Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and would like to thank you for your interest. Below, we inform you about how we process your personal data when you use our website. Personal data means all data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Bertrand Dahi, Alte Eisenacher Str. 25, 99834 Gerstungen, Germany, Tel.: +4915792557024, E-mail: kontakt@eichenhain.com. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data collection when visiting our website

2.1 When you use our website purely for information purposes—that is, if you do not register or otherwise transmit information to us—we only collect the data that your browser transmits to the website server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us in order to display the website to you:

The website you visited
Date and time of access
Amount of data sent in bytes
Source/Referrer, from which you reached the page
Browser used
Operating system used
IP address used (if applicable: in anonymised form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. Disclosure or other use of the data does not take place. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognise a secure connection by the “https://” string and the padlock symbol in your browser’s address bar.

3) Hosting & Content Delivery Network

For hosting our website and displaying page content, we use a provider that delivers its services either itself or through selected sub-contractors exclusively on servers located within the European Union.

All data collected on our website is processed on these servers.

We have concluded a data processing agreement with the provider to ensure the protection of the data of our website visitors and to prohibit any unauthorised disclosure to third parties.

4) Cookies

To make your visit to our website more enjoyable and to enable the use of certain functions, we use cookies—small text files that are stored on your device. Some cookies are automatically deleted again after you close your browser (so-called “session cookies”), while others remain on your device for longer and allow the saving of website settings (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

To the extent that personal data is processed by individual cookies used by us, processing takes place in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the event of consent granted, or pursuant to Art. 6(1)(f) GDPR in order to protect our legitimate interests in ensuring the best possible functionality of the website, as well as a customer-friendly and effective presentation of the visit to the website.

You can configure your browser so that you are informed about cookie setting and can decide individually whether to accept them, or you can generally exclude cookie acceptance for certain cases or in general.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contact

5.1 Personal review reminder

Only on the basis of your express consent in accordance with Art. 6(1)(a) GDPR, we use your e-mail address to send you a one-time reminder to submit a review of our services after contract performance. You can withdraw your consent at any time by sending a message to the controller responsible for data processing.

5.2 ShopVote

For review reminders, we use the services of the following provider: Blickreif GmbH, Schulstraße 46, 80634 Munich, Germany

Only on the basis of your express consent in accordance with Art. 6(1)(a) GDPR, we transmit your e-mail address and, if applicable, other customer data to the provider so that it can contact you by e-mail with a review reminder.

You can withdraw your consent at any time with effect for the future, either vis-à-vis us or the provider.

We have concluded a data processing agreement with the provider that ensures the protection of the data of our website visitors and prohibits unauthorised disclosure to third parties.

5.3 WhatsApp Business

You have the option to contact us via the WhatsApp messaging service of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called “Business version” of WhatsApp.

If you contact us via WhatsApp in connection with a specific transaction (for example, an order you have placed), we store and use the mobile phone number you use on WhatsApp, as well as—if provided—your first and last name in accordance with Art. 6(1)(b) GDPR for processing and responding to your request. On the basis of the same legal basis, we may ask you via WhatsApp to provide further data (order number, customer number, address or e-mail address) so that we can assign your request to a specific matter.

If you use our WhatsApp contact for general inquiries (e.g. about our range of services, availability, or our online presence), we store and use the mobile phone number you use on WhatsApp, as well as—if provided—your first and last name in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing the requested information efficiently and promptly.

Your data is always used only to respond to your request via WhatsApp. No disclosure to third parties takes place.

Please note that WhatsApp Business obtains access to the address book of the mobile device we use for this purpose and automatically transfers phone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account, we use a mobile device whose address book stores only the WhatsApp contact data of those users who have also contacted us via WhatsApp.

This ensures that each person whose WhatsApp contact data is stored in our address book has already, upon first use of the app on their device, consented to the transfer of their WhatsApp phone number from the address books of their chat contacts by accepting the WhatsApp terms of use in accordance with Art. 6(1)(a) GDPR. A transfer of data of users who do not use WhatsApp and/or who have not contacted us via WhatsApp is therefore excluded.

The purpose and scope of data collection and further processing and use of the data by WhatsApp, as well as your related rights and options for protecting your privacy, can be found in WhatsApp’s privacy information: https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

As part of the processing described above, data transfers to Meta Platforms Inc. servers in the USA may occur.

For transfers of data to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the level of European data protection on the basis of an adequacy decision by the European Commission.

5.4 Within the context of contacting us (e.g. via a contact form or e-mail), personal data is processed—exclusively for the purpose of handling and responding to your request and only to the extent required for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. If your inquiry is aimed at entering into a contract, additional legal basis for processing is Art. 6(1)(b) GDPR. Your data is deleted when it follows from the circumstances that the matter in question has been conclusively clarified and provided that no statutory retention obligations conflict with deletion.

6) Data processing when opening a customer account

In accordance with Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. Which data is required for account creation can be found in the input mask of the corresponding form on our website.

You can delete your customer account at any time and do so by sending a message to the controller’s address stated above. After deleting your customer account, your data will be deleted if all contracts concluded via the account have been fully processed, if no statutory retention periods conflict, and if we do not have a legitimate interest in further storage.

7) Use of customer data for direct marketing

7.1 Subscription to our e-mail newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our offers. The only mandatory information required to send the newsletter is your e-mail address. Providing additional data is voluntary and is used so that we can address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter once you have expressly confirmed your consent to receive the newsletter by activating a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6(1)(a) GDPR. In doing so, we store the IP address recorded by your internet service provider (ISP) as well as the date and time of registration in order to be able to trace possible misuse of your e-mail address at a later point in time. The data we collect when you sign up for the newsletter is used strictly for the stated purpose.

You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending an appropriate message to the controller named at the beginning. After you unsubscribe, your e-mail address will be deleted immediately from our newsletter distribution list, unless you have expressly consented to further use of your data or we have reserved the right to use your data further in a way that is permitted by law and that we inform you about in this statement.

7.2 ActiveCampaign

Our e-mail newsletters are sent via this provider: ActiveCampaign, LLC, 150 N. Michigan Ave Suite 1230, Chicago, IL, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we transfer the data you provide when subscribing to the newsletter according to Art. 6(1)(f) GDPR to this provider so that it can handle the newsletter dispatch on our behalf.

Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also performs statistical evaluation of campaign success using web beacons and/or tracking pixels in the e-mails sent, which can measure open rates and specific interactions with the newsletter content. Device information (e.g. time of access, IP address, browser type and operating system) is also collected and analysed, but is not combined with other data sets.

You can withdraw your consent for newsletter tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

7.3 E-mail notification of product availability

For items that are temporarily unavailable, you can sign up to receive e-mail notifications about their availability. In this case, we will send you a one-time e-mail message notifying you of the availability of the specific item you selected. The only mandatory information for sending this notification is your e-mail address. Providing additional data is voluntary and may be used to address you personally. For e-mail dispatch, we use the so-called double opt-in procedure, which ensures that you only receive a notification once you have expressly confirmed your consent for this purpose by activating a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6(1)(a) GDPR. In doing so, we store the IP address recorded by your internet service provider (ISP) as well as the date and time of registration in order to be able to trace possible misuse of your e-mail address at a later point in time. The data we collect when you sign up for our e-mail availability notification service is used strictly for the stated purpose.

You can unsubscribe from availability notifications at any time by sending an appropriate message to the controller named at the beginning. After you unsubscribe, your e-mail address will be deleted immediately from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we have reserved the right to use your data further in a way that is permitted by law and that we inform you about in this statement.

7.4 E-mail shopping cart reminders

In the event that you abandon your purchase with us before completing the order, you have the option to receive a one-time reminder by e-mail about the contents of your virtual shopping cart.

The only mandatory information for sending this reminder is your e-mail address. Providing additional data is voluntary and may be used to address you personally. For e-mail dispatch, we use the so-called double opt-in procedure, which ensures that you only receive a notification once you have expressly confirmed your consent for this purpose by activating a verification link sent to the e-mail address provided.

By activating the confirmation link, you give us your consent in accordance with Art. 6(1)(a) GDPR to use your personal data for sending a shopping cart reminder. In doing so, we store the IP address recorded by your internet service provider (ISP) as well as the date and time of registration in order to be able to trace possible misuse of your e-mail address at a later point in time. The data we collect when you sign up for our e-mail notification service is used strictly for the stated purpose.

You can unsubscribe from shopping cart reminders at any time by sending an appropriate message to the controller named at the beginning. After you unsubscribe, your e-mail address will be deleted immediately from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we have reserved the right to use your data further in a way that is permitted by law and that we inform you about in this statement.

8) Data processing for order fulfilment

8.1 To the extent required for contract performance for delivery and payment purposes, the personal data we collect is forwarded in accordance with Art. 6(1)(b) GDPR to the commissioned shipping company and the commissioned financial institution.

If, based on an applicable agreement, we owe you updates for goods with digital elements or for digital products, we process the contact details you provide when placing the order in order to inform you personally within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details are used strictly for notifications about updates we owe and, for this purpose, are processed by us only to the extent required for the respective information.

To fulfil your order, we also work with the following service provider(s), who support us wholly or in part in carrying out the contracts concluded. Certain personal data is transferred to these service providers in accordance with the information below.

8.2 Monta

For order fulfilment, we use the following provider: Monta Krefeld GmbH, Märkische Straße 10, 47809 Krefeld

Name, address and any other personal data are, in accordance with Art. 6(1)(b) GDPR, forwarded to the provider exclusively for the purpose of processing the online order. Your data is only transferred to the extent actually required to fulfil the order.

8.3 Disclosure of personal data to shipping service providers

- DHL

As a shipping service provider, we use the following provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

We forward your e-mail address and/or telephone number in accordance with Art. 6(1)(a) GDPR to the provider prior to delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, provided that you have given your express consent for this during the ordering process. Otherwise, for the purpose of delivery, in accordance with Art. 6(1)(b) GDPR, we only forward the recipient’s name and the delivery address to the provider. The transfer is made only to the extent required for the delivery of the goods. In this case, prior coordination of the delivery date with the provider and/or delivery notification is not possible.

Your consent can be withdrawn at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.
- UPS

As a shipping service provider, we use the following provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

Your consent can be withdrawn at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.

8.4 Use of payment service providers (payment services)

- Klarna

One or more of the following online payment options offered by the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method offered by the provider in which you pay in advance (e.g. credit card payment), your payment details provided as part of the checkout process (including name, address, bank and payment card information, currency and transaction number), as well as information about the contents of your order, are forwarded to the provider in accordance with Art. 6(1)(b) GDPR. In this case, the transfer of your data is made exclusively for the purpose of processing the payment with the provider and only to the extent required for this purpose.

If you select a payment method in which the provider pays in advance (e.g. invoice or instalment purchase or direct debit), during the checkout process you are also asked to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number, and, if applicable, data regarding an alternative payment method).

To protect our legitimate interest in determining our customers’ ability to pay, we forward these data to the provider for the purpose of a credit assessment in accordance with Art. 6(1)(f) GDPR. Based on the personal data you provide and other data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option you have selected can be granted taking into account risks of payment default and/or outstanding claims.

For the decision as part of the application review, identity and creditworthiness information from the following credit reference agencies may also be included, in addition to criteria internal to the provider pursuant to Art. 6(1)(f) GDPR:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit information may contain probability values (so-called score values). Where score values are included in the result of the credit assessment, they are based on a scientifically recognised mathematical-statistical procedure. The calculation of the score values includes, among other things, but not exclusively, address data.

You can object to this processing of your data at any time by sending us a message or by contacting the provider. However, the provider may continue to be entitled to process your personal data if this is necessary for proper contract-based payment processing.
- Mollie

One or more of the following online payment options offered by the following provider are available on this website: Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, Netherlands

One or more of the following online payment options offered by the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method offered by the provider in which you pay in advance, your payment details provided as part of the checkout process (including name, address, bank and payment card information, currency and transaction number), as well as information about the contents of your order, are forwarded to the provider in accordance with Art. 6(1)(b) GDPR. In this case, the transfer of your data is made exclusively for the purpose of processing the payment with the provider and only to the extent required for this purpose.

If you select a payment method offered by the provider in which we pay in advance, during the checkout process you are also asked to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number, and, if applicable, data regarding an alternative payment method).

To protect our legitimate interest in determining your ability to pay in such cases, we forward these data to the provider for the purpose of a credit assessment in accordance with Art. 6(1)(f) GDPR. Based on the personal data you provide and other data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option you have selected can be granted taking into account risks of payment default and/or outstanding claims.

One or more of the following online payment options offered by the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

If you select a payment method offered by the provider in which the provider pays in advance (e.g. invoice or instalment purchase or direct debit), during the checkout process you are also asked to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number, and, if applicable, data regarding an alternative payment method).

8.5 Electronic withdrawal function for distance selling contracts

Consumers who conclude contracts on this website for which there is a statutory right of withdrawal have the option to declare their withdrawal using an electronic withdrawal function in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to information required to identify the contract to be withdrawn, you must also provide or confirm further personal information such as your first and last name and the consumer’s e-mail address.

The collection of this information and its transmission to us takes place in accordance with Art. 6(1)(b) GDPR and only to the extent required for proper processing of the withdrawal. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the withdrawal statement by e-mail. An additional legal basis for processing is Art. 6(1)(c) GDPR. We are legally required to maintain an electronic withdrawal function for distance selling contracts concluded with consumers for which payment is due.

9) Page functionalities

9.1 ShopVote graphics

On our website, graphic elements from the following provider are integrated for displaying external customer reviews and/or an externally awarded quality seal: Blickreif GmbH, Schulstraße 46, 80634 Munich, Germany

When you access a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider’s servers in order to load the elements correctly. Certain browser information, including your IP address, is transmitted to the provider.

To the extent that personal data is processed in this context, it is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the optimal marketing of our offer and an attractive presentation of our website.

9.2 - Cloudflare Turnstiles

On this website, we use the CAPTCHA service of the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA

The service checks whether an input is made by a natural person or abusively by machine-based and automated processing, and blocks spam, DDoS attacks and similar automated malicious access. To ensure that an action is performed by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the device used, detection data relating to the type of browser and operating system used, and the date and duration of the visit, and transmits this information to the provider’s servers for analysis.

The legal basis is our legitimate interest in establishing individual responsibility online and preventing misuse and spam in accordance with Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with the provider that ensures the protection of the data of our website visitors and prohibits any unauthorised disclosure to third parties.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the level of European data protection on the basis of an adequacy decision by the European Commission.

10) Tools and other

Lexware Office

For handling bookkeeping, we use the service of the cloud-based bookkeeping software of the following provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany

The provider processes incoming and outgoing invoices and, if applicable, our company’s bank transactions in order to automatically capture invoices, match them to transactions, and generate financial accounting in a partially automated process.

To the extent that personal data is processed in this context, the processing is based on our legitimate interest in the efficient organisation and documentation of our business processes in accordance with Art. 6(1)(f) GDPR.

11) Rights of the data subject

11.1 The applicable data protection law provides you, vis-à-vis the controller, with the following data subject rights (rights of access and intervention) regarding the processing of your personal data, and the legal basis cited below applies to the specific conditions for exercising each right:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent granted pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA AS PART OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERriding LEGITIMATE INTERESTS, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR SPECIFIC SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE DATA IN QUESTION. HOWEVER, FURTHER PROCESSING MAY STILL BE CARRIED OUT IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE PURPOSE OF ESTABLISHING, EXERCISING OR DEFENDING LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA IN ORDER TO CARRY OUT DIRECT MARKETING, YOU HAVE THE RIGHT, AT ANY TIME, TO OBJECT TO THE PROCESSING OF THE PERSONAL DATA CONCERNING YOU FOR THE PURPOSES OF SUCH MARKETING. YOU MAY EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE DATA IN QUESTION FOR DIRECT MARKETING PURPOSES.

12) Duration of storage of personal data

The length of time for which personal data is stored is determined by the applicable legal basis, the processing purpose and—where applicable—additionally by the respective statutory retention period (e.g. retention periods under commercial and tax law).

When personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

If statutory retention periods exist for data that is processed within the scope of contractual or quasi-contractual obligations on the basis of Art. 6(1)(b) GDPR, this data will be deleted routinely after the retention periods expire, provided it is no longer required for contract fulfilment or contract initiation and/or if we do not have a legitimate interest in further storage.

When personal data is processed on the basis of Art. 6(1)(f) GDPR, it will be stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.

When personal data is processed for the purposes of direct marketing on the basis of Art. 6(1)(f) GDPR, it is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the other information in this statement regarding specific processing situations, stored personal data will also be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

As of: 21.07.2026, 10:47:03