Shopping cart

Your shopping card does not contain any products

shop now!

Data protection policy


I. General

1. Scope of data processing

As a rule, we collect and utilise our users’ personal data only to the extent that allows us to provide a functional website and our content and services. We only collect and use our users’ personal data if permitted to do so by legal regulations, or if they give their consent.

2. Legal basis for data processing

If we obtain a user’s consent for processing their personal data on our website, Art. 6 (1) (a) GDPR serves as the legal basis for that processing. Art. 6 (1) (b) GDPR serves as the legal basis when we process personal data needed to fulfil an agreement to which the user is a party. This also applies to processing operations needed for the performance of a quasi-contractual obligation or pre-contractual activities. Art. 6 (1) (c) GDPR serves as the legal basis whenever the processing of personal data is required for the fulfilment of a legal obligation to which our company is subject. Art. 6 (1) (f) GDPR serves as the legal basis for data processing if that processing is required to protect the legitimate interests of our company or a third party, and provided the interests, fundamental rights and freedoms of the user do not outweigh those interests (weighing up of interests). There are other legal bases for the processing of personal data, which we have listed below where relevant.

3. Retention period

The user’s personal data are deleted or blocked as soon as the purpose of their retention ceases to apply. They may continue to be stored if permitted by European or national legislators in EU regulations, laws or other provisions to which our company is subject. Data is also blocked or deleted if a retention period prescribed by the aforementioned standards expires, unless the data still need to be stored for the conclusion or fulfilment of a contract.

4. Disclosure of personal data

If we do pass on personal data, it is to service companies that help us to fulfil the aforementioned purposes. As “data processors”, these companies are only allowed to use your personal data to perform the tasks we have set them and are obliged to comply with the relevant data protection regulations. The data processors we use are:

  • Ultrabold; Quadrat G7, 4p; 68159 Mannheim, Germany
  • Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
  • Stoll von Gáti GmbH, Haller Straße 187, 74564 Crailsheim

Personal data will not be given to anyone else.

5. Place of data processing

With the exception of the use of Google services, our processing of your personal data is done in countries of the European Economic Area. For more information about the processing of data as part of its use and transfer to the data processors mentioned in Section I.4, please refer to Section IV.

II. Processing personal data

1. Providing the website and creating log files

a) Description of data processing

Each time our website is visited, our system automatically collects data and information from the visiting computer. The following data are collected:

  • Browser type and version
  • Operating system used
  • User’s IP address
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request

The data are also stored in our system’s log files. These data are not stored together with users’ other personal data.

b) Legal basis for data processing

The legal basis for the temporary retention of data and log files is Art. 6 (1) (f) GDPR.

c) Purpose of data processing

Data is stored in log files to ensure that our website works properly. We also use the data to optimise the website and to make sure our information technology systems are secure. Data is not evaluated for marketing purposes in this context. These purposes also represent our legitimate interest in data processing according to Art. 6 (1) (f) GDPR.

d) Duration of retention

Data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. In the case of log file storage, this means after seven days at the latest. They may however be stored for longer. If so, the IP addresses of the users are deleted or anonymised, so that it is no longer possible to associate the data with visiting clients.

e) Option to object and remove

Collecting data for the provision of the website and the storage of these data in log files is essential to the operation of the website. Because of this, there is no option for the user to object.

2. Contact form / email contact

a) Description of data processing

There are contact forms on our website that you can use to get in touch electronically. If you use them, the data you enter in the form (mandatory and optional boxes) will be sent to us and stored. These data are, in particular:

  • Name, address, and, if applicable, your company
  • E-mail address
  • Subject
  • Your message to us

Alternatively, you can contact us using the email address we provide. If you do, the personal data transmitted with your email will be stored. The data are not passed on to third parties in this context. They are used exclusively for our correspondence.

b) Legal basis for data processing

The legal basis for the processing of data is Art. 6 (1) (f) GDPR. If the intention of sending the email is to conclude a contract or quasi-contractual obligation, then the additional legal basis for the processing is Art. 6 (1) (b) GDPR.

c) Purpose of data processing

Processing personal data is done solely for the sake of establishing contact. If contact is made, this also constitutes a necessary and legitimate interest in processing data.

d) Duration of retention

Data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. In terms of personal data sent by email, this happens when the conversation with the user comes to an end. The conversation ends when it is clear from the circumstances that the topic has been conclusively dealt with.

e) Option to object and remove

If users contact us by email or contact form, they can object to the retention of their personal data at any time. You can object by sending a message using the contact details at the end of our data protection policy. If you do object, your conversation with us will not be continued and we will delete any personal data stored in the course of our communication.

3. Using our webshop

a) Description of data processing

If you want to place an order at our webshop, you will need to provide the personal details we require for the processing of your order so that a contract can be concluded between us. These data are stored in a customer account. You can always delete any data you have provided, including your user account, in the customer area. The mandatory information required for the processing of agreements is marked as such; other information is voluntary.

b) Legal basis for data processing

The legal basis for processing data to fulfil agreements is Art. 6 (1) (1) (b) GDPR, or if the data are used for advertising purposes, Art. 6 (1) (f) GDPR.

c) Purpose of data processing

We process the data you provide to fulfil your order. To do this, we may pass on your payment details to our bank or to credit agencies to check your creditworthiness. We may also process the data you provide to tell you about other interesting products from our portfolio, or to send you emails containing technical information.

d) Duration of retention

Commercial and tax law obliges us to retain your address, payment details and order details for ten years.

e) Encryption during the ordering process

The ordering process is encrypted using SSL technology in order to prevent other people from accessing your personal data without permission, especially your financial details.

III. Use of cookies

1. Description of data processing

We use cookies in order to make visiting our website as attractive as possible and to enable certain features to be used. Cookies are small text files stored in a browser or by a browser on a device. When a user accesses a website, a cookie may be stored in their operating system. This cookie contains a distinctive string of characters that enables the browser to be identified if it visits the website again. When a user visits our website, they are informed about the use of technically non-essential and third party cookies, and their consent is obtained to the processing of the personal data used in this context. Reference is also made to this data protection policy.

a) Technically essential cookies

We use cookies to make our website more user-friendly. Some elements of our website require it to identify the visiting browser, including after the site has been changed. The following data are stored and transmitted in the cookies:

  • Session cookie

b) Technically non-essential and third party cookies

We also use technically non-essential cookies on our website, which mainly enable us to analyse users’ surfing behaviour. We use the following technically non-essential cookies and third party cookies:

  • Google Analytics

c) Note on changing browser settings

Most browsers are set to accept cookies automatically. You can prevent cookies from being stored on your computer by setting your browser accordingly. However, this may limit the features of our website.

2. Legal basis for data processing

The legal basis for processing personal data using technically non-essential and third party cookies with the user’s consent is Art. 6 (1) (a) GDPR. Aside from that, the legal basis for the processing of personal data using technically essential cookies is Art. 6 (1) (f) GDPR.

3. Purpose of data processing

The purpose of using technically essential cookies is to make it easier for you to use the website. Some of the features of our website are only available if cookies are used. They require your browser to be recognised, even after a change to the site. These purposes also represent our legitimate interest in personal data processing according to Art. 6 (1) (f) GDPR. Analytical cookies tell us how the website is used so that we can keep improving it. User data collected by cookies on our website are not used to create user profiles.

4. Duration of retention, option to object and remove

Cookies are stored on the user’s computer, which sends them to our website. As a user, you therefore have full control over the use of cookies. You can deactivate or restrict the sending of cookies by changing the settings in your browser. Cookies that have already been saved can be deleted at any time. This can be done automatically. If cookies are deactivated for our website, you may no longer be able to use all of its features fully.

IV. Use of Google services and other services/tools

1. General information about Google services

We use various Google Inc. (“Google”) services on our website. Since Google services are integrated, Google may collect and process information, including personal data. There are circumstances under which Google may also send this information to a server in a country outside the European Economic Area. Google has undertaken to comply with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework on the collection, use and retention of personal data originating in member states of the EU and Switzerland. Google, including Google LLC and its wholly owned US subsidiaries, has certified that it adheres to the Privacy Shield principles. For more information, see: We have also concluded agreements on commissioned data processing with the companies listed in Section I.4, including standard contractual clauses. We cannot dictate which data Google actually collects and processes. But Google does state that it may process the following information, including personal data:

  • Log data (especially IP address)
  • Geolocation information
  • Unique application numbers
  • Cookies and similar technologies

If you are logged into your Google account, Google may, depending on your account settings, add the processed information to your account and treat it as personal data; see in particular You can prevent these data from being linked to your Google account by logging out of it, or by changing the relevant settings in it. You can also change your cookie settings (such as delete cookies, block cookies). See Section III for more information. Further details are available in Google’s privacy policy, which is here: You will find information about Google’s privacy settings at

You have the right to object. You can do so by sending a message using the contact details at the end of our data protection policy. Other objection pathways are described under the Google services involved, if applicable.

2. Use of Google Analytics

This website uses Google Analytics, a Web analysis service provided by Google Inc. (“Google”). We use Google Analytics for the purpose of analysing user behaviour on our website, so that we can respond to that behaviour. This helps us to continuously improve the website. When you visit our website, you are informed about the use of Google Analytics and analysis cookies and we ask for your consent to the processing of the data used in that regard. Reference is also made to this data protection policy. The legal basis for using Google Analytics is Art. 6 (1) (a) GDPR, provided the user has given consent. Google Analytics uses cookies, which are text files placed on users' computers to help the website analyse how users use it. The information generated by the cookie concerning the user's use of this website is generally sent to a Google server in the US and stored there. However, if IP-anonymity is activated on this website, then your IP address will first be truncated by Google inside the member states of the European Union and in other states that are signatories to the European Economic Area Agreement. The full IP address is only sent to a Google server in the US and truncated there in exceptional cases. According to Google, the IP address transmitted from your browser as part of Google Analytics is not linked to any other data held by Google. Google uses this information on behalf of the operator of this website to evaluate how people use the site, to compile reports about website activity and to provide the website operator with other services related to the use of this website and to internet usage. We also have a legitimate interest in processing data for these purposes. We set data to be deleted automatically in Google Analytics after 14 months.

Please note that the code “ga(‘set’, ‘anonymizeIp’, true);” has been added to Google Analytics on this website, so that IP addresses are collected anonymously. For further information on data handling in connection with Google Analytics, please refer to Google's privacy policy: You may refuse the use of cookies by selecting the appropriate settings on your browser, but please note that if you do this, you may not be able to use all of this website’s features. You can also prevent the data produced by the cookie and relating to how you use the website (including your IP address) from being sent to and processed by Google by downloading and installing the browser plug-in at the following link. The current link is:

3. Use of the “Adobe Fonts” service“

We use Adobe Fonts to display text on our website. Adobe Fonts is a service that enables access to a font library and is provided by Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA (“Adobe”). When you open a page, your browser loads the Web Fonts it needs into your browser cache, so that text and fonts display correctly. The Fonts service does not involve placing or using cookies to provide the fonts. In order to provide the Fonts service, Adobe may collect font information to identify the website itself and the associated Fonts account. More information is available on the Adobe Fonts privacy information page at and in Adobe’s privacy policy at

4. Google Tag Manager

This website uses Google Tag Manager. This service allows website tags to be managed via an interface. Google Tool Manager only handles tags. This means that cookies are not used and personal data are not collected. Google Tool Manager triggers other tags which may collect data, but Google Tag Manager does not access that data. If deactivation has been done at domain or cookie level, it remains in place for all tracking tags, provided these were implemented using Google Tag Manager.

V. Data subject rights

If your personal data are processed, you are a data subject as defined in GDPR and you have the following rights vis-à-vis the controller:

1. Right to information

You have the right to ask whether your personal data are being processed; if they are, you have the right to know about the personal data and about the information listed in detail in Art. 15 GDPR.

2. Right to rectification

You have the right to request the correction of any inaccurate personal data concerning you and the completion of any incomplete personal data (Art. 16 GDPR), without undue delay.

3. Right to restriction of processing

You have the right to request the restriction of processing if one of the conditions listed in Art. 18 GDPR applies, such as if you have objected to processing, for as long as it takes to determine whether the objection can be upheld.

4. Right to deletion

You have the right to request that personal data relating to you is deleted without delay, provided one of the reasons specified in Art. 17 GDPR applies, such as if the data are no longer required for the purposes pursued and if statutory retention provisions do not prevent deletion.

5. Right to data portability

According to Art. 20 GDPR, you have the right to receive the personal data relating to you that you have provided us with in a structured, commonly used and machine-readable format, so that either you yourself or – if technically feasible – we may send it to a third party.

6. Option to object

You have the right, within the scope of Art. 21 GDPR, to object to the processing of personal data relating to you at any time, on grounds relating to your particular situation.

7. Right to revoke your declaration of consent under data protection law

You have the right to revoke at any time any declaration of consent given to us under data protection law. Doing so shall not affect the lawfulness of any processing done on the basis of your consent before you revoked it.

8. Rights in the case of automated decisions

If, in exceptional cases, we use automated individual decisions – including profiling – we are obliged by law to take such precautions that allow you influence the decision (Art. 22 GDPR).

9. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state where you reside or work, or where the alleged infringement took place, if you think that the processing of personal data concerning you infringes data protection regulations. You will find the contact details of the supervisory authority responsible for our company at the end of this data protection policy.

10. Other

Please note that the above data subject rights may be limited by EU or national law. Please contact us using the details at the end of this protection policy to exercise any of the above rights. Enquiries submitted to us electronically will usually be answered electronically, unless you request otherwise.

VI. External links

Our website may contain links to websites hosted by others. In case it is not immediately obvious, we would like to point out that these are external links. We have no influence whatsoever on the content or design of other websites, to which this data protection policy does not apply.

VII. Changes to this data protection policy

The internet is developing constantly and the applicable legal standards often change as a result, so we need to adapt our data protection policy from time to time. We will inform you here about any such changes.

VIII. Responsible body

The responsible entity in terms of the General Data Protection Regulation, other national data protection laws of Member States and other data protection regulations is:

Bei den Pferdeställen 8
72072 Tübingen
Telephone: +49 (0)7071 /94 83 800

IX. Contacting the data protection officer

The contact details of the data protection officer responsible are:

Physical address:
Herr Georg von Hausen
Bei den Pferdeställen 8
72072 Tübingen
Telephone: +49 (0)7071 /94 83 800
Postal address:
Herr Georg von Hausen
Bei den Pferdeställen 8
72072 Tübingen
Telephone: +49 (0)7071 /94 83 800

X. Contacting the supervisory authority

The contact details of the supervisory authority responsible for our company's registered office are:

The Baden-Württemberg State Commissioner for Data Protection and Freedom of Information

Lautenschlagerstraße 20
70173 Stuttgart

Postfach 10 29 32
70025 Stuttgart

Tel.: 0711/615541-0
FAX: 0711/615541-15