Privacy Policy

1) Introduction and contact details of the data controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about how we handle your personal data when using our website. “Personal data” means all data with which you can be personally identified.

1.2 The data controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Bertrand Dahi, Alte Eisenacher Str. 25, 99834 Gerstungen, Germany, Tel.: +4915792557024, E-mail: kontakt@eichenhain.com. The data controller responsible for processing personal data is the natural or legal person who decides—alone or jointly with others—on the purposes and means of processing personal data.

2) Data collection when visiting our website

2.1 When our website is used purely for information purposes—that is, when you do not register or otherwise provide us with information—we only collect the data that your browser transmits to the website server (so-called “server log files”). When you access our website, we collect the following data that is technically necessary for us to display the website to you:

Our website that you accessed
Date and time of access
Amount of data sent in bytes
Source/Referrer, from which you reached the page
Browser used
Operating system used
IP address used (if applicable: in anonymised form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. Disclosure or other use of the data does not take place. However, we reserve the right to review the server log files retrospectively if specific indications suggest unlawful use.

2.2 For security reasons and to protect the transfer of personal data and other confidential content (e.g., orders or inquiries to the data controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock symbol in your browser’s address bar.

3) Hosting & Content-Delivery-Network

For hosting our website and displaying page content, we use a provider that provides its services itself or through selected subcontractors exclusively on servers within the European Union.

All data collected on our website are processed on these servers.

We have entered into a data processing agreement with the provider to ensure the protection of the data of our website visitors and to prohibit unauthorised disclosure to third parties.

4) Cookies

To make our website visits more appealing and to enable the use of certain functions, we use cookies—small text files that are stored on your device. Some of these cookies are automatically deleted again after you close the browser (so-called “session cookies”), while others remain on your device longer and enable the storage of page settings (so-called “persistent cookies”). In the latter case, you can find the storage period in the overview of the cookie settings of your web browser.

Where personal data is processed through individual cookies used by us, processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR in the event of consent given, or in accordance with Art. 6(1)(f) GDPR for the safeguarding of our legitimate interests in ensuring the best possible functionality of the website and a customer-friendly and effective design of the website visit.

You can configure your browser so that you are informed about the setting of cookies and you can decide individually whether to accept them, or you can generally exclude acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be restricted.

5) Contacting us

5.1 Your own review reminder

Based solely on your express consent pursuant to Art. 6(1)(a) GDPR, we use your e-mail address to send you a one-time reminder to submit a review of our services after contract performance. You can withdraw your consent at any time by sending a message to the person responsible for data processing.

5.2 ShopVote

To send review reminders, we use the services of the following provider: Blickreif GmbH, Schulstraße 46, 80634 Munich, Germany

Based solely on your express consent pursuant to Art. 6(1)(a) GDPR, we transmit your e-mail address and, if applicable, other customer data to the provider so that it can contact you by e-mail with a review reminder.

You can withdraw your consent at any time with effect for the future, either from us or from the provider.

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits unauthorised disclosure to third parties.

5.3 WhatsApp Business

You have the option to contact us via the WhatsApp messaging service of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this, we use the so-called “Business Version” of WhatsApp.

If you contact us via WhatsApp in connection with a specific matter (for example, an order you placed), we store and use the mobile phone number that you use on WhatsApp and—if provided—your first and last name in accordance with Art. 6(1)(b) GDPR for the purpose of processing and responding to your request. On the basis of the same legal basis, we may ask you via WhatsApp to provide additional data (order number, customer number, address or e-mail address) so that we can assign your request to a specific transaction.

If you use our WhatsApp contact for general inquiries (for example, about the range of services, availability, or our website), we store and use the mobile phone number that you use on WhatsApp and—if provided—your first and last name in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing the requested information efficiently and promptly.

Your data is always used only to respond to your request via WhatsApp. There is no disclosure to third parties.

Please note that WhatsApp Business receives access to the address book of the mobile device used by us for this purpose and automatically transmits the phone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account, we use a mobile device on which the address book stores exclusively the WhatsApp contact details of those users who have also contacted us via WhatsApp.

This ensures that each person whose WhatsApp contact details are stored in our address book has already consented—when first using the app on their device—to the transmission of their WhatsApp phone number from the address books of their chat contacts by accepting the WhatsApp Terms of Use, in accordance with Art. 6(1)(a) GDPR. In this context, the transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is excluded.

For the purpose and scope of data collection and the further processing and use of the data by WhatsApp, as well as your rights in this regard and your available settings to protect your privacy, please refer to WhatsApp’s privacy notices: https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits unauthorised disclosure to third parties.

As part of the processing described above, data transfers to Meta Platforms Inc. servers in the USA may occur.

For transfers of data to the USA, the provider has joined the EU–US Data Privacy Framework (EU-US Data Privacy Framework), which ensures compliance with the level of European data protection on the basis of an adequacy decision by the European Commission.

5.4 As part of contacting us (e.g., via a contact form or e-mail), personal data is processed—exclusively for the purpose of processing and responding to your request and only to the extent required for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. If your contact is directed towards concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis for processing. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided there are no statutory retention obligations.

6) Data processing when opening a customer account

In accordance with Art. 6(1)(b) GDPR, personal data is further collected and processed to the extent required if you provide this to us when opening a customer account. Which data are required for opening the account can be found in the input form of the corresponding form on our website.

You can delete your customer account at any time and this can be done by sending a message to the above-mentioned address of the data controller. After deletion of your customer account, your data will be deleted unless all contracts concluded are fully processed, no statutory retention periods conflict with deletion, and we do not have any legitimate interest in further storage.

7) Use of customer data for direct marketing

7.1 Subscription to our e-mail newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our offers. The mandatory information for sending the newsletter is only your e-mail address. Providing additional data is voluntary and is used so that we can address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter after you have explicitly confirmed your consent to receive the newsletter by clicking a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR. We store your IP address registered by your Internet Service Provider (ISP), as well as the date and time of registration, so that any misuse of your e-mail address can be traced at a later time. The data that we collect when you subscribe to the newsletter is used strictly for the stated purpose.

You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a corresponding message to the responsible party stated at the beginning. After you unsubscribe, your e-mail address will be deleted from our newsletter distribution list immediately, unless you have explicitly consented to further use of your data or we have reserved the right to use your data beyond that, where such use is legally permitted and we inform you about it in this statement.

7.2 ActiveCampaign

Our e-mail newsletters are sent via the following provider: ActiveCampaign, LLC, 150 N. Michigan Ave Suite 1230, Chicago, IL, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we transfer the data you provide when subscribing to the newsletter according to Art. 6(1)(f) GDPR to this provider so that it can handle the newsletter sending on our behalf.

Subject to your express consent in accordance with Art. 6(1)(a) GDPR, the provider also performs statistical success analysis of newsletter campaigns using web beacons and/or tracking pixels in the sent e-mails, which can measure open rates and specific interactions with the newsletter content. In this context, device information (e.g., time of access, IP address, browser type and operating system) is also collected and analysed, but it is not combined with other data sets.

You can withdraw your consent to newsletter tracking at any time with effect for the future.

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits unauthorised disclosure to third parties.

7.3 E-mail notification of product availability

For items that are temporarily unavailable, you can subscribe to receive e-mail notifications about their availability. In this case, we will send you a one-time message by e-mail regarding the availability of the particular item you selected. The mandatory information for sending this notification is only your e-mail address. Providing additional data is voluntary and will be used, if applicable, so that we can address you personally. For sending the e-mail, we use the so-called double opt-in procedure, which ensures that you only receive a notification once you have explicitly confirmed your consent for this by clicking a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR. In this context, we store your IP address registered by your Internet Service Provider (ISP), as well as the date and time of registration, so that any misuse of your e-mail address can be traced at a later time. The data that we collect when you register for our e-mail notification service for product availability is used strictly for the stated purpose.

You can unsubscribe from the availability notifications at any time by sending a corresponding message to the responsible party stated at the beginning. After you unsubscribe, your e-mail address will be deleted from our distribution list set up for this purpose immediately, unless you have explicitly consented to further use of your data or we have reserved the right to use your data beyond that, where such use is legally permitted and we inform you about it in this statement.

7.4 E-mail reminders for the shopping cart

If you stop your purchase with us before completing the order, you have the option to receive a one-time reminder by e-mail about the contents of your virtual shopping cart.

The mandatory information for sending this reminder is only your e-mail address. Providing additional data is voluntary and may be used, if applicable, so that we can address you personally. For sending the e-mail, we use the so-called double opt-in procedure, which ensures that you only receive a notification once you have explicitly confirmed your consent for this by clicking a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR for sending a shopping cart reminder. In this context, we store your IP address registered by your Internet Service Provider (ISP), as well as the date and time of registration, so that any misuse of your e-mail address can be traced at a later time. The data that we collect when you register for our e-mail notification service is used strictly for the stated purpose.

You can unsubscribe from the shopping cart reminders at any time by sending a corresponding message to the responsible party stated at the beginning. After you unsubscribe, your e-mail address will be deleted from our distribution list set up for this purpose immediately, unless you have explicitly consented to further use of your data or we have reserved the right to use your data beyond that, where such use is legally permitted and we inform you about it in this statement.

8) Data processing for order fulfilment

8.1 To the extent required for contract processing for delivery and payment purposes, the personal data we collect will be transferred in accordance with Art. 6(1)(b) GDPR to the commissioned shipping company and the commissioned financial institution.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we process the contact details you provided when placing the order in order to inform you personally as part of our statutory information obligations in accordance with Art. 6(1)(c) GDPR. In this context, your contact details are used strictly for notifications about updates we owe you and are processed by us only to the extent required for the respective information.

To process your order, we also work with the service(s) provider(s) listed below, who support us wholly or partly in carrying out the contracts concluded. Certain personal data are transferred to these service providers in accordance with the information below.

8.2 Monta

For order processing, we use the following provider: Monta Krefeld GmbH, Märkische Straße 10, 47809 Krefeld

Name, address and any other personal data will be transferred exclusively to the provider for the purpose of processing the online order in accordance with Art. 6(1)(b) GDPR. The transfer of your data is made only to the extent that this is actually required for processing your order.

8.3 Transfer of personal data to shipping service providers

- DHL

As a shipping service provider, we use the following provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

We transfer your e-mail address and/or phone number to the provider in accordance with Art. 6(1)(a) GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or sending a delivery notification, provided that you have granted your express consent for this during the ordering process. Otherwise, for the purpose of delivery in accordance with Art. 6(1)(b) GDPR, we transfer only the recipient’s name and delivery address to the provider. The transfer occurs only to the extent required for delivery of the goods. In this case, prior coordination of the delivery date with the provider or a delivery notification is not possible.

You may withdraw your consent at any time with effect for the future by contacting the data controller named above or the provider.
- UPS

As a shipping service provider, we use the following provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

You may withdraw your consent at any time with effect for the future by contacting the data controller named above or the provider.

8.4 Use of payment service providers (payment services)

- Klarna

On this website, one or more online payment methods offered by the following provider are available: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

When you select a payment method offered by the provider in which you pay in advance (e.g., credit card payment), the provider receives your payment details (including name, address, bank and payment card information, currency and transaction number) that you provide during the ordering process, as well as information about the contents of your order in accordance with Art. 6(1)(b) GDPR. In this case, the transfer of your data is carried out exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

When you select a payment method offered by the provider in which the provider pays in advance (e.g., invoice or instalment purchase or direct debit), you are also asked during the ordering process to provide certain personal information (first and last name, street, house number, postal code, city, date of birth, e-mail address, phone number, and—if applicable—data about an alternative payment method).

To protect our legitimate interest in verifying the creditworthiness of our customers, we transfer this data to the provider for the purpose of a credit check in accordance with Art. 6(1)(f) GDPR. Based on the personal data you provide and other data (such as shopping cart, invoice amount, order history, payment experiences), the provider checks whether the payment method you have selected can be granted with regard to payment default and/or receivables default risks.

For the decision as part of the application review, in addition to provider-internal criteria in accordance with Art. 6(1)(f) GDPR, identity and creditworthiness information from the following credit reference agencies may also be used:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may include probability values (so-called score values). Where score values are included in the result of the credit report, their basis is a scientifically recognised mathematical-statistical procedure. The calculation of score values includes, among other things, but not exclusively, address data.

You can object at any time to this processing of your data by sending a message to us or to the provider. However, the provider may continue to be entitled to process your personal data if this is necessary for contractually compliant payment processing.
- Mollie

On this website, one or more online payment methods offered by the following provider are available: Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands

On this website, one or more online payment methods offered by the following provider are available: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

When you select a payment method offered by the provider in which you pay in advance, the provider receives your payment details (including name, address, bank and payment card information, currency and transaction number) that you provide during the ordering process, as well as information about the contents of your order in accordance with Art. 6(1)(b) GDPR. In this case, the transfer of your data is carried out exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

When you select a payment method offered by the provider in which we pay in advance, you are also asked during the ordering process to provide certain personal information (first and last name, street, house number, postal code, city, date of birth, e-mail address, phone number, and—if applicable—data about an alternative payment method).

To protect our legitimate interest in verifying your creditworthiness in such cases, we transfer this data to the provider for the purpose of a credit check in accordance with Art. 6(1)(f) GDPR. Based on the personal data you provide and other data (such as shopping cart, invoice amount, order history, payment experiences), the provider checks whether the payment method you have selected can be granted with regard to payment default and/or receivables default risks.

On this website, one or more online payment methods offered by the following provider are available: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

8.5 Electronic withdrawal function for distance selling contracts

Consumers who enter into contracts on this website for which there is a statutory right of withdrawal have the option to declare their withdrawal using an electronic withdrawal function in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to details for identifying the contract to be withdrawn from, you must provide or confirm additional personal information such as your first and last name and the consumer’s e-mail address.

The collection of this information and its transmission to us is carried out in accordance with Art. 6(1)(b) GDPR and only to the extent required for the proper handling of the withdrawal. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the withdrawal declaration by e-mail. Another legal basis for processing is Art. 6(1)(c) GDPR. We are legally required to maintain an electronic withdrawal function for paid-for consumer distance selling contracts.

9) Page functionalities

9.1 ShopVote graphics

On our website, graphic elements from the following provider are integrated for displaying external customer reviews and/or an externally awarded quality seal: Blickreif GmbH, Schulstraße 46, 80634 Munich, Germany

When you access a page of our web presence that contains such graphic elements, your browser establishes a direct connection to the provider’s servers in order to load the elements correctly. In this process, certain browser information is transmitted to the provider, including your IP address.

If personal data is also processed in this context, it is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the optimal marketing of our offering and the appealing design of our website.

9.2 - Cloudflare Turnstile

On this website, we use the CAPTCHA service of the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA

The service checks whether an input is made by a natural person or is carried out in a fraudulent manner through machine-based and automated processing, and blocks spam, DDoS attacks and similar automated malicious attempts. To ensure that an action is performed by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the device used, identifying data of the type of browser and operating system used, as well as the date and duration of the visit, and transmits this for evaluation to the provider’s servers.

The legal basis is our legitimate interest in establishing individual responsibility online and preventing abuse and spam in accordance with Art. 6(1)(f) GDPR.

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU–US Data Privacy Framework (EU-US Data Privacy Framework), which ensures compliance with the level of European data protection on the basis of an adequacy decision by the European Commission.

10) Tools and miscellaneous

Lexware Office

To manage our bookkeeping, we use the service of the cloud-based accounting software of the following provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany

The provider processes incoming and outgoing invoices and, if applicable, also our company’s bank transactions in order to automatically record invoices, match them to transactions and, based on this, create our financial accounting through a partially automated process.

If personal data is processed in this process, processing is carried out on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions in accordance with Art. 6(1)(f) GDPR.

11) Rights of the data subject

11.1 The applicable data protection law grants you, as against the data controller, the following rights of the data subject (rights of access and intervention) with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions for exercising the rights:

Right of access under Art. 15 GDPR;
Right to rectification under Art. 16 GDPR;
Right to erasure under Art. 17 GDPR;
Right to restriction of processing under Art. 18 GDPR;
Right to notification under Art. 19 GDPR;
Right to data portability under Art. 20 GDPR;
Right to withdraw consent granted under Art. 7(3) GDPR;
Right to lodge a complaint under Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA IN THE CONTEXT OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERriding LEGITIMATE INTERESTS, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNING YOU. HOWEVER, WE MAY CONTINUE TO PROCESS THE DATA IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.

By exercising your right to object, we will cease processing the data concerning you for the purposes of direct marketing.

12) Duration of storage of personal data

The duration of storage of personal data depends on the respective legal basis, the purpose of processing and—if applicable—also on the applicable statutory retention periods (e.g., retention periods under commercial and tax law).

Where personal data is processed on the basis of express consent in accordance with Art. 6(1)(a) GDPR, the data will be stored until you withdraw your consent.

Where there are statutory retention periods for data processed as part of contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, such data are deleted routinely after expiry of the retention periods, unless the data are no longer required for contract performance or initiation and/or we do not have any legitimate interest in further storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, it will be stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, it will be stored until you exercise your right to object under Art. 21(2) GDPR.

Insofar as the other information in this statement does not specify otherwise for specific processing situations, stored personal data will also be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.

Last updated: 21.07.2026, 10:47:03