Privacy Policy

1. Introduction and Contact Details of the Controller

We are pleased that you are visiting our website and thank you for your interest. In the following, we will inform you about the handling of your personal data when you use our website.

Personal data is any data with which you can be personally identified.

The controller for data processing on this website in the sense of the General Data Protection Regulation (GDPR) is:

Edenharter & Helmer GbR
trading as Trunk Hogs
Steinbuckelweg 9
93413 Cham
Germany
E-mail: info@trunkhogs.com

The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2. Data Collection When Visiting Our Website

When you use our website for informational purposes only, i.e., if you do not register, place an order, or otherwise transmit information to us, we only collect data that your browser transmits to the page server.

The following data, in particular, may be processed:

• visited website
• date and time of access
• amount of data sent
• source or reference from which you accessed the page
• browser used
• operating system used
• IP address used, possibly in abbreviated or anonymized form

Processing is carried out on the basis of Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the technical provision, security, stability, and functionality of our website.

We do not carry out any further analysis of this data for marketing purposes. However, we reserve the right to review server log files retrospectively if there are concrete indications of illegal use.

3. Hosting and Shopify Shop System

To operate our online shop, we use the shop system and hosting services of:

Shopify International Limited
Victoria Buildings
2nd Floor
1-2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides us with the technical platform through which we offer our goods, receive orders, operate the shop, and manage customer profiles.

When using our online shop, personal data may be processed on Shopify's systems. This may include, in particular, IP addresses, contact details, order data, payment information, delivery information, customer account data, and technical usage data.

Data may also be transferred to other Shopify companies and service providers, particularly to Canada and the USA, as part of Shopify's services. For data transfers to third countries, appropriate safeguards are used in accordance with data protection regulations.

We have concluded a data processing agreement with Shopify insofar as Shopify processes personal data on our behalf.

Depending on the context, processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as it is necessary for contract fulfillment, and on the basis of Art. 6 Para. 1 lit. f GDPR due to our legitimate interest in the secure, functional, and economical operation of our online shop.

Further information on data processing by Shopify can be found in Shopify's privacy policy.

4. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device.

Some cookies are technically necessary for our website and the ordering process to function properly. This includes, in particular, cookies for the shopping cart function, session management, secure payment processing, and the display of the shop.

The processing of technically necessary cookies is based on Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the error-free and secure provision of our website and online shop.

Insofar as cookies or similar technologies are used that are not technically necessary, for example for analysis, marketing, or tracking purposes, their use only takes place on the basis of your consent according to Art. 6 Para. 1 lit. a GDPR, provided that such consent is legally required.

You can change your cookie settings, if offered on our website, at any time via the cookie banner or the cookie settings.

5. Contacting Us

If you contact us, for example by email or via a contact form, we process the personal data you provide solely for the purpose of processing and responding to your inquiry.

This may include, in particular, your name, email address, the content of the message, and any other information you voluntarily submit.

The legal basis for the processing is Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in processing and responding to your inquiry.

If your contact is aimed at concluding or fulfilling a contract, an additional legal basis is Art. 6 Para. 1 lit. b GDPR.

Your data will be deleted once your inquiry has been conclusively processed and no legal retention obligations or legitimate interests in further storage prevent this.

6. Authority Inquiries and Authority Form

If you use our authority form, we process the personal data you submit to review, process, and respond to your inquiry.

This may include, in particular, the following data:

• Name
• Department, authority, organization, or company
• Official contact details
• Content of the inquiry
• Other information you voluntarily submit

Processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as the inquiry is aimed at initiating or fulfilling a contract.

Insofar as processing is necessary for reviewing and handling general authority, organizational, or company inquiries, it is carried out on the basis of Art. 6 Para. 1 lit. f GDPR.

Our legitimate interest lies in processing such inquiries and communicating with authorities, organizations, companies, or official contact persons.

The data will be deleted as soon as the inquiry has been conclusively processed and no legal retention obligations or legitimate interests in further storage exist.

7. Test, Application, and Inquiry Forms

If you use a test form, application form, or a similar inquiry form on our website, we process the personal data you submit to review, process, and respond to your inquiry.

This may include, in particular, the following data:

• Name
• Email address
• Other contact details
• Social media profile, if voluntarily provided
• Information about yourself
• Information about the intended use
• Content of your message
• Other information you voluntarily submit

Processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as the inquiry is aimed at initiating or fulfilling a contract, a cooperation, or a comparable legal relationship.

Insofar as processing is necessary for the selection, review, and organization of product tests, cooperations, or comparable actions, it is carried out on the basis of Art. 6 Para. 1 lit. f GDPR.

Our legitimate interest lies in organizing such actions, selecting suitable participants, and processing incoming inquiries.

The data will be deleted as soon as the inquiry has been conclusively processed and no legal retention obligations or legitimate interests in further storage exist.

8. Product Notifications, Restock Alerts, and News Forms

If you subscribe to product notifications, restock alerts, drop information, or other news about specific products via a form, we process your email address and any other voluntary information to send you the requested information.

Processing is carried out on the basis of your consent in accordance with Art. 6 Para. 1 lit. a GDPR.

The registration generally takes place via a double opt-in procedure. This means that after registration, you will receive an email in which you must confirm your registration. Only after this confirmation will you receive the respective notification.

You can revoke your consent at any time with effect for the future, for example via the unsubscribe link in the respective email or by sending us a message.

After revoking your consent, your data for these notifications will be deleted, unless there are legal retention obligations or other legitimate reasons for further storage.

9. Customer Account, Customer Profile, and Extended Customer Profiles

If you create a customer account in our online shop, place an order, or provide customer data during an order, we process the personal data required for this purpose.

This may include, in particular, the following data:

• Name
• Email address
• Billing address
• Delivery address
• Telephone number, if provided
• Order history
• Customer status
• Communication with us
• Return and complaint information
• Saved preferences or profile information
• Information about customer account, login, and use of the customer profile

Within our Shopify shop, we use customer profiles or extended customer profiles to manage orders, process customer inquiries, improve customer service, assign inquiries to orders, and enable returning customers to use our shop more efficiently.

Processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as it is necessary for setting up and using the customer account, for carrying out orders, or for processing contractual matters.

Insofar as processing also takes place for internal organization, customer care, fraud prevention, or improvement of our processes, it is based on Art. 6 Para. 1 lit. f GDPR.

Our legitimate interest lies in efficient management of our customer relationships and a functional customer service.

You can request the deletion of your customer account at any time by sending us a message. After the customer account has been deleted, your data will be deleted, provided that all contracts concluded through it have been fully processed, no legal retention periods prevent this, and we have no legitimate interest in further storage.

10. Order Processing

When you place an order in our online shop, we process the personal data required for the execution of the order.

This may include, in particular, the following data:

• Name
• Billing address
• Delivery address
• Email address
• Telephone number, if provided or required for delivery
• Order data
• Payment data
• Shipping data
• Information on returns, complaints, and customer service cases

Processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR for the fulfillment of the contract with you.

Insofar as we are legally obliged to retain certain data, processing is additionally carried out on the basis of Art. 6 Para. 1 lit. c GDPR.

11. Transfer of Data to Shipping Service Providers

For the delivery of your order, we pass on the necessary personal data to the commissioned shipping service provider.

This may include, in particular, name, delivery address, email address, and, if applicable, telephone number, insofar as this data is necessary for delivery or shipping notification.

Shipping is currently carried out in particular via:

DHL / Deutsche Post DHL Group

The transfer is carried out on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as it is necessary for the delivery of the ordered goods.

Insofar as the transfer of your email address or telephone number to the shipping service provider is exclusively for shipping announcements or package notifications and consent is required for this, processing is carried out on the basis of Art. 6 Para. 1 lit. a GDPR.

12. Payment Processing

For the processing of payments, we pass on personal data to the respective selected payment service provider, insofar as this is necessary for payment processing.

The payment methods available at checkout will be displayed to you during the order process.

The payment methods offered may include, in particular:

• Credit card
• Debit card
• American Express
• Visa
• Mastercard
• Maestro
• PayPal
• Apple Pay
• Google Pay
• Klarna
• Shop Pay
• UnionPay
• Other payment methods displayed at checkout

Processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR, insofar as it is necessary for payment processing and contract fulfillment.

Depending on the selected payment method, the respective payment service providers may also process personal data under their own data protection responsibility. For this, the data protection information of the respective payment service provider applies.

13. Shopify Payments, Credit Cards, Debit Cards, and Shop Pay

For certain payment methods, especially credit cards, debit cards, Shop Pay, and other payment methods displayed at checkout, we use payment services provided via Shopify Payments.

In the context of payment processing, personal data such as name, billing address, delivery address, email address, payment data, transaction data, and order data may be processed and transmitted to the involved payment service providers.

Payment processing via Shopify Payments may involve payment service providers such as Stripe.

Processing is carried out on the basis of Art. 6 Para. 1 lit. b GDPR for payment processing and contract fulfillment.

Further information on data processing in connection with Shopify Payments, Shop Pay, and Stripe can be found in the data protection information of the respective providers.

14. PayPal

If you select a PayPal payment method, payment processing is carried out via:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg

In the context of payment processing, the personal data required for this purpose is transmitted to PayPal. This may include, in particular, name, address, email address, payment data, invoice amount, currency, transaction data, and order information.

The processing is carried out on the basis of Art. 6 (1) lit. b GDPR for payment processing and contract fulfillment.

PayPal may also process personal data under its own data protection responsibility. Further information on this can be found in PayPal's privacy policy.

15. Klarna

If you select a Klarna payment method, payment processing is handled by:

Klarna Bank AB
Sveavägen 46
111 34 Stockholm
Sweden

In the context of payment processing, the personal data required for this purpose is transmitted to Klarna. This may include, in particular, name, address, email address, telephone number, payment data, invoice amount, order data, and transaction data.

For certain payment methods, in particular purchase on account, installment payments, or other payment methods where Klarna makes an advance payment, Klarna may carry out an identity and credit check.

The processing is carried out on the basis of Art. 6 (1) lit. b GDPR, insofar as it is necessary for payment processing and contract fulfillment.

Insofar as a credit check is carried out to prevent payment defaults, the processing may additionally be based on Art. 6 (1) lit. f GDPR. The legitimate interest lies in preventing payment defaults.

Klarna also processes personal data under its own data protection responsibility. Further information on this can be found in Klarna's privacy policy.

16. Apple Pay

If you select Apple Pay as the payment method, payment processing is handled via the Apple Pay function of your device.

The provider is:

Apple Distribution International Ltd.
Hollyhill Industrial Estate
Hollyhill, Cork
Ireland

In the context of payment processing, the necessary payment and transaction data are processed. Apple Pay uses security features of your device, such as device account numbers, tokenization, and authentication procedures.

The processing is carried out on the basis of Art. 6 (1) lit. b GDPR for payment processing and contract fulfillment.

Further information on data processing by Apple Pay can be found in Apple's privacy information.

17. Google Pay

If you select Google Pay as the payment method, payment processing is handled via Google Pay.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

In the context of payment processing, the necessary payment and transaction data are processed. Google Pay may transmit payment information in the form of tokens or transaction identifiers to complete and confirm the payment.

The processing is carried out on the basis of Art. 6 (1) lit. b GDPR for payment processing and contract fulfillment.

Google may also process personal data under its own data protection responsibility. Further information on this can be found in Google's privacy information.

18. Review system with Judge.me

We use the Judge.me review app in our online shop to display and manage customer reviews of our products and our shop.

The provider is:

Judge.me Ltd.
5th Floor
20 Farringdon Street
London
EC4A 4AB
United Kingdom

If you submit a review or interact with review functions, personal data may be processed.

This may include, in particular, the following data:

• Name or display name
• Email address
• Review text
• Review date
• Product reference
• Order reference
• IP address
• Technical usage data

The processing serves to record and display reviews, prevent misuse, verify the authenticity of reviews, and, if applicable, allow follow-up questions regarding a review.

The processing is carried out on the basis of Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the transparent presentation of customer reviews, the quality assurance of our products, and the prevention of abusive reviews.

If you have expressly consented to a review request, the publication of your review, or a specific processing, the processing is carried out on the basis of Art. 6 (1) lit. a GDPR.

Judge.me may also process personal data under its own data protection responsibility or via subcontractors. Further information on data processing by Judge.me can be found in Judge.me's privacy information.

19. Review requests by email

If you receive a review request by email after a purchase, this only happens if there is a legal basis for it.

This may be the case, in particular, if you have expressly consented or if there is legally permissible communication in connection with your purchase.

The processing is carried out, depending on the case, on the basis of Art. 6 (1) lit. a GDPR or Art. 6 (1) lit. f GDPR.

You can object to receiving review requests at any time with effect for the future.

20. Loyalty program with BLOY

We use the BLOY Loyalty app in our online shop to offer a customer loyalty program.

The provider is:

BLOY Loyalty
BLOY Rewards Program & Loyalty
Provider's registered office according to Shopify: Singapore

If you participate in our loyalty program or use loyalty program functions, personal data may be processed.

This may include, in particular, the following data:

• Name
• Email address
• Customer account
• Order history
• Points or reward status
• Redeemed benefits
• Customer status
• Participation in the loyalty program
• Technical usage data

The processing serves to enable your participation in the loyalty program, record points or benefits, provide rewards, prevent misuse, and technically manage the program.

The processing is carried out on the basis of Art. 6 (1) lit. b GDPR, insofar as it is necessary for the implementation of the loyalty program.

Insofar as the processing is carried out for the improvement, administration, analysis, or prevention of misuse of our loyalty program, it is based on Art. 6 (1) lit. f GDPR. Our legitimate interest lies in the implementation, administration, and optimization of our customer loyalty program.

If consent is required for certain functions, communications, or marketing measures within the framework of the loyalty program, the processing is carried out on the basis of Art. 6 (1) lit. a GDPR.

BLOY may also process personal data under its own data protection responsibility or as a service provider. Further information on data processing by BLOY can be found in BLOY's privacy information.

21. Newsletter

If you subscribe to our email newsletter, we use your email address to regularly send you information about our offers, products, promotions, and news.

The newsletter is only sent to persons who have subscribed to it or for whom there is legally permissible existing customer advertising.

Your email address is mandatory for the newsletter. Further details are voluntary.

The newsletter subscription generally uses the double opt-in procedure. This means that after registration, you will receive an email in which you must confirm your subscription. Only after this confirmation will you receive our newsletter.

When you register, we store the IP address as well as the date and time of registration and confirmation to prove the registration and to be able to trace any misuse of your email address.

The processing is carried out on the basis of your consent according to Art. 6 (1) lit. a GDPR.

You can unsubscribe from the newsletter at any time via the unsubscribe link in the newsletter or by sending us a message. After unsubscribing, your email address will be deleted from the newsletter distribution list, unless there are legal retention obligations or other permissible reasons for further storage.

22. Email advertising to existing customers

If you have provided us with your email address in connection with the purchase of goods or services, we reserve the right to send you offers for similar goods or services from our range by email.

This is only done if the legal requirements of Section 7 (3) UWG are met.

The processing is carried out on the basis of Art. 6 (1) lit. f GDPR. Our legitimate interest lies in advertising to existing customers for similar products.

You can object to the use of your email address for this purpose at any time with effect for the future. No costs other than the transmission costs according to the basic rates will be incurred for this.

After receipt of your objection, the use of your email address for advertising purposes will cease.

23. Rights of the data subjects

As a data subject, you have the following rights under the GDPR:

• Right to information according to Art. 15 GDPR
• Right to rectification according to Art. 16 GDPR
• Right to erasure according to Art. 17 GDPR
• Right to restriction of processing according to Art. 18 GDPR
• Right to notification according to Art. 19 GDPR
• Right to data portability according to Art. 20 GDPR
• Right to withdraw granted consents according to Art. 7 (3) GDPR
• Right to lodge a complaint with a supervisory authority according to Art. 77 GDPR

If you have given consent to the processing of personal data, you can revoke this consent at any time with effect for the future.

24. Right to object

If we process personal data on the basis of Art. 6 (1) lit. f GDPR due to our legitimate interest, you have the right to object to this processing at any time for reasons arising from your particular situation.

If you exercise your right to object, we will stop processing the data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves for the establishment, exercise, or defense of legal claims.

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purpose of such advertising.

If you exercise your right to object to direct marketing, we will stop processing the data concerned for direct marketing purposes.

25. Duration of storage of personal data

The duration of the storage of personal data depends on the respective legal basis, the purpose of the processing, and, if applicable, statutory retention periods.

When processing is based on consent pursuant to Art. 6 (1) lit. a GDPR, we store the data until you withdraw your consent, unless there is another legal basis for further storage.

When processing is for contract fulfillment or the implementation of pre-contractual measures pursuant to Art. 6 (1) lit. b GDPR, we store the data for as long as necessary for the execution of the contract and then only insofar as statutory retention obligations or legitimate interests exist.

When processing is based on a legal obligation pursuant to Art. 6 (1) lit. c GDPR, we store the data for the duration of the respective statutory retention period.

When processing is based on legitimate interests pursuant to Art. 6 (1) lit. f GDPR, we store the data for as long as our legitimate interest exists, unless your interests, fundamental rights, or fundamental freedoms prevail or you effectively object.

Personal data will be deleted as soon as they are no longer necessary for the purposes for which they were collected or processed and no statutory retention obligations or legitimate reasons for further storage exist.

26. Timeliness of this privacy policy

This privacy policy is valid in the version published on our website.

We reserve the right to adapt this privacy policy if technical, legal, or organizational changes occur.