Privacy Policy

1) Introduction and contact details of the controller

1.1 We are pleased that you have visited our website and thank you for your interest. In the following, we inform you about how we process your personal data when you use our website. Personal data, in this context, means all data with which you can be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Bertrand Dahi, Alte Eisenacher Str. 25, 99834 Gerstungen, Germany, Tel.: +4915792557024, E-mail: kontakt@eichenhain.com. The controller responsible for processing personal data is the natural or legal person that alone or jointly with others determines the purposes and means of processing personal data.

2) Data collection when visiting our website

2.1 When our website is used purely for informational purposes—i.e., when you do not register or otherwise provide us with information—we only collect the data that your browser transmits to our web server (so-called “server log files”). When you access our website, we collect the following data that is technically necessary for us to display the website to you:

The website you accessed
Date and time of access
Amount of data sent in bytes
Source/Referrer, from which you reached the page
Browser used
Operating system used
IP address used (if applicable: in anonymised form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. There is no disclosure or other use of the data. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transfer of personal data and other confidential content (e.g., orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock symbol in your browser’s address bar.

3) Hosting & content delivery network

For hosting our website and displaying the page content, we use a provider whose services are provided either by the provider itself or through selected subcontractors exclusively on servers located within the European Union.

All data collected on our website is processed on these servers.

We have entered into a data processing agreement with the provider to ensure the protection of the data of visitors to our website and to prohibit unauthorised disclosure to third parties.

4) Cookies

To make your visit to our website more attractive and to enable the use of certain functions, we use cookies—i.e., small text files that are stored on your end device. Some of these cookies are automatically deleted again when you close your browser (so-called “session cookies”); in other cases, these cookies remain longer on your end device and enable the saving of page settings (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

Where, by means of individual cookies used by us, personal data is also processed, processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR in the event of consent given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of your visit to the site.

You can configure your browser so that you are informed about the setting of cookies, and you can decide individually whether to accept them or you can exclude the acceptance of cookies for certain cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Contact

5.1 Your own review reminder

Only on the basis of your express consent pursuant to Art. 6(1)(a) GDPR, we use your e-mail address to send you a one-time reminder to submit a review of our services after fulfilment of the contract. You can withdraw your consent at any time by sending a message to the controller responsible for data processing.

5.2 ShopVote

For review reminders, we use the services of the following provider: Blickreif GmbH, Schulstraße 46, 80634 Munich, Germany

Only on the basis of your express consent pursuant to Art. 6(1)(a) GDPR, we transmit your e-mail address and, if applicable, other customer data to the provider so that it can contact you by e-mail with a review reminder.

You can withdraw your consent at any time with effect for the future, either vis-à-vis us or the provider.

We have entered into a data processing agreement with the provider to ensure the protection of the data of visitors to our website and to prohibit unauthorised disclosure to third parties.

5.3 WhatsApp Business

You have the option to contact us via the WhatsApp messaging service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this purpose, we use the so-called “Business version” of WhatsApp.

If you contact us via WhatsApp in connection with a specific matter (for example, an order you placed), we store and use the mobile number you use on WhatsApp, and—if provided—your first and last name pursuant to Art. 6(1)(b) GDPR in order to process and respond to your request. On the basis of the same legal basis, we may ask you via WhatsApp to provide additional data (order number, customer number, address or e-mail address) so that we can assign your request to a specific process.

If you use our WhatsApp contact for general inquiries (e.g., about our range of services, availability, or our website), we store and use the mobile number you use on WhatsApp, and—if provided—your first and last name pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the efficient and timely provision of the requested information.

Your data is always used only to respond to your request via WhatsApp. There is no disclosure to third parties.

Please note that WhatsApp Business receives access to the address book of the mobile end device we use for this purpose and automatically transfers the phone numbers stored in the address book to a server of the parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account, we use a mobile end device in which only the WhatsApp contact details of those users are stored who have also contacted us via WhatsApp.

This ensures that anyone whose WhatsApp contact details are stored in our address book has, when using the app for the first time on their device, consented to the transfer of their WhatsApp telephone number from the address books of their chat contacts by accepting the WhatsApp terms of use, pursuant to Art. 6(1)(a) GDPR. A transfer of data of users who do not use WhatsApp and/or have not contacted us via WhatsApp is therefore excluded.

For the purpose and scope of data collection and the further processing and use of the data by WhatsApp, as well as your rights and settings in this regard to protect your privacy, please refer to WhatsApp’s privacy information: https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have entered into a data processing agreement with the provider to protect the data of visitors to our website and to prohibit unauthorised disclosure to third parties.

As part of the processing described above, data transfers to servers of Meta Platforms Inc. in the USA may occur.

For data transfers to the USA, the provider has joined the EU-U.S. Data Privacy Framework (EU-US Data Privacy Framework), which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

5.4 In the course of contacting us (e.g., via the contact form or by e-mail), personal data is processed—exclusively for the purpose of processing and responding to your request and only to the extent required for this.

The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at entering into a contract, Art. 6(1)(b) GDPR is an additional legal basis for processing. Your data will be deleted when it can be seen from the circumstances that the matter in question has been conclusively clarified and provided there are no statutory retention obligations to the contrary.

6) Data processing when opening a customer account

Pursuant to Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary when you provide it to us when opening a customer account. Which data is required for opening the account can be found in the input mask of the corresponding form on our website.

Deleting your customer account is possible at any time and can be done by sending a message to the controller’s address stated above. After deletion of your customer account, your data will be deleted provided that all contracts concluded via the account have been fully processed, there are no statutory retention periods to the contrary, and we do not have a legitimate interest in retaining the data further.

7) Use of customer data for direct advertising

7.1 Subscription to our e-mail newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our offers. The only mandatory information required to send the newsletter is your e-mail address. Providing other data is voluntary and is used so that we can address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you receive the newsletter only after you have expressly confirmed your consent to receive the newsletter by activating a verification link sent to the e-mail address provided.

By activating the confirmation link, you grant us your consent for the use of your personal data pursuant to Art. 6(1)(a) GDPR. In doing so, we store the IP address recorded by your internet service provider (ISP), as well as the date and time of registration, in order to be able to trace possible misuse of your e-mail address at a later point in time. The data we collect during newsletter registration is used strictly for the specified purpose.

You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning. After you unsubscribe, your e-mail address will be deleted from our newsletter distribution list immediately, unless you have expressly consented to further use of your data or we reserve the right to use your data further in a way that is legally permitted and of which we inform you in this statement.

7.2 ActiveCampaign

Our e-mail newsletters are sent via this provider: ActiveCampaign, LLC, 150 N. Michigan Ave Suite 1230, Chicago, IL, USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we share the data you provide when subscribing to the newsletter with this provider pursuant to Art. 6(1)(f) GDPR so that it can handle the newsletter sending on our behalf.

Subject to your express consent pursuant to Art. 6(1)(a) GDPR, the provider also performs statistical analyses of the success of newsletter campaigns using web beacons and/or tracking pixels in the e-mails sent, which can measure open rates and specific interactions with the newsletter content. In doing so, end-device information (e.g., time of access, IP address, browser type and operating system) is also collected and analysed, but it is not combined with other data sets.

You can withdraw your consent to newsletter tracking at any time with effect for the future.

We have entered into a data processing agreement with the provider to protect the data of visitors to our website and to prohibit unauthorised disclosure to third parties.

7.3 E-mail notification of product availability

For temporarily unavailable items, you can register to receive e-mail notifications about product availability. In this case, we will send you an e-mail once, informing you about the availability of the specific item you have selected. The only mandatory information required to send this notification is your e-mail address. Providing other data is voluntary and may be used to address you personally. For sending the e-mails, we use the so-called double opt-in procedure, which ensures that you receive a notification only after you have expressly confirmed your consent for this by activating a verification link sent to the e-mail address provided.

By activating the confirmation link, you grant us your consent for the use of your personal data pursuant to Art. 6(1)(a) GDPR. In doing so, we store the IP address recorded by your internet service provider (ISP), as well as the date and time of registration, in order to be able to trace possible misuse of your e-mail address at a later point in time. The data we collect when you register for our e-mail notification service for product availability is used strictly for the specified purpose.

You can unsubscribe from availability notifications at any time by sending a corresponding message to the controller named at the beginning. After successful unsubscription, your e-mail address will be deleted immediately from the distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data further in a manner that is legally permitted and of which we inform you in this statement.

7.4 E-mail shopping cart reminders

If you stop your purchase with us before completing the order, you have the option to be reminded once by e-mail of the contents of your virtual shopping cart.

The only mandatory information required to send this reminder is your e-mail address. Providing other data is voluntary and may be used to address you personally. For sending the e-mails, we use the so-called double opt-in procedure, which ensures that you receive a notification only after you have expressly confirmed your consent for this by activating a verification link sent to the e-mail address provided.

By activating the confirmation link, you grant us your consent for the use of your personal data pursuant to Art. 6(1)(a) GDPR for sending a shopping cart reminder. In doing so, we store the IP address recorded by your internet service provider (ISP), as well as the date and time of registration, in order to be able to trace possible misuse of your e-mail address at a later point in time. The data we collect when you register for our e-mail notification service is used strictly for the specified purpose.

You can unsubscribe from shopping cart reminders at any time by sending a corresponding message to the controller named at the beginning. After successful unsubscription, your e-mail address will be deleted immediately from the distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data further in a manner that is legally permitted and of which we inform you in this statement.

8) Data processing for order fulfilment

8.1 To the extent required for contract performance for delivery and payment purposes, the personal data collected by us is shared pursuant to Art. 6(1)(b) GDPR with the commissioned transport company and the commissioned financial institution.

If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provide when placing the order to inform you personally in accordance with our statutory information obligations pursuant to Art. 6(1)(c) GDPR. In doing so, your contact details are used strictly for notifications about updates owed by us and, for this purpose, are processed by us only to the extent required for the respective information.

To process your order, we also work with the following service(s) provider(s) that support us in whole or in part in carrying out the contracts concluded. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Monta

For order processing, we use the following provider: Monta Krefeld GmbH, Märkische Straße 10, 47809 Krefeld

Name, address and, if applicable, other personal data are transmitted to the provider exclusively for the purpose of processing the online order in accordance with Art. 6(1)(b) GDPR. The transfer of your data in this case takes place only to the extent actually necessary for order fulfilment.

8.3 Transfer of personal data to shipping service providers

- DHL

As a transport/shipping service provider, we use the following provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

We pass on your e-mail address and/or telephone number pursuant to Art. 6(1)(a) GDPR to the provider before delivery of the goods, for the purpose of coordinating a delivery date or sending delivery notifications, provided that you have given your express consent for this in the ordering process. Otherwise, for delivery purposes pursuant to Art. 6(1)(b) GDPR we only provide the provider with the recipient’s name and the delivery address. The transfer takes place only to the extent required for delivery of the goods. In this case, prior coordination of the delivery date with the provider and/or delivery notification is not possible.

Consent may be withdrawn at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.
- UPS

As a transport/shipping service provider, we use the following provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany

Consent may be withdrawn at any time with effect for the future vis-à-vis the controller named above or vis-à-vis the provider.

8.4 Use of payment service providers (payment services)

- Klarna

On this website, one or more online payment methods offered by the following provider are available: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden

If you select a payment method of the provider for which you pay in advance (e.g., credit card payment), your payment details provided as part of the checkout process (including name, address, bank and payment card information, currency and transaction number), as well as information about the content of your order, are transmitted to this provider pursuant to Art. 6(1)(b) GDPR. In this case, the transfer of your data takes place exclusively for the purpose of processing payment with the provider and only to the extent required for this.

If you select a payment method for which the provider pays in advance (e.g., invoice purchase or instalment purchase or direct debit), you will also be asked in the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number, and if applicable details relating to an alternative payment method).

To safeguard our legitimate interest in verifying the creditworthiness of our customers, we transmit these data to the provider for the purpose of a creditworthiness check pursuant to Art. 6(1)(f) GDPR. The provider checks, on the basis of the personal data you provide and other data (such as shopping cart, invoice amount, order history, payment experience), whether the payment option you have selected can be granted with regard to payment and/or default risk.

For the decision as part of the application review, in addition to criteria internal to the provider pursuant to Art. 6(1)(f) GDPR, identity and creditworthiness information from the following credit agencies may also be included:

https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). If score values are included in the result of the creditworthiness report, they are based on a scientifically recognised mathematical-statistical procedure. Among other things, but not exclusively, address data is used to calculate the score values.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may continue to be entitled to process your personal data if this is required for contractual payment processing.
- Mollie

On this website, one or more online payment methods offered by the following provider are available: Mollie B.V., Keizersgracht 313, 1016 EE Amsterdam, The Netherlands

On this website, one or more online payment methods offered by the following provider are available: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider for which you pay in advance, your payment details provided as part of the checkout process (including name, address, bank and payment card information, currency and transaction number), as well as information about the content of your order, are transmitted to this provider pursuant to Art. 6(1)(b) GDPR. In this case, the transfer of your data takes place exclusively for the purpose of processing payment with the provider and only to the extent required for this.

If you select a payment method of the provider for which we pay in advance, you will also be asked in the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, e-mail address, telephone number, and if applicable details relating to an alternative payment method).

To safeguard our legitimate interest in verifying your creditworthiness in such cases, we transmit these data to the provider for the purpose of a creditworthiness check pursuant to Art. 6(1)(f) GDPR. The provider checks, on the basis of the personal data you provide and other data (such as shopping cart, invoice amount, order history, payment experience), whether the payment option you have selected can be granted with regard to payment and/or default risk.

On this website, one or more online payment methods offered by the following provider are available: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

8.5 Electronic withdrawal function for distance contracts

Consumers who enter into contracts on this website for which a statutory right of withdrawal exists have the option to explain their withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to details for identifying the contract to be withdrawn from, additional personal information such as the consumer’s first and last name and e-mail address must be provided or confirmed.

The collection of this information and its transmission to us is carried out pursuant to Art. 6(1)(b) GDPR and only to the extent required for the proper processing of the withdrawal. Also on the basis of Art. 6(1)(b) GDPR, the personal data provided is used to confirm receipt of the withdrawal declaration by e-mail. Another legal basis for processing is Art. 6(1)(c) GDPR. We are legally required to maintain an electronic withdrawal function for paid distance contracts with consumers.

9) Website functionality

9.1 ShopVote graphics

On our website, graphic elements provided by the following provider are embedded for displaying external customer reviews and/or an externally awarded quality seal: Blickreif GmbH, Schulstraße 46, 80634 Munich, Germany

When you access a page of our web presence that contains such graphic elements, your browser establishes a direct connection to the provider’s servers in order to load the elements properly. In doing so, certain browser information—including your IP address—is transmitted to the provider.

If personal data is processed in the process, this is done in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the optimal marketing of our offering and the appealing design of our website.

9.2 - Cloudflare Turnstile

On this website, we use the CAPTCHA service provided by the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA

The service checks whether an input is made by a natural person or is carried out in a potentially abusive manner by machine-based and automated processing, and it blocks spam, DDoS attacks and similar automated malicious access attempts. To ensure that an action is performed by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the end device used, recognition data of the browser and operating system type used, as well as the date and duration of the visit, and transmits this data to the provider’s servers for analysis.

The legal basis is our legitimate interest in determining individual responsibility online and in preventing misuse and spam pursuant to Art. 6(1)(f) GDPR.

We have entered into a data processing agreement with the provider to protect the data of visitors to our website and to prohibit unauthorised disclosure to third parties.

10) Tools and miscellaneous

Lexware Office

For handling accounting, we use the service of the cloud-based accounting software provided by the following provider: Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany

The provider processes incoming and outgoing invoices and, if applicable, also our company’s bank transactions in order to automatically capture invoices, match them with transactions, and—using a semi-automated process—create financial accounting.

Where personal data is processed in this context, the processing is based on our legitimate interest in the efficient organisation and documentation of our business transactions pursuant to Art. 6(1)(f) GDPR.

11) Rights of the data subject

11.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) against the controller regarding the processing of your personal data, whereby the legal basis stated above is referenced for the requirements for the exercise of each right:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent granted pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA WITHIN THE SCOPE OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT, AT ANY TIME, TO OBJECT TO THIS PROCESSING FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE AFFECTED DATA. HOWEVER, FURTHER PROCESSING MAY STILL BE PERFORMED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL TERMINATE THE PROCESSING OF THE AFFECTED DATA FOR THE PURPOSES OF DIRECT ADVERTISING.

12) Duration of storage of personal data

The duration of storage of personal data is determined based on the respective legal basis, the processing purpose and—where applicable—also on the respective statutory retention period (e.g., retention periods under commercial and tax law).

Where personal data is processed on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, the relevant data will be stored until you withdraw your consent.

If statutory retention periods exist for data processed within the scope of contractual or contract-like obligations on the basis of Art. 6(1)(b) GDPR, such data is routinely deleted after the retention periods have expired, unless it is no longer necessary for the performance of the contract or for contract initiation and/or we do not have a legitimate interest in further retention.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, such data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate reasons for processing that override your interests, rights and freedoms, or if the processing serves the assertion, exercise or defence of legal claims.

Where personal data is processed for the purpose of direct advertising on the basis of Art. 6(1)(f) GDPR, such data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

In addition, unless otherwise stated in the other information in this policy regarding specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.

Last updated: 21.07.2026, 10:47:03