Privacy policy

Thank you for visiting our website kfi-shop.de and for your interest in our company.
The protection of your personal data, such as date of birth, name, telephone number, address, etc., is important to us.
The purpose of this privacy policy is to inform you about the processing of your personal data that we collect when you visit our website. Our data protection practices comply with the statutory provisions of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The following privacy policy serves to fulfill the information obligations arising from the GDPR. These can be found, for example, in Art. 13 and Art. 14 ff. GDPR.

Section 1 - General information

1.1 The controller

The controller within the meaning of Art. 4 No. 7 GDPR is the person who alone or jointly with others determines the purposes and means of the processing of personal data.
With regard to our website, the controller is:
KFI Cargo Control GmbH
Röntgenstr. 1
66763 Dillingen
Germany
E-Mail: info@kfi-cargo.com
Phone: +49 (0) 6831 76889-30
Fax: +49 (0) 6831 76889-33
We have appointed a data protection officer in accordance with Art. 37 GDPR. You can contact our data protection officer at info@kfi-cargo.com.

1.2. Processing of store data

Our website is an online store where you can purchase various merchandise items, among other things.
As with any other online store, we must collect personal data from you as part of the sales process. This includes, in particular, address data (surname, first name, street, zip code, city, country), contact details (e-mail address, telephone number if applicable), invoice and billing data (surname, first name, street, zip code, city, country, purchase amount, selected payment method, etc.), as well as general technical personal data.We also collect general technical personal data (such as your IP address, the status of your shopping cart, products you have purchased, etc.).
In the course of contract processing, we will also pass on your personal data to third parties for the fulfillment of our contract for specific purposes. Particularly sensitive data in the context of billing is only transmitted on the basis of state-of-the-art encryption.

1.3. provision of the website and creation of log files

Each time our website is accessed, our system automatically collects data and information from the device accessing it (e.g. computer, cell phone, tablet, etc.).

What personal data is collected and to what extent is it processed?

(1) Information about the browser type and version used;
(2) The operating system of the accessing device;
(3) Host name of the accessing computer;
(4) The IP address of the accessing device;
(5) Date and time of access;
(6) Websites and resources (images, files, other page content) that were accessed on our website;
(7) Websites from which the user's system came to our website (referrer tracking);
(8) Notification of whether the access was successful;
(9) Amount of data transferred
This data is stored in our system's log files. This data is not stored together with the personal data of a specific user, so that individual site visitors are not identified.

Legal basis for the processing of personal data

Art. 6 para. 1 lit. f GDPR (legitimate interest). Our legitimate interest is to ensure the achievement of the purpose described below.

Purpose of data processing

The temporary (automated) storage of data is necessary for the course of a website visit in order to enable the website to be delivered. The storage and processing of personal data is also carried out to maintain the compatibility of our website for as many visitors as possible and to combat misuse and troubleshooting. For this purpose, it is necessary to log the technical data of the accessing computer in order to be able to react as early as possible to display errors, attacks on our IT systems and/or errors in the functionality of our website. In addition, we use the data to optimize the website and to generally ensure the security of our IT systems.

Duration of storage

The aforementioned technical data is deleted as soon as it is no longer required to ensure the compatibility of the website for all visitors, but no later than 3 months after our website is accessed.
Right

to object and erasureYou

can object to the processing at any time in accordance with Art. 21 GDPR and request the erasure of data in accordance with Art. 17 GDPR. The rights to which you are entitled and how you can assert them can be found at the bottom of this privacy policy.

1.4. General information on contacting us

Please note that complete data security cannot be guaranteed on the transmission path to our IT systems in the case of unencrypted communication by email, so we expressly recommend encrypted communication or the postal service for information requiring a high level of confidentiality. Transmission by email involves the following risks, among others:

• Personal data could be disclosed to third parties without authorization if the email address is not entered correctly;
• You have no information about the recipient, e.g. which or how many employees have access to the e-mail;
• due to the transmission of data by e-mail via several distributed intermediaries, unauthorized third parties can access the data without encryption.

Section 2 - Special information

2.1 Special functions of the websiteOur website offers you various functions that collect, process and store personal data when you use them. Below we explain what happens to this data:
 2

.1.1 Order form

• What personal data is collected and to what extent is it processed?

  The data you enter in the form fields, e.g. address, surname, first name, etc., is processed by us to fulfill the purpose stated below.

• Legal basis for the processing of personal data

  Art. 6 para. 1 lit. b GDPR (implementation of (pre)contractual measures)

• Purpose of data processing

  The purpose of data processing is to process your order so that we can handle potential contractual relationships with you or carry out pre-contractual measures.

• Duration of storage

  The data is deleted as soon as it is no longer required for processing the order and there are no longer any legal obligations to retain it. This will generally be after 10 years (see Section 147 (3) in conjunction with (1) nos. 1, 4 and 4a AO, Section 14b (1) UStG).

• Objection and deletion options

  The rights to which you are entitled and how you can assert them can be found at the bottom of this privacy policy.

• Necessity of providing personal data

  The information in the order form is neither contractually nor legally required, but is necessary for the conclusion of a contract. If you do not fill in the existing mandatory fields or do not fill them in completely, the order you have requested cannot be completed.

 2

.1.2 Contact form(s)

• What personal data is collected and to what extent is it processed?

  We will process the data entered by you in our contact forms, which you have entered in the input mask of the contact form, to fulfill the purpose stated below.

• Legal basis for the processing of personal data

  Art. 6 para. 1 lit. a GDPR (consent by clear affirmative action or behavior)

• Purpose of data processing

  The data collected via our contact form or We will only use the data collected via our contact form or via our contact forms to process the specific contact request received via the contact form.

• Duration of storage

  Once your request has been processed, the data collected will be deleted immediately, provided there are no statutory retention periods.

• Revocation and deletion options

  The revocation and deletion options are based on the general regulations on the right of revocation and deletion under data protection law described below in this data protection declaration.

• Necessity of providing personal data

  The use of the contact forms is voluntary and is neither contractually nor legally required. You are not obliged to contact us via the contact form, but can also use the other contact options provided on our website. If you wish to use our contact form, you must complete the fields marked as mandatory. If you do not fill in the required fields of the contact form, you will either not be able to send the request or we will unfortunately not be able to process your request.

 2

.1.3 Login area

• What personal data is collected and to what extent is it processed?

  We will process the registration and login data you enter with us to fulfill the purpose stated below.

• Legal basis for the processing of personal data

  Art. 6 para. 1 lit. b GDPR (implementation of (pre)contractual measures)

• Purpose of data processing

  You have the option of using a separate login area on our website. So that we can check your authorization to use the protected area or the protected documents, you must enter your login data (e-mail or user name and password) in the corresponding form.

• Duration of storage

  The data collected will be stored for as long as you maintain a user account with us.

• Objection and deletion options

  The rights to which you are entitled and how you can assert them can be found at the bottom of this privacy policy.

• Requirement to provide personal data

  The use of the login area on our website is contractually required for the use of the protected area. It is not possible to use the content protected by the login area without entering personal data. If you wish to use our login area, you must complete the fields marked as mandatory (user name and password). The entry of the data requires the existence of a user account. Registration is not possible if the data you enter is incorrect. If the data you enter is incorrect or not entered at all, the protected area cannot be used. However, the rest of the site can still be used without logging in.

 2

.2 Statistical analysis of visits to this website - web tracker

We collect, process and store the following data when this website or individual files on the website are accessed: IP address, website from which the file was retrieved, name of the file, date and time of retrieval, amount of data transferred and notification of the success of the retrieval (so-called web log). We use this access data exclusively in non-personalized form for the continuous improvement of our website and for statistical purposes. We also use the following web trackers to analyze visits to this website:

• Dynatrace

  We use the Dynatrace service from Dynatrace GmbH, Konrad-Zuse-Platz 8, 81829 Munich, Germany, e-mail: privacy@dynatrace.com, Website: https://www.dynatrace.com/. Personal data is also transferred to the USA. With regard to the transfer of personal data to the USA, there is an adequacy decision on the EU-US Data Privacy Framework of the EU Commission within the meaning of Art. 45 GDPR (hereinafter: DPF - https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en ). The operator of the service is certified under the DPF, so that the usual level of protection of the GDPR applies to the transfer.
  The legal basis for the processing of personal data is your consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have given on our website.
  Dynatrace is used on our website to monitor and analyze performance and user behavior. The service works by collecting data such as loading times, user interactions and errors in order to improve the user experience and identify potential problems at an early stage. Dynatrace uses Real User Monitoring (RUM) to collect and analyze data in real time.
  The certification of the parent company within the framework of the EU-US Data Privacy Framework can be found at https://www.dataprivacyframework.gov/s/.
  You can withdraw your consent at any time. You can find more information on revoking your consent either in the consent itself or at the end of this privacy policy.
  Further information on the handling of the transferred data can be found in the provider's privacy policy at https://www.dynatrace.com/company/trust-center/privacy/.

Google Analytics

• We use the Google Analytics service provided by Google Ireland Ltd, Gordon House, Barrow Street, 4 Dublin, Ireland, e-mail: support-deutschland@google.com, Website: https://www.google.com/. Personal data is also transferred to the USA. With regard to the transfer of personal data to the USA, there is an adequacy decision on the EU-US Data Privacy Framework of the EU Commission within the meaning of Art. 45 GDPR (hereinafter: DPF - https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en ). The operator of the service is certified under the DPF, so that the usual level of protection of the GDPR applies to the transfer.
  The legal basis for the processing of personal data is your consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR that you have given on our website.
  Google Analytics is a web tracker that analyzes the behavior of site visitors and their interactions with our website and provides us with evaluations and forecasts about the content and products of our website and their popularity (so-called tracking). We have integrated Google Analytics so that the service can compile an analysis of the surfing behavior of site users. For this purpose, Google collects the page interactions of page visitors with our website and any existing information resulting from the reading of cookies or other storage technologies and prepares it statistically for us. Google Analytics uses data processing technologies that make it possible to track individual site visitors and their interaction with other Google services such as the Google Ads advertising network. Data from other Google services is also used to close data gaps using machine learning technologies, modeled statistics and forecasting functions and to compile comprehensive statistics on the content of our website. If Google Analytics is activated on our website, the data collected by Google Analytics is transferred to servers of Google Ireland Limited. As part of order processing, personal data may also be transmitted to the servers of the parent company Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States. We carry out the analysis using Google Analytics in order to constantly optimize our website and make it more accessible. This is a so-called reach measurement.
  The service or we collect the following data for processing: Data on the interactions of page visitors with the content of the website, data on the handling of the services presented on our website, data from external Google services, insofar as they interact with our website, such as advertising data or data on behavior in relation to advertising, data on the rough geographical origin, the browser used, operating system and other information on the end device used.
  Google Analytics will store the data relevant for the provision of web tracking for as long as is necessary to fulfill the booked web service. Data collection and storage is anonymized. Insofar as individual interactions of site visitors make it possible to subsequently establish a personal reference to specific actions, we will delete the collected data when the purpose has been achieved. The data will be deleted at the latest when it is not subject to any statutory retention obligations. As a rule, we will delete this data after 12 months at the latest. You can view the provider's certification under the EU-US Data Privacy Framework at https://www.dataprivacyframework.gov/list.
  You can withdraw your consent at any time. You can find more information on revoking your consent either in the consent itself or at the end of this privacy policy.
  Further information on the handling of the transferred data can be found in the provider's privacy policy at https://policies.google.com/privacy.
  The provider also offers an opt-out option at https://tools.google.com/dlpage/gaoptout?hl=de.

• Google Tag Manager

  We use the Google Tag Manager service provided by Google Ireland Ltd. on our website, Gordon House, Barrow Street, 4 Dublin, Ireland, e-mail: support-deutschland@google.com, Website: https://www.google.com/. Personal data is also transferred to the USA. With regard to the transfer of personal data to the USA, there is an adequacy decision on the EU-US Data Privacy Framework of the EU Commission within the meaning of Art. 45 GDPR (hereinafter: DPF - https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en ). The operator of the service is certified under the DPF, so that the usual level of protection of the GDPR applies to the transfer.
  The legal basis for the processing of personal data is your consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have given on our website.
  Google Tag Manager offers a technical platform to execute and bundle other web tools and web tracking programs by means of so-called "tags". In this context, Google Tag Manager stores cookies on your computer and, if web tracking tools are executed using Google Tag Manager, analyzes your surfing behavior (so-called "tracking"). The data generated by the tags is merged, stored and processed by Google Tag Manager under a uniform user interface. All integrated tags are listed separately in this privacy policy. When using our website with activated integration of "tags" from Google Tag Manager, data, in particular your IP address and your user activities, are transmitted to Google servers. The tracking tools used in Google Tag Manager ensure that the IP address is anonymized by Google Tag Manager before transmission by means of IP anonymization of the source code. Tag Manager can be used to link and evaluate measurement values from different service providers (Google and third-party providers) on the basis of so-called tag management. Google Tag Manager helps us to compile reports on website activity and to control the web tools on our website.
  The service or we collect the following data for the processing itself: Cookies, web tracking data, outgoing or incoming links, information generated by Google Tag Manager and the web tools triggered by Google Tag Manager when JavaScript code is integrated and activated on the website.
  You can access the provider's certification under the EU-US Data Privacy Framework at https://www.dataprivacyframework.gov/list.
  You can withdraw your consent at any time. You can find more information on revoking your consent either in the consent itself or at the end of this privacy policy.
  Further information on the handling of the transferred data can be found in the provider's privacy policy at https://policies.google. com/privacy.com/privacy.
  The provider also offers an opt-out option at https://policies.google.com/privacy.

• Piwik PRO

  On our website we use the Piwik PRO service of Piwik PRO GmbH, Knesebeckstraße 62/63, 10719 Berlin, Germany, e-mail: gdpr@piwik.pro, website: https: //piwikpro.de/. The transfer also takes place to a third country for which there is no adequacy decision by the Commission. Therefore, the usual level of protection for the GDPR cannot be guaranteed for the transfer, as it cannot be ruled out that authorities in the third country, for example, may access the data collected.
  The legal basis for the processing of personal data is your consent in accordance with Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR. Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR, which you have given on our website.
  Piwik PRO is used on our website to analyze the behavior of visitors and to better understand the use of the website. The service works by collecting data such as pages visited, session duration, device type, browser, operating system and visitor location. This information helps us to optimize the user experience and customize content.
  You can withdraw your consent at any time. You can find more information on withdrawing your consent either in the consent itself or at the end of this privacy policy.
  Further information on the handling of the transferred data can be found in the provider's privacy policy at https://piwikpro.de/datenschutz/.

 2

.3 Integration of external web services and processing of data outside the EU

We use active content from external providers, so-called web services, on our website. When you visit our website, these external providers may receive personal information about your visit to our website. This may result in data being processed outside the EU. You can prevent this by installing an appropriate browser plugin or deactivating the execution of scripts in your browser. This may result in functional restrictions on websites that you visit.
We use the following external web services:

• Legal text

  snippet and modules

  We use the legal text snippet and modules service of the company Website-Check GmbH, Beethovenstraße 24, 66111 Saarbrücken, Germany, e-mail: support@website-check.de, Website: https: //www.website-check.de/. The transfer of personal data takes place exclusively to servers in the European Union.
  The legal basis for the processing is Art. 6 para. 1 lit. c GDPR. The use of the service helps us to comply with our legal obligations.
  The service is used to reload the content of our legal texts on our website. The current legal texts are reloaded via the integration on our website. This integration may also be used to load further technical modules with regard to the legal texts or legally required elements.
  The rights to which you are entitled with regard to processing can be found at the end of this privacy policy.
  Further information on the handling of the transferred data can be found in the provider's privacy policy at https://www.website-check.de/datenschutzerklaerung/.

 2

.4. Integration of cookies

• What personal data is collected and to what extent is it processed?

  We integrate and use cookies on various pages to enable certain functions of our website and to integrate external web services. Cookies are small text files that your browser can store on your access device. These text files contain a characteristic string of characters that uniquely identifies the browser when you return to our website. The process of saving a cookie file is also referred to as "setting a cookie". Cookies can be set both by the website itself and by external web services. The cookies are set by our website or the external web services in order to maintain the full functionality of our website, to improve user-friendliness or to pursue the purpose stated with your consent. Cookie technology also enables us to recognize individual visitors by means of pseudonyms, e.g. individual or random IDs, so that we can offer more individual services. Details are listed in the following table.

• Legal basis for the processing of personal data

  Insofar as cookies are processed on the basis of consent pursuant to Art. 6 para. 1 lit. a GDPR, this consent is also deemed to be consent within the meaning of Section 25 para. 1 TDDDG for the setting of the cookie on the user's terminal device. Insofar as another legal basis is stated under the GDPR (e.g. for the performance of a contract or to fulfill legal obligations), the storage or setting is based on an exception in accordance with Section 25 (2) TDDDG. This is the case "if the sole purpose of storing information in the end user's terminal equipment or the sole purpose of accessing information already stored in the end user's terminal equipment is to carry out the transmission of a communication over a public telecommunications network" or "if the storage of information in the end user's terminal equipment or access to information already stored in the end user's terminal equipment is strictly necessary to enable the provider of a telemedia service to provide a telemedia service explicitly requested by the user". The relevant legal basis can be found in the cookie table listed later in this section.

Purpose of data processing

• The cookies are set by our website or the external web services in order to maintain the full functionality of our website, to improve user-friendliness or to pursue the purpose stated with your consent. Cookie technology also enables us to recognize individual visitors by means of pseudonyms, e.g. individual or random IDs, so that we can offer more individual services. Details are listed in the table below.

• Duration of storage

  Our cookies are stored until they are deleted in your browser or, if it is a session cookie, until the session has expired. Details are listed in the following table.

• Objection and removal options

  You can set your browser according to your wishes so that the setting of cookies is generally prevented. You can then decide on a case-by-case basis whether to accept cookies or to accept cookies in general. Cookies can be used for various purposes, e.g. to recognize that your access device is already connected to our website (permanent cookies) or to save recently viewed offers (session cookies). If you have expressly given us permission to process your personal data, you can revoke this consent at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of your consent until you withdraw it.

Cookie name	Server name	Provider	Purpose	Legal basis	Storage period	Type
LanguageId	kfi-shop.de	Website operator	This cookie enables us to save individual comfort settings you have selected and to retain them for your current and future visits to the site.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	Session	configuration
_pk_id.	kfi-shop.com	Website operator	The cookie is a tracking cookie from Piwik PRO. The cookie enables us to record page interactions based on an assigned pseudonymous visitor ID and to compile statistics on user behavior on the website. For this purpose, it stores and analyzes information about visitors' actions on the website during the current session, such as the date and time of the first visit, the average time spent on the website and the number of all visitors to the website.	Art. 6 para. 1 lit. f GDPR (legitimate interests)	approx. 13 months	Analytics
_pk_ses.	kfi-shop.com	Website operator	The cookie is a tracking cookie from Piwik PRO. The cookie enables us to record page interactions based on an assigned pseudonymous visitor ID and to compile statistics on user behavior on the website. For this purpose, it stores and analyzes information about visitors' actions on the website during the current session, such as the date and time of the first visit, the average time spent on the website and the number of all visitors to the website.	Art. 6 para. 1 lit. f GDPR (legitimate interests)	approx. 31 minutes	Analytics
auth	kfi-shop.de	Website operator	This cookie allows us to store the authentication of the website visitor.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 3 days	configuration
dTValidationCookie	kfi-shop.com	Website operator	The cookie is set in connection with Dynatrace. It is used to determine the top-level domain.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	Session	Analytics
dtCookie	kfi-shop.com	Website operator	The cookie is set in connection with Dynatrace. It tracks a visit across multiple requests.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	Session	Analytics
dtPC	kfi-shop.de	Website operator	The cookie is set in connection with Dynatrace. It is required to identify the correct endpoints for the information transfer; contains the session ID for the assignment.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	Session	Analytics
dtSa	kfi-shop.de	Website operator	The cookie is set in connection with Dynatrace. It serves as a cache for cross-page actions. This cookie is used to store the names of user actions, such as "click to login", across different pages. This is necessary because loading a page leads to a restart of the JavaScript code, so all context-related information must be stored in cookies.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	Session	Analytics
rxVisitor	kfi-shop.de	Website operator	The cookie is set in connection with Dynatrace. It contains the visitor ID to assign sessions.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	Session	Analytics
rxvt	kfi-shop.de	Website operator	The cookie is set in connection with Dynatrace. It indicates the timeout of the session.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	Session	Analytics
stg_externalReferrer	kfi-shop.com	Website operator	The cookie is set in connection with Piwik PRO. It stores the URL of the website that referred a visitor to our website.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	Session	Analytics
stg_last_interaction	kfi-shop.com	Website operator	The cookie is set in connection with Piwik PRO. It indicates whether the session of the last visitor is still running or a new session has started. It stores the timestamp of the visitor's last interaction with our website.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 12 months	Analytics
stg_returning_visitor	kfi-shop.com	Website operator	The cookie is set in connection with Piwik PRO. It indicates whether the visitor has been to our website before - in which case they are a returning visitor. It stores the timestamp of the visitor's last interaction with our website.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 12 months	Analytics
stg_traffic_source_priority	kfi-shop.com	Website operator	The cookie is set in connection with Piwik PRO. It stores the type of access source from which the visitor came to our website, e.g. "Direct", "Referral", "Social media", "Organic search", "Campaign".	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 31 minutes	Analytics
_ga	kfi-shop.com	Google Analytics	This cookie assigns an ID to a user so that the web tracker can summarize the user's actions under this ID.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 24 months	Analytics
_ga	kfi-shop.com	Google Analytics	This cookie assigns an ID to a user so that the web tracker can summarize the user's actions under this ID.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 24 months	Analytics
_ga_	kfi-shop.com	Google Analytics	This cookie stores a unique ID for a website visitor in connection with Google Analytics or Google Tag Manager and tracks how the visitor uses the website.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 24 months	Analytics
_gat_gtag_UA_	kfi-shop.com	Google Analytics	This cookie assigns an ID to a user and assigns the user's actions to this ID in connection with Google Tag Manager.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 80 seconds	Analytics
_gcl_au	kfi-shop.com	Google Tag Manager	This cookie is used by Google AdSense to increase the efficiency of advertising.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 3 months	Marketing
_gid	kfi-shop.com	Google Analytics	This cookie assigns an ID to a user so that the web tracker can summarize the user's actions under this ID.	Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR (consent)	approx. 24 hours	Analytics

2.5 Use of localStorage and sessionStorage

Web storage technology is a technical option which - similar to cookies - can be used to store data and information on the user's computer or end device.

Data can generally be stored in web storage in two ways. The name of the web storage depends on the storage duration. A distinction is made between permanent storage (localStorage) and storage limited to the "session" (sessionStorage). A session begins when the page is called up and ends when the page is exited (e.g. by closing the tab or the browser).

The localStorage or sessionStorage is accessed via the scripts and web services used on the website.

We have created a table in which we explain the type of data and the purpose of the localStorage and sessionStorage.

Name	Type	Purpose	Legal basis
ruxitagent_17863b604e9f27e6_Store	Configuration	The Local Storage service is used in connection with Dynatrace.	Art. 6 para. 1 lit. a GDPR (consent)
dtCookie	Analytics	The session storage service is used in conjunction with Dynatrace. It tracks a visit over several requests.	Art. 6 para. 1 lit. a GDPR (consent)
dtSa	Analytics	The session storage service is used in conjunction with Dynatrace. It serves as a cache for cross-page actions. This cookie is used to store the names of user actions, such as "click to login", across different pages. This is necessary because loading a page leads to a restart of the JavaScript code, so all context-related information must be stored in cookies.	Art. 6 para. 1 lit. a GDPR (consent)
rxvisitid	Analytics	The session storage service is set in connection with Dynatrace. It contains the visitor ID to assign sessions.	Art. 6 para. 1 lit. a GDPR (consent)
rxVisitor	Analytics	The session storage service is set in connection with Dynatrace. It contains the visitor ID to assign sessions.	Art. 6 para. 1 lit. a GDPR (consent)
rxvt	Analytics	The session storage service is set in connection with Dynatrace. It indicates the timeout of the session.	Art. 6 para. 1 lit. a GDPR (consent)

2.6 Automatic e-mail archiving

• Scope of the processing of personal data

  We would like to expressly point out that our mail system has an automated archiving process. All incoming and outgoing emails are digitally archived in an audit-proof manner.

• Legal basis for the processing of personal data

  Art. 6 para. 1 lit. c GDPR (legal obligation). The legal obligation consists of compliance with tax and commercial law requirements (e.g. Sections 146, 147 AO, Sections 238, 257 HGB).

• Purpose of data processing

  The purpose of archiving is to comply with tax law (e.g. §§ 146, 147 AO - obligation to store e-mails of relevance under tax law) and commercial law (e.g. §§ 238, 257 HGB - obligation to archive business correspondence).

• Duration of storage

  Our email communication is stored until the expiry of retention obligations under tax and commercial law. The retention period can be up to 10 years.

• Right to object and erasure

  You can object to the processing at any time in accordance with Art. 21 GDPR and request the erasure of data in accordance with Art. 17 GDPR. You can find out which rights you are entitled to and how to assert them at the bottom of this privacy policy.

• Dealing with application documents

2.7 Automated credit check / scoring

If you wish to conclude a contract with us, we reserve the right to carry out exclusively automated processing of your personal data in order to check your creditworthiness. We are also entitled to make such an automated decision in accordance with Art. 22 para. 2 a GDPR. Whether or not the contract can be concluded depends on the result of the automated credit check. During a credit check, statistical probabilities of a payment default are calculated. The credit report can contain probability values (score values) that are calculated on the basis of scientifically recognized mathematical-statistical procedures. A large number of characteristics, such as income, address data, occupation, marital status and previous payment history, are used to determine the customer's future risk of non-payment. The result is expressed in the form of a payment score. The information obtained in this way forms the basis of our decision on the establishment, execution or termination of a contractual relationship. If you believe that you have been wrongly excluded from concluding a contract due to the credit check, you are welcome to explain your point of view to us by email. We will then review the automated decision on a case-by-case basis in accordance with Art. 22 (3) GDPR. In order to be able to carry out the credit check, we may store and process your personal data in accordance with Art. 6 para. 1 lit. b GDPR.

We transmit your data to the following provider(s) in the cases listed below on the basis of the contract in progress:

• Atradius N.V.:

  Atradius N.V., David Ricardostraat 1, 1066 JS Amsterdam, The Netherlands(https://atradius.de/): Our company regularly checks your creditworthiness when concluding contracts and, in certain cases where there is a legitimate interest, also for existing customers. For this purpose, we work together with Atradius N.V., David Ricardostraat 1, 1066 JS Amsterdam, Netherlands, from which we receive the data required for this purpose. For this purpose, we transmit your name and contact details to Atradius N.V..

• Automatic identity and credit check when selecting the "PayPal" payment method

  • What personal data is collected and to what extent is it processed?

    If you have selected "PayPal" as the payment method, we will forward your personal customer data collected as part of the order to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal"), as part of the payment processing. If you give your consent, the following data will be affected by the data transfer: First and last name, street, house number, zip code, city, date of birth, telephone number and data related to your order.

  • Legal basis for the processing of personal data

    Art. 6 para. 1 lit. b GDPR (implementation of (pre-)contractual measures)

  • Purpose of data processing

    PayPal carries out a credit check when the "PayPal" payment method is selected. Mathematical-statistical procedures are used to calculate a rating regarding the probability of a payment default (so-called calculation of a scoring value). PayPal bases its decision on the provision of the respective payment methods on the calculated scoring value. The calculation of a scoring value is based on recognized scientific procedures. Reference is also made to PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

  • Duration of storage

    We will store the relevant data for processing the payment for as long as is necessary to complete the transaction. If the data is subject to statutory retention obligations, it will be deleted after the retention obligation has expired. The duration of data storage by PayPal can be found in PayPal's privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

  • Objection and deletion options

    You can object to the processing at any time in accordance with Art. 21 GDPR and request the deletion of the data in accordance with Art. 17 GDPR. You can find out which rights you are entitled to and how to assert them at the bottom of this privacy policy.

Section 3 - Your rights

3.1 Right to information

You have the right to request confirmation as to whether we are processing your personal data. If this is the case, you have a right of access to the information specified in Art. 15 (1) and (2) GDPR. We will also be happy to provide you with a copy of the data, provided that the rights and freedoms of other persons are not affected (see Art. 15 para. 4 GDPR).

3.2 Right to rectification

In accordance with Art. 16 GDPR, you have the right to have any incorrect personal data stored by us (e.g. address, name, etc.) corrected at any time. You can also request the completion of the data stored by us at any time. A corresponding adjustment will be made immediately.

3.3 Right to erasure

In accordance with Art. 17 (1) GDPR, you have the right to demand that we erase the personal data collected about you if

• the data is no longer required;
• the legal basis for the processing no longer applies due to the withdrawal of your consent
• you have objected to the processing and there are no overriding legitimate grounds for the processing
• your data is being processed unlawfully;
• a legal obligation requires this
• a collection pursuant to Art. 8 para. 1 GDPR has taken place.

According to Art. 17 para. 3 GDPR, the right does not exist if

• the processing is necessary for exercising the right of freedom of expression and information
• your data has been collected on the basis of a legal obligation
• the processing is necessary for reasons of public interest
• the data is necessary for the establishment, exercise or defense of legal claims.

3.4 Right to restriction of processing

According to Art. 18 para. 1 GDPR, you have the right in individual cases to request the restriction of the processing of your personal data.

This is the case if

• the accuracy of the personal data is disputed by you
• the processing is unlawful and you do not consent to its erasure
• the data is no longer required for the purpose of processing, but the data collected serves the establishment, exercise or defense of legal claims
• an objection to the processing pursuant to Art. 21 para. 1 GDPR has been lodged and it is still unclear which interests prevail.

3.5 Right of revocation

If you have given us your express consent to process your personal data (Art. 6 para. 1 lit. a GDPR), you can withdraw this consent at any time. Please note that this does not affect the lawfulness of the processing carried out on the basis of the consent until revocation.

3.6 Right to object

---

If you no longer want us to process your data when storing and processing your data due to a special situation, you can object at any time to data that we have collected on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest) in accordance with Art. 21 GDPR.

---

3.7 Right to data portability

Upon request, we will provide you or a controller designated by you with the following data in a commonly used, machine-readable format in accordance with Art. 20 (1) GDPR

• Data collected on the basis of express consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR;
• Data that we have received from you in accordance with Art. 6 para. 1 lit. b GDPR within the framework of existing contracts; insofar as the data has been processed within the framework of an automated procedure.

3.8 How do you exercise your rights?

You can exercise your rights at any time by contacting us using the contact details below:

KFI Cargo Control GmbH
Röntgenstr. 1
66763 Dillingen
Germany
E-Mail: info@kfi-cargo.com
Phone: +49 (0) 6831 76889-30
Fax: +49 (0) 6831 76889-33

3.9 Right to lodge a complaint with the supervisory authority pursuant to Art. 77 para. 1 GDPR

If you suspect that your data is being processed unlawfully on our website, you can of course bring about a judicial clarification of the problem at any time. You also have every other legal option available to you. Irrespective of this, you have the option of contacting a supervisory authority in accordance with Art. 77 para. 1 GDPR. You have the right to lodge a complaint under Art. 77 GDPR in the EU Member State of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you can choose the supervisory authority to which you turn from the above-mentioned places. The supervisory authority with which the complaint has been lodged will then inform you of the status and outcome of your complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

Created by:

© DURY LEGAL Attorneys at Law - www.dury.de

© Website-Check GmbH - www.website-check.de