The Action Painters Deutschland
English EN

Privacy policy

The party responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is

The Action Painters DE GmbH

Arnulfstraße 19

80634 Munic

Email: support@theactionpainters.com

Phone: +49 176 42895305

 

1) Data Collection When Visiting Our Website

When you use our website solely for informational purposes — that is, when you do not register or otherwise provide us with information — we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • The website visited
  • Date and time of access
  • Amount of data sent in bytes
  • Source/referrer from which you accessed the page
  • Browser used / Operating system used
  • IP address used (possibly in anonymized form)

Processing takes place pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. However, we reserve the right to subsequently review the server log files if there are concrete indications of unlawful use.

 

2) Cookies

To make visiting our website attractive and to enable the use of certain features, we use so-called cookies on various pages. These are small text files stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (session cookies). Other cookies remain on your device and allow us to recognize your browser on your next visit (persistent cookies). When cookies are set, they collect and process certain user information to varying degrees, such as browser and location data as well as IP address values. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie. You can find the storage duration of each cookie in the overview of your web browser's cookie settings.

Some cookies serve to simplify the ordering process by storing settings (e.g. remembering the contents of a virtual shopping cart for a later visit to the website). Where personal data is also processed through individual cookies we use, processing takes place pursuant to Art. 6(1)(b) GDPR for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective website experience.

Please note that you can configure your browser to notify you when cookies are set and to decide individually whether to accept them, or to exclude the acceptance of cookies in certain cases or generally. Each browser differs in how it manages cookie settings. This is described in the help menu of each browser, which explains how you can change your cookie settings. You can find this for the respective browsers at the following links:

Please note that the functionality of our website may be limited if you do not accept cookies.

 

3) Contact and Hosting

3.1 Contact

When you contact us (e.g. via contact form or email), personal data is collected. Which data is collected in the case of a contact form is evident from the respective contact form. This data is stored and used exclusively for the purpose of responding to your inquiry or for contacting you and the associated technical administration. The legal basis for processing this data is Art. 6(1)(b) GDPR (necessary for the implementation of pre-contractual measures). Your data will be deleted 3 years after your inquiry has been finally processed.

 

3.2 Shopify

For hosting our website and displaying the page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada. All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties. In the case of a data transfer to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

 

3.3 Own Review Reminder

Exclusively on the basis of your explicit consent pursuant to Art. 6(1)(a) GDPR, we use your email address for a one-time reminder to submit a review of your order. You can revoke your consent at any time by sending a message to the party responsible for data processing.

 

4) Data Processing for Contract Fulfillment

4.1 Contract Fulfillment

Pursuant to Art. 6(1)(b) GDPR, personal data is collected and processed when you provide it to us for the performance of a contract. Which data is collected is evident from the respective order form. We store and use the data you provide for contract fulfillment. After the contract has been fully performed or your customer account has been deleted, your data will be deleted taking into account tax and commercial retention periods (currently 7 years).

 

5) Data Processing for Order Processing

5.1 Insofar as necessary for contract fulfillment for payment purposes, the personal data we collect is passed on to the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

 

5.2 Use of Payment Service Providers

Apple Pay

If you choose "Apple Pay" as your payment method, provided by Apple Distribution International ("Apple"), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, payment is processed via the "Apple Pay" function of your device running iOS, watchOS, or macOS by charging a payment card stored in "Apple Pay." Apple Pay uses security features integrated into your device's hardware and software to protect your transactions. To authorize a payment, you must enter a code you have previously set as well as verification via your device's "Face ID" or "Touch ID" function. For payment processing purposes, the information you provide during the ordering process, together with information about your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay to process the payment. This encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm successful payment. Where personal data is processed in connection with the transmissions described above, processing takes place exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR. Apple retains anonymized transaction data, including the approximate purchase amount, approximate date and time, and whether the transaction was completed successfully. Anonymization completely rules out any connection to a specific person. Apple uses the anonymized data to improve Apple Pay and other Apple products and services. If you use Apple Pay on your iPhone or Apple Watch to complete a purchase made via Safari on your Mac, the Mac and the authorizing device communicate via an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that could identify you personally. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to "Wallet & Apple Pay" and disable "Allow Payments on Mac."

Further information on data protection for Apple Pay can be found at: https://support.apple.com/de-de/HT203027

 

Google Pay

If you choose "Google Pay" as your payment method, provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), payment is processed via the "Google Pay" application on your mobile device running at least Android 4.4 ("KitKat") and equipped with NFC functionality by charging a payment card stored in Google Pay or a verified payment system stored there (e.g. PayPal). To authorize a payment via Google Pay exceeding €25, your mobile device must first be unlocked using the verification method you have set up (e.g. facial recognition, password, fingerprint, or pattern). For payment processing purposes, the information you provide during the ordering process, together with information about your order, is passed on to Google. Google then transmits your payment information stored in Google Pay in the form of a one-time transaction number to the originating website, which is used to verify a completed payment. This transaction number contains no information about the actual payment data of your payment method stored in Google Pay, but is generated and transmitted as a one-time valid numeric token. In all transactions via Google Pay, Google acts only as an intermediary for processing the payment. The transaction is carried out exclusively between the user and the originating website by charging the payment method stored in Google Pay. Where personal data is processed in connection with the transmissions described above, processing takes place exclusively for the purpose of payment processing pursuant to Art. 6(1)(b) GDPR. Google reserves the right to collect, store, and evaluate certain transaction-specific information for each transaction made via Google Pay. This includes the date, time, and amount of the transaction, merchant location and description, a merchant-provided description of the goods or services purchased, photos you attached to the transaction, the name and email address of the seller and buyer or sender and recipient, the payment method used, your description of the reason for the transaction, and, where applicable, the offer associated with the transaction. According to Google, this processing takes place exclusively pursuant to Art. 6(1)(f) GDPR based on the legitimate interest in proper accounting, verification of transaction data, and optimization and maintenance of the Google Pay service. Google also reserves the right to combine the processed transaction data with other information collected and stored by Google through the use of other Google services. Google Pay's terms of use can be found here: https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=de

Further information on data protection for Google Pay can be found at: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

 

Klarna

One or more online payment methods from the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden. If you select a payment method offered by the provider in which you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose. If you select a payment method in which the provider pays in advance (e.g. purchase on account, installment purchase, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, phone number, and, where applicable, data on an alternative payment method). In order to safeguard our legitimate interest in verifying our customers' creditworthiness, this data is forwarded by us to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. Based on the personal data you provide as well as additional data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment method you selected can be granted in view of payment and/or default risks. For the decision within the scope of the application review, in addition to internal criteria, identity and credit information from the following credit agencies may also be included pursuant to Art. 6(1)(f) GDPR: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values is based, among other things, but not exclusively, on address data. You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may nevertheless remain entitled to process your personal data if this is necessary for contractual payment processing.

 

PayPal

One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you select a payment method offered by the provider in which you pay in advance, your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose. If you select a payment method in which we pay in advance, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, phone number, and, where applicable, data on an alternative payment method). In order to safeguard our legitimate interest in verifying your creditworthiness in such cases, this data is forwarded by us to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. Based on the personal data you provide as well as additional data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment method you selected can be granted in view of payment and/or default risks. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values is based, among other things, but not exclusively, on address data. You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may nevertheless remain entitled to process your personal data if this is necessary for contractual payment processing.

 

Shopify Payments

One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. If you select a payment method offered by the provider in which you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

 

SOFORT

One or more online payment methods from the following provider are available on this website: SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany. If you select a payment method offered by the provider in which you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

 

Stripe

One or more online payment methods from the following provider are available on this website: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. If you select a payment method offered by the provider in which you pay in advance (e.g. credit card payment), your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data is passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose. If you select a payment method in which the provider pays in advance (e.g. purchase on account, installment purchase, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, phone number, and, where applicable, data on an alternative payment method). In order to safeguard our legitimate interest in verifying our customers' creditworthiness, this data is forwarded by us to the provider pursuant to Art. 6(1)(f) GDPR for the purpose of a credit check. Based on the personal data you provide as well as additional data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment method you selected can be granted in view of payment and/or default risks. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values is based, among other things, but not exclusively, on address data. You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may nevertheless remain entitled to process your personal data if this is necessary for contractual payment processing.


7) Web Analytics

7.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables analysis of your use of our website. By default, when you visit the website, Google Analytics 4 sets cookies, which are stored as small text files on your device and collect certain information. This information includes your IP address, which is, however, shortened by Google (the last digits removed) to rule out direct personal identifiability. The information is transmitted to Google's servers and further processed there. Transfers to Google LLC, headquartered in the USA, are also possible in this context. Google uses the collected information on our behalf to evaluate your use of the website, compile reports on website activity for us, and provide other services related to website and internet usage. The shortened IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. Data collected as part of the use of Google Analytics 4 is stored for a period of two months and then deleted. All processing described above, in particular the setting of cookies on the device used, only takes place if you have given us your explicit consent pursuant to Art. 6(1)(a) GDPR. Without your consent, Google Analytics 4 will not be used during your visit to the site. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the "cookie consent tool" provided on the website. We have concluded a data processing agreement with Google that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://policies.google.com/privacy?hl=de&gl=de and https://policies.google.com/technologies/partner-sites


7.2 Data

Demographic Characteristics

Google Analytics 4 uses the special "demographic characteristics" feature and can use it to generate statistics that make statements about the age, gender, and interests of website visitors. This is done through the analysis of advertising and information from third-party providers. This allows target groups for marketing activities to be identified. However, the data collected cannot be attributed to a specific person and is deleted after being stored for a period of two months.

 

Google Signals

As an extension to Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have enabled personalized ads and linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR, analyze your usage behavior across devices and create database models, including for cross-device conversions. We do not receive personal data from Google, only statistics. If you want to stop cross-device analysis, you can disable the "Personalized advertising" feature in your Google account settings. To do so, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=de

Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

 

UserIDs

As an extension to Google Analytics 4, this website may use the "UserIDs" feature. If you have consented to the use of Google Analytics 4 pursuant to Art. 6(1)(a) GDPR, have set up an account on this website, and log in with this account on various devices, your activities, including conversions, may be analyzed across devices. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision of the European Commission, ensures compliance with the European level of data protection.

 

7.3 Meta Pixel

Within our online offering, we use the "Meta Pixel" service provided by the following provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Meta"). If a user clicks on an advertisement we have placed on Facebook and/or Instagram, "Meta Pixel" adds a parameter to the URL of our linked page. This URL parameter is then entered into the user's browser after redirection via a cookie set by our linked page itself. This makes it possible for Meta to determine the visitors to our online offering as a target group for the display of advertisements ("ads"). Accordingly, we use the service to display our Facebook and/or Instagram ads only to users who have shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products, determined based on the websites visited) that we transmit to Meta ("custom audiences"). On the other hand, "Meta Pixel" can be used to track whether users were redirected to our website after clicking on an advertisement and what actions they took there ("conversion tracking"). The data collected is anonymous to us, meaning it provides us with no insight into the identity of the users. However, the data is stored and processed by Meta, so a connection to the respective user profile is possible, and Meta can use the data for its own advertising purposes. All the processing described above, in particular the setting of cookies to read information on the device used, is only carried out if you have given us your explicit consent pursuant to Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "cookie consent tool" provided on the website. We have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties. The information generated by Meta is generally transmitted to and stored on a Meta server; this may also involve transmission to Meta Platforms Inc. servers in the USA. For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision of the European Commission, ensures compliance with the European level of data protection.


8) Tools

8.1 Consent Tool

This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications requiring consent. The "cookie consent tool" is displayed to users when they access the page in the form of an interactive user interface, on which consent can be given for certain cookies and/or cookie-based applications by ticking boxes. By using the tool, all cookies/services requiring consent are only loaded if the respective user has given the appropriate consent by ticking the box. This ensures that such cookies are only set on the respective user's device if consent has been given. The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context. If, in individual cases, personal data (such as the IP address) is nevertheless processed for the purpose of storing, assigning, or logging cookie settings, this is done pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in legally compliant, user-specific, and user-friendly consent management for cookies and thus in the legally compliant design of our website. Art. 6(1)(c) GDPR is a further legal basis for processing. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user's consent. Where necessary, we have concluded a data processing agreement with the provider that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties. Further information on the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

 

8.2 Microsoft Clarity

We work with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website using behavioral metrics, heatmaps, and session recordings. The goal is to improve and market our products and services. Website usage data is collected using first-party and third-party cookies as well as other tracking technologies to analyze the popularity of products/services and online activities. In addition, we use this information to optimize the website, for security and fraud prevention purposes, and for advertising purposes. Further information on how Microsoft collects and uses your data can be found in Microsoft's privacy policy.

 

9) Data Subject Rights

9.1 Applicable data protection law grants you comprehensive data subject rights vis-à-vis the controller regarding the processing of your personal data, which we inform you of below:

  • Right of access pursuant to Art. 15 GDPR: In particular, you have the right to obtain information about your personal data processed by us, the processing purposes, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it was not collected by us from you, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the significance and intended effects of such processing for you, as well as your right to be informed about which safeguards exist pursuant to Art. 46 GDPR when your data is transferred to third countries;
  • Right to rectification pursuant to Art. 16 GDPR: You have the right to have inaccurate data concerning you corrected without delay and/or to have incomplete data stored by us completed;
  • Right to erasure pursuant to Art. 17 GDPR: You have the right to request the erasure of your personal data if the conditions of Art. 17(1) GDPR are met. However, this right does not apply, in particular, if the processing is necessary for the exercise of the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims;
  • Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of the data disputed by you is being verified, if you refuse to have your data erased due to unlawful processing and instead request the restriction of the processing of your data, if you need your data to assert, exercise, or defend legal claims after we no longer need this data once its purpose has been achieved, or if you have objected on grounds relating to your particular situation and it is not yet clear whether our legitimate reasons override yours;
  • Right to be informed pursuant to Art. 19 GDPR: If you have exercised your right to rectification, erasure, or restriction of processing vis-à-vis the controller, the controller is obliged to inform all recipients to whom your personal data has been disclosed of this rectification, erasure, or restriction of processing, unless this proves impossible or involves disproportionate effort. You have the right to be informed of these recipients.
  • Right to data portability pursuant to Art. 20 GDPR: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request its transfer to another controller, insofar as this is technically feasible;
  • Right to withdraw consent given pursuant to Art. 7(3) GDPR: You have the right to withdraw consent given for the processing of data at any time with effect for the future. In the event of withdrawal, we will delete the affected data without delay, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of processing carried out based on the consent up to the point of withdrawal;
  • Right to complain pursuant to Art. 77 GDPR: If you believe that the processing of personal data concerning you violates the GDPR, you have the right — without prejudice to any other administrative or judicial remedy — to lodge a complaint with a supervisory authority, in Austria the Data Protection Authority (Datenschutzbehörde).

 

9.2 Right to Object

If your personal data is processed based on our overriding interest, you have the right to object to this processing at any time with effect for the future. However, further processing remains reserved if there are compelling reasons for further processing.

 

10) Duration of Storage of Personal Data

The duration of storage of personal data is based on the respective legal basis, the processing purpose, and — where applicable — additionally on the respective statutory retention period (e.g. corporate and tax law retention periods).

When personal data is processed based on explicit consent pursuant to Art. 6(1)(a) GDPR, this data is stored until the data subject withdraws their consent.

Where statutory retention periods exist for data processed within the framework of contractual or quasi-contractual obligations based on Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer required for contract fulfillment or contract initiation and/or we no longer have a legitimate interest in continued storage.

When personal data is processed for direct marketing purposes based on Art. 6(1)(f) GDPR, this data is stored until the data subject exercises their right to object pursuant to Art. 21(2) GDPR. Unless otherwise indicated by the other information in this policy regarding specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.