Privacy Policy for Horando Germany

We—Horando Deutschland GmbH (“Horando” or “we”)—would like to inform you about our processing of your personal data in accordance with the General Data Protection Regulation (“GDPR”).

Our privacy notice is structured in a modular format. It consists of general information regarding any processing of personal data and processing situations (I.) and specific information, the content of which relates only to the processing situation specified therein (II. ff.). To find the sections relevant to you, please refer to the outline below:

1. General Information

2. Additional Information on Data Processing When Visiting the Website

3. Supplementary Information for Users of Our Online Store

4. Supplementary Information Regarding Communication with Us

5. Supplementary Information for Contractual Partners

6. Additional Information for Job Applicants

1. General Information

1.1. Data Controller

The controller within the meaning of the GDPR and other national data protection laws of the Member States, as well as other data protection provisions.

Horando Deutschland GmbH

Georgstrasse 38

30159 Hanover

Email: contact@horando.de

Website: www.horando.de

1.2. Legal Bases for the Processing of Personal Data

We process some of your personal data based on the following legal grounds:

1.2.1. Consent of the Data Subject

To the extent that we obtain the data subject’s consent for a specific purpose, Article 6(1)(a) of the GDPR serves as the legal basis.

1.2.2. Performance of contractual obligations

To the extent that processing is necessary for the performance of a contract to which you are a party, Article 6(1), first sentence, letter b of the GDPR serves as the legal basis. This also applies to processing operations necessary for the implementation of precontractual measures.

1.2.3. Legal Requirements and Obligations

To the extent that processing is necessary to comply with a legal obligation to which we are subject, the legal basis is Article 6(1), first sentence, subparagraph (c) of the GDPR.

1.2.4. Protection of Legitimate Interests

To the extent that processing is necessary to protect our legitimate interests or those of a third party, and your interests, fundamental rights, and fundamental freedoms do not override the former interest, the legal basis is Article 6(1), sentence 1, subparagraph (f) of the GDPR.

1.3. Retention Period and Deletion of Personal Data

Personal data will be deleted or blocked as soon as no purpose or legal basis for processing remains.

1.4. Recipients of Personal Data

Internally, only those departments that require personal data to fulfill their processing purposes process such data. This also applies to the processors, service providers, and agents we engage. All departments and individuals who work with personal data are bound by data confidentiality and have been instructed to handle such data with care.

Personal data is disclosed to third parties only if this is in accordance with data protection regulations. In particular, parties engaged to carry out our business operations (e.g., banks, tax advisors, service providers for computer and IT services) as well as government agencies/authorities may receive your personal data to the extent necessary to fulfill a legal obligation.

1.5. Data Processing in Third Countries

In some cases, our services require the processing of personal data in countries outside the EU/EEA (“third countries”) by our data processors. To the extent that personal data is processed and the country in question does not have a level of data protection equivalent to the European standard—as confirmed by an adequacy decision pursuant to Article 45(3) of the GDPR issued by the European Commission—we have entered into EU Standard Contractual Clauses with the relevant data processors to establish appropriate safeguards within the meaning of Article 46 of the GDPR. A copy of the EU Standard Contractual Clauses can be found here:

Where processing in a third country takes place, we will indicate this below.

1.6. Data Subject Rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and are entitled to the following rights vis-à-vis us as the data controller:

1.6.1. Right of Access

Pursuant to Article 15 of the GDPR, you have the right to request information about the personal data we process. In particular, you may

information regarding the purposes of processing,
the categories of data,
the categories of recipients to whom your data has been or will be disclosed, as well as information on whether the personal data will be transferred to a third country or to an international organization (in this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR),
the planned retention period,
the existence of a right to rectification, erasure, restriction of processing, or objection,
the existence of a right to lodge a complaint, the origin of your data, if it was not collected by us,
as well as information regarding the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and—at least in these cases—meaningful information regarding the logic involved, as well as the scope and intended effects of such processing on the data subject.

1.6.2. Right to Rectification

Pursuant to Article 16 of the GDPR, you have the right to have your personal data rectified and/or completed if it is inaccurate or incomplete. We must carry out the rectification without undue delay.

1.6.3. Right to Restriction of Processing

Pursuant to Article 18 of the GDPR, you have the right to request the restriction of the processing of your data if you contest the accuracy of the data or if the processing is unlawful.

If the restriction on processing has been imposed, we will notify you before the restriction is lifted.

1.6.4. Right to erasure

Pursuant to Article 17 of the GDPR, you have the right to have your personal data erased, unless processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or to establish, exercise, or defend legal claims.

1.6.5. Right to Be Informed

If you have exercised your right to rectification, erasure, or restriction of processing with us, we are obligated to notify all recipients to whom the personal data has been disclosed of the rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort.

1.6.6. Right to Data Portability

Pursuant to Article 20 of the GDPR, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller.

1.6.7. Right to Object

Pursuant to Article 21 of the GDPR, you have the right to object to the processing, provided that the processing is based on Article 6(1)(e) or (f) of the GDPR.

1.6.8. Right to Withdraw Consent

Pursuant to Article 7(3) of the GDPR, you have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

1.6.9. Right to lodge a complaint with a supervisory authority

Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data.

2. Additional Information Regarding Data Processing When Visiting the Website

We are responsible for our website and its subpages (“Website”). Personal data is processed when you use our Website. Below, we provide detailed information about the data processing that takes place.

2.1. Provision of the Website and Creation of Log Files

When you access our website, we automatically collect data and information from your device (so-called log files).

2.2. Data Processor

To provide our website, we use the Rocketspace service provided by the data processor ZooBrotghers UG (Siegfriedstraße 49-60, 10365 Berlin), with whom we have entered into a data processing agreement and who processes personal data exclusively on our behalf.

2.2.1. Information & Duration of Processing

The following information is processed when you visit our website:

Information about the browser type and version used
The operating system of the end device
The user’s Internet service provider
The IP address of the device
Name and URL of the retrieved file
Referrer URL
Status code and amount of data transferred
Date and time of access

The log files are deleted within seven days at the latest.

2.2.2. Purpose of Processing & Legal Basis

The data is required to display the website on the user’s device, to ensure its functionality, and to analyze any malfunctions. In addition, the data helps us optimize the website and ensure the security of our information technology systems.

The legal basis is Article 6(1)(f) of the GDPR. The collection of log files is absolutely necessary for the operation of the website. Consequently, the user has no right to object.

2.3. Use of Cookies

We use cookies on our website. These are text files that are stored in or by the internet browser on the user’s device when visiting a website. Each cookie contains a unique string of characters that allows the browser—and thus the user’s device—to be uniquely identified the next time the website is accessed.

2.3.1. Technically Necessary Cookies

Some functions of our website cannot be performed without the use of cookies. For example, it may be necessary to use so-called counting cookies to prevent the website from becoming overloaded. Session cookies may also be required to retain the selected language setting of the website for future visits or to detect malicious bot requests. In addition, mandatory cookies also enable our system to recognize whether the user has consented to the placement of cookies in their browser or has restricted them (so-called “opt-out” cookies). These technically necessary cookies are not used to determine the user’s identity or to create user profiles. The necessary cookies are deleted at the end of the session.

The legal basis for storing essential cookies is Section 25(2)(2) of the TTDSG.

The legal basis for processing the personal data generated in this process is Article 6(1), sentence 1, subparagraph (f) of the GDPR.

The use of these cookies is strictly necessary for the operation of the website. Consequently, the user has no option to object.

2.3.2. Optional Cookies

We use optional cookies on our website. These are used for functional, analytical, or marketing purposes. The use of these cookies is based on the user’s consent, which the user grants to us upon their first visit to the website and which encompasses both the storage and retrieval of cookies as such and the processing of the personal data generated in the process. The legal basis for storing and retrieving analytics cookies is Section 25(1) of the TTDSG; the legal basis for processing the resulting personal data is Article 6(1)(a) of the GDPR. You may revoke your consent at any time by changing the settings in the Consent Manager, which is accessible in the footer of our website. There you will also find all information regarding the cookies used, their purpose, their respective retention periods, and the recipients of the data processed by the cookies. The lawfulness of the processing carried out on the basis of your consent until its revocation remains unaffected.

To provide the Consent Manager, we use the data processor Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich (“Usercentric”), with whom we have entered into a data processing agreement and who processes user settings exclusively on our behalf. In the event of any data processing on servers in the U.S., Usercentric has implemented appropriate safeguards in accordance with Art. 46 of the GDPR.

2.4. Google Services

We use several Google services. Our contractual partner in this regard is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Recipients of your data may include:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as a processor pursuant to Article 28 of the GDPR)

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

To the extent that Google processes data outside the EU/EEA and there is no level of data protection equivalent to European standards, Google Ireland Limited has entered into contractual arrangements to provide appropriate safeguards in accordance with Article 46 of the GDPR. A copy of the contractual clauses can be found here: . Additionally, Google LLC is certified under the EU-U.S. Data Privacy Framework. For more information, please visit:

2.4.1. Google Tag Manager

If you have given your consent, Google Tag Manager is used on this website.

Google Tag Manager is primarily used to deploy other tools. Instead of loading a tool directly, it is loaded by Google Tag Manager. Google Tag Manager uses administrator cookies and transmits cookies associated with the Tag Manager to Google. The information collected via these cookies regarding your use of this website is generally transmitted to a Google server in the U.S. and stored there.

Due to the server connections between your Internet connection and Google’s servers, your IP address and network data—such as the following—are also processed:

approximate location (region)

technical information about the browser and the devices used (e.g., language settings, screen resolution)

Internet service provider

the referrer URL (via which website or advertising medium users arrived at this website)

The legal basis for data processing by Google Tag Manager is your consent pursuant to Section 25(1) of the German Telemedia Act (TTDSG) in conjunction with Article 6(1)(a) of the General Data Protection Regulation (GDPR).

You may revoke your consent at any time with future effect by accessing the settings in the Consent Manager and changing your selection there. The lawfulness of the processing carried out on the basis of your consent up until the time of revocation remains unaffected. Furthermore, the data collected via the Tag Manager will be processed until you revoke your consent.

2.4.2. Google Analytics

If you have given your consent, the web analytics service Google Analytics 4 is used on this website.

Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected via the cookies about your use of this website is generally transmitted to a Google server in the United States and stored there.

IP address anonymization is enabled by default in Google Analytics 4. Due to IP anonymization, your IP address is truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. According to Google, the IP address transmitted by your browser as part of Google Analytics is not combined with other Google data.

During your visit to the website, your user behavior is recorded in the form of “events.” Events may include:

Page views
First visit to the website
Start of the session
Your “click path,” interaction with the website
Scrolls (whenever a user scrolls to the bottom of the page (90%))
Clicks on external links
Internal search queries
Interaction with videos
File downloads
Ads viewed / clicked
Language setting

The following information is also collected:

Your approximate location (region)
Your IP address (in truncated form)
Technical information about your browser and the devices you use (e.g., language setting, screen resolution)
Your internet service provider
The referrer URL (the website or advertisement through which you arrived at this website)

Google will use this information on our behalf to analyze your pseudonymous use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyze the performance of our website.

Data that has reached the end of its retention period is automatically deleted once a month.

The legal basis for this data processing is your consent pursuant to Section 25(1) of the German Telemedia Act (TTDSG) in conjunction with Article 6(1)(a) of the General Data Protection Regulation (GDPR). You may revoke your consent at any time with future effect by accessing the cookie settings in the Consent Manager and changing your selection there. There you will also find information about the cookies being processed. The lawfulness of the processing carried out on the basis of your consent up until its revocation remains unaffected.

You can also prevent cookies from being stored from the outset by configuring your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in limited functionality on this and other websites. You can also prevent Google from collecting the data generated by the cookie and related to your use of the website (including your IP address) and from processing this data by

not giving your consent to the setting of the cookie or
downloading and installing the browser add-on to disable Google Analytics:

For more information on the Google Analytics Terms of Service and Google’s privacy policy, please visit and .

2.4.3. Google Marketing Platform

Provided you have given your consent, we use services from the Google Marketing Platform (formerly “DoubleClick”). These services use cookies to serve ads that are relevant to users, to improve campaign performance reports, or to prevent a user from seeing the same ad more than once. Campaign Manager 360 allows us to run ad campaigns and measure their performance. Display & Video 360 helps us manage display and video campaigns. Search Ads 360 is used to manage search campaigns across various search engines.

Google uses a cookie ID to determine which ads are served in which browser, thereby preventing them from being displayed more than once. Google may also use cookie IDs to track conversions—that is, whether a user sees an ad and later visits the advertiser’s website to make a purchase. These cookies do not contain any personal information.

Your browser automatically establishes a direct connection to the Google server. According to Google, by integrating these services, Google receives information that you have accessed the corresponding part of our website or clicked on one of our ads. If you are registered with a Google service, Google can associate the visit with your user account. Even if you are not registered with Google or are not logged in, it is possible that the provider may obtain and store your IP address.

In addition, we can use cookies to track whether you perform certain actions on our website after viewing or clicking on one of our ads on Google or another platform (conversion tracking) (“Floodlight”). Google uses this cookie to understand the content with which you have interacted on our websites so that we can later send you targeted advertising.

The legal basis for this data processing is your consent pursuant to Section 25(1) of the German Teleservices Data Protection Act (TTDSG) in conjunction with Article 6(1)(a) of the General Data Protection Regulation (GDPR). You may revoke your consent at any time with future effect by accessing the cookie settings in the Consnt Manager and changing your selection there. You will also find information about the cookies being processed there. The lawfulness of the processing carried out on the basis of your consent up until the time of revocation remains unaffected.

In addition to the option to generally grant or revoke your consent to the use of analytics and/or marketing cookies via the settings at the top of this policy, you can prevent tracking by changing your browser settings (e.g., disabling third-party cookies), disable conversion tracking cookies by blocking cookies from the domain in your browser settings, and, with regard to interest-based ads from providers participating in the About Ads self-regulatory campaign, by clicking the link or the link . Please note that in this case, you may not be able to use all features of the website to their full extent.

2.5. Meta Business Tools

We use the Meta Business Tools Meta Pixel and Conversion API provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.

If you have given your consent, we process the following personal data: page views and interactions (events), IP address, date/time, user agent, referrer URL, and, if applicable, parameters (e.g., order value, product IDs). If Advanced Matching/Conversions API is enabled, hashed contact information (e.g., email address) may also be transmitted.

The purpose of this processing is to analyze the use of our website, display interest-based ads on Meta services (Facebook, Instagram), and measure campaign success.

We store the event data only for as long as necessary for the purposes stated above. Information on Meta’s retention period can be found in Meta’s privacy policy:

The legal basis for the processing is your consent; for setting the pixel and activating the Conversion API, this is based on Section 25(1) of the TTDSG, and for the personal data processed in this context, on Article 6(1)(a) of the GDPR (consent). You may revoke your consent at any time with future effect in the cookie settings (Consent Manager in the website footer) or in the ad preferences of your Meta account.

We and Meta are joint controllers for the collection and transmission of certain data via the Meta Business Tools. The division of roles is set forth in the Meta Business Tools Terms, including the Joint Controller Addendum:

Meta processes data in Ireland, among other locations, and may transfer data to third countries (particularly the U.S.). The basis for data transfers to the U.S. is the EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework (DPF), under which the parent company, Meta Platforms Inc., is certified.

2.6. Newsletter

If you would like to subscribe to the newsletter we offer, we need your email address as well as information that allows us to verify that you are the owner of the provided email address and that you consent to receiving the newsletter. You may revoke your consent to the storage of your data and email address, as well as their use for sending the newsletter, at any time—for example, via the “Unsubscribe” link in the newsletter. The lawfulness of any data processing that has already taken place remains unaffected by this revocation.

The data you have provided to us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter and will be deleted after you unsubscribe. The legal basis for data processing is your consent (Art. 6(1)(a) GDPR).

The newsletter is sent via the Klaviyo service provided by our data processor, Klaviyo Inc., 125 Summer St., Ste. 600, Boston, MA 02110, USA (hereinafter “Klaviyo”), with whom we have entered into a data processing agreement that includes the EU Standard Contractual Clauses. In addition, Klaviyo is certified under the EU-U.S. Data Privacy Framework. For more information, please visit

3. Social Media Presence

We maintain online presences on social networks and platforms to communicate with customers, prospective customers, and users active there and to inform them about our services.

Accordingly, we have provided a link to the Facebook and Instagram websites, which are operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. No further data is exchanged with Meta on our part.

We have included a link to the X website (formerly “Twitter”), which is operated by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland (“X”). No further data is exchanged with X on our site.

We have accordingly provided a link to the “LinkedIn” website, which is operated by LinkedIn, Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). No further data is exchanged with LinkedIn on our site.

We have accordingly provided a link to the “YouTube” website, which is operated by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“YouTube”). No further data exchange with YouTube takes place on our site.

When accessing the respective networks and platforms, the terms of service and data processing policies of their respective operators apply. Unless otherwise specified in our privacy policy, we process users’ data when they communicate with us within social networks and platforms, e.g., by posting on our online presences or sending us messages.

4. Additional Information for Users of Our Online Store

We are responsible for the services available through our online store. The use of these services involves the processing of personal data. Below, we provide detailed information about the data processing that takes place.

4.1. Purchase Processing

As the controller for the online store, we process the following personal data when a product is purchased:

Email address
First name, last name
Company name (optional)
Address (including country)
Alternative shipping address (optional)
Apartment, room, etc. (optional)
Phone
Product details regarding the item being purchased

When using paid services, the following additional data is processed:

Billing information

The purpose of the processing is to provide users with the services we are contractually obligated to deliver. The legal basis for the processing is the purchase contract; Art. 6(1)(b) GDPR. The data is processed for the duration of the user agreement, unless you have given us consent for permanent storage or there is a purpose and a legal basis for storage beyond that period. This includes statutory retention periods (Art. 6(1), first sentence, lit. c GDPR) as well as storage for the purpose of asserting or defending civil claims based on overriding legitimate interests (Art. 6(1), first sentence, lit. f GDPR).

4.2. Data Processors

To provide our services, we use the online store system of our data processor, Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”), for the purpose of hosting and displaying the online store; we have entered into a data processing agreement with Shopify. All data collected on our website is processed on Shopify’s servers. As part of the aforementioned services provided by Shopify, data may also be transferred, within the scope of further processing on behalf of Shopify, to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada; Shopify Data Processing (USA) Inc.; Shopify Payments (USA) Inc.; or Shopify (USA) Inc. In the event of data transfer to Shopify Inc. in Canada, an adequate level of data protection is ensured by the European Commission’s adequacy decision. Further information on Shopify’s data protection practices is available on the following website: Further processing on servers other than those mentioned above operated by Shopify takes place only within the scope described below.

4.3. Trusted Shops

Trusted Shops widgets are integrated into this website to display Trusted Shops services (e.g., quality seals, collected reviews) and to offer Trusted Shops products to buyers after they place an order. This serves to safeguard our legitimate interests—which prevail following a balancing of interests—in optimal marketing by enabling a secure shopping experience in accordance with Art. 6(1)(f) of the GDPR. The Trust Badge and the services advertised through it are provided by Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne (“Trusted Shops”), with whom we are joint controllers under Article 26 of the GDPR. In this Privacy Policy, we provide you below with information on the essential terms of the agreement pursuant to Article 26(2) of the GDPR.

Within the framework of the joint responsibility existing between us and Trusted Shops, please contact Trusted Shops as a matter of preference regarding data protection questions and to exercise your rights, using the contact options provided. Regardless of this, however, you may always contact the data controller of your choice. Your inquiry will then, if necessary, be forwarded to the other data controller for a response.

4.3.1. Data Processing When the Trustbadge or Other Widgets Are Integrated

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which contains your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access. The IP address is anonymized immediately after collection, so that the stored data cannot be linked to you personally. The anonymized data is used in particular for statistical purposes and for error analysis.

4.3.2. Data Processing After Order Completion

After the order is completed, order information (order total, order number, and, if applicable, the product purchased) as well as your email address—hashed using a cryptographic one-way function—is transmitted to Trusted Shops. The legal basis for this is Article 6(1)(f) of the GDPR. This serves to verify whether you are already registered for services with Trusted Shops and is therefore necessary to fulfill our and Trusted Shops’ overriding legitimate interests in providing the buyer protection and transactional review services associated with the specific order, in accordance with Article 6(1), first sentence, letter f of the GDPR. If this is the case, further processing takes place in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the services, you will then have the opportunity to do so for the first time. Further processing after registration is also governed by the contractual agreement with Trusted Shops. If you do not register, all transmitted data will be automatically deleted by Trusted Shops, and it will no longer be possible to link the data to a specific individual.

4.3.3. Processing in Third Countries

The Trustbadge is provided by a U.S.-based CDN (Content Delivery Network) provider. Trusted Shops also uses service providers for hosting, monitoring, and logging. The legal basis is Article 6(1)(f) of the GDPR for the purpose of ensuring trouble-free operation. In this context, processing may take place in third countries (the U.S. and Israel).

An adequate level of data protection is ensured in each case by an adequacy decision of the European Commission, which is available here for the U.S.: and here for Israel: https://eur-lex.europa.eu/legal-content/DE/TXT/HTML/?uri=CELEX:32011D0061. Service providers from the U.S. are generally certified under the EU-U.S. Data Privacy Framework. If service providers are not certified under the DPF, the EU Standard Contractual Clauses have been adopted as an appropriate safeguard.

4.4. Payment Service Providers

We use the following payment service providers to process payments initiated through our website:

Credit card companies (the respective financial services company that issued your card for Mastercard, VISA, AMEX)
PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg)
Apple Pay, Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA
Klarna, Klarna Bank AB (publ.), Chausseestrasse 117, 10115 Berlin
BitPay Inc., 1201 W Peachtree St NW Ste 2625, PMB 91017, Atlanta, USA

If these companies provide services as payment service providers (PSPs), they themselves are data controllers within the meaning of the GDPR. Credit card payments are processed directly through the respective providers. We do not process this data for our own purposes.

If necessary, the exchange of data related to your respective booking may also be required to resolve payment processing discrepancies between us and the payment service providers. These data transfers are carried out on the basis of a legitimate interest pursuant to Article 6(1)(f) of the GDPR. Please note that, with regard to the processing of financial transaction data, the financial service providers and responsible entities may also disclose your personal data to credit bureaus, as well as to affiliated companies and subcontractors, to the extent that this is necessary to fulfill contractual obligations or on the basis of a legitimate interest, or if the data is processed on their behalf. It cannot be ruled out that financial service providers may also transfer personal information to affiliated companies outside the EU or the EEA (e.g., in the U.S.). Service providers (including subcontractors) based in the U.S. are generally certified under the EU-U.S. Data Privacy Framework. For more information, click here: If the service providers used are not certified under the DPF, the EU Standard Contractual Clauses have been adopted as an appropriate safeguard.

Your data is transmitted to the financial service providers in encrypted form and is processed exclusively by them for the purpose of payment processing. The financial service providers are legally obligated to process and verify this data.

For more information on data protection in connection with this payment service provider, please refer to the privacy policies of

PayPal: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Apple Pay: https://www.apple.com/de/legal/privacy/data/de/apple-pay/

Klarna: https://www.klarna.com/de/datenschutz/?

or from your respective card issuer.

If you pay for goods or services, we also share your data with our service providers in the areas of banking, taxes, and tax consulting, as well as—within the scope of legal requirements—with the tax authorities.

5. Additional Information Regarding Communication with Us

The following information applies to all communication with us.

If the communication takes place within a contractual relationship or another contractual arrangement, data processing is also governed by the additional information under V.

If the communication is related to a job application with us, data processing is also governed by the additional information under VI.

5.1. Telephone

You can contact us by phone.

5.1.1. Information Processed & Duration of Processing

In addition to your phone number, we process the personal data you provide to us during the call.

The data will be deleted—unless there is another reason for processing it—as soon as the matter has been resolved with you.

5.1.2. Purpose of Processing & Legal Basis

We process personal data exclusively for the purpose of handling your inquiry and in the event of follow-up questions.

If the communication is aimed at concluding a contract, the legal basis for processing is Article 6(1), first sentence, letter b of the GDPR.

In all other cases, the legal basis is Article 6(1), first sentence, subparagraph (f) of the GDPR. Your interest does not outweigh our interest in responding to your inquiry; since you have written to us, a response is also in your interest, and you are aware that we must process your personal data in order to respond to your inquiry.

5.2. Email

You can contact us via email (e.g., through our contact form). We would like to point out that there is a possibility that third parties may gain access to email communications. If it is important to you that the information you provide is not exposed to the risk of unauthorized access by third parties, we therefore recommend using a different method of communication. However, if you contact us via email, we assume that continuing the exchange through this channel is also in your interest.

5.2.1. Information Processed & Duration of Processing

In addition to your email address, we process the personal data you provide to us in the course of our email communication.

The data will be deleted—unless there is another reason for processing it—as soon as the matter with you has been resolved.

5.2.2. Purpose of Processing & Legal Basis

We process personal data exclusively for the purpose of handling your inquiry and in the event of follow-up questions.

If the communication is aimed at concluding a contract, the legal basis for processing is Article 6(1), first sentence, letter b of the GDPR.

In all other cases, the legal basis is Article 6(1), first sentence, subparagraph (f) of the GDPR. Your interest does not outweigh our interest in responding to your inquiry; since you have contacted us, a response is also in your interest, and you are aware that we must process your personal data in order to respond to your inquiry.

5.3. Video Calls

We also use video calls for communication.

5.3.1. Data Processors

To conduct video calls, we use the “Google Meet” service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) or “MS Teams” provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South Business Park, Carmanhall and Leopardstown, Dublin, D18 P521, Ireland, as our data processor. We have entered into a data processing agreement with the data processor. The data processor may process personal data in a third country to ensure smooth video calls. We have therefore entered into EU Standard Contractual Clauses with the data processor to establish appropriate safeguards in accordance with Article 46 of the GDPR.

5.3.2. Information Processed & Duration of Processing

The following communication data is processed during video calls:

Personal master data (if you provide this voluntarily)
Content of the online meeting (if you appear personally and contribute verbally and/or in writing)
Authentication data
Log files, log data
Metadata (e.g., IP address, time of participation, etc.)
Profile data (e.g., your username, if you provide it voluntarily)

Personal data will be deleted as soon as the matter has been resolved with you and provided there is no longer any other reason for processing it.

5.3.3. Purpose of Processing & Legal Basis

We process personal data exclusively for the purpose of handling your inquiry and in the event of follow-up questions.

If the communication is aimed at concluding a contract, the legal basis for processing is Article 6(1)(b) of the GDPR.

6. Additional Information for Contractual Partners

In addition, the following information applies to you if we are in a contractual relationship with each other.

6.1. Information Processed & Duration of Processing

The specific data processed about you depends on the tasks within the contractual relationship. We use personal information exclusively for the purpose for which it was provided to us. This includes, for example, personal details (name, address, and other contact information; date and place of birth). In addition, this may also include order data (e.g., payment orders), data arising from the fulfillment of our contractual obligations (e.g., transaction data in payment processing), information about your financial situation (e.g., creditworthiness data), marketing and sales data, as well as other data comparable to the categories mentioned.

Personal data will be deleted as soon as the contractual relationship with you ends and provided there is no longer any other basis for processing.

6.2. Purpose of Processing & Legal Basis

Processing is primarily carried out for the purpose of establishing and executing the contractual relationship; the legal basis is Article 6(1)(b) of the GDPR.

In addition, we also process your data in part based on our legitimate interest, namely for the purposes of contact and communication management, cost-effectiveness reviews, contract and project management, and to ensure the operation of information and telecommunications systems. The legal basis is Article 6(1), first sentence, letter f of the GDPR.

Furthermore, as a company, we are bound by various legal obligations that must be complied with in accordance with applicable laws and regulations. The legal basis for processing to fulfill legal requirements and obligations is Article 6(1), sentence 1, letter c of the GDPR. This includes, among other things, tax-related retention requirements.

7. Additional Information for Job Applicants

The following information also applies to you if you apply for a position with us.

7.1. Information Processed & Duration of Processing

We process the personal data we receive from you through your application.

The personal data will be deleted after six months if no employment relationship is established. If an employment relationship is established, the data will continue to be processed for that purpose.

7.2. Purpose of Processing & Legal Basis

We collect and process applicants’ personal data for the purpose of conducting the application process.

The legal basis for the processing of personal data is Section 26 of the German Federal Data Protection Act (BDSG). If we enter into an employment contract with you, the data provided will continue to be processed for the purpose of administering the employment relationship; in this case, the legal basis remains, in particular, Section 26 of the BDSG.

If no employment contract is concluded, the application documents will be deleted, provided that no other legitimate interests of the data controller preclude such deletion. Other legitimate interests in this context include, for example, a burden of proof in proceedings under the General Equal Treatment Act (AGG).

Privacy Policy for Horando Germany