Data Protection

1. Data controller and overview

Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is:

OBB Oberbadische Bettfedernfabrik GmbH
54 Mühlestraße
79539 Lörrach
Germany
Telephone: +49 7621 / 1520-0
Fax: +49 7621 / 1520-20
Email: info@obb.de
Website: www.obb.de

Managing directors authorised to represent the company: Bastian Roscheck, Petra Schweigert

2. General information on legal bases and data retention

Where we seek consent for the processing of personal data, this serves to Article 6(1)(a) of the GDPR (and, where applicable, Section 25(1) of the TDDDG (such as when setting cookies or reading information from end devices) as the legal basis.

Where processing is carried out for the purpose of performing a contract or taking steps prior to entering into a contract, Article 6(1)(b) of the GDPR the legal basis. Where processing is necessary to comply with a legal obligation, we rely on Article 6(1)(c) of the GDPR. If processing is necessary to safeguard a legitimate interest and the interests of the data subjects do not override this, we rely on Article 6(1)(f) of the GDPR (and Section 25(2) of the TDDDG in the case of technically necessary cookies).

Data transfers to third countries (in particular the USA):
Where we transfer data to the USA, this is primarily done on the basis of the EU Commission’s adequacy decision (EU–U.S. Data Privacy Framework – DPF) or on the basis of EU Standard Contractual Clauses (SCCs) in conjunction with your explicit consent (Article 49(1)(a) of the GDPR).

3. Provision of the website and server log files

When you visit our website, our web server automatically records technical information about your browser in what are known as server log files:

IP address of the device accessing the site
Date and time of access
Name and URL of the file accessed
Referrer URL (previously visited page)
Browser type, version and operating system

This data is processed on a temporary basis to ensure the technical functionality, stability and IT security of the website. The legal basis for this is Article 6(1)(f) of the GDPR (legitimate interest in secure and error-free operation). The data is usually deleted automatically after 7 to 14 days at the latest.

4. Online shop features (WooCommerce) and multilingual support (WPML)

Online shop via WooCommerce

We use the e-commerce system for our online shop WooCommerce (a plugin by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA).

When you place an order with us, we collect order details (e.g. name, delivery and billing addresses, email address, items ordered). WooCommerce uses cookies that are technically necessary (e.g. to store the contents of your shopping basket and for session management).

Legal basis: Article 6(1)(b) of the GDPR (performance of a contract) and Section 25(2)(2) of the TDDDG (storage necessary for technical reasons).

Multilingualism with WPML

To make our website available in several languages, we use the plugin WPML (OnTheGoSystems Ltd., 22/F, 3 Lockhart Road, Wanchai, Hong Kong). WPML stores a temporary cookie to retain the user’s chosen language for subsequent visits and for the duration of the session.

Legal basis: Article 6(1)(f) of the GDPR or Section 25(2)(2) of the TDDDG (legitimate interest in language output tailored to requirements).

5. Payment service providers

In order to process payments in the online shop, we pass on your payment details to the relevant financial service providers as part of the payment processing procedure.

PayPal

If you pay via PayPal, your order details will be sent to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

PayPal processes this data to carry out the transaction and, where necessary, to verify identity and creditworthiness. The legal basis for this is Article 6(1)(b) of the GDPR (performance of a contract). Further information can be found in the PayPal Privacy Policy.

Stripe

For payments (e.g. credit card, direct debit), we use the payment service Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

Stripe processes transaction and credit card data on its own behalf for the purposes of processing payments and preventing fraud. The legal basis for this is Article 6(1)(b) of the GDPR. The parent company, Stripe Inc., is certified under the EU-US Data Privacy Framework. For further details, see Stripe Privacy Policy.

6. Review portal: eTrusted (Trusted Shops)

To display customer reviews and collect feedback following a purchase, we integrate services from Trusted Shops AG (Sublimis / eTrusted), Colonius Carré, Subbelrather Str. 15c, 50823 Cologne, Germany.

When widgets are accessed, technical connection data is transmitted. Once your order has been completed, you may be sent an invitation to leave a review, provided you have given your separate consent (Article 6(1)(a) of the GDPR) or this is carried out on the basis of Article 6(1)(f) of the GDPR for quality assurance and review verification purposes. Further details can be found in the Trusted Shops’ Privacy Policy.

7. Tag management, web analytics and advertising

Important note regarding consent management: The Google and Meta services listed below will only be loaded and executed once you have expressly given your consent via our cookie consent banner (Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG). You can revoke your consent at any time via the banner, with effect for the future.

Google Tag Manager

We use the Google Tag Manager Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’).

The Tag Manager itself does not store any cookies or collect any personal data; it merely serves as a trigger and management tool for other scripts and tags (such as Google Analytics or Google Ads).

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google. GA4 uses cookies and identifiers to analyse user behaviour on the website (e.g. time spent on the site, clicks, scroll depth, Cart interactions).

In Google Analytics 4, IP anonymisation is enabled by default, meaning that your IP address is truncated before it is stored within the EU/EEA. Google LLC is certified under the EU-US Data Privacy Framework.

Legal basis: Consent pursuant to Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

Google Ads (including conversion tracking and remarketing)

We use Google Ads, to run adverts on the Google Display Network and measure their success (conversion tracking). If you found us via a Google advert, a cookie is set to track whether a purchase or interaction took place.

Legal basis: Consent pursuant to Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

Meta Ads & Meta Pixel (Facebook / Instagram)

On our website, we use the Meta-pixel Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (‘Meta’).

The pixel enables Meta to identify visitors to our website as a target audience for the display of advertisements (known as ‘Facebook Ads’ or ‘Instagram Ads’) and to analyse the effectiveness of our advertising campaigns for statistical purposes.

Insofar as personal data is collected via the pixel and transferred to Meta, we and Meta are joint controllers in accordance with Article 26 of the GDPR. The agreement on joint responsibility can be found at Meta Controller Addendum can be viewed. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

Legal basis: Consent pursuant to Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.

8. Contact and Support

If you contact us by email, telephone or via a contact form, we will process the information you provide (name, email address, enquiry) in order to deal with your enquiry.

Legal basis: Article 6(1)(b) of the GDPR (insofar as contractual enquiries or complaints are concerned) or Article 6(1)(f) of the GDPR (legitimate interest in responding promptly to customer enquiries).

9. Your rights as a data subject

Under the General Data Protection Regulation, you have the following rights:

Right of access (Article 15 of the GDPR): You may request information about the data we process about you.
Right to rectification (Article 16 of the GDPR): You may request that any inaccurate data be corrected or that your data be completed.
Right to erasure (Article 17 of the GDPR): You may request that your data be deleted, provided that there are no statutory retention periods that prevent this.
Restriction of processing (Article 18 of the GDPR): You may request that your data be processed only to a limited extent.
Data portability (Article 20 of the GDPR): You have the right to receive your data in a structured, commonly used format.
Right to withdraw consent (Article 7(3) of the GDPR): You may withdraw any consent you have given at any time with effect for the future.
Right to object (Article 21 of the GDPR): You have the right to object at any time to processing based on Article 6(1)(f) of the GDPR on grounds relating to your particular situation.
Right to lodge a complaint (Article 77 of the GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information in Baden-Württemberg (LfDI BW).

10. Data security (SSL/TLS)

For security reasons and to protect the transmission of confidential information, this site uses state-of-the-art TLS/SSL encryption. You can recognise an encrypted connection by the fact that the address bar in your browser changes from ‘http://’ to ‘https://’ and by the padlock icon in your browser’s address bar.

11. Cookie banner

Zur Verwaltung der eingesetzten Cookies und ähnlichen Technologien (Tracking-Pixel, Web-Beacons etc.) und diesbezüglicher Einwilligungen setzen wir das Consent Tool “Real Cookie Banner” ein. Details zur Funktionsweise von “Real Cookie Banner” findest du unter https://devowl.io/de/rcb/datenverarbeitung/.

The legal basis for the processing of personal data in this context is Article 6(1)(c) of the GDPR and Article 6(1)(f) of the GDPR. Our legitimate interest is the management of the cookies and similar technologies used, and the associated consents.

The provision of personal data is neither contractually required nor necessary for the conclusion of a contract. You are not obliged to provide personal data. If you do not provide personal data, we will be unable to manage your consents.

12. Use of Cloudflare Turnstile

On our website, we use the service Cloudflare Turnstile one.
The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

Purpose and how it works

Turnstile is used to determine whether entries on our website are made by a real person or, abusively, by automated programmes (so-called bots).
We use turnstiles in invisible mode (invisible mode), so that the verification process usually takes place in the background without any disruptive puzzles or additional interaction steps.
The service analyses technical device signals, network parameters and telemetry data (including IP address, user agent, operating system, TLS fingerprinting and interaction patterns).
According to the provider, the data is not used for behavioural advertising or to create user profiles.

Legal basis

The use of Cloudflare Turnstile is based on our legitimate interest in accordance with Article 6(1)(f) of the GDPR the IT security of our online services, the stability of our shop systems, and protection against brute-force attacks, credential stuffing and spam registrations.

Data transfers to third countries

The data collected as part of the review is transferred to Cloudflare’s servers and processed there. It cannot be ruled out that this data may be transferred to the USA.
Cloudflare, Inc. is, following the EU-US Data Privacy Framework (DPF) certified, thereby ensuring a level of data protection in line with European standards. In addition, Standard Contractual Clauses (SCCs) have been agreed.

Further information & Turnstile Privacy Addendum

Further details on data processing by Turnstile, as well as the provisions governing incognito mode Turnstile Privacy Addendum can be found at:
https://www.cloudflare.com/turnstile-privacy-policy/

You can view Cloudflare’s general privacy policy here:
https://www.cloudflare.com/privacypolicy/