Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website, and we thank you for your interest. Below, we inform you about how we handle your personal data when using our website. Personal data in this context means all data that can be used to personally identify you.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Bertrand Dahi, Alte Eisenacher Str. 25, 99834 Gerstungen, Germany, Tel.: +4915792557024, E-mail: kontakt@eichenhain.com. The controller responsible for processing personal data is the natural or legal person that determines, alone or jointly with others, the purposes and means of processing personal data.

2) Data collection when visiting our website

2.1 When our website is used purely for informational purposes—i.e., when you do not register and do not otherwise provide us with information—we only collect the data that your browser transmits to our web server (so-called “server log files”). When you access our website, we collect the following data that is technically necessary for us to display the website to you:

The website you have visited
Date and time of access
Amount of data sent in bytes
Source/Referrer, i.e., the page from which you reached us
Browser used
Operating system used
Used IP address (if applicable: in anonymised form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. No disclosure or other use of the data takes place. However, we reserve the right to subsequently review the server log files should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transfer of personal data and other confidential content (e.g., orders or requests to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock symbol in your browser’s address bar.

3) Hosting & Content Delivery Network

For hosting our website and for displaying the page contents, we use a provider that delivers its services itself or through selected subcontractors exclusively on servers located within the European Union.

All data collected on our website is processed on these servers.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

4) Cookies

To make your visit to our website more appealing and to enable the use of certain functions, we use cookies, i.e., small text files that are stored on your device. Some of these cookies are automatically deleted again after you close your browser (so-called “session cookies”); in other cases, these cookies remain on your device longer and allow the saving of page settings (so-called “persistent cookies”). In the latter case, you can find the storage period in the overview of the cookie settings in your web browser.

Where personal data is also processed by individual cookies used by us, processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR in the case of consent given, or in accordance with Art. 6(1)(f) GDPR for the safeguarding of our legitimate interests in the best possible functionality of the website and a customer-friendly and efficient design of your visit to the site.

You can configure your browser so that you are informed about the setting of cookies and decide individually whether to accept them, or exclude the acceptance of cookies for certain cases or generally.

Please note that if cookies are not accepted, the functionality of our website may be restricted.

5) Contacting us

5.1 Personal review reminder

Based exclusively on your express consent in accordance with Art. 6(1)(a) GDPR, we use your e-mail address to send you a one-time reminder to submit a review of our services after contract performance. You may withdraw your consent at any time by sending a message to the controller responsible for data processing.

5.2 ShopVote

For review reminders, we use the services of the following provider: Blickreif GmbH, Schulstraße 46, 80634 Munich, Germany

Based exclusively on your express consent in accordance with Art. 6(1)(a) GDPR, we transfer your e-mail address and, if applicable, other customer data to the provider so that it can contact you by e-mail with a review reminder.

You can withdraw your consent at any time with effect for the future, either by contacting us or the provider.

We have entered into a data processing agreement with the provider that ensures the protection of the data of our website visitors and prohibits unauthorised disclosure to third parties.

5.3 WhatsApp Business

You have the option to contact us via the WhatsApp messaging service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this, we use the so-called “Business version” of WhatsApp.

If you contact us via WhatsApp in connection with a specific business matter (for example a placed order), we store and use the mobile number you used on WhatsApp and—if provided—your first and last name in accordance with Art. 6(1)(b) GDPR to process and respond to your request. On the basis of the same legal ground, we may ask you via WhatsApp to provide further data (order number, customer number, address or e-mail address) so that we can assign your request to a specific transaction.

If you use our WhatsApp contact for general enquiries (e.g., about our range of services, availability, or our online presence), we store and use the mobile number you used on WhatsApp and—if provided—your first and last name in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the efficient and timely provision of the requested information.

Your data is always used only to respond to your enquiry via WhatsApp. No disclosure to third parties takes place.

Please note that WhatsApp Business receives access to the address book of the mobile device we use for this purpose and automatically transmits telephone numbers stored in the address book to a server of the parent group, Meta Platforms Inc., in the USA. To operate our WhatsApp Business account, we use a mobile device whose address book contains only the WhatsApp contact details of users who have also contacted us via WhatsApp.

This ensures that each person whose WhatsApp contact details are stored in our address book has already consented, when using the app for the first time on their device, to the transmission of their WhatsApp telephone number from the address books of their chat contacts by accepting the WhatsApp Terms of Use, in accordance with Art. 6(1)(a) GDPR. Insofar as data is concerned, the transmission of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is excluded.

You can find the purpose and scope of data collection and the further processing and use of the data by WhatsApp, as well as your rights and settings options in relation to the protection of your privacy, in WhatsApp’s privacy notices: https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

As part of the processing described above, it may involve transfers of data to servers of Meta Platforms Inc. in the USA.

For transfers of data to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level on the basis of an adequacy decision of the European Commission.

5.4 In the context of contacting us (e.g., via a contact form or e-mail), personal data is processed—exclusively for the purpose of processing and responding to your request and only to the extent required for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your enquiry in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at entering into a contract, Art. 6(1)(b) GDPR is an additional legal basis for processing. Your data will be deleted when it can be seen from the circumstances that the relevant matter has been conclusively clarified and unless any statutory retention obligations apply.

6) Data processing when opening a customer account

In accordance with Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required for account creation can be found in the input form of the relevant form on our website.

Deleting your customer account is possible at any time and can be done by sending a message to the controller address stated above. After deletion of your customer account, your data will be deleted provided that all contracts concluded thereunder have been fully settled, no statutory retention periods conflict with this, and we do not have any legitimate interest in further storage.

7) Use of customer data for direct marketing

7.1 Subscription to our e-mail newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your e-mail address. Providing additional data is voluntary and is used to enable us to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter after you have expressly confirmed your consent to receive the newsletter by clicking a verification link sent to the specified e-mail address.

By activating the confirmation link, you grant us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR. In doing so, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of registration, so that any misuse of your e-mail address can be traced at a later point in time. The data collected by us when you register for the newsletter is used strictly for the stated purposes.

You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning. After successful unsubscription, your e-mail address will be deleted immediately from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this, where such use is permitted by law and we inform you about it in this declaration.

7.2 ActiveCampaign

Our e-mail newsletters are sent via the following provider: ActiveCampaign, LLC, 150 N. Michigan Ave Suite 1230, Chicago, IL, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we forward the data you provide when subscribing to the newsletter to this provider pursuant to Art. 6(1)(f) GDPR so that it can take over the newsletter dispatch on our behalf.

Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider additionally performs statistical success analysis of newsletter campaigns by means of web beacons and/or tracking pixels in the sent e-mails, which can measure open rates and specific interactions with the newsletter contents. In this process, end device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated, but is not combined with other data sets.

You can withdraw your consent for newsletter tracking at any time with effect for the future.

We have entered into a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level on the basis of an adequacy decision by the European Commission.

7.3 E-mail notification of product availability

For temporarily unavailable items, you can subscribe to receive e-mail notifications about availability. In this case, we send you an e-mail once to inform you about the availability of the item you selected. The mandatory information for sending this notification is your e-mail address alone. Providing additional data is voluntary and may be used to address you personally. For e-mail dispatch, we use the so-called double opt-in procedure, which ensures that you only receive a notification after you have expressly confirmed your consent to this matter by clicking a verification link sent to the specified e-mail address.

By activating the confirmation link, you grant us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR. In doing so, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of registration, so that any misuse of your e-mail address can be traced at a later point in time. The data we collect when you sign up for our e-mail availability notification service is used strictly for the stated purposes.

You can unsubscribe from availability notifications at any time by sending a corresponding message to the controller named at the beginning. After successful unsubscription, your e-mail address will be deleted immediately from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this where such use is permitted by law and we inform you about it in this declaration.

7.4 E-mail cart reminders

If you abandon your purchase with us before completing the order, you have the option to receive a one-time e-mail reminder about the contents of your virtual shopping cart.

The mandatory information for sending this reminder is your e-mail address alone. Providing additional data is voluntary and may be used, if applicable, to address you personally. For e-mail dispatch, we use the so-called double opt-in procedure, which ensures that you only receive a notification after you have expressly confirmed your consent to this by clicking a verification link sent to the specified e-mail address.

By activating the confirmation link, you grant us your consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR for the sending of a cart reminder. In doing so, we store your IP address as recorded by your Internet Service Provider (ISP), as well as the date and time of registration, so that any misuse of your e-mail address can be traced at a later point in time. The data we collect when you sign up for our e-mail notification service is used strictly for the stated purposes.

You can unsubscribe from cart reminders at any time by sending a corresponding message to the controller named at the beginning. After successful unsubscription, your e-mail address will be deleted immediately from the distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this where such use is permitted by law and we inform you about it in this declaration.

8) Data processing for order fulfilment

8.1 To the extent required for contract performance for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned shipping company and the commissioned financial institution in accordance with Art. 6(1)(b) GDPR.

If, on the basis of an appropriate agreement, we owe you updates for goods with digital elements or for digital products, we process the contact details you provide when ordering in order to inform you personally within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. In this context, your contact details are used strictly for communications about updates we owe you and are processed by us only to the extent necessary for the respective information.

For the fulfilment of your order, we also work with the following service provider(s) that support us, in whole or in part, in carrying out concluded contracts. Certain personal data is transferred to these service providers in accordance with the information below.

8.2 Monta

For order fulfilment, we use the following provider: Monta Krefeld GmbH, Märkische Straße 10, 47809 Krefeld

Name, address and, where applicable, other personal data are transferred to the provider exclusively for the purpose of fulfilling the online order, in accordance with Art. 6(1)(b) GDPR. In this case, your data is only passed on to the extent that it is actually necessary for order fulfilment.

8.3 Disclosure of personal data to shipping service providers

- DHL

As shipping service provider, we use the following provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

We pass on your e-mail address and/or telephone number to the provider in accordance with Art. 6(1)(a) GDPR before delivery of the goods, for the purpose of coordinating a delivery date or providing delivery notification, provided that you have given your express consent for this in the ordering process. Otherwise, for delivery purposes, we pass only the recipient’s name and delivery address to the provider in accordance with Art. 6(1)(b) GDPR. The disclosure takes place only to the extent required for delivering the goods. In this case, prior coordination of the delivery date with the provider and/or delivery notification is not possible.

Your consent may be withdrawn at any time with effect for the future by notifying the controller identified above or by notifying the provider.
- UPS

As shipping service provider, we use the following provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

Your consent may be withdrawn at any time with effect for the future by notifying the controller identified above or by notifying the provider.

8.4 Use of payment service providers (payment services)

- Klarna

On this website, one or more online payment methods offered by the following provider are available: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method provided by the provider in which you pay in advance (e.g., credit card payment), your payment details provided during the ordering process (including name, address, bank and credit card information, currency and transaction number) and information about the contents of your order are passed on to them in accordance with Art. 6(1)(b) GDPR. In this case, your data is transferred exclusively for the purpose of payment processing with the provider and only to the extent required for that purpose.

If you select a payment method where the provider pays in advance (e.g., invoice or instalment purchase or direct debit), you are also asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number, and possibly details regarding an alternative payment method).

In order to safeguard our legitimate interest in verifying our customers’ ability to pay, we forward this data to the provider for the purpose of a creditworthiness check in accordance with Art. 6(1)(f) GDPR. The provider assesses, based on the personal data you provide as well as further data (such as shopping cart, invoice amount, order history, payment experiences), whether the payment method you selected can be granted with regard to payment and/or default risk.

For the decision within the framework of the application assessment, in addition to criteria internal to the provider pursuant to Art. 6(1)(f) GDPR, identity and creditworthiness information from the following credit reference agencies may also be taken into account:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The creditworthiness report may contain probability values (so-called score values). If score values are included in the result of the creditworthiness report, they are based on a scientifically recognised mathematical and statistical procedure. Address data is included in the calculation of the score values, among other things, but not exclusively.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may nevertheless continue to be entitled to process your personal data if this is necessary for contractually compliant payment processing.
- Mollie

On this website, one or more online payment methods offered by the following provider are available: Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, the Netherlands

On this website, one or more online payment methods offered by the following provider are available: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method provided by the provider in which you pay in advance, your payment details provided during the ordering process (including name, address, bank and credit card information, currency and transaction number) and information about the contents of your order are passed on to them in accordance with Art. 6(1)(b) GDPR. In this case, your data is transferred exclusively for the purpose of payment processing with the provider and only to the extent required for that purpose.

If you select a payment method in which we pay in advance, you are also asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number, and possibly details regarding an alternative payment method).

In order to safeguard our legitimate interest in verifying your ability to pay in such cases, we forward this data to the provider for the purpose of a creditworthiness check in accordance with Art. 6(1)(f) GDPR. The provider assesses, based on the personal data you provide as well as further data (such as shopping cart, invoice amount, order history, payment experiences), whether the payment method you selected can be granted with regard to payment and/or default risk.

On this website, one or more online payment methods offered by the following provider are available: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

If you select a payment method provided by the provider in which the provider pays in advance (e.g., invoice or instalment purchase or direct debit), you are also asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number, and possibly details regarding an alternative payment method).

8.5 Electronic revocation function for distance contracts

Consumers who conclude contracts on this website that have a statutory right of withdrawal may declare their revocation using an electronic revocation function in accordance with the applicable provisions on revocation.

When using the revocation function, in addition to details for identifying the contract to be revoked, you must provide or confirm other personal information such as your first and last name and the consumer’s e-mail address.

Collection of this information and its transmission to us is carried out in accordance with Art. 6(1)(b) GDPR and only to the extent required for proper handling of the revocation. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the revocation statement by e-mail. Another legal basis for processing is Art. 6(1)(c) GDPR. We are legally required to provide an electronic revocation function for paid distance contracts with consumers.

9) Website functionality features

9.1 ShopVote graphics

On our website, graphic elements from the following provider are embedded for displaying external customer reviews and/or an external quality label: Blickreif GmbH, Schulstraße 46, 80634 Munich, Germany

When you access a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider’s servers in order to load the elements properly. In this process, certain browser information, including your IP address, is transmitted to the provider.

If personal data is processed in this process, it is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the optimal marketing of our offering and an attractive design of our online presence.

9.2 - Cloudflare Turnstile

On this website, we use the CAPTCHA service of the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA

The service checks whether an input is made by a natural person or is performed improperly via machine-based and automated processing, and blocks spam, DDoS attacks and similar automated malicious accesses. In order to ensure that an action is performed by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the device used, detection data about the type of the browser and operating system used, as well as the date and duration of the visit, and transmits this to the provider’s servers for evaluation.

The legal basis is our legitimate interest in determining individual responsibility on the internet and preventing misuse and spam in accordance with Art. 6(1)(f) GDPR.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework (EU-US Data Privacy Framework), which ensures compliance with the European data protection level on the basis of an adequacy decision by the European Commission.

10) Tools and miscellaneous

Lexware Office

For handling accounting, we use the service of the cloud-based accounting software of the following provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany

The provider processes incoming and outgoing invoices and, where applicable, also our company’s bank transactions in order to automatically capture invoices, match them to transactions and, in a partially automated process, create financial accounting based on this.

Where personal data is also processed in this context, processing is carried out on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions in accordance with Art. 6(1)(f) GDPR.

11) Rights of the data subject

11.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) against the controller with regard to the processing of your personal data, whereby the legal basis referenced above is used for the respective conditions for exercising these rights:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent granted pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A BALANCING OF INTERESTS DUE TO OUR LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, FOR REASONS ARISING FROM YOUR SPECIFIC SITUATION, TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE AFFECTED PERSONAL DATA. HOWEVER, FURTHER PROCESSING MAY CONTINUE IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, WITH EFFECT FOR THE FUTURE, TO THE PROCESSING OF YOUR PERSONAL DATA CONCERNING SUCH MARKETING. YOU MAY EXERCISE YOUR OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE THE PROCESSING OF THE AFFECTED PERSONAL DATA FOR DIRECT MARKETING PURPOSES.

12) Duration of storage of personal data

The duration of storage of personal data is determined on the basis of the respective legal basis, the processing purpose and—if applicable—additionally on the basis of the applicable statutory retention period (e.g., retention periods under commercial and tax law).

Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the affected data is stored until you withdraw your consent.

If there are statutory retention periods for data processed within the context of contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, unless it is no longer required for contract fulfilment or contract initiation and/or unless we continue to have a legitimate interest in further storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, it is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate reasons for the processing that override your interests, rights and freedoms, or unless the processing serves the assertion, exercise or defence of legal claims.

Where personal data is processed for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, it is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the other information in this declaration regarding specific processing situations, stored personal data is deleted once it is no longer necessary for the purposes for which it was collected or otherwise processed.

As of: 21.07.2026, 10:47:03