Privacy policy

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1

We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Martin Kost, KOST KAMM, Rothenburger Straße 7, 91635 Windelsbach, Germany, Tel.: +49 (0) 9867 / 94939, Fax: +49 (0) 9867 / 9513, Email: info@kostkamm.de. The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others decides on the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1

When using our website for informational purposes only, i.e., if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called "server log files"). When you call up our website, we collect the following data, which is technically necessary for us to display the website to you:

  • Our visited website

  • Date and time at the moment of access

  • Amount of data sent in bytes

  • Source/reference from which you came to the page

  • Browser used

  • Operating system used

  • IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

2.2

For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string "https://" and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

3.1

For hosting our website and displaying the page content, we use a provider that performs its services itself or through selected subcontractors exclusively on servers within the European Union.

All data collected on our website is processed on these servers, unless different data recipients are named below for specific data processing operations.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

3.2 Cloudflare

We use a Content Delivery Network provided by: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content, or scripts faster via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with European data protection standards on the basis of an adequacy decision by the European Commission.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e., small text files that are stored on your end device. Some of these cookies are automatically deleted after closing the browser (so-called "session cookies"), while others remain on your end device longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can check the storage duration in the overview of cookie settings in your web browser.

If personal data is also processed by individual cookies used by us, processing takes place in accordance with Art. 6 (1) (b) GDPR either for the execution of the contract, in accordance with Art. 6 (1) (a) GDPR in the event of consent granted, or in accordance with Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.

You can set your browser so that you are informed about the setting of cookies and decide individually on their acceptance, or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be restricted.

5) Contacting Us

5.1 Shopify Inbox

This website uses the live chat system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

The processing of personal data transmitted via chat is carried out either in accordance with Art. 6 (1) (b) GDPR, because it is necessary for contract initiation or performance, or in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in effective customer support.

Your data transmitted in this way will be deleted subject to statutory retention periods once the matter in question has been finally clarified.

In addition, for the purpose of creating pseudonymized usage profiles using cookies, further information may be collected and evaluated, which, however, does not serve your personal identification and is not combined with other data sets. If this information contains a personal reference, processing takes place in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the statistical analysis of user behavior for optimization purposes.

The setting of cookies can be prevented by appropriate browser settings. In this case, however, the functionality of our website may be restricted.

You can object to the collection and storage of data for the purpose of creating a pseudonymized usage profile at any time with effect for the future by notifying us.

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

In the case of data transfers to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

5.2 Judge.me

For review reminders, we use the services of the following provider: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom.

Exclusively on the basis of your explicit consent pursuant to Art. 6 (1) (a) GDPR, we transfer your email address and, if applicable, other customer data to the provider so that they can contact you with a review reminder by email.

You can revoke your consent at any time with effect for the future vis-à-vis us or the provider.

We have concluded a data processing agreement with the provider, which ensures the protection of our site visitors' data and prohibits unauthorized disclosure to third parties.

In the case of data transfers to the provider's location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

5.3

When contacting us (e.g., via contact form or email), personal data is processed exclusively for the purpose of handling and answering your request and only to the extent necessary.

The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6 (1) (f) GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided that no statutory retention obligations prevent this.

6) Data Processing When Opening a Customer Account

Pursuant to Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide it to us when opening a customer account. The data required for opening an account can be found in the input mask of the corresponding form on our website.

Deletion of your customer account is possible at any time and can be requested by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be deleted, provided that all contracts concluded through it have been completely processed, no statutory retention periods prevent deletion, and there is no legitimate interest on our part in continued storage.

7) Use of Customer Data for Direct Advertising

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory entry for sending the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter if you have explicitly confirmed your consent to receive it by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) (a) GDPR. In doing so, we store your IP address entered by the Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace possible misuse of your email address at a later date. The data collected by us when subscribing to the newsletter will be used strictly for the specified purpose.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a message to the controller mentioned at the beginning. After unsubscribing, your email address will be deleted from our newsletter distribution list immediately, unless you have explicitly consented to further use of your data or we reserve a broader use of data that is permitted by law and about which we inform you in this declaration.

7.2 Shopify Email

Our email newsletters are sent via this provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we pass on your data provided during newsletter registration to this provider in accordance with Art. 6 (1) (f) GDPR so that they can send the newsletter on our behalf.

Subject to your explicit consent pursuant to Art. 6 (1) (a) GDPR, the provider also performs a statistical evaluation of the success of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure open rates and specific interactions with the newsletter content. Device information (e.g., time of call, IP address, browser type, and operating system) is also collected and evaluated, but not merged with other data sets.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider, which protects the data of our site visitors and prohibits disclosure to third parties.

In the case of data transfers to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

7.3 Email Stock Availability Notifications

For temporarily unavailable items, you can sign up to receive email stock availability notifications. We will send you a one-time email notification regarding the availability of the item you selected. The only mandatory entry for sending this notification is your email address. Providing additional data is voluntary and may be used to address you personally. For sending the email, we use the double opt-in procedure, ensuring that you only receive a notification after explicitly confirming your consent via a verification link.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6 (1) (a) GDPR. We store your IP address registered by your ISP, as well as the date and time of registration, to trace potential misuse at a later date. Data collected for this service is used strictly for its intended purpose.

You can unsubscribe from availability notifications at any time by sending a message to the controller. Upon unsubscribing, your email address will be promptly removed from the relevant mailing list, unless you have consented to further use or legal permissions apply.

7.4 Abandoned Cart Reminders via Email

In the event that you abandon your shopping process before completing an order, you have the option to receive a one-time email reminder regarding the contents of your virtual shopping cart.

The only mandatory information for sending this reminder is your email address. Providing further data is voluntary. We use the double opt-in procedure for this service.

By activating the confirmation link, you grant us consent to process your personal data in accordance with Art. 6 (1) (a) GDPR to send the abandoned cart reminder. We store your IP address and registration timestamp for security and verification purposes.

You can unsubscribe from cart reminders at any time by notifying the controller. Your email address will then be removed immediately from the distribution list.

8) Data Processing for Order Processing

8.1

To the extent necessary for contract performance for delivery and payment purposes, personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR.

If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we process the contact data transmitted by you during the order to inform you personally within the scope of our statutory information obligations pursuant to Art. 6 (1) (c) GDPR.

8.2 Disclosure of Personal Data to Shipping Service Providers

  • DHL

    As a transport service provider, we use: DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany.

    We pass on your email address and/or phone number to the provider prior to delivery pursuant to Art. 6 (1) (a) GDPR for the purpose of coordinating a delivery date or for delivery notification, provided you have given your explicit consent during the ordering process. Otherwise, pursuant to Art. 6 (1) (b) GDPR, we only pass on the recipient's name and delivery address. Consent can be revoked at any time with effect for the future.

8.3 Use of Payment Service Providers

  • Google Pay

    If you choose "Google Pay" by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, payment processing takes place via the Google Pay app on your mobile device (Android 4.4+ with NFC capability) by charging a payment card stored with Google Pay. Data transmitted during the ordering process is passed to Google pursuant to Art. 6 (1) (b) GDPR solely for payment processing. Google acts as an intermediary. Google processes transaction-specific data under Art. 6 (1) (f) GDPR based on legitimate interests in accounting, verification, and service optimization.

    Terms of Service: https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=en

    Privacy Policy: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en

  • PayPal

    Provider: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

    When selecting a PayPal payment method, your payment details and order information are transferred pursuant to Art. 6 (1) (b) GDPR for processing. Where PayPal performs advance payments or credit checks, personal data may be processed pursuant to Art. 6 (1) (f) GDPR to assess credit risk using mathematical-statistical procedures (score values). You can object to this processing at any time.

  • Ratepay

    Provider: Ratepay GmbH, Ritterstr. 12-14, 10969 Berlin, Germany.

    When selecting Ratepay payment methods, payment details are transmitted pursuant to Art. 6 (1) (b) GDPR. For payment methods where Ratepay assumes financial risk (e.g., invoice or installment purchases), a credit check may be performed under Art. 6 (1) (f) GDPR. Identity and credit information may be retrieved from credit agencies listed at: https://www.ratepay.com/legal-payment-creditagencies/. You may object to this processing at any time.

8.4 Electronic Withdrawal Function for Distance Contracts

Consumers who conclude distance contracts on this website with a statutory right of withdrawal can submit their withdrawal via an electronic withdrawal tool.

For this function, we use a service provided by: EU Widerruf Pro, Martini & Radl OG, Garnisongasse 4/11, 1090 Vienna, Austria.

Data collected during the withdrawal process (e.g., name, email address, contract identifiers) is processed based on our legitimate interest in an efficient procedure under Art. 6 (1) (f) GDPR, as well as our legal obligation under Art. 6 (1) (c) GDPR and contract performance under Art. 6 (1) (b) GDPR. Data is routinely deleted following completion of the withdrawal request, unless retention duties apply.

9) Site Functionalities

9.1 Judge.me

Graphic elements from Judge.me Ltd. (c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, EC2A 2AB, UK) are integrated to display external customer reviews/badges. Your browser establishes a direct connection to the provider's servers, transmitting technical info including your IP address. Processing is based on our legitimate marketing interest under Art. 6 (1) (f) GDPR. Data transfer to the UK is covered by an EU adequacy decision.

9.2 Cloudflare Turnstile

We use the CAPTCHA service Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Turnstile checks whether input is made by a human or an automated bot to prevent spam and attacks. It collects browser/device data, IP address, and visit duration. Legal basis: Legitimate interest under Art. 6 (1) (f) GDPR. Cloudflare complies with the EU-US Data Privacy Framework.

9.3 Forms App

For surveys and forms, we use FORMS APP OÜ, Lasnamäe tn 4b-26, 11412 Harju, Tallinn, Estonia.

Submitted form data, along with technical details (IP address, browser, time), is stored securely on the provider's servers. Legal basis: Contract execution (Art. 6 (1) (b) GDPR) or consent (Art. 6 (1) (a) GDPR).

10) Tools and Miscellaneous

Cookie Consent Tool

This website uses a Cookie Consent Tool to obtain valid user consent for cookies requiring consent. The interactive interface allows users to set preferences via checkboxes. Technically necessary cookies are stored to save your preferences.

Legal bases: Legitimate interest in compliant consent management (Art. 6 (1) (f) GDPR) and legal compliance obligations (Art. 6 (1) (c) GDPR).

 

11) Rights of the Data Subject

11.1

Applicable data protection law grants you comprehensive rights regarding your personal data vis-à-vis the controller:

 

  • Right of access pursuant to Art. 15 GDPR

  • Right to rectification pursuant to Art. 16 GDPR

  • Right to erasure ("right to be forgotten") pursuant to Art. 17 GDPR

  • Right to restriction of processing pursuant to Art. 18 GDPR

  • Right to notification pursuant to Art. 19 GDPR

  • Right to data portability pursuant to Art. 20 GDPR

  • Right to withdraw consent pursuant to Art. 7 (3) GDPR

  • Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON A WEIGHING OF INTERESTS PURSUANT TO OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH EFFECT FOR THE FUTURE ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING. IF YOU OBJECT, WE WILL CEASE PROCESSING YOUR DATA FOR DIRECT MARKETING PURPOSES.

12) Duration of Storage of Personal Data

The duration of the storage of personal data is determined by the respective legal basis, the processing purpose, and—if applicable—the respective statutory retention period (e.g., commercial and tax retention periods).

When processing personal data on the basis of explicit consent pursuant to Art. 6 (1) (a) GDPR, the data is stored until you revoke your consent.

 

If statutory retention periods exist for data processed within the scope of contractual obligations under Art. 6 (1) (b) GDPR, this data will be routinely deleted after the retention periods expire, provided it is no longer required for contract fulfillment or initiation and/or we have no legitimate interest in continued storage.

 

When processing personal data under Art. 6 (1) (f) GDPR, data is stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or for legal claims.

When processing personal data for direct marketing under Art. 6 (1) (f) GDPR, data is stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in this policy, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Status: September 26, 2026