Privacy Policy

You can visit our website without providing any personal information.

Every time you access our website, your Internet browser transmits usage data to us or our web host/IT service provider, and this data is stored in log files (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred, and the requesting provider. This processing is based on Article 6(1)(f) of the GDPR, grounded in our overriding legitimate interest in ensuring the smooth operation of our website and in improving our services.

Our website is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; “Hetzner”). Hetzner processes the data on our behalf based on a data processing agreement in accordance with Article 28 of the GDPR.

Your data may be transferred to third countries outside the European Union for which the European Commission has issued an adequacy decision. For the United States, the European Commission issued an adequacy decision on July 10, 2023, under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), which applies to transfers to certified companies there. If no adequacy decision has been issued by the European Commission or if a recipient in the United States is not certified, data transfers are based, among other things, on standard contractual clauses as appropriate safeguards for the protection of personal data, which can be viewed at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de

When paying via a third-party payment provider, the data required for payment processing is transmitted to PayPal. This processing is based on Article 6(1)(b) of the GDPR. To facilitate this payment method, PayPal may then forward the data to the respective provider. This processing is based on Article 6(1)(b) of the GDPR.

When paying via the “Purchase on Invoice” payment method, the data required for payment processing is first transmitted to PayPal. To process this payment method, PayPal then transmits the data to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; “Ratepay”) in order to fulfill the contract with you using the selected payment method. This processing is based on Article 6(1)(b) of the GDPR. Ratepay may conduct a credit check based on mathematical and statistical methods (probability or score values) using credit reporting agencies, following the procedure described above. The data processing serves the purpose of conducting a credit check for the initiation of a contract. The processing is based on Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in protecting against payment default when Ratepay makes an advance payment. For more information on data protection and which credit bureaus Ratpay uses, please visit https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

For more information about data processing when using PayPal, please see the corresponding privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

PayPal “Pay Later”

If you select the “Pay Later” payment method via PayPal (e.g., “Pay in 30 Days” or “Pay in Installments”), the required information—specifically your name, address, email address, date of birth, as well as order and billing information, will be transmitted to PayPal. Before approving the transaction, PayPal conducts an identity and credit check, as described in the preceding section. Data processing for payment processing is based on Article 6(1)(b) of the GDPR, and the credit check is based on Article 6(1)(f) of the GDPR.

Using Google Pay

On our website, we offer payment via Google Pay, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). If you select Google Pay, you will confirm the payment in a Google window using a payment card associated with your Google Account. In doing so, Google transmits the data required for the payment (including tokenized card data, name, billing and shipping addresses if applicable, and email address) to us or to the payment service provider we use. This processing is based on Article 6(1)(b) of the GDPR for the purpose of fulfilling the contract. To display the Google Pay button, a connection to Google’s servers is established when you access the product or checkout page, which results in, among other things, your IP address being transmitted to Google. Google itself is responsible for the processing of data within your Google Account. Your data may also be transferred to Google LLC in the United States. For the United States, the European Commission issued an adequacy decision on July 10, 2023, under the EU-U.S. Data Privacy Framework (Article 45 of the GDPR). Google LLC is certified under the Data Privacy Framework. In addition, the data transfer is based on standard contractual clauses, which serve as appropriate safeguards for the protection of personal data (Art. 46(2)(c) GDPR). For more information, please visit https://policies.google.com/privacy.

Using Apple Pay

On our website, we offer payment via Apple Pay, provided by Apple Distribution International Ltd. (Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; “Apple”). When you select Apple Pay, you confirm the payment on your Apple device, for example, using Face ID, Touch ID, or a passcode. Apple transmits the data required for the payment (including a device-specific card number or payment token, name, billing and shipping addresses if applicable, and email address) to us or to the payment service provider we use. Your actual card number is not transmitted to us during this process. This processing is based on Article 6(1)(b) of the GDPR for the purpose of fulfilling the contract. Apple itself is responsible for the processing within Apple Pay. For more information, please visit https://www.apple.com/de/legal/privacy/data/de/apple-pay/.

Payment by bank transfer (prepayment)

Select “Prepayment via Bank Transfer” as your payment method, then transfer the invoice amount to our business account. In this process, the transfer details (account holder’s name, IBAN, amount, payment reference) are transmitted from your bank to our bank and processed by us to match the payment to your order. This processing is based on Article 6(1)(b) of the GDPR. We retain the payment data in accordance with statutory retention requirements (including Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)).

You have the right to object at any time to the processing of your personal data for reasons related to your particular situation.

In addition, we use the remarketing feature of Google Ads. This allows us to show interest-based ads to visitors to our website who have shown interest in specific products on other websites in the Google Display Network, in Google Search, or on YouTube. To do this, your browser is recognized via cookies or a pseudonymous identifier, and information about which pages of our store you have visited—such as products you’ve viewed and items you’ve added to your cart—is stored. Based on this information, visitors are added to target groups (remarketing lists). If you are signed in to your Google Account, Google can associate this information with your account and use it across devices. You can manage your settings for personalized ads at https://adssettings.google.com. For more information on the types of data processed, visit https://privacy.google.com/businesses/adsservices. The product data for the ads comes from our Google Merchant Center (see the “Google for WooCommerce” section).

We also use Google Consent Mode. This transmits your consent decision, made via the Borlabs cookie, to Google, and Google services (Google Analytics, Google Ads) adjust their behavior accordingly. Without your consent, no cookies are set or read for analytics or advertising purposes. The transmission of the consent status is based on Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR (proof of consent).

Your data may be transferred to Google LLC’s servers in the United States. On July 10, 2023, the European Commission issued an adequacy decision for the United States under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Google LLC is certified under the Data Privacy Framework. In addition, the data transfer is based on standard contractual clauses as appropriate safeguards for the protection of personal data (Art. 46(2)(c) GDPR), which can be viewed at: https://policies.google.com/privacy/frameworks and https://business.safety.google/adscontrollerterms/.

Use of the Meta Pixel (Facebook and Instagram)

We use the Meta Pixel from Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland; “Meta”) on our website. This allows us to track what actions users take on our website after they have seen or clicked on one of our ads on Facebook or Instagram (conversion tracking). In addition, we can display interest-based ads to visitors of our website on Facebook and Instagram, as well as on Meta’s partner services (the so-called “Audience Network”) (remarketing / custom audiences). This data processing is used to measure the effectiveness of our advertising and to optimize it.

The following information, among other things, may be collected: IP address, browser and device information, pages visited, referrer URL, date and time, triggered events (e.g., product view, adding to cart, purchase, including order value), and cookie identifiers. If you are logged in to Facebook or Instagram, Meta can associate your visit with your account.

We are jointly responsible with Meta for the collection of data on our website and its transmission to Meta (Art. 26 GDPR). You can find the agreement regarding this at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent processing. Your data may be transferred to Meta Platforms, Inc. in the United States. On July 10, 2023, the European Commission issued an adequacy decision for the United States under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Meta Platforms, Inc. is certified under the Data Privacy Framework. In addition, the data transfer is based on Standard Contractual Clauses as appropriate safeguards for the protection of personal data (Art. 46(2)(c) GDPR), available at: https://www.facebook.com/legal/EU_data_transfer_addendum.

The use of cookies or similar technologies is based on your consent pursuant to Section 25(1), sentence 1 of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time via the “Cookie Settings” in the footer of our website, without affecting the lawfulness of the processing carried out on the basis of your consent prior to withdrawal. You can manage your advertising settings at https://www.facebook.com/adpreferences/ad_settings (Facebook or Instagram login required). For more information on data processing by Meta, please visit https://www.facebook.com/privacy/policy/.

Use of OpenAI Ads (Advertising in ChatGPT)

We run ads on ChatGPT and use the OpenAI pixel on our website to track conversions. The provider is OpenAI Ireland Limited (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; “OpenAI”). The pixel is directly integrated into our website and is loaded only after you have given your consent via the Borlabs cookie. We use the pixel to track whether users who clicked on one of our ads in ChatGPT subsequently make a purchase in our store. Data processing is used to measure the success of and optimize our advertising campaigns.

In particular, the IP address, technical information about the browser and device, the page accessed, the time of access, a click or ad identifier, and the “purchase” event—including the order value—are transmitted to OpenAI. For this purpose, the cookies “__oppref” (storage period: 30 days) and “__obref” (storage period: 365 days) are stored in your browser. We receive only aggregated reports from OpenAI regarding the performance of our ads. Processing by OpenAI’s affiliated companies in the U.S. cannot be ruled out.

The use of cookies or similar technologies is based on your consent pursuant to Section 25(1), sentence 1 of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may revoke your consent at any time via the “Cookie Settings” in the footer of our website, without affecting the lawfulness of the processing carried out on the basis of your consent prior to revocation. For more information, please visit https://openai.com/policies/eu-privacy-policy/.

Using PixelYourSite

We use the WordPress plugin PixelYourSite to integrate and manage tracking services. The plugin is hosted on our own server; no personal data is transmitted to the plugin’s developer. PixelYourSite tracks events on our website (e.g., page views, product views, shopping cart and purchase events) and supplements this data with information such as the origin of the visit (traffic source, UTM parameters), landing page, and order details. To do this, the plugin sets its own cookies (e.g., “pysTrafficSource,” “pys_landing_page,” “pys_first_visit”). The data is shared with the services described in this Privacy Policy.

The use of cookies or similar technologies is based on your consent pursuant to Section 25(1), sentence 1 of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time via the “Cookie Settings” in the footer of our website, without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

Using Google for WooCommerce (Google Merchant Center)

We use the “Google for WooCommerce” extension provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). We use this to transmit our product data (e.g., product name, price, availability, images) to the Google Merchant Center in order to display our products on Google Shopping, in Google Search, and in Google Ads campaigns. No personal data of our customers is transmitted in this process. In addition, the extension integrates the Google Tag, which is used to transmit conversion data (e.g., purchase event, order value, products purchased) to Google Ads and the Merchant Center. The information in the “Google Ads” section applies accordingly; the Google tag is loaded only with your consent (Section 25(1), Sentence 1 of the TDDDG in conjunction with Article 6(1)(a) of the GDPR).

Using Trustindex (Google Reviews)

To display customer reviews posted about our company on Google, we use a widget provided by Trustindex Ltd. (Nyári Pál utca 15, 2724 Újlengyel, Hungary; “Trustindex”). The widget is displayed on our website via the Trustindex plugin. In the process, content such as scripts, review texts, and profile pictures of the reviewers may be loaded from servers operated by Trustindex or Google; in the process, your IP address, information about your browser and device, and the page you are viewing are transmitted, among other things. If content is loaded from Google, your IP address is also transmitted to Google. The purpose of this data processing is to display independent customer reviews to visitors of our website.

The use of cookies or similar technologies is based on your consent pursuant to Section 25(1), sentence 1 of the TDDDG in conjunction with Article 6(1)(a) of the GDPR. The processing of your personal data is based on your consent pursuant to Article 6(1)(a) of the GDPR. You may withdraw your consent at any time via the “Cookie Settings” in the footer of our website, without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal. For more information, please visit https://www.trustindex.io/privacy-policy. Google’s Privacy Policy also applies to the displayed Google reviews: https://policies.google.com/privacy.

Using Microsoft 365 for Email

For our email communications—in particular, order confirmations, shipping notifications, and customer service—we use Microsoft 365 (Exchange Online) provided by Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; “Microsoft”). In this process, the content of the emails as well as metadata (e.g., sender, recipient, date and time, IP addresses) are processed on Microsoft’s servers. Microsoft processes the data on our behalf based on a data processing agreement in accordance with Article 28 of the GDPR. A transfer to the United States cannot be ruled out. For the United States, the European Commission issued an adequacy decision on July 10, 2023, under the EU-U.S. Data Privacy Framework (Article 45 of the GDPR). Microsoft Corporation is certified under the Data Privacy Framework. In addition, the data transfer is based on standard contractual clauses, which serve as appropriate safeguards for the protection of personal data (Article 46(2)(c) of the GDPR).

Processing is carried out, to the extent that it serves the purpose of contract performance, on the basis of Article 6(1)(b) of the GDPR; in all other cases, it is based on Article 6(1)(f) of the GDPR, which reflects our legitimate interest in secure and efficient email communication. You have the right to object at any time to this processing based on Article 6(1)(f) of the GDPR for reasons arising from your particular situation. For more information, please visit https://privacy.microsoft.com/de-de/privacystatement.