Last updated: October 11, 2026

1. Data Controller

The controller responsible for the processing of personal data in connection with this website and the online store operated through it is Kadriye Sahin, trading as DS V-LINE / DS V-LINE VERTRIEB, Bahnhofstraße 45, 34613 Schwalmstadt, Germany. Phone: +49 173 709 19 84. Email: info@dsvline.com. Website: https://www.dsvline.com. This Privacy Policy applies to our online store and its associated language and regional versions, insofar as they are operated by us.

2. General Information on the Processing of Personal Data

Protecting your personal data is of great importance to us. We process personal data in accordance with applicable data protection legislation, particularly the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the relevant statutory provisions governing privacy in digital services. Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, addresses, contact details, IP addresses, customer account information, order and payment details, and information relating to the use of our online store. We process personal data primarily to provide and secure our online store, manage customer accounts, process orders and payments, generate invoices and maintain financial accounting records, organise shipping and delivery, verify and approve business customers, provide country-specific versions of our store, respond to customer enquiries, send newsletters and marketing communications, analyse and improve our services, and comply with legal obligations. All processing of personal data is based on an appropriate legal basis. These legal bases include Article 6(1)(a) GDPR for processing based on freely given consent, Article 6(1)(b) GDPR for processing necessary for the performance of a contract or pre-contractual measures, Article 6(1)(c) GDPR for compliance with a legal obligation, and Article 6(1)(f) GDPR for the purposes of our legitimate interests, provided that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject. Where we store information on your device or access information already stored on it, we additionally comply with the applicable provisions of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where processing is based on your consent, it takes place only within the scope of that consent. You may withdraw your consent at any time with effect for the future.

3. Provision and Hosting of Our Online Store

Our online store is operated using the Shopify e-commerce platform. Shopify provides the technical infrastructure required to operate our website, manage products and customer accounts, provide shopping cart functionality, process checkout transactions, manage orders, and implement various security and administrative functions. When you use our online store, information such as IP addresses and technical connection details, device and browser information, pages visited and website interactions, customer account and contact information, shopping cart and order details, payment and transaction information, and technical security and error data may be processed. Where processing is necessary to fulfil an order or provide a customer account, the legal basis is Article 6(1)(b) GDPR. Where processing is necessary to ensure the technical operation, security, and stability of our online store, it is based on Article 6(1)(f) GDPR. Our legitimate interest is to provide a secure, reliable, and functional online shopping experience. Shopify may engage affiliated companies and additional technical service providers in delivering its services. Where Shopify processes personal data on our behalf, the relevant contractual arrangements governing data processing apply. Personal data may be processed or made accessible outside the European Economic Area as part of Shopify's international infrastructure. Further information is provided in the section entitled "International Data Transfers". For more information about Shopify's processing of personal data, please refer to https://www.shopify.com/legal/privacy.

4. Access Data and Technical Logging

When you visit our website, technically necessary information is processed to provide the website and ensure its secure operation. Such information may include your IP address, date and time of access, pages visited, browser type and version, operating system, device information, referring URL, and technical status or error messages. This information is used to establish a connection to our website, deliver content correctly, identify technical problems, and protect our systems against misuse and unauthorised access. The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest is to ensure the secure and uninterrupted operation of our online store. Technical log data is retained according to its necessity and the technical retention arrangements of the infrastructure used. Where log data is required to investigate specific security incidents, prevent attacks, or establish, exercise, or defend legal claims, longer retention may be permissible.

5. Customer Accounts and Registration

You may create a customer account in our online store. When you do so, we process the personal data necessary to establish, manage, and maintain your account. This may include your name, email address, postal address, telephone number, and information relating to your orders and account management. Processing is carried out to provide the requested account functions and perform the associated contractual relationship, in accordance with Article 6(1)(b) GDPR. Where processing is necessary to ensure account security and prevent unauthorised access, it is additionally based on Article 6(1)(f) GDPR. Data required for your customer account is generally retained for the duration of the customer relationship. If you close your account, personal data that is no longer required will be deleted unless statutory retention obligations or other lawful grounds justify further storage. In particular, order and invoice information may remain subject to statutory retention requirements after the customer account has been deleted.

6. Registration and Verification of Business Customers

Certain products and services offered through our online store are intended exclusively for business customers, qualified professionals, or members of specific professional groups. To enable access to these products and verify the necessary professional or business qualifications, we provide a separate registration process for professional customers. We use the Shopify-integrated application Helium Customer Fields to manage and administer this registration process. During registration, we may collect first and last names, business email addresses, telephone numbers, company names and business addresses, information about professional occupations and company affiliations, information relating to professional or commercial qualifications, submitted qualification documents or proof of business registration, and registration dates and approval status. This information is processed to verify eligibility, assign customers to the appropriate access groups, and manage the business customer relationship. The legal basis is Article 6(1)(b) GDPR, insofar as processing is necessary to take steps prior to entering into a business relationship or to perform an existing contractual relationship. Processing may additionally be based on Article 6(1)(f) GDPR. Our legitimate interest is to restrict access to certain professional products to appropriately qualified customers, prevent unauthorised registrations, and maintain appropriate records of access authorisations.

Verification and Retention of Qualification Documents

As part of the B2B registration process, applicants are required to provide suitable evidence of their professional qualifications or business registration. Submitted documents are used exclusively to verify eligibility and maintain the documentation necessary for the verification process. Where a B2B customer application is approved, the submitted qualification documents are retained for a maximum of one year from the date of approval. The documents are deleted upon expiry of this period. Where an application is rejected, the submitted qualification documents are deleted without undue delay following completion of the rejection decision. If a B2B customer account is closed or the relevant access authorisation is revoked, the qualification documents are likewise deleted without undue delay, regardless of whether the standard one-year retention period has expired. The deletion of qualification documents relates specifically to the submitted verification documents. Other information, particularly order and invoice records, may remain subject to statutory retention obligations. Registration data is technically managed using Helium Customer Fields and the associated infrastructure. Submitted qualification documents are not disclosed or used for independent marketing purposes.

7. Access Restrictions for Professional Products

Certain products, product information, and, where applicable, special purchasing conditions are available exclusively to registered and approved professional customers. We use the Shopify application BSS B2B Lock to implement these access restrictions. For this purpose, information such as login status, customer groups, internal customer identifiers, and other data necessary to verify access permissions may be processed. This processing allows us to provide restricted product areas only to customers who hold the appropriate authorisation. The legal basis is Article 6(1)(b) GDPR, where processing is necessary to perform the relevant contractual relationship. Additionally, processing may be based on Article 6(1)(f) GDPR. Our legitimate interest is to protect restricted distribution channels and ensure that professional products are accessible only to authorised customer groups. The necessary authorisation information is generally processed for the duration of the relevant access permission. When the authorisation expires or is revoked, the corresponding identifiers are removed or updated unless another legal basis justifies further storage.

8. Country-Specific and Language-Based Store Presentation

Our online store serves customers in various countries and regions. To provide an appropriate regional and language version of our website, we use features that enable the approximate geographical location of website visitors to be determined. For this purpose, we use the Shopify application Geo. The application may determine a visitor's approximate country or geographical region based on their IP address. Based on this information, an appropriate regional or language version of our online store may be suggested, displayed, or selected through a redirect. The information processed may include the IP address, the approximate geographical location derived from it, the selected market version, and technical information relating to the website request. Precise GPS location data is not required for this purpose. The processing serves to provide a user-friendly and market-specific shopping experience. The legal basis is Article 6(1)(f) GDPR, insofar as processing is necessary for our legitimate interest in providing a functional, country-specific online store. Where individual functions are expressly requested by users, Article 6(1)(b) GDPR may apply. Where information is stored on or accessed from your device, we comply with the applicable statutory requirements. Where consent is required, the relevant processing is carried out only after that consent has been obtained. Technical processing and any logging are governed by the configuration used and the contractual and technical arrangements of the service provider.

9. Orders and Contract Performance

When you place an order through our online store, we process the personal data necessary to execute and fulfil the purchase contract. This includes, in particular, your name, billing and shipping address, email address, telephone number where applicable, products ordered, order value, and payment and delivery information. We use this information to process your order, arrange payment, organise shipping, and handle returns, warranty claims, and other contractual matters. The legal basis is Article 6(1)(b) GDPR. Where we are legally required to retain certain order, invoice, or accounting information, further processing is based on Article 6(1)(c) GDPR. Personal data is disclosed only where necessary to fulfil the contract or where another lawful basis applies.

Invoice Generation and Financial Accounting

For the creation, management, and archiving of invoices, as well as the preparation and transfer of our accounting data, we use software solutions provided by pathway solutions GmbH. These applications are connected to our Shopify store and enable the automated generation of invoices and the structured processing of order, payment, and accounting information for our financial accounting purposes. The personal data processed may include names, billing addresses, company names and VAT identification numbers where applicable, order numbers, invoice numbers, invoice dates, purchased products, invoice amounts, tax rates, payment methods, payment status, and information relating to refunds and credit notes. The accounting information required for our financial records is prepared through the relevant interfaces for further processing in DATEV and transferred to the DATEV applications used by us or our tax advisers. Where necessary, electronic invoices and related accounting documents may also be processed. Processing is carried out for the purposes of proper invoicing, financial accounting, payment reconciliation, tax documentation, and compliance with statutory record-keeping obligations. The legal basis is Article 6(1)(b) GDPR, insofar as processing is necessary to perform the purchase contract and issue invoices, and Article 6(1)(c) GDPR in conjunction with the applicable commercial and tax-related legal obligations. Where external service providers process personal data on our behalf, the appropriate data processing agreements apply. Invoice and accounting information is retained in accordance with the applicable statutory retention periods, which may be six, eight, or ten years depending on the type of document. Following expiry of the relevant retention periods, the data is deleted unless further statutory obligations or other lawful grounds justify continued storage.

10. Payment Processing

To provide secure and reliable payment processing, we offer various electronic payment methods. We use Shopify Payments as well as separately integrated payment service providers, particularly PayPal and Klarna. Depending on the selected payment method, the information necessary to process the transaction is transmitted to the relevant payment service provider. This may include your name, billing address, email address, order amount, currency, order number, and other payment-related information. The transfer is necessary to process your selected payment method and fulfil the purchase contract, pursuant to Article 6(1)(b) GDPR. Payment providers may process additional information to comply with legal verification and documentation requirements or to prevent fraud, where an appropriate legal basis exists.

Credit and Debit Card Payments via Shopify Payments

Credit and debit card payments in our online store are processed through Shopify Payments. The card and transaction information required to authorise and complete the payment is processed within the designated payment infrastructure. Depending on the card used and the financial institutions involved, payment networks and additional technical service providers may participate in the transaction. Security checks and fraud prevention measures may be carried out during payment processing. Complete payment card details are not made available to us as freely accessible order information within the standard Shopify administration interface. We receive the information necessary to identify and manage the payment, process refunds, and handle any payment disputes. Further information about Shopify Payments is available at https://www.shopify.com/legal/privacy.

Payments via Apple Pay

Where technically supported, you may pay for purchases in our online store using Apple Pay. Apple Pay is a digital payment service provided by Apple that enables an accelerated and technically secured payment process. In our store, the payment itself is processed through the payment infrastructure supported by Shopify Payments. When Apple Pay is used, the information required to authorise and execute the transaction is processed between the relevant device, participating payment service providers, and financial institutions. Technical security mechanisms and transaction-specific payment identifiers are used during this process. Your complete actual card number is not disclosed to us in the standard Apple Pay transaction. Where Apple independently processes personal data in connection with the provision of Apple Pay, Apple's applicable privacy information also applies. Further information is available at https://www.apple.com/legal/privacy/.

Payments via PayPal

If you select PayPal, payment processing is carried out through the separately integrated PayPal payment service. For customers in the European Economic Area, the relevant provider is generally PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. The order and transaction information required to complete the payment is transmitted to PayPal. PayPal processes personal data for purposes including payment execution, transaction verification, fraud prevention, and compliance with legal obligations. Depending on the PayPal payment function selected, additional verification procedures may be required. Where PayPal processes personal data as an independent data controller, its own privacy policy applies. Further information is available at https://www.paypal.com/de/legalhub/paypal/privacy-full.

Payments via Klarna

For certain orders, we offer payment through the separately integrated payment service provider Klarna. This includes, in particular, the "Pay Later" payment option. The relevant provider is generally Klarna Bank AB (publ), Stockholm, Sweden. If you select this payment method, the information required to process the transaction is transferred to Klarna. This may include your name, address, contact details, order amount, information about the products ordered, and additional payment-related details. As "Pay Later" is a deferred payment method, Klarna may independently conduct creditworthiness, identity, and risk assessments when evaluating eligibility for this payment option. Where applicable, information obtained from external credit reference agencies may be taken into account. Klarna determines whether the selected payment option can be offered in accordance with its own terms, conditions, and assessment procedures. We generally receive the payment status information required for order and payment administration, but not all information Klarna processes during its own creditworthiness assessments. Personal data independently processed by Klarna is subject to Klarna's privacy policy. Further information is available at https://www.klarna.com/international/privacy-policy/.

Retention of Payment Information

We retain payment and transaction information only for as long as necessary to perform the contract, process refunds and complaints, and comply with statutory retention obligations. Commercial and tax-related payment and accounting documents are subject to the applicable statutory retention periods. Any additional retention of personal data by independently responsible payment service providers is governed by their respective privacy policies and legal obligations.

11. Shipping and Delivery

To organise and fulfil the delivery of purchased goods, we process the personal data necessary for shipping and delivery. For the technical management of our shipping processes, we use, among other services, DHL Express Commerce, which is integrated into Shopify. The information processed may include the recipient's name, delivery address, company name where applicable, order and tracking numbers, shipment information, and an email address or telephone number where necessary for delivery. Processing is carried out to generate shipping labels, organise and complete transportation, provide shipment tracking, and handle returns or complaints where applicable. The legal basis is Article 6(1)(b) GDPR. Where shipping is subject to statutory documentation or customs obligations, processing is additionally based on Article 6(1)(c) GDPR. For international shipments, it may be necessary to transfer certain recipient and shipment information to customs authorities, participating DHL companies, and additional logistics partners in the destination country. Data is retained according to the requirements of the shipping process and applicable statutory retention obligations. Where transportation providers independently process personal data for additional purposes, their respective privacy policies apply.

12. Contact and Customer Service

If you contact us by email, telephone, contact form, or another communication channel, we process the personal data you provide. This may include your name, email address, telephone number, the content of your message, and relevant order information. The information is used to respond to your enquiry and conduct any necessary further communication. Where your enquiry relates to an existing contract or pre-contractual measures, processing is based on Article 6(1)(b) GDPR. For general enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to respond to enquiries appropriately and efficiently. The relevant information is generally deleted once the enquiry has been resolved and no statutory retention obligation or other lawful basis justifies continued storage.

13. Newsletters and Electronic Marketing

We offer visitors to our online store the opportunity to subscribe to our newsletter. Through our newsletter, we provide information about products, news, special offers, and selected marketing campaigns. We use Shopify Messaging, a marketing service integrated into the Shopify platform, to manage and send newsletters and automated marketing emails. When you subscribe, we process your email address, your name where applicable, your preferred language, your marketing subscription status, and information relating to your registration and subsequent confirmation. The legal basis for sending newsletters is your express consent under Article 6(1)(a) GDPR. Creating a customer account or applying for B2B access does not automatically subscribe you to our newsletter.

Double Opt-In Procedure

To protect against unauthorised newsletter registrations, we use a double opt-in procedure. After entering your email address and submitting the newsletter registration form, you will first receive an automated confirmation email. This message contains a confirmation link through which you can actively confirm your subscription. Your email address will only be activated for regular newsletter delivery after successful confirmation. The confirmation email is used exclusively to verify your subscription and does not contain independent advertising content. To document and demonstrate your consent, we process the information available in Shopify relating to the registration procedure and confirmed marketing subscription status. Where technically recorded, this may include the registration date and time, confirmation date and time, registration source, and other information necessary to demonstrate consent. Processing of these records serves to comply with our legal obligations concerning consent documentation and, where applicable, to defend against legal claims.

Welcome Offers and Discount Codes

As part of selected newsletter campaigns, we may offer new subscribers a discount code for their next purchase. Where such an offer is conditional upon a confirmed newsletter subscription, the discount code is sent only after successful completion of the double opt-in procedure. The welcome email containing the relevant discount code is automatically sent through Shopify Messaging. The personal data required for this purpose is processed on the basis of the newsletter consent provided under Article 6(1)(a) GDPR.

Analysis of Marketing Emails

We use Shopify Messaging's analytical features to evaluate and improve our newsletters. This may involve processing information relating to email delivery, email openings, clicks on links included in messages, unsubscribes, and spam complaints. Technical tracking methods, particularly tracking pixels embedded in emails, may be used to measure email openings. Such technologies may make it possible to determine whether an email has been opened. Link-click information may also provide insights into which content is of interest to recipients. Where separate consent is legally required for such processing, the personal data is analysed only on the basis of valid consent under Article 6(1)(a) GDPR and in compliance with other applicable data protection requirements.

Withdrawal of Consent and Unsubscription

You may withdraw your consent to receive our newsletter at any time with effect for the future. You can unsubscribe using the link provided in every marketing email. Alternatively, you may contact us at info@dsvline.com. Following unsubscription, your marketing subscription status will be updated accordingly. You will no longer receive newsletters based on the withdrawn consent. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Retention of Newsletter Data

Your contact information is generally processed for as long as valid newsletter consent remains in place. Following withdrawal or unsubscription, the information is blocked for active marketing purposes or removed from the relevant mailing list. Information necessary to document the original consent and its withdrawal may be retained beyond that point where required to comply with legal documentation obligations or defend against potential claims. Campaign and interaction data is retained in accordance with the relevant processing purposes and actual applicable retention arrangements.

14. Cookies and Similar Technologies

Our online store uses cookies and similar technologies to provide the website and enable certain functions. We distinguish between strictly necessary technologies and optional analytics, marketing, and personalisation functions. Strictly necessary technologies may be required for shopping cart functionality, checkout, customer logins, security settings, and other expressly requested services. Where consent is legally required to store or access information on your device, the relevant processing takes place only after consent has been obtained. The legal basis for consent-dependent processing of personal data is Article 6(1)(a) GDPR, together with the applicable provisions of Section 25 TDDDG. For technically necessary processing of personal data, Article 6(1)(b) or Article 6(1)(f) GDPR may apply, depending on the circumstances. You can change or withdraw your consent at any time through the privacy or cookie settings provided on our website. The retention period of individual cookies and similar technologies depends on their respective functions and the services used.

15. Google Ads and Conversion Tracking

We use Google Ads to advertise our products through Google's advertising network and measure the effectiveness of our advertising campaigns. For users in the European Economic Area, the relevant provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where you have provided the necessary consent, information about your interactions with our website may be processed. This may include advertising clicks, page views, product interactions, orders, technical device information, and online identifiers. This processing enables us to measure advertising performance and optimise our campaigns. The legal basis, where required, is Article 6(1)(a) GDPR together with the applicable provisions of Section 25 TDDDG. You may withdraw your consent at any time with effect for the future through our privacy settings. Personal data may be processed outside the European Economic Area in connection with Google services.

16. Google Merchant Center

We use Google Merchant Center to provide product information for Google services and display our products in relevant search, shopping, and advertising formats. The information processed generally relates to products, such as product names, descriptions, prices, images, and availability. Where personal data is processed in connection with additional advertising, analytics, or conversion measurement functions, the relevant legal bases and consent requirements apply.

17. Store Statistics and General Analytics

We use the statistics and analytics features provided by Shopify to evaluate the commercial and technical performance of our online store. This may involve analysing page views, shopping cart activity, orders, sales, and the use of individual store functions. Where analyses are based on fully anonymised information, the information does not constitute personal data. Where personal data is processed, this takes place on an appropriate legal basis. Where cookies or similar technologies requiring consent are used, they are deployed only in accordance with the applicable consent requirements.

18. Google Analytics

We use Google Analytics to analyse the use of our online store and improve our online services. For users in the European Economic Area, the relevant provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics may process information about page views, website interactions, approximate geographical location, device and browser information, and events such as product views, shopping cart actions, and purchases. Cookies and similar technologies may be used for these purposes. Where consent is required, Google Analytics is activated only after the necessary consent has been provided. The legal basis is Article 6(1)(a) GDPR together with the applicable provisions of Section 25 TDDDG. You may withdraw your consent at any time through our privacy or cookie settings. The retention period for user and event data stored in Google Analytics depends on the retention settings actually configured in our Google Analytics account. Personal data may be processed outside the European Economic Area. Further information is provided in the section entitled "International Data Transfers". Additional information is available at https://policies.google.com/privacy.

19. Meta Pixel and Advertising-Related Data Processing

We use Meta Pixel to measure and optimise our advertising activities on Facebook and Instagram. For users in the European Economic Area, the relevant provider is generally Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta Pixel allows us to understand how visitors interact with our online store after viewing or clicking on an advertisement on a Meta platform. Depending on the configuration, information relating to page views, product views, searches, shopping cart actions, checkout events, and purchases may be collected. Technical connection information, online identifiers, and website interaction data may be processed. Processing is carried out to measure advertising effectiveness and optimise the targeting and delivery of advertising campaigns. Where consent is required, processing takes place only after the necessary consent has been provided under Article 6(1)(a) GDPR and in accordance with Section 25 TDDDG. You may withdraw your consent at any time with effect for the future through our privacy settings. Meta may process personal data outside the European Economic Area in connection with its services. Further information is available at https://www.facebook.com/privacy/policy/.

20. Social Media and Communication Through Social Networks

We maintain business profiles on social networks to provide information about our products and services and communicate with customers and interested parties. When you visit or interact with these profiles, personal data may be processed both by us and by the relevant platform providers. This may include publicly available profile information, comments, messages, reactions, and interaction data. If you contact us through a social network, we process the information you provide to respond to your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual measures. Otherwise, processing is based on Article 6(1)(f) GDPR. The respective platform providers' privacy policies apply to their independent processing activities. Where joint controllership exists for certain processing activities, the relevant rights and obligations are governed by the applicable arrangements.

21. Recipients of Personal Data

Personal data is disclosed to external recipients only within the scope of the respective lawful processing purposes. Recipients may include providers of e-commerce and hosting services, payment service providers, shipping and logistics companies, IT and software providers, customer management and B2B verification service providers, invoicing and accounting service providers, and, where applicable, marketing and analytics providers. The services we use include Shopify, Helium Customer Fields, BSS B2B Lock, Geo, Shopify Messaging, and DHL Express Commerce. For the creation and management of invoices, as well as the transfer and processing of accounting data, we also use software solutions provided by pathway solutions GmbH and DATEV. Where necessary, our appointed tax advisers may access the information required for financial accounting, tax documentation, and compliance with statutory obligations. Personal data may also be disclosed to public authorities and other public bodies where legally required or otherwise permitted. Only the information necessary for the relevant purpose is disclosed. Where service providers process personal data on our behalf, this is governed by the required contractual and data protection arrangements. Where external providers process personal data as independent controllers, their respective privacy policies additionally apply.

22. Retention and Deletion of Personal Data

We generally retain personal data only for as long as necessary to fulfil the relevant processing purpose or comply with statutory retention obligations. Retention periods depend on the type of data, the purpose of processing, existing contractual relationships, and applicable legal requirements.

Customer Accounts

Customer account information is generally processed for the duration of the active customer relationship. When an account is closed, customer data that is no longer required is deleted unless statutory retention obligations or other lawful grounds justify continued storage.

B2B Qualification Documents

Qualification documents submitted during professional customer registration are deleted no later than one year after the approval date if the application is approved. If an application is rejected, the B2B customer account is closed, or the relevant access authorisation is revoked, the documents are deleted without undue delay. This provision applies specifically to documents submitted as evidence of professional qualifications.

Order and Invoice Records

Certain commercial and tax-related documents are subject to statutory retention obligations. Depending on the type of document and the applicable statutory rules, these periods may include ten years for certain commercial books, inventories, financial statements, and other legally specified documents; eight years for accounting vouchers and supporting accounting records; and six years for certain commercial and business correspondence. The relevant retention period generally begins at the end of the calendar year in which the event triggering the retention obligation occurred, unless otherwise provided by law. These statutory retention periods also apply to invoices, credit notes, accounting records, and other documents subject to mandatory retention requirements that are created, processed, or transferred using pathway solutions GmbH and DATEV. Where required by law, the relevant information is retained within the accounting systems used for these purposes and, where applicable, by our appointed service providers. Following expiry of the applicable retention periods, personal data is deleted unless further legal obligations or other lawful grounds justify continued storage.

Newsletter and Marketing Data

Newsletter contact information is generally retained for the duration of valid consent. Following withdrawal, the information is blocked for active marketing purposes or removed from the relevant mailing list. Information necessary to demonstrate consent and its withdrawal may be retained beyond this period where required to fulfil statutory documentation obligations or defend against potential claims.

Shipping Data

Shipping and delivery information is retained for the duration of contract performance and for the handling of returns, complaints, and applicable statutory documentation obligations.

Analytics and Tracking Data

Personal data used for analytics and tracking is processed in accordance with the relevant purposes, consent preferences, and the retention settings actually configured for the services concerned. Following withdrawal of consent, processing activities dependent on that consent are discontinued for the future. Data already collected is deleted or anonymised in accordance with the applicable deletion obligations, unless another lawful basis permits continued processing.

Customer Enquiries

Information relating to customer enquiries is generally deleted once the enquiry has been resolved, unless a legal obligation or another lawful basis justifies continued retention.

Legal Claims

Longer retention may be necessary in individual cases where personal data is required to establish, exercise, or defend legal claims. When the relevant purpose no longer applies and applicable retention periods have expired, personal data is deleted or anonymised unless another lawful basis permits further retention.

23. International Data Transfers

In connection with the operation of our online store and the use of external service providers, personal data may be processed outside the European Union or the European Economic Area. This may involve the international infrastructure of certain e-commerce and software providers, payment service providers, marketing and analytics services, and the processing of international shipments. Where personal data is transferred to recipients in third countries, we comply with the requirements of Articles 44 et seq. GDPR. Such transfers take place only where the applicable legal conditions are met. Depending on the recipient and destination country, the applicable mechanisms may include adequacy decisions under Article 45 GDPR, appropriate safeguards such as the European Commission's Standard Contractual Clauses under Article 46 GDPR, or statutory derogations under Article 49 GDPR in the exceptional circumstances provided for by law. Transfers to appropriately certified organisations in the United States may rely on the relevant adequacy decision under the EU-US Data Privacy Framework, where its conditions are met. Additional technical and organisational protective measures are considered where necessary. For international deliveries, the transfer of necessary recipient and shipment information to transportation providers and customs authorities in the destination country may be required. The specific recipients, destination countries, and safeguards depend on the services actually used and the applicable contractual arrangements. Further information about the safeguards governing individual transfers may be requested by contacting info@dsvline.com.

24. Data Subject Rights and Right to Lodge a Complaint

Subject to the applicable legal requirements, you have various rights concerning the processing of your personal data. These include the right of access under Article 15 GDPR, the right to rectification under Article 16 GDPR, the right to erasure under Article 17 GDPR, the right to restriction of processing under Article 18 GDPR, the right to data portability under Article 20 GDPR, and the right to object under Article 21 GDPR. Subject to the statutory requirements, you may object to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR. Where we process personal data for direct marketing purposes, you have the right to object to such processing at any time. You may also withdraw your consent at any time with effect for the future under Article 7(3) GDPR. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Where automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place, you have the rights provided for under the applicable statutory provisions. To exercise your rights, please contact us at info@dsvline.com.

Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR. In particular, you may lodge a complaint with the supervisory authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement. As our business is located in Hesse, Germany, the Hessian Commissioner for Data Protection and Freedom of Information is generally also a competent supervisory authority. Further information is available at https://datenschutz.hessen.de/.

25. Data Security and Changes to This Privacy Policy

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, and other unlawful processing. Depending on the relevant processing activities, these measures include access restrictions, secure data transmission, permission management, and safeguards for the e-commerce and IT systems used. When selecting and engaging external service providers, we take account of the applicable data protection and technical security requirements. We reserve the right to update this Privacy Policy where our processing activities, service providers, technical functions, or applicable legal requirements change. The current version of this Privacy Policy is available on our website. If you have any questions regarding the processing of your personal data, please contact us at info@dsvline.com.