be able to use all the functions of this website to their full extent.
Enabling cookies is necessary for the smooth functioning of the website. We therefore have a legitimate interest in their use. The legal basis for the associated data processing is therefore Art. 6(1)(f) GDPR.
Should we use additional cookies (e.g. cookies for analyzing your browsing behavior), we will inform you of this separately in this Privacy Policy.
(b) Google Analytics and Google Tag Manager
To analyze your use of our website, we use "Google Analytics" together with "Google Tag Manager" and "Google Ads", services of companies within the Google LLC group, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Google Analytics uses cookies. The information generated by the cookies about your use of our website is generally transmitted to and stored on a Google server in the USA. The storage of Google Analytics cookies and the use of this analysis tool are carried out on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR. Your consent can be withdrawn at any time.
We have activated the IP anonymization function. As a result, your IP address is shortened by Google within member states of the European Union or in other signatory states of the Agreement on the European Economic Area prior to transmission to the USA. On our behalf, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide us with other services related to website and internet usage.
You have the option of preventing the storage of cookies by changing the settings of your browser software accordingly. Furthermore, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en.
Further information on the processing of user data by Google Analytics can be found in Google's privacy policy at: https://support.google.com/analytics/answer/6004245?hl=en.
(c) Microsoft Clarity
Furthermore, we use the "Clarity" service to optimize our service and the user experience. This service is provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Clarity is a technology service that helps us better understand our users' experiences (e.g. how much time you spend on which pages, which links you click on, what you like and what you don't). Clarity uses cookies and other technologies to collect data about the behavior of our users and their devices (in particular the device's IP address, the device's screen size, device type, browser information, geographic location, preferred language in which our website is displayed). Clarity stores this information in a pseudonymized user profile. Neither Clarity nor we will or can use this information to identify individual users or match it with other data about an individual user.
Data processing via Clarity is carried out on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR.
If you would like to read more about Microsoft Clarity and how Microsoft processes your data, please visit: https://privacy.microsoft.com/en-us/privacystatement.
4 Recipients of personal data
As part of our activities, your personal data may be shared with or disclosed to external service providers (IT providers, transport companies, payment service providers). In some cases, these third parties act as independent controllers under data protection law; in other cases, they act in the capacity of a processor on our behalf and in accordance with our instructions pursuant to Art. 28 GDPR.
4.1 Payment service providers
(a) Stripe
If you choose a payment method offered via the payment service provider "Stripe", payment processing is carried out via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we disclose the information you provided as part of the ordering process together with information about your order (name, address, account number, sort code, possibly credit card number, invoice amount, currency, and transaction number) pursuant to Art. 6(1)(b) GDPR. Your data is disclosed exclusively for the purpose of payment processing with Stripe Payments Europe Ltd. and only to the extent necessary for this purpose. Further information on Stripe's data protection practices can be found at the following internet address: https://stripe.com/de/privacy#translation.
(b) Apple Pay
If you choose the "Apple Pay" payment method provided by Apple Distribution International ("Apple"), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the "Apple Pay" function of your device running iOS, watchOS, or macOS by charging a payment card stored with Apple Pay. Apple Pay uses security features integrated into your device's hardware and software to protect your transactions. Authorizing a payment therefore requires entering a code you have previously set, as well as verification via your device's "Face ID" or "Touch ID" function.
For the purpose of payment processing, the information you provided as part of the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay in order to carry out the payment. This encryption ensures that only the website through which the purchase was made can access the payment data. Once payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm that the payment was successful.
To the extent that personal data is processed in the course of the transmissions described, this processing is carried out exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR.
Further information on data protection with regard to Apple Pay can be found at the following internet address: support.apple.com/de-de/HT203027
(c) Klarna
We also offer you the option of paying by "invoice" via the "Klarna" service provided by Klarna AB, Sveavägen 46, 111 34 Stockholm, Sweden. If you decide to pay by invoice, as part of your agreement with Klarna you transmit to Klarna the personal data necessary for processing the invoice purchase and for an identity and credit check (first and last name, address, date of birth, gender, email address, IP address, phone number), as well as the data necessary for processing the invoice purchase (number of items, item number, invoice amount, and taxes). This data is collected so that Klarna can carry out an identity and credit check and create an invoice in order to process your purchase using your desired invoice payment method. With regard to the identity and credit check, Klarna may obtain information from credit reporting agencies as applicable.
As part of the decision on the invoice payment option, Klarna uses, in addition to an address check, information on your previous payment behavior as well as probability values regarding this behavior in the future. Klarna's calculation of these score values is carried out on the basis of a scientifically recognized mathematical-statistical procedure. For this purpose, Klarna will also use, among other things, your address data.
The transmission of your data to Klarna is carried out on the basis of Art. 6(1)(b) GDPR for the performance of the contract with you.
Further information on data processing by Klarna can be found in Klarna's privacy policy at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy
4.2 Customer support
We use the ticketing system "Zendesk", a customer service platform provided by Zendesk Inc., 989 Market Street 300, San Francisco, CA 94102, to process customer inquiries. For this purpose, necessary data such as name, first name, address, phone number, email address are collected via our website in order to be able to respond to your inquiry. We have concluded a data processing agreement with Zendesk pursuant to Art. 28 GDPR.
Further information on data processing by Zendesk can be found in Zendesk's privacy policy at http://www.zendesk.com/company/privacy. If you have any questions, you can also contact Zendesk's Data Protection Officer directly: privacy@zendesk.com
4.3 Customer feedback
For the purposes of customer and product reviews by our customers and for our own quality management, we use the personal data you provided as part of your purchase, such as your email address, to request a review of your order via the review system we use.
By agreeing to this Privacy Policy at the end of the ordering process, you consent to us sending you an email after your order has been processed, to the email address you have provided, asking you to submit a review. You may withdraw this consent at any time by informal notice by email to support@mitte.co.
We work with zenloop GmbH, Habersaathstraße 58, 10115 Berlin. zenloop is a business- to-business software-as-a-service platform that enables us to collect feedback from our customers via various channels and have it analyzed. This allows us to tailor our offering to the needs of our customers and improve it. In addition, zenloop collects your survey responses.
The legal basis for data processing by zenloop is Art. 6(1)(f) GDPR.
We have concluded a data processing agreement with zenloop pursuant to Art. 28(3) GDPR and have satisfied ourselves that zenloop has implemented appropriate technical and organizational measures to ensure that processing is carried out in accordance with the requirements of the GDPR and that your rights are protected.
Further information on this can be found in the privacy policy at www.zenloop.com.
After submitting your review, you may be redirected to a review portal where you can post your review publicly.
5 Transfer of data to third countries
As part of our activities, your personal data may be disclosed or transferred to other companies. These companies may also be located outside the European Economic Area (EEA), i.e. in third countries. This applies to the use of the following services:
(a) Google: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
(b) Microsoft: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.
(c) Zendesk: Zendesk Inc., 989 Market Street 300, San Francisco, CA 94102.
(d) Zenloop: zenloop GmbH, Habersaathstraße 58, 10115 Berlin, Germany.
(e) Chargebee: Chargebee Inc, 909 Rose Avenue, Suite 610, North Bethesda, MD 20852, USA.
When transferring personal data to a third country, we will regularly ensure, through appropriate safeguards, that data is only transferred to a third country on the basis of a level of protection that complies with the GDPR.
To the extent that data is transferred to a third country, in particular the USA, in connection with the use of the services listed in this Section 5, for which no adequacy decision by the Commission exists, this is done on the basis of standard contractual clauses pursuant to Art. 46(2)(c) GDPR in conjunction with appropriate technical and organizational measures to protect your data.
A copy of the standard contractual clauses, or further information on the standard contractual clauses used, can be found on the respective websites of the service providers we use:
(a) Google: https://privacy.google.com/businesses/processorterms/mccs/
(b) Microsoft: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
(c) Zendesk: http://www.zendesk.com/company/privacy
(d) Zenloop: https://www.zenloop.com/de/legal/privacy
(e) Chargebee: https://www.chargebee.com/privacy/
6 Data security
All data you personally transmit is transmitted using the secure and proven SSL (Secure Socket Layer) standard, which is also used, for example, in online banking. We also employ appropriate technical and organizational security measures to protect stored personal data against manipulation, partial or complete loss, and unauthorized access by third parties. Our security measures are continuously improved in line with technological developments. In particular, we ensure that sensitive personal data is stored exclusively on servers hosted in the EU that are certified in accordance with DIN ISO/IEC 27001 (as amended from time to time).
7 Your rights
With regard to our processing of your personal data, you have the following rights free of charge:
7.1 Right of access pursuant to Art. 15 GDPR
You have the right to obtain from us confirmation as to whether and which data we process about you. This includes, among other things, information on how long and for what purpose we process the data, from which source it originates, and to which recipients or categories of recipients we disclose it. In addition, you may be provided with a copy of this data.
7.2 Right to rectification pursuant to Art. 16 GDPR
You have the right to have us promptly correct any inaccurate or no longer accurate data concerning you. In addition, you can request that your incomplete personal data be completed. Where legally required, we will also inform third parties of this rectification, provided we have disclosed your personal data to them.
7.3 Right to erasure pursuant to Art. 17 GDPR
You have the right to demand that we promptly delete your personal data if one of the following cases applies:
• Your data is no longer necessary for the purposes for which it was collected or otherwise processed, or the purpose has been achieved;
• You withdraw your consent and there is no other legal basis for the processing;
• You object to the processing and there are no overriding legitimate grounds for the processing; a mere objection on your part is sufficient in the case of the use of personal data for direct marketing purposes;
• Your personal data has been processed unlawfully;
• The deletion of your personal data is necessary to comply with a legal obligation under the law of the European Union or the law of a member state to which we are subject.
Your right to erasure may be restricted on the basis of statutory provisions. This includes in particular the restrictions set out in Art. 17 GDPR and Section 35 BDSG.
7.4 Right to restriction of processing pursuant to Art. 18 GDPR
You have the right to request that we restrict the processing of your personal data if one of the following reasons applies:
• You dispute the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data;
• The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
• We no longer need your personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims, or
• You have objected to the processing, pending verification as to whether our legitimate grounds override yours.
If you have obtained a restriction of processing based on the above list, we will notify you before the restriction is lifted.
7.5 Right to data portability pursuant to Art. 20 GDPR
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit this data to others. The exercise of this right does not affect your right to erasure.
7.6 Right to object pursuant to Art. 21 GDPR
Pursuant to Art. 21 GDPR, you have in particular the right, for reasons arising from your particular situation, to object at any time to the processing of your data where we base such processing on legitimate interests pursuant to Art. 6(1)(f) GDPR. If you object, we will no longer process your personal data, except in two cases:
• we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or
• the processing serves to assert, exercise, or defend legal claims.
In particular, insofar as we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your data for such advertising purposes. If you object to the processing of your data for direct marketing purposes, we will no longer use your personal data for this purpose.
7.7 Right to withdraw consent pursuant to Art. 7 GDPR
You may withdraw any consent given to us at any time with effect for the future. This withdrawal may be communicated informally to the contact addresses stated above. If you withdraw your consent, this will not affect the lawfulness of the processing carried out up to that point.
7.8 Right to lodge a complaint with a supervisory authority
If you believe that our processing of your data violates applicable data protection law, you have the right to lodge a complaint with one of the competent supervisory authorities. The supervisory authority responsible for us is:
Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstr. 219
10969 Berlin
Phone: 030 13889-0
Fax: 030 2155050
Email: mailbox@datenschutz-berlin.de
