3.1 Accessing our website/application

When you access our website/application, the browser used on your device automatically sends information to the server of our website/application and temporarily stores it in a so-called log file. We have no influence on this. The following information is recorded without your intervention and stored until it is automatically deleted:

• the IP address of the requesting internet-enabled device,
• the date and time of access,
• the name and URL of the retrieved file,
• the website/application from which access was made (referrer URL),
• the browser you use and, if applicable, the operating system of your internet-enabled computer and the name of your access provider.

The legal basis for processing the IP address is Article 6 paragraph 1 letter f) GDPR. Our legitimate interest follows from the purposes of data collection listed below. At this point, we would like to point out that we are unable to draw any direct conclusions about your identity from the data collected, and we do not draw any conclusions about it either.

The IP address of your device and the other data listed above are used by us for the following purposes:

• Ensuring a smooth connection,
• Ensuring comfortable use of our website/application,
• Evaluating system security and stability.

The data is stored for a period of 24 months and then automatically deleted. We also use so-called cookies, tracking tools, targeting processes and social media plug-ins for our website/application. The exact processes involved and how your data is used for them are explained in more detail below under section 3.4.

If you have agreed to so-called geolocation in your browser or in the operating system or other settings of your device, we use this function to be able to offer you individual services related to your current location (e.g. the location of the nearest branch). We process your location data exclusively for this function. If you stop using the service, the data will be deleted.

3.2 Conclusion, implementation or termination of a contract

3.2.1 Data processing when concluding a contract
The object of activity of Marketing (tilda.ws) is the distance selling of goods and services. In this context, we process the data required for the conclusion, implementation or termination of a contract with you. This includes:

• Salutation
• First name, last name
• Billing and delivery address
• Email address
• Billing and payment details
• Date of birth if applicable
• Telephone number if applicable

The legal basis for this is Article 6 Paragraph 1 Letter b) GDPR, i.e. you provide us with the data on the basis of the contractual relationship between you and us. We are also obliged to process your email address due to a requirement in the German Civil Code (BGB) to send an electronic order confirmation (Article 6 Paragraph 1 Letter c) GDPR). Unless we use your contact details for advertising purposes (see 3.3 below), we store the data collected for contract processing until the statutory or possible contractual warranty and guarantee rights expire. After this period has expired, we retain the information required by commercial and tax law for the contractual relationship for the legally specified periods. For this period (usually ten years from the conclusion of the contract), the data will only be processed again in the event of an audit by the tax authorities.

The following data processing is also required to process the purchase contract:

If you have selected a payment method other than advance payment or cash on delivery, we will pass on the required payment data to a payment service provider commissioned by us. We will pass on information about your delivery address to a logistics company commissioned by us for the purpose of processing the purchase contract. To ensure that the goods are delivered according to your wishes, we will send your email address and, if applicable, your telephone number to the logistics company commissioned by us. The logistics company will contact you in advance of delivery to coordinate delivery details with you. The data is transmitted for this purpose alone and deleted after delivery.
3.2.2 Identity, creditworthiness and transmission to credit agencies

If necessary, we will check your identity using information from service providers such as CRIF Bürgel GmbH, Leopoldstraße 244, 80807 Munich. The legal basis for this is Article 6 paragraph 1 letter b) and letter f) GDPR. The justification for this arises from the protection of your identity and the avoidance of attempted fraud to our detriment. The fact and the result of our inquiry will be saved in your customer account or your guest account for the duration of the contractual relationship.

In the course of the ordering process, we also check your creditworthiness in order to then be able to show you the payment methods that you can use. If you do not wish to give the above consent, we can offer you different payment methods with advance payment. For the purpose of checking your creditworthiness, we transmit the following types of data to so-called credit agencies that cooperate with us: name, address, date of birth. The legal basis for this is the declaration of consent given by you below in accordance with Article 6 Paragraph 1 Letter a) GDPR:

Applies to purchases made when not logged in: I hereby consent to my creditworthiness being checked by Marketing (tilda.ws) for this order. I am aware that the check is carried out at the beginning of the ordering process. If you do not agree to the credit check, you have the option of using an advance payment method.

Applies to logged in first purchases: I hereby consent to my creditworthiness being checked by Marketing (tilda.ws) for this and subsequent orders with my login. I am aware that the check is carried out at the beginning of the ordering process and I can revoke my consent at any time. If you do not agree to the credit check, you have the option of using an advance payment method.

You can revoke your consent at any time with effect for the future by sending a declaration to the address provided under "Contact". The revocation of consent does not affect the legality of the personal data processed up to the time of revocation.

If you have already purchased from us, the data we have stored about you can be supplemented with so-called score values. Scoring is understood to mean creating a forecast of future events based on collected information and past experience. Based on the data stored about you, you are assigned to statistical groups of people who had similar entries in the past. The underlying procedure used is a well-founded, long-tested, mathematical-statistical method for predicting risk probabilities.

In the event of a delay in payment, if the other legal requirements are met, we will transmit the necessary data to a company commissioned to assert the claim. The legal basis for this is both Article 6 paragraph 1 letter b) and Article 6 paragraph 1 letter f) GDPR. The assertion of a contractual claim is to be regarded as a legitimate interest within the meaning of the second provision. If the other legal requirements are met, we also transmit information about the delay in payment or any loss of receivables to credit agencies that cooperate with us. The legal basis for this is Article 6 Paragraph 1 Letter f) GDPR. The legitimate interest required here arises from our interest and that of third parties in reducing contractual risks for future contracts.
3.3 Data processing for advertising purposes
The following statements refer to the processing of personal data for advertising purposes. The GDPR declares such data processing to be fundamentally conceivable and a legitimate interest on the basis of Article 6 Paragraph 1 Letter f). The duration of data storage for advertising purposes does not follow any rigid principles and is based on the question of whether storage is necessary for advertising purposes. At Marketing (tilda.ws) we also follow the principle of deleting data for advertising use after 24 months. Please see section 3.3.3 for information on how your objection procedure will be handled.
3.3.1 Advertising purposes of Marketing (tilda.ws) and third parties
If you have concluded a contract with us, we will treat you as an existing customer. In this case, we will process your postal contact details without the need for specific consent in order to send you information about new products and services. We will process your email address in order to send you information about our own, similar products without the need for specific consent.
3.3.2 Right of objection
You can object to the processing of your data for the aforementioned purposes at any time, free of charge, separately for each communication channel and with effect for the future. All you need to do is send an email or a letter to the contact details given under 2.

3.4 Online presence and website optimization

3.4.1 Cookies - General information
We use so-called cookies on our website. If these cookies contain personal data, they are used on the basis of Article 6 Paragraph 1 Letter f of the GDPR. Our interest in optimizing our website is to be regarded as legitimate within the meaning of the aforementioned provision. Cookies are small files that your browser automatically creates and that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware. Information is stored in the cookie that is related to the specific device used. However, this does not mean that we thereby receive immediate knowledge of your identity. On the one hand, the use of cookies serves to make the use of our offer more pleasant for you. For example, we use so-called session cookies to recognize that you have already visited individual pages of our website or that you have already logged into your customer account. These are automatically deleted when you leave our site. In addition, we also use temporary cookies for the purpose of user-friendliness, which are stored on your device for a specific period of time. If you visit our site again to use our services, it is automatically recognized that you have already been with us and which entries and settings you have made so that you do not have to enter them again.

If you have a customer account at buecher.de and are logged in or activate the "stay logged in" function, the information stored in cookies will be added to your customer account.

We also use cookies to statistically record the use of our website and to evaluate it for the purpose of optimizing our offer for you, as well as to display information tailored specifically to you. These cookies enable us to automatically recognize that you have already been with us when you visit our site again. These cookies are automatically deleted after a defined period of time. Most browsers accept cookies automatically. However, you can configure your browser so that no cookies are stored on your computer or a notice always appears before a new cookie is created. However, completely deactivating cookies may mean that you cannot use all the functions of our website. The storage period of cookies depends on their purpose and is not the same for all.
3.4.2 Google Analytics
For the purpose of needs-based design and ongoing optimization of our pages, we use Google Analytics, a web analysis service from Google Inc. ("Google"), on the basis of Article 6 Paragraph 1 Letter f of the GDPR. In this context, pseudonymized usage profiles are created and cookies are used. The information generated by the cookie about your use of this website, such as

• browser type/version,
• operating system used,
• referrer URL (the previously visited page),
• host name of the accessing computer (IP address),
• time of the server request,

is transferred to a Google server in the USA and stored there. The information is used to evaluate the use of the website, to compile reports on website activities and to provide other services related to website and internet usage for the purposes of market research and the needs-based design of these websites. This information may also be transferred to third parties if this is required by law or if third parties process this data on behalf of Google. Under no circumstances will your IP address be merged with other data held by Google. The IP addresses are anonymized so that an assignment is not possible (so-called IP masking).

You can prevent the installation of cookies by setting your browser software accordingly; however, we would like to point out that in this case, not all functions of this website may be fully available. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) as well as the processing of this data by Google by downloading and installing this browser add-on. As an alternative to the browser add-on, especially for browsers on mobile devices, you can also prevent Google Analytics from collecting data by clicking on this link. An opt-out cookie will be set that prevents future collection of your data when you visit this website.

3.4.3.4 Objection/opt-out option You can prevent the targeting technologies described by setting the appropriate cookies in your browser (see also 3.4.1). You also have the option of deactivating preference-based advertising using the preference manager available here.

3.4.4 Integration/use of YouTube videos This website uses the YouTube embedding function to display and play videos from the provider "Youtube", which belongs to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). The extended data protection mode is used here, which, according to the provider, only starts storing user information when the video(s) is played. If the playback of embedded YouTube videos is started, the provider "Youtube" uses cookies to collect information about user behavior. According to information from "Youtube", these are used, among other things, to record video statistics, improve user-friendliness and prevent abusive behavior. If you are logged in to Google, your data will be assigned directly to your account when you click on a video. If you do not want to be assigned to your YouTube profile, you must log out before activating the button. Google stores your data (even for users who are not logged in) as usage profiles and evaluates them. Such an evaluation is carried out in particular in accordance with Art. 6 Para. 1 lit.f GDPR on the basis of Google's legitimate interests in displaying personalized advertising, market research and/or designing its website to meet your needs. You have the right to object to the creation of these user profiles, and you must contact YouTube to exercise this right. Google LLC, based in the USA, is certified for the US-European data protection agreement "Privacy Shield", which guarantees compliance with the data protection level applicable in the EU. You can find more information on data protection at "YouTube" here.
3.4.5 Use of the Facebook Custom Audiences Pixel In order to present interest-based advertisements to visitors to our website during their visit to Facebook, we use Custom Audiences Pixel from Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). We have implemented a Facebook pixel on our website, which establishes a direct connection to the Facebook servers when you visit our website. The Facebook server is informed that you have visited our website and Facebook assigns this information to your personal Facebook user account. The data about you collected by the pixel is: • Pages you have viewed • Arti