Privacy

Privacy Policy

1. Information on the collection of personal data and contact details of the controller

1.1. We are pleased that you are visiting our website. Below we inform you about how we handle your personal data when you use our website. Personal data is any data by which you can be personally identified.

1.2. The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is SimplyCodes GmbH, Turmstraße 49, 23843 Bad Oldesloe, Germany, email: info@simplycodes.de, phone: +49 (0) 1522 7800630. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3. For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the character string "https://" and the padlock symbol in your browser's address bar.

2. Data collected when you visit our website

When you use our website for information purposes only, we only collect the data that your browser transmits to our server (so-called "server log files"):

  • The page of our website you visited
  • Date and time of access
  • Amount of data sent in bytes
  • Source/referrer from which you reached the page
  • Browser and operating system used
  • IP address used (anonymised where applicable)

The processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.

3. Cookies

To make your visit to our website more appealing, we use cookies. These are small text files that are stored on your device. Where individual cookies also process personal data, the processing is carried out in accordance with Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest).

You decide which cookies we may set with your consent in our cookie banner on your first visit. You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page.

You can configure your browser so that you are informed when cookies are set and can decide individually whether to accept them, or exclude their acceptance in certain cases or in general.

Promotion links for VGO XP. When you open a promotion link, for example from our newsletter, we set the cookie “vgo_xp”. It contains only the code of the respective VGO XP promotion and ensures that the promotion is retained until you place your order, even if you leave the website in the meantime. The cookie expires when the promotion ends, after 14 days at the latest. It is strictly necessary for your requested participation in the promotion (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG)) and is therefore set without consent; the legal basis for the associated processing is Art. 6(1)(b) GDPR. If you place an order during a promotion, we store with your order through which promotion and by which route (link or code) it was placed, so that we can credit you with the additional VGO XP.

4. Contacting us

When you contact us (e.g. via contact form or email), personal data is collected. This data is stored solely for the purpose of responding to your enquiry. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) or, if the contact is aimed at concluding a contract, Art. 6(1)(b) GDPR.

5. Data processing when opening a customer account, using the guest login and for contract processing

5.1. In accordance with Art. 6(1)(b) GDPR, personal data is collected and processed when you provide it to us for the performance of a contract, for a guest order or when opening a customer account. The data collected can be seen in the respective input forms. You can delete your customer account at any time.

5.2. Participation in the loyalty programme (loyalty points)
We offer our customers the opportunity to take part in a loyalty programme. This applies both to registered customers (email and password) and to customers who order via a guest login (email address). For the purpose of crediting, managing and redeeming loyalty points, we process your email address and data on the purchases you have made. This processing is necessary in order to grant you the contractually promised benefits of the programme (e.g. a €5 voucher from 5,000 points). The legal basis is Art. 6(1)(b) GDPR. The data is stored for the duration of your participation in the programme, or until the points expire in accordance with our Terms and Conditions or deletion is requested.

6. Use of your data for direct marketing (newsletter)

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information is your email address. We use the double opt-in procedure. The legal basis for the processing is your consent in accordance with Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time via the link in the newsletter.

7. Data processing for order processing

7.1. We work with service providers to process your order. As part of payment processing, we pass your payment data on to the commissioned credit institution or payment service provider (Art. 6(1)(b) GDPR).

7.2. PayPal: The data is passed on to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. PayPal may reserve the right to carry out a credit check (Art. 6(1)(f) GDPR).

7.3. HubSpot CRM: We use HubSpot for customer management (Art. 6(1)(f) GDPR). HubSpot Inc. is certified under the EU-U.S. Data Privacy Framework, which guarantees an adequate level of data protection.

7.4. Brevo: We use Brevo (Sendinblue GmbH, Berlin) to send emails, as a processor in accordance with Art. 28 GDPR.

8. Verification (Veriff)

We use Veriff (Estonia) to verify your data. In the process, identity document data is transmitted to check its authenticity. The legal basis is Art. 6(1)(b) GDPR or our legitimate interest in preventing fraud.

9. Online marketing and web analytics

We only use the following services if you have given your consent in our cookie settings, depending on the service to the category “Statistics” or “Personalisation”. In that case, the legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG)). You can change your choice at any time via the “Cookie settings” link at the bottom of every page and thereby withdraw your consent with effect for the future. Any deviations are stated for the respective service.

Google Ads & Google Analytics: These services are provided by Google Ireland Limited (Ireland). Where data is transferred to the USA, Google LLC is certified under the EU-U.S. Data Privacy Framework. The processing is based on your consent (Art. 6(1)(a) GDPR) or our legitimate interest (Art. 6(1)(f) GDPR).

Microsoft Clarity: With your consent to the category “Statistics”, we use Microsoft Clarity provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity records how visitors use our pages (pages viewed, clicks, mouse movements and scrolling) as well as information about the device, browser and screen size, and displays this as heatmaps and session recordings. This helps us find errors and improve usability. For this purpose, Clarity sets the cookies “_clck” (storage period 1 year) and “_clsk” (1 day), which are used to combine your usage across several pages and visits. Without your consent, Clarity is not loaded. Where data is transferred to the USA, Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Further information: https://privacy.microsoft.com/en-gb/privacystatement

Microsoft Advertising: For advertisements in the Bing search engine and the Microsoft advertising network, we use, with your consent to the category “Personalisation”, the conversion tracking “Universal Event Tracking” (UET) of Microsoft Advertising; the provider is Microsoft Ireland Operations Limited (address see above). This allows us to measure whether visits and purchases result from one of our advertisements, to control the delivery of our advertisements and to create target groups for advertisements. The data transmitted comprises the pages viewed, for purchases the order value and the items purchased, your IP address and browser and device information. UET sets the cookies “_uetsid” (1 day) and “_uetvid” (13 months); Microsoft also sets its own cookie “MUID” (13 months). Where data is transferred to the USA, Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Further information: https://privacy.microsoft.com/en-gb/privacystatement

Meta Pixel and Meta Conversions API: For advertisements on Facebook and Instagram, we use, with your consent to the category “Personalisation”, the Meta Pixel and the Meta Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). This allows us to measure whether visits and purchases result from one of our advertisements, to control the delivery of our advertisements and to create target groups for advertisements (e.g. people who have visited our shop).

The Meta Pixel sets the cookie “_fbp” and, if you reach us via a Meta advertisement, the cookie “_fbc” (storage period 90 days each). It transmits to Meta: pages viewed, viewing a product, adding to the shopping cart, starting the checkout and the purchase (with order value, currency, order number and item identifiers), as well as your IP address, browser and device information and the address of the page viewed. Without your consent, the Meta Pixel is not loaded.

With the same consent, we also transmit purchases directly from our server to Meta (Conversions API). In doing so, we transmit the order value, currency, order number and item identifiers, your IP address, the browser identifier (user agent), the identifiers from the cookies “_fbp” and “_fbc” and your email address in pseudonymised form (as a hash value). This ensures that purchases are recorded even if they are lost in the browser, for example when returning from a payment provider. Meta matches this data with user accounts and merges events received twice.

We and Meta are jointly responsible for the collection and transmission of the data (Art. 26 GDPR). The details are set out in the agreement at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing; information on this can be found in Meta's privacy policy at https://www.facebook.com/privacy/policy. Where data is transferred to the USA, Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

10. Tools and other services

Google reCAPTCHA & YouTube: Here, too, the provider is Google Ireland Limited. They are used to prevent misuse and to present our online offers in an appealing way. Certification under the EU-U.S. Data Privacy Framework is in place.

11. Rights of the data subject

You have the following rights under the GDPR:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16) or erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object to processing (Art. 21)
  • Right to withdraw consent given (Art. 7(3))
  • Right to lodge a complaint with a supervisory authority (Art. 77)

12. Storage period

The storage period is determined by the statutory retention periods (e.g. 10 years for accounting records). After these periods have expired, the data is deleted unless it is still required for the performance of the contract.