Privacy policy

We appreciate your interest in our website. The protection of your privacy is very important to us. We process your customer data exclusively in compliance with the provisions of the German Federal Data Protection Act (BDSG) and the EU General Data Protection Regulation (GDPR). Below we inform you in detail about how we handle your data.

Overview of content:

Person responsible and data protection officer
Collection, storage and type and purpose of their use at
1. Visiting the website
2. Opening a customer account or "guest" orders
3. E-mail advertising
4. Newsletter dispatch, consent
5. Shop reviews
6. Question & Answer Service and product evaluation
7. Information videos (Youtube)
8. Emarsys
Data transfer to third countries
Cookies
Analysis tools
Payment methods
1. Braintree
2. Apple Pay
3. Giropay
4. Google Pay
5. PayPal
6. Klarna Sofort
7. Credit card
8. Amazon Pay
Data subject rights
Right to object
Credit check
Data security
Current privacy policy

1) Name and contact details of the controller and the company data protection officer

The controller for data processing is Wagner eCommerce Group GmbH, Ludwigstr. 43, 63667 Nidda.

Managing Director: Tobias Wagner

Contact person for data protection: If you have any questions about data protection, please contact our company data protection officer Mr D. Jäger, who can be reached at: datenschutz@petpoint-charly.com. You can also contact our data protection officer at the above postal address "Attn: Mr D. Jäger".

2) Collection and storage of personal data and the nature and purpose of its use

The Wagner eCommerce Group GmbH processes the customer data it collects exclusively in compliance with the above data protection regulations. All data received from the customer will only be collected, processed, used and forwarded to authorised partners to the extent necessary for the establishment, execution and implementation of the contracts or the purchase contract. Our data protection practices comply with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telemedia Act (TMG).

a) When visiting our website

You can visit our website without providing any personal data.

When you visit our website https://www.petpoint-charly.com, the browser used on your device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and stored until it is automatically deleted.

IP address of the requesting computer
Date and time of access
Name and URL of the retrieved file
Website from which the access is made (referrer URL)
Browser used and, if applicable, the operating system of your computer and the name of your access provider.

We process the aforementioned data for the following purposes:

Ensuring a smooth connection to the website,
Ensuring convenient use of our website,
Evaluating system security and stability and
for other administrative purposes

The legal basis for data processing is Article 6(1)(1)(f) GDPR. Para. I S.1 lit.f GDPR. Our legitimate interest follows from the data processing purposes listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person.

In addition, we use cookies and analysis services when you visit our website. You can find more detailed explanations on this in sections 4 and 5 of this privacy policy.

b) When opening a customer account on our website

You have the option of setting up a customer account on our website in advance or as part of your order. You can then view your orders in our customer login area if you have previously registered as a (new) customer.

You can also place your order as a "guest", in which case your order data is no longer accessible via the Internet for security reasons.

Your orders are stored by us after conclusion of the contract. If you lose your order documents, please contact us by e-mail or telephone. We will be happy to send you a copy of your order details.

The following data is collected when you optionally create a customer account:

First name and surname
Address (postal address)
Your email address
Your telephone number

We process this data for the following purposes:

Fulfilment of the contract concluded with you or
For the implementation of pre-contractual measures taken at your request
Processing of the order
If requested by you, also for the processing of further services (2-person contract service, warranty extension)

The legal basis for data processing is Art.6 Para. I S.1 lit.b GDPR.

In particular, we save your contract text and send you the order data and our GTC by e-mail. You can also view the GTC at any time here.

The storage takes place until the expiry of the statutory warranty periods, unless longer storage should be required for tax or commercial law regulations.

c) Our e-mail advertising in accordance with § 7 III UWG

We would like to point out that PetPoint Charly uses the e-mail address you provide, e.g. as part of the order, for its own marketing purposes.

If we receive your email address in connection with the sale of a product and you have not objected to this, we reserve the right to regularly send you offers on similar products to those already purchased from our range on the basis of Section 7 III UWG.
We use the email address you provided when placing your order for this purpose, regardless of whether you have opened a customer account or ordered as a guest.

This sending of our advertising email serves to protect our legitimate interests in advertising to our customers, which outweigh our interests.

This form of direct marketing as part of our existing customer relationship is permitted under Section 7 of the German Act Against Unfair Competition (UWG), even after the introduction of the GDPR. No separate consent is required for this, as direct marketing serves our legitimate interest as a retailer. Unreasonable harassment of the customer is then generally not to be assumed.

For this purpose, you will receive messages from us in which we offer you our own similar goods or services. For this purpose, we work together with Emarsys Interactive Services GmbH, Willi-Schwabe-Straße 1, 12489 Berlin, ("Emarsys"). You can find further details on this under "Emarsys" in this privacy policy.

You have the option to informally object to receiving further advertising emails from us. You will then no longer receive any advertising emails from us in future. You can send us an email to widerspruch@petpoint-charly.com or use the link at the end of each of our advertising emails to exercise your right of cancellation without incurring any costs other than the transmission costs according to the basic tariffs.

d) When registering for the newsletter service - "Subscribe to newsletter"

If you explicitly agreed to the "Subscribe to newsletter" option when opening the customer account, we will use your email address to send you our newsletter on a regular basis. As part of your consent, we will inform you in the legally required form about the type and scope of your consent and our newsletter. As part of our newsletter, we will inform you about new functions of our web shop or special offers.

In order to receive the newsletter, it is sufficient to provide an email address. If you have expressly given your consent to "Subscribe to newsletter", the following data will be collected:

Your email address

The legal basis for data processing is Article 6(I)(1)(a) GDPR.

For statistical purposes, we analyse in anonymous form which links in the newsletter are clicked. It is not possible to recognise which person has clicked.

We work together with our partner company to send our newsletter. We only send your email address to this partner company for this purpose. This partner company will of course treat your data with absolute confidentiality and in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telemedia Act (TMG).

We remain the controller within the meaning of the applicable data protection law even when sending the newsletter.

You have the option to revoke your express consent (you can also find more information on this under point 6 of this privacy policy). You can do this at any time by unsubscribing from the newsletter service, for example via the attached link at the end of each newsletter. Alternatively, you can also send your unsubscribe request (withdrawal of consent) at any time by email.

This should be sent to datenschutz@petpoint-charly.com by email.

After notifying us of your unsubscribe request, you will no longer receive newsletters in the future.

You will, however, continue to receive emails that are required for contract and order processing. If you do not wish to receive this, please contact our customer service by telephone.

e) When participating in the shop rating system

We offer you the opportunity to rate our services after your order has been processed. This is a shop rating from PetPoint Charly, where you can rate our service in relation to your order. In this way, we want to continuously optimise our customer service and increase your satisfaction.

Participation is voluntary.

If you have not objected, we will use your personal data to send you a request for a shop evaluation by email after receiving your order. When you provide your personal data during the ordering process, we expressly inform you about the future use of your e-mail address for direct marketing purposes. Upon receipt of all direct advertising emails, you will be expressly informed again of your right to object at any time and informally and will be given the opportunity to exercise this objection immediately.

The following data is collected and processed for this purpose:

First and last name and
your email address

The legal basis for data processing is Article 6(I)(1)(f) GDPR. Furthermore, this is a permissible measure in accordance with Section 7 III UWG.

Data will not be passed on to third parties. The technical processing is carried out by PetPoint Charly.

The shop reviews themselves are anonymised, your personal data is not linked to the shop review you have submitted.

The data will be deleted for direct marketing purposes no later than 24 months after completion of your order.

You have the option to object to the use of your email address for this purpose at any time without incurring any costs other than the transmission costs according to the basic rates. Each request email will again contain a reference to the right to object at any time as well as an unsubscribe link through which this objection can be exercised directly. This right to object is based on Article 21 GDPR; reference is made to the special information under point 7) of this data protection notice.

Once we have received your objection, we will no longer use, process or transmit the data concerned for purposes other than processing your order and will cease sending you any further advertising material. This applies to all post-contractual direct marketing measures that are permitted on the basis of our legitimate interest under the GDPR, such as requests for product and shop evaluations.

You will, however, continue to receive emails that are required for contract and order processing. If you do not wish this, please contact our customer service by telephone.

Unless you expressly revoke your consent to receive the newsletter, you will continue to receive it. You have the option of expressly revoking your consent to receive the newsletter; you can find further information on this under point 2.c) of this privacy policy.

f) When using the Q&A service (technical customer support)

We offer you the option of using our technical customer support. After your order has been processed, we offer you the opportunity to evaluate the product you have purchased and to ask questions about the product. In this way, we offer you comprehensive customer support in order to provide you with the best possible service for all aspects of order processing.

Product reviews (Reviews & Ratings)
Question & Answer Service (technical customer support)

Participation is voluntary. You will now find further information on the processing of the data.

Product review-

If you have not objected, we will use your personal data to send you a request for a product review by email after receiving your order. When you provide your personal data during the ordering process, we expressly inform you about the future use of your e-mail address for direct marketing purposes. Upon receipt of all direct advertising emails, you will be expressly informed again of your right to object at any time and informally and will be given the opportunity to exercise this right immediately.

The following data will be collected and processed for this purpose:

First and last name and
your email address
Address (postal address)
Your telephone number

The legal basis for data processing is Art. 6 para. Para. I S.1 lit.f DS-GVO. Our legitimate interest follows from the above-mentioned purposes for data processing. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person.

The personal data will be deleted for direct marketing purposes no later than 24 months after completion of your order.

The content of the product reviews themselves is anonymised; your personal data is not linked to the review you have submitted.

With the help of Bazaarvoice, we also send you reminders to submit a review of the products you have ordered. Your personal data is passed on to Bazaarvoice for this purpose. (Bazaarvoice, Inc. Legal Dept, 10901 Stonelake Blvd, Austin, Tx 78759, USA) Your data will only be used there for the personalisation and sending of emails and then deleted. There is no permanent storage or transfer of the data.

There is no adequacy decision by the EU Commission for the USA. Bazaarvoice has subjected itself to the aforementioned standard contractual clauses (see "Data transfer to third countries").

Further information on data protection at Bazaarvoice can be found at www.bazaarvoice.com/de/legal/datenschutzrichtlinie

You can object to the use of your email address for this purpose at any time without incurring any costs other than the transmission costs according to the basic rates. Each request email will again contain a reference to the right to object at any time as well as an unsubscribe link through which this objection can be exercised directly. This right to object is based on Article 21 GDPR; reference is made to the special information under point 7) of this data protection notice.

You will, however, continue to receive emails that are required for contract and order processing. If you do not want this, please contact our customer service by telephone.

If you do not expressly revoke your consent to receive the newsletter, you will continue to receive it; further information can be found under point 2.c) of this privacy policy.

-Question & Answer Service-

When using the Q&A service of our technical customer support, your personal data will be passed on and processed by the IT service provider Bazaarvoice. The company provides technical and administrative support for our technical specialists so that we can answer your questions as quickly as possible. The services relating to product reviews (Reviews & Ratings) are also managed by Bazaarvoice.

The following data is collected and processed for this purpose:

First and last name and
your email address
Address (postal address)
your telephone number

The legal basis for data processing is Article 6(I)(1)(f) GDPR. Our legitimate interest follows from the above-mentioned purposes for data processing. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person.

The personal data will be deleted for direct marketing purposes no later than 24 months after completion of your order.

The content of your questions and answers will be anonymised; your personal data will not be linked to the evaluation you have submitted.

For more information on data protection at Bazaarvoice, please visit www.bazaarvoice.com/de/legal/datenschutzrichtlinie.

g) "YouTube" embedded information videos

We offer you helpful additional information in many places on our website by embedding videos. You have the option of starting and watching the embedded video by clicking on it. This will provide you with helpful product information, such as assembly instructions, at your request. This enables you to make an informed purchase decision and any questions you may have about the product are answered beforehand.

The legal basis for data processing is Article 6(I)(1)(b) GDPR.

These are embedded videos from the YouTube service, represented by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit our site: Your IP address is sent to YouTube and cookies are installed on your computer as soon as you visit a page with embedded videos. However, we have integrated our YouTube videos with the extended data protection mode (in this case, YouTube still contacts Google's Double Click service, but according to Google's privacy policy, personal data is not analysed).

YouTube therefore does not store information about visitors to this page (with the embedded video).

When you click on the video: When you click on the video, your IP address is transmitted to YouTube and YouTube learns that you have watched the video. If you are logged in to YouTube, this information will also be assigned to your user account (you can prevent this by logging out of YouTube before watching the video).

We have no knowledge of the possible collection and use of your data by YouTube and have no influence on this.

There is no adequacy decision by the EU Commission for the USA. YouTube has submitted to the aforementioned standard contractual clauses (see "Data transfer to third countries").

For more information, see https://business.safety.google/privacy/ or directly in YouTube's privacy policy at www.google.com/intl/en/policies/privacy/.

In addition, we refer you to our general description in this privacy policy under point 4 for the general handling and deactivation of cookies.

h) Emarsys

We use technologies from Emarsys Interactive Services GmbH, Willi-Schwabe-Straße 1, 12489 Berlin, ("Emarsys") to personalise and automate our email marketing. For our cooperation with Emarsys, we have concluded an agreement on order processing in accordance with the GDPR.

Emarsys supports us in the planning, implementation and analysis, in particular in the technical implementation and processing of our direct marketing. For this purpose, you as a customer will receive messages from us in which we offer you our own similar goods or services. This form of direct marketing within the framework of our existing customer relationship is permitted under Section 7 III UWG even after the introduction of the GDPR. You will also find further information on this under point 2) b) of this privacy policy.

We automatically transmit to Emarsys the e-mail address you provided yourself when placing the order.

The transmitted data will only be used by Emarsys within the framework of the agreement on order processing in accordance with the GDPR.

The legal basis for this data processing is Art. 6 Para. lit. f GDPR and thus our legitimate interests as an online retailer.

You have the option of informally objecting to receiving further advertising messages about similar goods or services from us (withdrawal@petpoint-charly.com). You will not incur any costs other than the transmission costs according to the basic tariffs. You will then no longer receive any advertising emails from us in future. For this purpose, you will find a corresponding note at the end of each of the aforementioned emails.

We also use the technologies of Emarsys Interactive Services GmbH, Willi-Schwabe-Straße 1, 12489 Berlin, ("Emarsys") to record and measure the success of certain marketing measures.

We use the Emarsys Predict analysis tool to compile our individual email newsletter, which analyses your use of both the newsletter and our website. To record your usage behaviour on our website, we use cookies to recognise your browser. This enables us to track your movements on our website and to record and measure the success of certain marketing measures. In addition, our newsletters may contain hyperlinks ("links") that contain random but unique identification numbers. We may collect and store these identification numbers when your computer accesses these links in order to retrieve additional information from our servers. We use this information about the requests you have made to track your use of our newsletter and our website, to measure the success of certain marketing measures and to adapt our offers to your individual interests and needs.

You can object to this collection and analysis of data using cookies by clicking on the opt-out box under the following link: http://www.scarabresearch.com/privacy/#optout. You can find more information about data protection and the cookies used by Emarsys here http://www.scarabresearch.com/privacy/.

Further information on cookies can also be found under point 4) of this privacy policy.

Emarsys uses, among other things, services from Heroku, Inc, The Landmark @ 1 Market St., Suite 300, San Francisco, CA 94105, USA ("Heroku"), a group company of Salesforce.com Inc, The Landmark @ One Market St., Suite 300 San Francisco, California 94105, USA ("Salesfoce"), Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA ("Google") and Compose / IBM Corp, 1 New Orchard Road, Armonk, New York 10504-1722, USA ("IBM").

There is no adequacy decision by the EU Commission for the USA.

Heroku and Salesforce have submitted to the aforementioned standard contractual clauses (see "Data transfer to third countries"). Further information can be found in the Privacy Policy of Salesforce, which also applies to Heroku.

Google has submitted to the aforementioned standard contractual clauses (see "Data transfer to third countries"). You can find more information in Google's privacy policy.

IBM has submitted to the aforementioned standard contractual clauses (see "Data transfer to third countries"). Further information can be found in the Privacy Policy of IBM.

3) Transfer of your data

Transfer within the scope of order processing, customer service enquiries:

Within the scope of our customer service, personal data is transferred to REACHXCEL L.L.C., Rruga Tirana 31, 10 000 Prishtine, Kosovo, and processed there. We select our contractual partners with the utmost care and ensure that they are obliged to handle your data confidentially in accordance with the GDPR. REACHXCELL L.L.C. has been obliged to comply with European data protection regulations on the basis of the EU standard contractual clauses. This ensures an appropriate level of data protection.

AI-supported telephone customer support

When you contact us by telephone, your call can initially be answered by a digital, AI-supported telephone assistant. The content spoken by you is automatically processed and converted into text (speech-to-text) in order to record the content of your request, process it automatically and, if possible, resolve it directly or forward it to a suitable contact person if final processing by the digital assistant is not possible or you wish this.
Speech or sound recordings are not stored; the voice is only used technically for a short time to create the transcript.
We use the service provider DigitalGenius, Ltd. for the provision of the telephone assistant, 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom, as a processor. If your request can be fully processed by the telephone assistant, the resulting call transcripts are stored by the service provider for a maximum of 30 days for the purposes of technical processing, quality assurance and error analysis and then automatically deleted. If the call is transferred to a human employee during the course of the conversation, the transcript is also documented in our customer service system to enable further processing of the enquiry. The data is stored exclusively for the purpose of processing the enquiry, documenting customer communication and fulfilling statutory verification, retention and warranty obligations and is deleted or anonymised as soon as it is no longer required for this purpose.
The processing of personal data in connection with the use of DigitalGenius is carried out for the processing of customer enquiries and for the implementation of pre-contractual or contractual measures in accordance with Art. 6 para. 1 lit. b GDPR and on the basis of our legitimate interest in efficient customer service in accordance with Art. 6 para. 1 lit. f GDPR.
A processing or transfer of personal data to countries outside the European Union does not take place according to our contractual agreements with DigitalGenius.

You can obtain information at any time about which categories of customer data have been processed. You can find your full rights under point 7) of this privacy policy.

Your personal data will not be transferred to third parties for purposes other than those listed below.

We will only pass on your personal data to third parties if:

You have given your express consent in accordance with Art.6 I S.1 lit.a GDPR
The disclosure pursuant to Art.6 I S.1 lit.f GDPR is necessary for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data. This may also include the transfer of negative data - please note the information below-
In the event that there is a legal basis for the transfer in accordance with Art. 6 Para. lit.c GDPR, and
this is legally permissible and necessary for the processing of contractual relationships with you in accordance with Art. 6 para. I lit.b GDPR.

This company may only use your data for order processing and not for any other purposes.

The transfer of your data to other companies for advertising purposes is expressly excluded.

Transfer of negative data In the cases permitted by law (Art.6 I S.1 lit.f DS-GVO see above in the list), we may transmit address and negative data to Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss, Germany, which provides third parties with creditworthiness information based on mathematical-statistical procedures for credit assessment purposes if there is a legitimate interest. Your interests worthy of protection are taken into account in accordance with the statutory provisions.

4) Data transfer to third countries

In the event that data is transferred to recipients based outside the European Union or the European Economic Area (third country) or personal data is processed in the context of the use of third-party services in such a third country, this is done in compliance with an adequate level of data protection. Where there is no adequacy decision by the EU Commission, the protection of personal data is ensured on the basis of standard contractual clauses as suitable guarantees (standard contractual clauses or standard data protection clauses) in accordance with Article 46 II lit.c GDPR.

Your data collected on this website is transferred to third countries by Google, Emarsys, Heroku/Salesforce, YouTube, Bazaarvoice, IBM, PayPal, Apple. We ourselves transmit data to REACHXCEL L.L.C. based in Kosovo. You can find more information on this in this privacy policy.

5) Cookies

A "cookie" is a small data file that we transfer to your computer when you browse our website. A cookie can only contain information that we ourselves send to your computer - it cannot be used to read private data. If you accept the cookies on our website, we do not have access to your personal information, but with the help of the cookies we can identify your computer.

We use cookies for the following purposes:

so that you can fill and manage your shopping basket with orders during your session.
so that we can recognise you on future visits in order to display your desired preferences in the shopping cart (item, payment and delivery method, country of delivery).
so that we can analyse your usage behaviour on our website in order to create individual marketing measures (further details can be found under the "Emarsys" section of this privacy policy).

The data stored in our cookies is not linked to your personal data (name, address, etc.). We will not link the data stored in our cookies to your personal data (name, address, etc.) without your express consent. Some of the cookies we use are deleted again at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and enable us or our partner companies to recognise your browser on your next visit (persistent cookies). With the help of the information collected, we can analyse usage patterns and structures of our website. In this way, we can continue to optimise our website by improving the content or personalisation and simplifying use.

Most browsers accept cookies by default. You can allow or prohibit temporary and stored cookies independently of each other in the security settings. If you deactivate cookies, certain features on our website may not be available to you and some web pages may not be displayed correctly. To be able to use our shopping basket, temporary cookies must be allowed! If you generally do not accept cookies, you are welcome to place your order via our customer service: +49 (0) 6043 - 556 9001

6) Analysis tools

a) Google Analytics 4

If you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Scope of processing

Google Analytics uses cookies to help analyse how you use our websites. The information collected by the cookies about your use of this website is usually transferred to a Google server in the USA and stored there.

We use the User ID function. With the help of the user ID, we can assign a unique, permanent ID to one or more sessions (and the activities within these sessions) and analyse user behaviour across devices.

We use Google Signals. This allows Google Analytics to collect additional information about users who have activated personalised ads (interests and demographic data) and ads can be delivered to these users in cross-device remarketing campaigns.

According to Google, the IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.

During your website visit, your user behaviour is recorded in the form of "events". Events can be:

Page views
First visit to the website
Start of the session
Your "click path", Interaction with the website
Scrolls (whenever a user scrolls to the bottom of the page (90%))
Clicks on external links
Internal search queries
Interaction with videos
File downloads
Viewed/clicked adverts
Language setting

In addition, the following is recorded:

Your approximate location (region)
Your IP address (in abbreviated form)
Technical information about your browser and the end devices you use (e.g. language setting, screen resolution).B. language setting, screen resolution)
Your internet provider
The referrer URL (via which website/advertising medium you came to this website)

Purposes of processing

On behalf of the operator of this website, Google will use this information to analyse your use of the website and to compile reports on website activity. The reports provided by Google Analytics are used to analyse the performance of our website.

Recipients of the data

Recipients of the data may be:

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor according to Art. 28 GDPR)
Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

Third country transfer

In so far as data is processed outside the EU/EEA and there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish an adequate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to any legal remedies against access by authorities.

Storage period

The data sent by us and linked to cookies is automatically deleted after 14 months. The deletion of data whose retention period has been reached takes place automatically once a month.

Legal basis & Revocation

We only use Google Analytics with your prior consent. The legal basis is therefore Art. 6 para. 1 lit. a) GDPR. You can revoke this consent at any time with effect for the future by deleting the cookies in your browser.
The legality of the processing carried out on the basis of the consent until the revocation remains unaffected.

You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may restrict the functionality of this and other websites. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by:

a. Not giving your consent to the setting of cookies or

b. Downloading and installing the browser add-on to deactivate Google Analytics here.

For more information on the terms of use of Google Analytics and data protection at Google, please visit: https://business.safety.google/privacy/
https://marketingplatform.google.com/about/analytics/terms/de/
https://policies.google.com/?hl=de.

b) Other implemented Google advertising functions: Remarketing

The google-analytics code implemented on this website supports display advertising. Remarketing is activated on this website as part of google-analytics for display advertising. PetPoint Charly - Ads are shown on websites by third parties, including Google. PetPoint Charly and third-party providers, including Google, use cookies. The combined use of first-party cookies (e.g. google-analytics cookies) and third-party cookies (e.g. Doubleclick cookies) allows targeted ad targeting, ad optimisation and ad placement based on your previous visits to this website. You can use the preferences manager to deactivate google-analytics for display advertising and customise ads in the Googledisplay network. In addition, the Google functions "Reports on performance according to demographic characteristics and interests" are used on this website.

c) Other implemented Google advertising functions: Google ReCaptcha

In selected cases, we use the reCAPTCHA service provided by Google Inc (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) to protect the transmission of forms (e.g. online membership declaration, contact form, registration for the internal member area).

This is to ensure that the entries on the PC are made by a human and not by a computer programme.

The service includes sending your IP address and any other data required by Google for the reCAPTCHA service to Google. The deviating data protection provisions of Google apply to this data. Further details can be found in Google's data protection centre: https://www.google.de/intl/de/privacy or at https://business.safety.google/privacy/

The following data is collected:

IP address
Date and time of access
Name and URL of the retrieved file
Website from which the access is made (referrer URL)
Browser used and, if applicable, the operating system of your computer and the name of your browser. the operating system of your computer and the name of your access provider.
Further data (e.g. cursor tracking to be able to assess whether it is an automated process or human interaction.

The legal basis for data processing is Art. 6 para. I p.1 lit.f GDPR. Our legitimate interest follows from the purposes for data processing listed above, in particular the special protection of your sensitive data when transmitting personal data in the context of contact forms etc.

In no case do we use the collected data for the purpose of drawing conclusions about your person.

The collected data is not stored, but deleted immediately after leaving the page.

In addition, we use SSL encryption on our website. Further information on this can be found under point 8 "Data security".

There is no adequacy decision by the EU Commission for the USA. Google has submitted to the aforementioned standard contractual clauses (see "Data transfer to third countries").

d) Google Ads Customer Match

Our website uses advertising services from Google Ireland Limited ("Google"). As part of these advertising services, we have the option, with your consent in accordance with Article 6(1)(a) GDPR or on the basis of our legitimate interest in accordance with Article 6(1)(f) GDPR, to transmit your email address stored in the customer account to Google as a hash value.

The transmitted data is processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. For this purpose, we have concluded an order processing contract with Google.

The hash value represents a conversion of your email address into another value, whereby your email address is pseudonymised. Google uses this hash value to identify you on Google websites and apps (such as YouTube) and to display personalised advertisements. There is also the possibility that this identification will result in you not being targeted with our adverts.

For the use of Customer Match, Google uploads lists of encrypted user data, including names, email addresses, addresses and customer-specific identifiers, for example. Google then compares whether the transmitted user data matches existing Google customers. On this basis, target groups can be created that are used for the placement of adverts and campaigns. Once the Salesforce match lists have been created, the encrypted customer data is automatically deleted. This prevents providers from gaining access to new addresses.

The European Court of Justice has ruled that the USA is a country with an inadequate level of data protection. The EU Commission adopted the adequacy decision for the "EU-U.S. Data Privacy Framework" on 10 July 2023. This decision states that the EU Commission classifies the level of data protection in the USA for transfers based on this agreement as comparable to that in the EU and therefore as secure. Google is certified under this framework and bases any data transfer to the USA on this basis.

For more information on data protection at Google, please visit:
Advertising - Privacy Policy & Terms of Use - Google
https://business.safety.google/privacy/

Here you will also find the possibility of asserting your rights as a data subject (e.g. right to cancellation) against Google Ireland Limited.

You have the possibility to object to this use by preventing the installation of cookies via a corresponding setting in your browser software (deactivation option). You can also customise personalised advertising in your Google account under the "Privacy" tab. To do this, sign in to Google and go to "Data and Privacy" in the "Manage Google Account" section.

7) Payment methods

a) Payment processing via Braintree (a PayPal service)

In order to provide you with secure and convenient payment processing for purchases in our online shop, we use Braintree, a service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal"), as our payment service provider.

When you select a payment method during the ordering process that is processed via Braintree (Apple Pay, Google Pay, credit card, PayPal), the payment data you enter will be transmitted to Braintree to process the payment. The transmission of your data to Braintree is based on Art. 6 para. 1 lit. b GDPR (processing for the fulfilment of a contract). We ourselves do not receive any knowledge of your payment data, but only information about the confirmation or rejection of the payment.

Braintree processes and stores your data insofar as this is necessary for the processing of payments and as long as statutory retention obligations exist. Your data will only be passed on within the scope of the necessary payment processing and only to the extent necessary for this purpose.

Braintree and PayPal reserve the right to store and transfer personal data to the USA or other third countries. PayPal relies on binding corporate rules approved by the relevant supervisory authorities. Other transfers are made on the basis of standard contractual clauses approved by the European Commission.

For more information on Braintree/PayPal's data protection practices, please refer to PayPal's privacy policy, which can be found at https://www.paypal.com/webapps/mpp/ua/privacy-full.

b) Payment processing via Apple Pay

For the processing of payments in our online shop, we offer Apple Pay, a payment service of Apple Inc, One Apple Park Way, Cupertino, California, USA, 95014 / Apple Distribution International Limited, based in Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland ("Apple"). Apple Pay enables fast, secure and contactless payment via Apple devices such as iPhone, iPad, Apple Watch and Mac by using bank or credit card details stored on your Apple device.

If you decide to pay with Apple Pay, payment is processed by selecting your stored payment method directly via your Apple device without payment information being transmitted to us.

The transmission of your data to Apple is based on Art. 6 para. 1 lit. b GDPR (processing for the fulfilment of a contract) and your express consent in accordance with Art. 6 para. 1 lit. a GDPR.

Apple may collect, process and use data in connection with the use of Apple Pay, in particular to enable the payment process and prevent fraud. The processing and storage of your data in the USA by Apple takes place in accordance with Apple's data protection guidelines, over which we have no influence. There is no adequacy decision by the EU Commission for the USA. Apple has submitted to the aforementioned standard contractual clauses (see "Data transfer to third countries").

For more information on data protection when using Apple Pay, please refer to Apple's privacy policy: https://www.apple.com/legal/privacy/de-ww/.

c) Payment processing via Giropay

We also offer Giropay for payment processing. Giropay is an online payment method of paydirekt GmbH, Stephanstraße 14-16, 60313 Frankfurt am Main ("Giropay"), which is supported by many German banks and savings banks. It allows you to pay directly via your online banking account without having to provide us with any additional account information.

If you select Giropay as your payment method, you will be redirected to your bank's or savings bank's online banking after confirming your order. There you log in as usual with your access data and authorise the payment. After successful payment, we will be informed about the transaction. Your bank details remain protected and are not made accessible to us at any time. Your data is transmitted to paydirekt on the basis of Art. 6 para. 1 lit. b GDPR (processing for the fulfilment of a contract).

Further information on data protection at Giropay can be found at https://www.giropay.de/agb/index.html

d) Payment processing via Google Pay

We offer Google Pay as one of the payment methods in our online shop. Google Pay is an online payment system and digital wallet service operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") or by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") for all customers residing in the European Economic Area (EEA). This payment method enables simple, fast and secure payment processing via your Google account using the means of payment stored there (e.g. credit cards or bank accounts).

If you decide to pay via Google Pay, you will be forwarded directly to Google Pay for authentication and confirmation of the payment. There you select one of the stored payment methods to make the payment. During this process, we do not receive access to your payment details such as credit card or bank account numbers. We only receive information about the payment authorisation.

Data processing in the context of payment processing via Google Pay is based on your express consent pursuant to Art. 6 para. 1 lit. a GDPR and the necessity of processing to fulfil a contract with you pursuant to Art. 6 para. 1 lit. b GDPR.

Google may process information in connection with the transactions in order to carry out the payment process, perform security checks and prevent fraud. We have no influence on data collection and processing by Google, including in the USA. There is no adequacy decision by the EU Commission for the USA. Google has submitted to the aforementioned standard contractual clauses (see "Data transfer to third countries"). For more information on Google's data protection practices, please refer to their privacy policy: https://policies.google.com/privacy, as well as the website https://business.safety.google/privacy/.

e) Payment processing via PayPal

For payment processing in our online shop, we offer the PayPal service, among others. PayPal is an online payment service provider operated by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you select PayPal as a payment method, payment will be processed via your PayPal account, which is linked to your email address.

By selecting PayPal as a payment option, you will be automatically redirected to the PayPal website during the ordering process to authorise the payment. PayPal makes it possible to make payments via various payment sources (PayPal credit, PayPal credit, bank transfer, credit cards). We only receive information from PayPal that the payment has been made; we are not informed of your payment details. The transfer of your data to PayPal is based on Art. 6 para. 1 lit. b GDPR (processing for the fulfilment of a contract).

Braintree or PayPal reserves the right to store and transfer personal data to the USA or other third countries. PayPal bases this on binding corporate rules approved by the competent supervisory authorities. Other transfers are made on the basis of standard contractual clauses approved by the European Commission.

The use of PayPal as a payment method is subject to PayPal's Terms of Use and Privacy Policy. Further information on data protection at PayPal can be found at https://www.paypal.com/webapps/mpp/ua/privacy-full.

f) Payment processing via Klarna Sofort

We also offer the use of Klarna Sofort to process payments. Klarna Sofort is a direct transfer procedure of Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. If you choose Klarna Sofort as your payment option, you will be taken directly to the Klarna website where you select your bank and log in with your online banking details. You then authorise your payment with a TAN.

When using Klarna Sofort, we do not obtain any knowledge of your personal bank details or online banking access data. We are only informed about the successful payment transaction. The transmission of your data to Klarna is based on Art. 6 para. 1 lit. b GDPR (processing for the fulfilment of a contract). Klarna processes your data in accordance with Klarna's privacy policy, which you can view at https://www.klarna.com/sofort/datenschutz.

g) Payment processing by credit card

If you decide to pay by credit card, we need the usual credit card details from you. This data is transmitted to our payment service provider (see "Braintree" in our privacy policy) for payment processing. The transmission of this information is encrypted under the highest security standards. We do not store any credit card data ourselves, but only receive confirmation of successful payment processing.

For your security, we also use the 3D Secure procedure, an additional security procedure for credit card payments that largely excludes misuse by unauthorised third parties.

h) Payment processing via Amazon Pay

We offer Amazon Pay as another convenient and secure payment method. Amazon Pay is a service provided by Amazon Services LLC, 410 Terry Avenue North, Seattle, WA 98109, USA. This payment method allows you to use the payment information stored in your Amazon account to make purchases in our online shop quickly and securely without having to re-enter your payment details.

If you select Amazon Pay as your payment method, you will be automatically redirected to an Amazon login page. After successfully logging in, you can select one of your saved payment methods and confirm the payment. We do not receive any knowledge of your credit card or bank details, but only a confirmation that the payment has been made.

The data processing when using Amazon Pay is based on your express consent in accordance with Art. 6 para. 1 lit. a GDPR and on the basis of contract processing in accordance with Art. 6 para. 1 lit. b GDPR. Amazon processes and stores your data in accordance with its own data protection guidelines, over which we have no influence. For the processing of your data in the USA or other third countries, Amazon relies on standard contractual clauses that are intended to ensure the data protection of European customers.

For more information on Amazon Pay's data protection practices, please refer to Amazon's privacy policy: https://pay.amazon.de/help/201212490.

8) Rights of data subjects

You have the right:

in accordance with Art. 15 GDPR to request information about your personal data processed by us. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right of appeal, the origin of your data if it has not been collected by us, as well as the existence of automated decision-making including profiling and, if applicable, meaningful information on its details;
in accordance with Art. 16 GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you or to have incomplete personal data completed;
you have the right to obtain from us the erasure of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
you have the right to obtain from us the erasure of personal data stored by us in accordance with Art. 18 GDPR, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims. 18 GDPR to demand the restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to delete it and we no longer need the data, but you need it for the assertion, exercise or defence of legal claims or you object to the processing in accordance with Art. 21 GDPR to object to the processing;
in accordance with Art. 20 GDPR to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request the transfer to another controller;
in accordance with Art. 7 para. 3 GDPR to revoke your consent given to us at any time. This means that we may no longer continue the data processing that was based on this consent in the future and
in accordance with Art. 77 GDPR to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters. Responsible supervisory authority: The Hessian Data Protection Officer, Wiesbaden. Further information can be found at https://datenschutz.hessen.de//

9) Right to object

If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which we will implement without you having to specify a particular situation.

If you wish to exercise your right to object, simply send an email to withdrawal@petpoint-charly.com.

10) Credit check

Our company regularly checks your creditworthiness when concluding contracts and, in certain cases where there is a legitimate interest, also for existing customers. For this purpose, we work together with infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden, from whom we receive the necessary data. On behalf of infoscore Consumer Data (ICD), we are already providing you with the following information in advance in accordance with Art. 14 EU GDPR:

We obtain credit-relevant information on your previous payment behaviour and information for assessing the risk of non-payment on the basis of mathematical-statistical procedures using address data (scoring) from infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden. You can find more information at https://www.experian.de/icd-infoblatt.

11) Data security

We use the widespread SSL method (Secure Socket Layer) in conjunction with the highest level of encryption supported by your browser when you visit our website. Your personal data is transmitted exclusively using the current and secure SSL encryption and is therefore not visible to third parties. As a rule, this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can tell whether an individual page of our website is transmitted in encrypted form by the closed display of the key or lock symbol in the lower status bar of your browser.

We also use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

Access to your customer account is only possible after entering your personal password. You should always treat your access information confidentially and close the browser window when you have finished communicating with us, especially if you share the computer with others.

12) Up-to-dateness and status of the data protection information

This data protection declaration is currently valid and is dated 19 February 2026.

It may be necessary to amend this data protection declaration due to the further development of our website and offers on it or due to changes in legal or official requirements. You can access and print out the current privacy policy at any time on the website at https://www.petpoint-charly.com/en/i/privatsphare-und-datenschutz_2.