Privacy policy
Unless otherwise stated below, providing your personal data is neither required by law or contract nor necessary to conclude a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This applies only where no different statement is made for the processing operations described below.
"Personal data" means any information relating to an identified or identifiable natural person.
Server log files
You can visit our websites without providing information about yourself.
Each time our website is accessed, your internet browser transmits usage data to us or to our web hosting/IT service provider, which is stored in log files (known as server log files). This stored data includes, for example, the name of the page accessed, date and time of access, IP address, amount of data transferred and the requesting provider.
Processing is based on Article 6(1)(f) GDPR and our overriding legitimate interest in ensuring the uninterrupted operation of our website and improving our services.
We use Shopify to operate this shop. Shopify International Ltd., Ireland, is responsible for processing in the European Economic Area. Data may also be processed in Canada, the USA and other countries. According to Shopify's current information, transfers within the Shopify group from the EEA are based on binding corporate rules (BCRs) approved by supervisory authorities. For transfers to other service providers, Shopify uses standard contractual clauses where required. Further information about safeguards and data processing is available in Shopify's privacy policy and Shopify's consumer privacy policy. You can also exercise rights concerning processing for which Shopify is independently responsible through Shopify's privacy portal.
Contact
Controller
The controller responsible for data processing in this online shop is:
BBT Bürotechnik Schulze & Schulze OHG
Berliner Straße 67
16540 Hohen Neuendorf
Germany
Represented by Markus Schulze and Marlis Schulze.
Phone: 03303 541 041
Email: info@bbt-online.de
Customer-initiated contact by email
If you initiate business contact with us by email, we collect your personal data (name, email address, message text) only to the extent you provide it. Processing serves to handle and respond to your enquiry.
If the contact serves to take steps prior to entering into a contract (e.g. advice about a purchase or preparation of a quotation) or concerns an existing contract between you and us, processing is based on Article 6(1)(b) GDPR.
If you contact us for other reasons, processing is based on Article 6(1)(f) GDPR and our overriding legitimate interest in handling and responding to your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR.
We use your email address only to handle your enquiry. Your data will subsequently be deleted in accordance with statutory retention periods unless you have consented to further processing and use.
Collection and processing when using the contact form
When you use the contact form, we collect your personal data (name, email address, message text) only to the extent you provide it. Processing serves the purpose of establishing contact.
If the contact serves to take steps prior to entering into a contract (e.g. advice about a purchase or preparation of a quotation) or concerns an existing contract between you and us, processing is based on Article 6(1)(b) GDPR.
If you contact us for other reasons, processing is based on Article 6(1)(f) GDPR and our overriding legitimate interest in handling and responding to your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(f) GDPR.
We use your email address only to handle your enquiry. Your data will subsequently be deleted in accordance with statutory retention periods unless you have consented to further processing and use.
Customer accounts and orders
Business registration and customer accounts
Our shop is exclusively for business customers. To verify business access and to set up and manage customer accounts, we process the data entered in the registration form, particularly the company name, business address, name and business contact details of the person enquiring and, where applicable, a VAT identification number. These details are used to verify business status and eligibility to order and to communicate approval. Verification is carried out by BBT. We use Shopify and a business registration service provider to provide the form and customer account technically.
Where processing is necessary for steps prior to a contract or performance of a contract with you as a sole trader, it is based on Article 6(1)(b) GDPR. For company contacts and verification of access eligibility, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is conducting business and restricting our offering to business customers. We cannot approve business access without the information required for verification. Consent to advertising is not required.
For sign-in, we use your registered email address to send a one-time code. You may request closure of your customer account using the contact details above. Statutory retention obligations, particularly for completed orders, remain unaffected. Data from enquiries that do not result in approval is deleted once verification and related communication are complete and there are no statutory retention obligations or legitimate grounds for further storage.
Collection, processing and disclosure of personal data for orders
When you order, we collect and process your personal data only as necessary to fulfil and process your order and handle your enquiries. Providing the data is necessary to conclude the contract. If it is not provided, no contract can be concluded. Processing is based on Article 6(1)(b) GDPR and is necessary for performance of a contract with you.
Your data may be disclosed, for example, to shipping companies, dropshipping or fulfilment providers, payment service providers, order processing service providers and IT service providers. In all cases we strictly comply with legal requirements. The scope of data transmission is limited to the minimum necessary.
We use Shopify to operate this shop. Shopify International Ltd., Ireland, is responsible for processing in the European Economic Area. Data may also be processed in Canada, the USA and other countries. According to Shopify's current information, transfers within the Shopify group from the EEA are based on binding corporate rules (BCRs) approved by supervisory authorities. For transfers to other service providers, Shopify uses standard contractual clauses where required. Further information about safeguards and data processing is available in Shopify's privacy policy and Shopify's consumer privacy policy. You can also exercise rights concerning processing for which Shopify is independently responsible through Shopify's privacy portal.
Newsletter
If you subscribe to our newsletter or a shop launch notification, we use your email address for the messages you have requested. Processing is based on your consent under Article 6(1)(a) GDPR. Subscription is voluntary and is not a condition for having a customer account or making a purchase.
You may withdraw your consent at any time with future effect, particularly using an unsubscribe link in the message or by emailing info@bbt-online.de. The lawfulness of processing before withdrawal remains unaffected. After unsubscribing, we no longer use your email address for these messages. Consent and unsubscribe records may continue to be stored to document and respect your decision where necessary and legally permissible.
Payment service providers
Use of PayPal Express
We use the PayPal Express payment service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22–24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. Processing serves to offer you payment through PayPal Express. Integrating this payment service requires PayPal to collect, store and analyse data (e.g. IP address, device type, operating system, browser type and location of your device) when the website is accessed. Cookies may also be used for this purpose. Cookies enable recognition of your browser.
Processing of your personal data is based on Article 6(1)(f) GDPR and our overriding legitimate interest in providing a customer-oriented range of payment methods. You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data.
When you select and use PayPal Express, data necessary to process the payment is transmitted to PayPal so that the contract with you can be performed using the selected payment method. This processing is based on Article 6(1)(b) GDPR.
Further information about processing when using PayPal Express is available in its privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS.
Use of PayPal Check-Out
We use the PayPal Check-Out payment service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22–24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. Processing serves to offer you payment through this payment service. When you select and use payment via PayPal, credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, data necessary to process the payment is transmitted to PayPal to perform the contract with you using the selected payment method. This processing is based on Article 6(1)(b) GDPR.
Cookies that enable recognition of your browser may be stored. The associated processing is based on Article 6(1)(f) GDPR and our overriding legitimate interest in providing a customer-oriented range of payment methods. You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data.
Credit card via PayPal, direct debit via PayPal and "Pay Later" via PayPal
For certain payment methods, such as credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, PayPal reserves the right to obtain a credit report using credit agencies and mathematical-statistical methods. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of payment default to make a balanced decision about establishing, performing or terminating the contractual relationship. The credit report may include probability values (scores) calculated using scientifically recognised mathematical-statistical methods, which may incorporate address data among other information. Your legitimate interests are considered in accordance with legal requirements. Processing serves to assess creditworthiness prior to entering into a contract. It is based on Article 6(1)(f) GDPR and our overriding legitimate interest in protection against payment default where PayPal makes an advance payment.
You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data based on Article 6(1)(f) GDPR by notifying PayPal. Providing the data is necessary to conclude the contract using your chosen payment method. If it is not provided, the contract cannot be concluded using that payment method.
Third-party providers
When you pay using a third-party payment method, data necessary to process the payment is transmitted to PayPal. This processing is based on Article 6(1)(b) GDPR. To carry out that payment method, PayPal may then forward the data to the respective provider. This processing is based on Article 6(1)(b) GDPR. Local third-party providers may include:
- Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
Payment on account via PayPal
When paying on account, data necessary to process the payment is initially transmitted to PayPal. To carry out this payment method, PayPal then forwards the data to Ratepay GmbH (Franklinstraße 28–29, 10587 Berlin; "Ratepay") to perform the contract with you using the selected payment method. This processing is based on Article 6(1)(b) GDPR. Ratepay may obtain a credit report using credit agencies and mathematical-statistical methods (probability values or scores) following the procedure described above. Processing serves to assess creditworthiness prior to entering into a contract. It is based on Article 6(1)(f) GDPR and our overriding legitimate interest in protection against payment default where Ratepay makes an advance payment. Further information about data protection and the credit agencies Ratepay uses is available at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.
Further information about data processing when using PayPal is available in its privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
Use of Shopify Payments
We use the "Shopify Payments" payment service provided by Shopify International Limited (2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website. Payments are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; "Stripe"). Processing serves to offer you payment through Shopify Payments. When you select and use a corresponding Shopify Payments method, data necessary to process the payment is transmitted to Stripe to perform the contract with you using the selected payment method. This processing is based on Article 6(1)(b) GDPR.
Stripe reserves the right to obtain a credit report using credit agencies and mathematical-statistical methods. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of payment default to make a balanced decision about establishing, performing or terminating the contractual relationship. The credit report may include probability values (scores) calculated using scientifically recognised mathematical-statistical methods, which may incorporate address data among other information. Your legitimate interests are considered in accordance with legal requirements. Processing serves to assess creditworthiness prior to entering into a contract. It is based on Article 6(1)(f) GDPR and our overriding legitimate interest in protection against payment default where Stripe makes an advance payment.
You have the right to object at any time, on grounds relating to your particular situation, to this processing of your personal data based on Article 6(1)(f) GDPR by notifying Stripe. Providing the data is necessary to conclude the contract using your chosen payment method. If it is not provided, the contract cannot be concluded using that payment method.
Further information about processing when using Shopify Payments is available in Shopify's privacy policy at https://www.shopify.com/de/legal/datenschutz.
Further information about processing by the payment service provider Stripe is available in Stripe's privacy policy at https://stripe.com/de/privacy.
Data subject rights and storage periods
Storage period
After the contract has been fully performed, the data is initially stored for the warranty period and then in accordance with statutory retention periods, particularly under tax and commercial law, and deleted after these periods expire unless you have consented to further processing and use.
Rights of the data subject
Where the legal requirements are met, you have the following rights under Articles 15 to 20 GDPR: access, rectification, erasure, restriction of processing and data portability.
Under Article 21(1) GDPR, you also have a right to object to processing based on Article 6(1)(f) GDPR and to processing for direct marketing purposes.
Right to lodge a complaint with a supervisory authority
Under Article 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data is unlawful.
You may lodge a complaint, among others, with the supervisory authority responsible for us, which can be contacted as follows:
Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht
Stahnsdorfer Damm 77
14532 Kleinmachnow
Phone: +49 33203 3560
Fax: +49 33203 35649
Email: poststelle@lda.brandenburg.de
Right to object
If the personal data processing described here is based on our legitimate interest under Article 6(1)(f) GDPR, you have the right to object at any time with future effect on grounds relating to your particular situation.
Following an objection, processing of the data concerned will cease unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.