Privacy, Data protection, Data Privacy Policy

When you visit our website, we process personal data (any information relating to an identified or identifiable natural person), provided that we are permitted to do so by law or we have your consent to do so. This Privacy Notice outlines how we process your personal data (also referred to as “data processing” below) and explains your rights as a data subject.

Contents

1. Data controller
   B. How to contact our data protection officer
   C. Operation and hosting of our website
   D. Overview of our data processing activities
   E. Performance of a contract
   F. Use of our website
   G. Communication
   H. Your additional rights as a data subject
   J. Data security
2. Data controller

The data controller responsible for the processing of data on this website is:

Noble Glass OY
Suvikatu 18 A1

FIN-04430 Järvenpää

Finland

E-Mail: info@nobleglass.fi
Tel: +358 45 35 44 557

1. How to contact our data protection officer

Our data protection officer can be contacted as follows:

Data Protection Officer of
Noble Glass OY
Suvikatu 18 A1

FIN-04430 Järvenpää

Finland

E-Mail: info@nobleglass.fi
Tel: +358 45 35 44 557

1. Operation and hosting of our website

Our website is operated in our name and on our behalf (Article 28 of the General Data Protection Regulation – GDPR) by a full-service e-commerce provider that we have commissioned to conduct all of the data processing activities relating to the use of our website. This data processing takes place on the servers of a hosting provider that connects the website to the internet on our behalf. Both service providers are based in Finland.

1. Overview of our data processing activities

We process data as follows:

• When you shop with us, we process data from you that we need to enter into and execute a purchase agreement (“performance of a contract”) with you (see section E below for more information on this);
• When you visit and surf our website (“use of our website”), we process data from and on your end device, some of which could be used to identify you as an individual (see section F below for more information on this);
• Finally, we process your data when you get in contact with us (“communication”), for example by subscribing to our newsletter, reviewing a product or sending us a message using the means of communication made available to you by us (see section G below for more information on this);

1. Performance of a contract
2. General information about data processing

When you make a purchase on our online shop, we will ask you to provide us with the following personal information:

• First name;
• Surname;
• Billing/delivery address;
• Email address;
• Bank details and/or credit card details.

1. Scope and purposes of the data processing

We process the data requested from you for the following purposes:

• To email you your confirmation of receipt and, if applicable, order confirmation containing the information required by law and to email you status updates on the delivery of the goods you have ordered;
• To process your payment;
• To send you your order invoice;
• To deliver the goods you have ordered;
• To assign any order cancellations, complaints and other enquiries made after the order has been placed to you and to your order and to handle your requests and enquiries.

If you choose to open a customer account by clicking on “My account – Register now”, we will also process this data to register you as a Noble Glass customer in case you visit or make purchases from our online shop again in the future. This means that you will not have to re-enter the information we need to perform the contract each time that you place an order with us and will allow you to see purchases that you have already made in your customer account at any time. After logging into your customer account, you can also save products available in our online shop as favourites so that you can purchase them at a later date if you so wish.

III. Data transfer/recipients

The recipients of your data are our website’s technical operator and hosting provider (see section C above). If necessary, in order to perform the contract, your data will also be passed to the companies commissioned by us to accept and process your order. These companies are as follows:

• The delivery company commissioned to dispatch, deliver or pick up the goods;
• The bank/building society responsible for processing the payment.

If you have chosen one of the PayPal payment methods of payment on account, direct debit or credit card, the following pieces of personal data are required to be passed on to PayPal (Europe) S.á.r.l. & Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, to enable your payment to be processed further and, in the case of payments on account, to enable our payment claim to be assigned to PayPal:

• Invoice number;
• Invoice amount;
• Recipient name and delivery address;
• Invoicee name and billing address.

1. Duration of storage

If you choose not to open a customer account, your data will be blocked once the purchase agreement has been fulfilled. This means it will only be processed by us to a limited extent. We will, on the one hand, be required to process it if you exercise claims against us within the statutory periods of limitation (usually three years) and we need to link these claims to you as an individual and the respective business transaction. On the other hand, we are required by commercial and tax law to keep business records for a maximum of ten years. These records may contain your data. We will delete your data as soon as these purposes have been met and these periods of time have expired.

If you have chosen to open a customer account, we will store your data in this account until you ask us to delete your customer account.

1. Legal bases for processing

The data is processed because doing so is necessary for the performance of a contract (Article 6, Paragraph 1b GDPR).

In some cases (sending confirmations of receipt and providing the information required under distance selling regulations), we also need to process the data in order to meet a legal obligation to which we are subject.

If you have opened a customer account, we also process your data on the basis of the consent you gave us when you opened your account (Article 6, Paragraph 1a GDPR).

1. Right to withdraw consent

You may withdraw your consent at any time with effect for the future for your data to be processed for the purpose of managing your customer account by contacting us using one of the methods of contact found in section A above. We will then delete your customer account.

1. Use of our website

Each time you visit our website, we process certain pieces of data from and, in some cases, on your computer/end device. These data processing activities can be divided into the following categories:

• Logging of your visit/use of functional cookies (see section I below for more details)
• Analysis of your use of our website using Google Analytics & Optimize (see section II below for more details)
• Use of tracking technology to provide personalised online advertising (see section III below for more details)
• Use of social plugins to connect our website to social media (see section IV below for more details)
• Embedding of YouTube videos (see section VI below for more details)
• Locating dealers using Google Maps (see section VII below for more details)
• Integration of Adobe Typekit (see section VIII below for more details)
• Use of Google reCAPTCHA (see section XI below for more details)

1. Logging of your visit/use of functional cookies
2. General information about data processing

The following log data is processed by us automatically each time you visit our website and each time you download a file from one of our webpages:

• The hostname of your computer/end device (IP address);
• The date and time of access/download;
• The page accessed;
• The name of the file downloaded (if applicable);
• The type of browser you are using;
• The operating system on your end device;
• The website you were visiting before you accessed our site.

We also use functional cookies to help us to operate our website. These are small text files that we store on your computer/end device. Functional cookies comprise both session cookies, which are only stored for the duration of your visit to our website, and persistent cookies, which remain on your computer/end device for longer. Both types of cookie contain a distinct alphanumeric string of characters, which in the case of persistent cookies allows your browser to be recognised if you visit our website again.

2. Scope and purposes of the data processing

We process the data for the following purposes:

• To identify and protect against attacks on our website;
• To ascertain whether your internet browser supports cookies;
• To prevent pop-ups being shown to you more than once;
• To display our website in the language you have chosen;
• To display our website in the correct version for the shipping country you have selected.

3. Data transfer/recipients

The recipients of your data are our website’s technical operator and hosting provider (see section C above).

4. Duration of storage

The data is stored for the following periods of time:

• Log data: until the purpose has been fulfilled, a maximum of three months;
• Session cookies: until you leave our website;
• Persistent cookies: one year.

5. Legal basis for processing

We process the data on the basis of our interest in ensuring that our website is fully functional and secure. In our assessment, this legitimate interest is not overridden by the interests or fundamental rights and freedoms of the data subjects (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

6. Right to object

You have the right to object, on grounds relating to your particular situation, to this processing at any time. If you exercise this right, we will no longer process this data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless the processing is being used to establish, exercise or defend legal claims. You can exercise your right to object by contacting us using the details provided in A above. Alternatively, you can control which types of cookie are created and whether they are created at all by adjusting your browser settings. If you do not accept the use of functional cookies, this may limit the functionality of our website.

1. Analysis of your use of our website using Google Analytics & Optimize
2. General information about data processing

We use Google Analytics including Google Optimize, a web analytics service provided by Google Ireland Limited(“Google”).

Google uses cookies. These are text files that are stored on your computer/end device and enable Google to analyse how you use our website. The following information is processed by Google Analytics:

• Browser type;
• Operating system;
• The website you visited before accessing our website;
• The hostname of your computer/end device (IP address, abbreviated);
• The time the request is received by our server.

2. Scope and purposes of the data processing

Google processes the data collected by the cookie on our behalf so that it can evaluate how you use our website, compile reports on website activities and provide other services to us relating to website and internet usage. Through the Google Optimize sub-service, we test new content and features on our site for a proportion of visitors to statistically evaluate any changes in usage. During these procedures, no data that could be used to identify you is processed. In particular, the cookie created does not contain any usernames (user IDs). The abbreviated IP address transmitted by your browser during the Google Analytics process is not merged with other Google data.

3. Data transfer/recipient

The information generated by the cookie about how you use our website is generally transferred to and stored on a Google server in the USA. Thanks to the deactivation of the User-ID feature and the activation of IP anonymisation (abbreviation of the IP address by removing the last octet), the data can no longer be linked to your connection or computer/end device.

4. Duration of storage

The data processed is stored by Google for 14 months before being deleted.

5. Legal basis for processing

We process the data on the basis of our interest in conducting statistical evaluations on the use of our website and in using the results of these evaluations to analyse the efficiency of our website. In our assessment, this legitimate interest is not overridden by the interests or fundamental rights and freedoms of the data subjects (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

6. Right to object

You have the right to object, on grounds relating to your particular situation, to this processing at any time. If you exercise this right, we will no longer process this data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless the processing is being used to establish, exercise or defend legal claims. You can prevent Google from collecting and processing the data generated by the cookie about your use of the website by moving the analysis slider in the cookie banner displayed when you visit our website from right (green) to left (grey) or by downloading and installing the browser plugin available at http://tools.google.com/dlpage/gaoptout?hl=en-GB. Alternatively, or when using a browser on a mobile device, you can also prevent Google Analytics & Optimize from capturing data on this website in the future by clicking here (this opt-out feature only works in this one browser and for this domain). This results in an opt-out cookie being created on your end device. You must click on the link again if you delete the cookies in this browser. A final option is to change your browser settings so that cookies are not created. If you do not accept the use of functional cookies, this may limit the functionality of our website.

III. Use of tracking technology to provide personalised online advertising

1. General information about data processing

Provided that you expressly consent to this when visiting our website, we use tracking technology such as cookies or tracking pixels from third-party providers for the purpose of personalised online advertising.

Tracking cookies are text files that are stored on your computer/end device. Tracking pixels are small graphics in our website header. Both technologies enable your browser to be recognised on other websites. We use the following tracking technologies from the following third-party providers to process the types of information listed below:

Google AdWords Remarketing provided by Google Ireland Limited(Google):

• Browser type;
• Operating system;
• Preferred language;
• Your visit to our website, including the date and time;
• Your most recent Google search, including the date and time;
• The hostname of your computer/end device (IP address, abbreviated);
• Alphanumeric username (user ID).

KUPONA Retargeting provided by KUPONA GmbH (KUPONA):

• Browser type;
• Operating system;
• Preferred language;
• Your visit to our website and, if applicable, visited product, category and brand subpages, including the date and time;
• The hostname of your computer/end device (IP address);
• Approximate location (city, state, country);
• Alphanumeric username (user ID);
• Mobile Ad ID (if applicable).

Facebook Custom Audience Pixel provided by Facebook Ireland Ltd. or Facebook Inc. (Facebook):

• Browser type;
• Operating system;
• Preferred language;
• Websites visited, including the date and time;
• The hostname of your computer/end device (IP address);
• Alphanumeric username (user ID).

We record your consent in a log file. This involves the following information being processed:

• The hostname of your computer/end device (IP address);
• The consent text;
• Activation of the “I agree” slider;
• The date and time at which you gave your consent (timestamp).

2. Scope and purposes of the data processing

We use tracking technology provided by Google, KUPONA and Facebook to allow Google and KUPONA to detect your browser on other websites and Facebook to detect your browser on Facebook using the recorded data specified in 1 above. This enables Google, KUPONA and Facebook to display our adverts based on your presumed interests. Google, KUPONA and Facebook ascertain your presumed interests from a pseudonymous profile. This pseudonymous profile is created using information gathered by the cookies/pixel about how you use the internet. For example, if you have shown an interest in certain products on our website, the use of the aforementioned third-party cookies allows us to display products of this type on websites connected to these third-party providers. In general, this also prevents the display of annoying advertising that is irrelevant and does not match your interests.

You can find out the categories that are being used to display personalised ads to you in the Google Display Network by clicking on the i button on the advert being displayed to you in order to discover why this particular advert is being shown to you or by visiting the Google page “Why am I seeing this ad”.

We record your consent so that we can demonstrate that it has been received.

3. Data transfer/recipients

The data recipients for Google are Google Ireland Ltd and its affiliated company Google LLC, which is based in the US. The data recipients for Facebook are Facebook Ireland Ltd and its affiliated company Facebook Inc., which is based in the US. The data recipients for KUPONA are KUPONA GmbH, Fulda, Germany as well as the subcontractors engaged by KUPONA (e.g. service providers for the delivery of advertising content, ad server providers). You can find a current list of the subcontractors engaged by KUPONA here:
https://www.kupona.de/dsgvo/#auftragsverarbeitung.

4. Duration of storage

In your browser’s security settings, you can find out for how long the various cookies are being stored and for how long your data is being processed for the above purposes. We store the log data about your consent until you withdraw your consent. Once you have withdrawn your consent, we store this log data for the duration of the period of limitation for your claims (three years) plus a safety margin of one month to allow for the delivery of any court documents, i.e. for a total of 37 months.

5. Legal basis for processing

The data is processed on the basis of your consent (Article 6, Paragraph 1a GDPR).

6. Right to withdraw consent

Your consent to the use of tracking cookies for personalised advertising remains in force until you withdraw it. You can do this at any time with effect for the future. If you wish to completely turn off tracking for advertising purposes on this website, go to the top of your cookies settings and switch the slide bar for marketing to the left. You can prevent the use of tracking cookies for personalised advertising in the Google Display Network by vising the Google Ads Settings page and moving the slider for “Ads personalisation online” and/or for “Ads personalisation during Google searches” from left to right. Click here to find out how to separately block certain ads or specific advertisers. You can only prevent KUPONA GmbH from using tracking cookies for interest-based advertising by following this link to the Kupona website and switching your tracking status from green, “active”, to red, “inactive”. You can prevent the use of just the Facebook pixel by clicking on this link. You can control whether tracking cookies can be stored on your device at all by turning off cross-site tracking in your browser settings.

1. Use of social plugins

We use social plugins on our website provided by the social networks Facebook, Google+, Pinterest and Twitter. To protect your data, these plugins are not directly integrated into our website but are embedded into the page via an HTML link (using the Shariff solution developed by c’t). This ensures that when you visit one of our webpages containing a plugin of this kind, no connection is automatically made with the servers of the respective social network providers. Instead, when you click on one of the buttons, a new browser window will open and display the page of the respective social network so that you can, for example, click the like or share button (if necessary, after entering your login data).

Please consult the privacy policies of the social media providers to find out the purpose for and extent to which the data is collected and processed by the respective providers as well as your rights relating to this and how you can change your settings to protect your privacy.

Facebook’s Data Policy: http://www.facebook.com/policy.php
Google’s Data Policy: https://policies.google.com/privacy?hl=de&gl=de
Pinterest’s Privacy Policy: https://policy.pinterest.com/de/privacy-policy
Twitter’s Privacy Policy: https://twitter.com/de/privacy

1. Embedding of YouTube videos
2. General information about data processing

We have embedded YouTube videos into our website. These videos are stored on the YouTube.com platform, which is operated by Google Ireland Limited (YouTube), and can be viewed directly on our website.

2. Scope and purpose of the data processing

The videos are embedded in the “enhanced data protection mode”. This means that no personal data is transmitted from you to YouTube unless you play the videos. The following data is processed when you play the videos:

• The hostname of your computer/end device (IP address);
• The date and time of access/download;
• The page accessed with the embedded YouTube video;
• The name of the file downloaded (if applicable);
• The type of browser you are using;
• The operating system on your end device;
• The website you were visiting before you accessed our site.

Further personal data could be processed if you have a Google user account and are logged in. This further processing is carried out in line with the agreement made between you and Google.

Further information on the scope and purposes of the processing of data by YouTube is available here

3. Data transfer/recipient

Your data is transferred to YouTube. YouTube is represented by Google Ireland Limited as well as the related Google LLC in the USA.

4. Duration of storage

The data being processed is stored by YouTube/Google until the intended purpose has been met. It is then deleted. Further information about how YouTube stores data can be found in Google Ireland Limited’s Privacy Policy.

5. Legal basis for processing

We process the data on the basis of our interest in boosting the attractiveness of our website by embedding YouTube videos. In our assessment, this legitimate interest is not overridden by the interests or fundamental rights and freedoms of the data subjects (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

6. Right to object

You have the right to object, on grounds relating to your particular situation, to this processing at any time. If you exercise this right, we will no longer process this data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless the processing is being used to establish, exercise or defend legal claims. You can exercise your right to object by contacting us using the details provided in A above.

VII. Locating dealers using Google Maps

1. General information about data processing

We have integrated Google Maps API into our website, a map service provided by Google Ireland Limited(Google) which you can use to find specialist dealers supplying our products near you. When you use this service, you can enter the following data about yourself for the purpose of finding a dealer:

• Street, house number;
• Postcode, town/city;
• Country.

2. Scope and purpose of the data processing

When you click on the magnifying glass icon to activate the search function after entering your location details, the following data will be transferred to Google. Then click on “Find a dealer” to search for a dealer. Google will then be informed that you have accessed that particular subpage on our website. The following data will also be transferred to Google:

• Your IP address;
• Your access to the dealer locator page;
• Date and time of request;
• Time zone difference from Greenwich Mean Time (GMT);
• Content of the request (specific page);
• Access status/HTTP status code;
• Quantity of data transferred each time;
• Website the request has come from;
• Browser type;
• Operating system and its interface;
• Language and version of browser software

Further personal data could be processed if you have a Google user account and are logged in. This further processing is carried out in line with the agreement made between you and Google. More information on the scope and purposes of the data processing by Google and your rights is available here.

3. Data transfer/recipients

The recipients of the data are Google Ireland Ltd and its affiliated company Google LLC, which is based in the US.

4. Duration of storage

The data being processed is stored by Google until the intended purpose has been fulfilled. It is then deleted. You can find more information about how Google Maps stores data in Google Ireland Limited’s Privacy Policy.

5. Legal basis for processing

The data is processed because doing so is necessary in order to complete the search request as a step taken prior to entering into a contract (Article 6, Paragraph 1b GDPR).

VIII. Integration of Adobe Typekit

1. General information about data processing

We use Adobe Typekit on this website, a service provided by Adobe Systems Software Ireland Ltd. (Adobe) which allows us to access the Adobe font library. In order to integrate the fonts we want to use into this website, your web browser needs to connect to an Adobe server in the USA and download the required font each time. This involves the following data being processed:

• Your IP address;
• The website accessed;
• Whether an ad blocker is being used;
• The date and time of access;
• The quantity of data transferred;
• The provider making the request.

2. Scope and purposes of the data processing

On the basis of the licence conditions relating to the use of fonts on our website, we track “pageviews” by counting the number of visits to the website for billing purposes and passing this information on to Adobe. To determine whether pageviews are being tracked correctly or whether the process is being hindered by the use of ad blockers, we check if there is an ad blocker enabled and pass this information on to Adobe if necessary. The data may be transferred by activating JavaScript code in your browser.

3. Data transfer/recipients

Your data is transferred to Adobe Systems Software Ireland Ltd. 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Republic of Ireland.

A European Commission decision governs the adequacy of the data protection level in respect of the transfer of personal data to Adobe servers in the USA.

4. Duration of storage

The data is stored by Adobe until the intended purpose has been fulfilled. It is then deleted.

5. Legal basis for processing

Data is processed based on our interest in the use of Adobe fonts on our website. In our assessment, this legitimate interest is not overridden by the interests or fundamental rights and freedoms of the data subjects (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

6. Right to object

You have the right to object to this processing on grounds relating to your particular situation at any time. If you exercise this right, we will no longer process this data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless the processing is being used to establish, exercise or defend legal claims. You can exercise your right to object by contacting us using the details provided in A above. You can install a JavaScript blocker (e.g. www.noscript.net) to prevent Adobe from running any JavaScript code at all. You can find more information about Adobe Typekit in the Adobe privacy policy at https://www.adobe.com/de/privacy/policy.html

1. Use of Google reCAPTCHA
2. General information about data processing

We use reCAPTCHA, a service provided by Google Ireland Ltd. (Google), for enquiries sent via the form on our website. This involves processing the following data on you:

• Browser type and settings
• Operating system
• Your visit to the website containing your form enquiry, including the date and time
• The hostname of your computer/end device (IP address, abbreviated)
• Mouse movements and clicks to answer the reCAPTCHA questions

2. Scope and purposes of the processing

We use the service to ensure that, based on the above mentioned data collected and any image recognition questions asked, the information entered subsequently in the form comes from an individual and not a bot.

You can find more information here about the scope of the data processing and about data protection applying to the use of Google products.

3. Data transfer/recipients

The recipients of the data are Google Ireland Ltd and its affiliated company Google LLC, which is based in the US.

4. Duration of storage

The data is stored until the intended purpose has been fulfilled and is then deleted.

5. Legal basis for processing

We process the data on the basis of our interest in ensuring that our website is secure and in order to prevent misuse in the form of the automated entry of fake information. In our assessment, this legitimate interest is not overridden by the interests or fundamental rights and freedoms of the data subjects (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

6. Right to object

You have the right to object, on grounds relating to your particular situation, to this processing at any time. If you exercise this right, we will no longer process this data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless the processing is being used to establish, exercise or defend legal claims. You can exercise your right to object by contacting us using the details provided in A above.

1. Communication
2. Newsletter
3. General information about data processing

On our website, you can choose to subscribe to our email newsletter service by entering your email address into the text box and clicking on the “Subscribe1” button.

We use a double opt-in procedure. This means that your subscription to the newsletter and your required consent only become valid once you have confirmed them by clicking on the link that we have sent to the email address provided.

We record your consent in a log file. This involves the following information being processed:

• The email address you have provided;
• The consent text;
• The fact that you have clicked on the “Subscribe” button;
• The date and time at which you gave your consent (timestamp).

2. Scope and purposes of the data processing

We process the email address confirmed by you so that we can send you information in the form of our email newsletter at irregular intervals in line with your consent.

We record your consent so that we can demonstrate that it has been received.

3. Data transfer/recipients

The recipients of your data are our website’s technical operator and hosting provider (see section C above) and the service provider commissioned by us to distribute our newsletter (Article 28 GDPR). These companies are based in Germany.

4. Duration of storage

We store your email address and the log data recording your consent until you unsubscribe from our newsletter. Once you have withdrawn your consent, we store the log data for the duration of the period of limitation for your claims (three years) plus a safety margin of one month to allow for the delivery of any court documents, i.e. for a total of 37 months.

5. Legal basis for processing

The data is processed on the basis of your consent (Article 6, Paragraph 1a GDPR).

6. Right to withdraw consent

Your consent to receive the newsletter remains in force until you withdraw it. You can do this at any time with effect for the future by contacting us using the details provided in A above or by clicking on the unsubscribe link found at the end of each newsletter. Alternatively, you can enter your email address into the newsletter text box on our website and click on the “Unsubscribe” button.

1. Contact
2. General information about data processing

You can contact us using the details provided in A above or by using our Contact form. If you do this, we will process the data you share with us in your message, i.e. your specific enquiry and your email address if you contact us by email, your postal address if you contact us by post, your telephone number if you call us and the following details if you use our contact form (the details in the latter case vary depending on your enquiry):

• Your name;
• Your email address;
• Your message;
• Order number (if applicable);
• Customer number (if applicable);
• Item number(s) (if applicable);
• Uploaded file(s) (if applicable);
• Uploaded photo(s) (if applicable).

2. Scope and purposes of the data processing

We process your data so that we can handle your enquiry and respond to you.

3. Data transfer/recipients

The recipients of your data are our website’s technical operator and hosting provider (see section C above).

4. Duration of storage

We store your data until we have responded to your enquiry.

5. Legal bases for processing

The data is processed because doing so is necessary in order to take steps prior to entering into a contract or for the performance of a contract (Article 6, Paragraph 1b GDPR). If your request does not concern precontractual or contractual matters, the legal basis is our legitimate interest in handling your enquiry. We assume that our legitimate interest is not overridden by any of your interests or fundamental rights and freedoms (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

6. Right to object

You have the right to object, on grounds relating to your particular situation, to this processing at any time. In such cases, we will no longer process this data for these purposes and, if applicable, will not respond to your enquiry. You can exercise your right to object by contacting us using the details provided in A above.

III. Product reviews

1. General information about data processing

You can share your opinion on specific products in our online shop by clicking on the “Rate now!” link. This will result in us processing the following data:

• The number of stars you have awarded the product;
• Your email address;
• Your comment.

2. Scope and purposes of the data processing

We process your data so that we can publish your review on our website. We process your email address so that we can ensure that your review is genuine, i.e. that it was written by a person and not a computer program (bot).

3. Data transfer/recipients

The recipients of your data are our website’s technical operator and hosting provider (see section C above).

4. Duration of storage

Your review will remain stored in our online shop for an indefinite period of time. However, your email address will be anonymised after two months.

5. Legal basis for processing

We process the data on the basis of our interest in presenting our products in a more attractive light by adding customer experiences. This legitimate interest is not overridden by any of your interests or fundamental rights and freedoms (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

5. Right to object

You have the right to object, on grounds relating to your particular situation, to this processing at any time. If you exercise this right, we will no longer process this data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless the processing is being used to establish, exercise or defend legal claims. You can exercise your right to object by contacting us using the details provided in A above.

1. “Product availability” alert service
2. General information about data processing

If an item on sale in our online shop is temporarily out of stock, you can use our alert service to enter your email address so that we can send you an automated email once the product is back in stock. We process the following data when you use our alert service:

• Your email address;
• The product in question.

You provide your data voluntarily. However, we are unable to make the alert service available to you unless you provide us with this data.

2. Scope and purposes of the processing

We process your personal data so that we can handle your enquiry and contact you for this purpose.

3. Data transfer/recipients

The recipients of your data are our website’s technical operator and hosting provider (see section C above).

4. Duration of storage

We store the data you have provided to us until we have responded to you. If the product in question does not become available again within six months, we will automatically delete your data and you will no longer receive an availability alert about this product.

5. Legal bases for processing

The data is processed because doing so is necessary in order to take steps prior to entering into a contract (Article 6, Paragraph 1b GDPR). If your request does not concern a precontractual matter, the legal basis is our legitimate interest in handling your enquiry. We assume that our legitimate interest is not overridden by any of your interests or fundamental rights and freedoms (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

6. Right to object

You have the right to object, on grounds relating to your particular situation, to this processing at any time. In such cases, we will no longer process this data for these purposes and, if applicable, will not respond to your enquiry. You can exercise your right to object by contacting us using the details provided in A above.

1. Postal Advertising
2. General Information on Data Processing

Your postal address, which we store and process for contract fulfilment, will additionally be used for postal advertising.

2. Scope and Purpose of Data Processing

Your postal address will only be used in this context in order to inform you at irregular intervals by letter about campaigns and news on Noble Glass products.

3. Data Transfer/Recipients

We will not forward your postal address to third parties.

4. Storage Period

Your postal address will be stored by us for the time needed for contract fulfilment (see point E above). If you object to postal advertising (see point 6 below), we will block your postal address for this purpose.

5. Legal Basis for Processing

The processing of your data is based on our legitimate interest in keeping you informed about news and campaigns regarding our product and brand worlds. We assume that our legitimate interest is not overridden by any of your interests or fundamental rights and freedoms (Article 6, Paragraph 1f GDPR). On request, we would be happy to provide you with more information about how we have weighed up these interests.

6. Right to object

You have the right to object to the processing of your data at any time. Your postal address will then no longer be used for the purpose of postal advertising. You can exercise your right to object by contacting us using the contact details provided under A above.

1. Your additional rights as a data subject

In addition to the rights specified above concerning the various ways in which we process data, you have the following rights relating to your personal data:

• Right to access: You can request access to the personal data concerning you that we process. Information on the extent of your right to access can be found in Article 15 GDPR and Section 34 of the German Federal Data Protection Act (BDSG – 2018).
• Right to rectification: You can request that we rectify inaccurate and complete incomplete personal data. Information on the extent of your right to rectification can be found in Article 16 GDPR.
• Right to erasure: Provided that certain conditions are met, you have the right to request that we erase your personal data. Information on the extent of your right to erasure can be found in Article 17 GDPR.
• Right to the restriction of processing:Provided that certain conditions are met, you have the right to request that we restrict the processing of your personal data. Information on the extent of your right to the restriction of processing can be found in Article 18 GDPR.
• Right to data portability: Provided that certain conditions are met, you have the right to request that we transmit the personal data that you have provided to us to you or to another controller in a commonly used and machine-readable format. Information on the extent of your right to data portability can be found in Article 20 GDPR.
• Right to lodge a complaint with a supervisory authority:: If you have a complaint, you also have the right to lodge it with a supervisory authority. Information on your right to lodge a complaint with a supervisory authority can be found in Article 77 GDPR.

1. Data security

In order to protect it from access by third parties, the personal data we ask you to share with us on our website is transferred to us using a secure SSL connection (Secure Sockets Layer) with 256-bit encryption.

We have also implemented other technical and organisational security measures to protect data from loss, destruction and misuse. For example, if you have opened a customer account, this can only be accessed using your personal password. You can help to keep your data secure by choosing a password that is as strong as possible (e.g. by including a combination of letters, numbers and special characters) and keeping it strictly confidential.