Data protection policy

General Information

Thank you for your interest in our website. The security of personal data is a serious and important corporate concern for us. When you visit our website, our web servers automatically store the IP address of your Internet service provider, the website from which you are visiting us, the pages you visit on our site, as well as the date and duration of your visit. This information is strictly necessary for the technical transmission of the web pages and secure server operation.
Data Controller/Data Protection Officer within the meaning of the General Data Protection Regulation (GDPR)

Schaller GmbH
represented by Managing Director - Owner Dr. Lars Bünning
An der Heide 15
92353 Postbauer Heng - Germany

Tel.: +49 9180 910-0
Email: mail@schaller.info

General Information on Data Processing

Personal Data

Personal data refers to information about you as an individual. This includes your name, address, and email address. You are not required to provide any personal data in order to visit our website. In some cases, we need your name and address, as well as additional information, in order to provide you with the service you have requested.
The same applies if we provide you with informational materials upon request or if we respond to your inquiries. In these cases, we will always inform you accordingly. Furthermore, we only store the data that you have provided to us automatically or voluntarily.
When you use one of our services, we generally collect only the data necessary to provide you with that service. We may ask you for additional information, but this is voluntary. Whenever we process personal data, we do so to provide you with our service or to pursue our commercial objectives.

Unsolicited Contact by the Customer via Email

If you contact us on your own initiative via email, we will collect your personal data (name, email address, message text) only to the extent that you provide it. The data processing serves to process and respond to your contact request. If the contact serves to carry out pre-contractual measures (e.g., consultation regarding purchase interest, preparation of an offer) or relates to a contract already concluded between you and us, this data processing is based on Article 6(1)(b) of the GDPR. If the contact is made for other reasons, this data processing is based on Article 6(1)(f) of the GDPR, based on our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(f) of the GDPR.
We use your email address solely to process your inquiry. Your data will subsequently be deleted in accordance with statutory retention periods, unless you have consented to further processing and use.

Creating a Customer Account with Order Processing

We collect and store the data you provide during registration (e.g., name, address, email address, password) in order to set up a password-protected customer account for you. This allows you to process future purchases more quickly and view your order history. We use the data collected as part of an order (payment details, shipping address) exclusively for the fulfillment of the contract, i.e., to process, deliver, and bill your order. The processing of data for the customer account is based on your consent (Art. 6(1)(a) GDPR). The processing of order data is carried out to fulfill the purchase contract (Art. 6(1)(b) GDPR).

Sharing of Data for Contract Fulfilment

Your data will only be shared with service providers that are strictly necessary for contract processing (e.g., shipping companies such as DPD, DHL, FedEx, GLS, UPS, and payment service providers such as PayPal, Apple Pay, or banks). Data in your customer account will remain stored for as long as the account exists. Order data is also subject to statutory retention periods (generally 10 years under commercial and tax law). You have the right at any time to request information about, correct, or delete your stored data free of charge. You can delete your customer account yourself at any time or request that we do so. To do so, simply send a message to the contact address listed above.

Collection and Processing of Personal Data for Unsolicited Applications

When you submit an unsolicited application, we use your data to match it with current and future vacancies in relevant departments. The processing of your personal data is based on Article 6(1)(b) of the GDPR in conjunction with Section 26(1) of the BDSG for the purpose of carrying out pre-contractual measures (completion of the application process as a preliminary step toward an employment contract). We collect your data only to the extent you provide it. We process your application documents (name, address, contact information, resume, references, cover letter) as well as all data you provide to us during the interview. Your data will be shared exclusively within the scope of the application process with the relevant HR staff and managers of the departments that may be of interest to you. Your data will not be shared with third parties outside the company.
If we are unable to offer you a suitable position, your data will be deleted no later than six months after the application process, provided you have not consented to further processing and use. You have the right at any time to access, correct, delete, or restrict the processing of your data, as well as the right to data portability. In addition, you may withdraw your consent to the storage of your data at any time with future effect. If an employment relationship is established following the application process, the data provided will be further processed on the basis of Art. 6(1)(b) GDPR in conjunction with § 26(1) BDSG for the purposes of carrying out the employment relationship and subsequently transferred to the personnel file.

Automatically Stored Non-Personal Data

Storage of Access Data in Server Log Files

The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. This information includes:

Date and time of the request
Name of the requested file
Page from which the file was requested
Access status (file transferred, file not found, etc.)
Web browser and operating system used
Full IP address of the requesting computer
Amount of data transferred

This data is not combined with other data sources. Processing is carried out in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.
For technical security reasons, in particular to defend against attempted attacks on our web server, we store this data temporarily. It is not possible for us to identify individual persons based on this data. After no later than seven days, the data is anonymized by truncating the IP address at the domain level, so that it is no longer possible to establish a connection to the individual user. In anonymized form, the data is also processed for statistical purposes; no comparison with other data sets or disclosure to third parties, even in excerpts, takes place.

Use of Cookies

We would like to inform you that technical cookies are necessary for the operation of this website. Cookies are small files that are transmitted from a web server to your browser and stored on your hard drive. The legal basis for the use of cookies is Article 6(1)(f) of the GDPR. Only the IP address is stored here—no other personal data. This information, which is stored in the cookies, allows us to automatically recognize you the next time you visit our website, thereby making it easier for you to use.
Of course, you can also visit our website without accepting cookies. If you do not want your computer to be recognized on your next visit, you can also refuse the use of cookies by changing the settings in your browser to “Reject cookies.” You can find the specific procedure in the user manual for your browser. However, if you refuse the use of cookies, this may result in restrictions on the use of certain areas of our websites.

Use of Your Email Address for Sending Newsletters

We use your email address solely for our own promotional purposes to send newsletters, regardless of the fulfillment of the contract, provided that you have expressly consented to this. Processing is based on Article 6(1)(a) of the GDPR with your consent. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to withdrawal. To do so, you may unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the distribution list.

Use of CleverReach for Newsletter Distribution

We use the services of CleverReach GmbH & Co. KG (Schafjückenweg 2, 26180 Rastede; “CleverReach”) for newsletter distribution under a data processing agreement.
We forward the information you provided during newsletter registration (email address, first and last name if applicable) to CleverReach. Data processing serves the purpose of sending the newsletter and its statistical analysis. To evaluate newsletter campaigns, the newsletters sent contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This allows us to determine whether you have opened the newsletter and whether you have clicked on any embedded links. Through conversion tracking, we are able to analyze whether, for example, a purchase was made after clicking a link in the newsletter or whether you registered on our website. In this context, we collect your personal data, such as your IP address, browser type, device, and the time of access. Usage profiles may be created from this data under a pseudonym. The collected data is not used to identify you personally. The collected data is used solely for statistical analysis to improve newsletter campaigns.
Your personal data is processed on the basis of Article 6(1)(f) of the GDPR, based on our legitimate interest in maintaining a targeted, effective, and user-friendly newsletter system. You have the right to object at any time to the processing of your personal data for reasons arising from your particular situation.

Use of Email for Advertising Without Consent (Existing Customer Relationship)

Pursuant to Section 7(3) of the UWG (Unfair Competition Act), a company may send email advertising to existing customers without consent if all of the following conditions are met: The customer provided their email address as part of a sales contract (for goods or services). Advertising is limited to the company’s own, similar goods or services. The customer has not objected to the use of their email address for advertising purposes (no objection). When the email address is collected (e.g., during checkout in the online store) and each time it is used (in every email), the customer must be clearly and unambiguously informed of their right to object (duty to inform).

Use of Shopware Analytics

We use the “Shopware Analytics” analysis tool from shopware AG, Ebbinghoff 10, 48624 Schöppingen, on our website. This tool is used to statistically analyze shop usage in order to continuously improve our offerings and the user experience. Usage data is collected (e.g., which pages were visited, duration of visit, click paths), which, according to the provider, is processed in an anonymized form so that no conclusions can be drawn about your identity. It is used to analyze user behavior to optimize the online shop and to measure the reach and effectiveness of shop functions. Data processing is based on your explicit consent in accordance with Art. 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect by adjusting your preferences in your browser’s Cookie Consent Manager. You can find the specific procedure in the user manual for your browser. However, if you refuse the use of cookies, this may result in restrictions on the use of certain areas of our websites.

Use of YouTube

We use the YouTube video embedding feature provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”) on our website. YouTube is an affiliate of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”). This feature displays videos stored on YouTube in an iFrame on the website. The “Enhanced Privacy Mode” option is enabled. As a result, YouTube does not store any information about website visitors. Information is only transmitted to YouTube and stored there once you watch a video. Your data may be transferred to the United States. An adequacy decision by the EU Commission exists for the United States: the Trans-Atlantic Data Privacy Framework (TADPF). YouTube has obtained TADPF certification and is thus committed to complying with European data protection principles. The use of cookies or similar technologies is based on your consent pursuant to Section 25(1) sentence 1 TDDDG in conjunction with Article 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Article 6(1)(a) of the GDPR. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent prior to withdrawal. For more information about how YouTube and Google collect and use data, your rights in this regard, and ways to protect your privacy, please refer to YouTube’s Privacy Policy.

Privacy Notice Regarding Payment Processing

We use various payment service providers to enable secure and efficient payment processing. This involves the processing of personal data. The legal basis for this is Article 6(1)(b) of the GDPR, as the processing is necessary for the performance of the purchase contract.

PayPal (Europe) S.à r.l. et Cie, S.C.A.

When you select payment methods via PayPal (PayPal, direct debit, credit card, purchase on account), we transmit your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg for payment processing. PayPal reserves the right to obtain a credit check for selected payment methods (e.g., purchase on account, installment payments) to safeguard its legitimate interest in determining creditworthiness (Art. 6(1)(f) GDPR). The result of the credit check may be used in the form of “score values.” For more information, please refer to the Privacy Policy on the PayPal website.

Apple Pay (Apple Distribution International Ltd.)

When you use Apple Pay, payments are processed using the cards stored in your Apple Wallet. We do not receive any credit card numbers. Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland processes data for verification and payment processing. For more information, please refer to the privacy policy on the Apple Pay website.

Credit Card Payment: Directly via Payment Service Provider (PSP)

When paying by credit card (Mastercard, Visa) via Stripe, Adyen, Mollie, or similar providers, your data (name, credit card number, expiration date, CVV) is transmitted directly to the respective Payment Service Provider (PSP). The PSP acts as an independent data controller to prevent fraud and authorize the payment. The transmission is encrypted (TLS) for security purposes. The privacy policies of the respective providers apply; you can view these on their websites.

Third-party payment methods (e.g., Klarna, Sofort, Giropay)

If you select payment methods such as Sofortüberweisung (Klarna) or EPS, data will be transmitted to the respective provider. When using Klarna services, Klarna processes data for transaction processing and credit checks. The privacy policies of the respective provider apply, which you can view on their websites.

Your rights

You have the right at any time to access, correct, delete, or restrict the processing of your data, as well as the right to object to the processing (Art. 21 GDPR). Please contact the respective payment service provider for this purpose.

Credit Check and Scoring

If we provide goods or services in advance (e.g., when purchasing on account), we reserve the right to obtain identity and credit information from specialized service providers (credit bureaus) to protect our legitimate interests (Art. 6(1)(f) GDPR). To this end, we transmit your personal data required for a credit check (name, address, date of birth) to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden. The credit bureau uses the aforementioned data to perform a corresponding assessment of your creditworthiness (scoring) based on mathematical-statistical methods. Your address data, among other things, is included in the calculation of the score. We use the result of the credit check regarding the statistical probability of default exclusively to decide whether to provide the desired payment method. You may object to this processing at any time; however, this may result in our being unable to offer you certain payment methods.

Data Subject Rights, Retention Period, and Contact Information

Retention Period

Once the contract has been fully executed, the data will initially be stored for the duration of the warranty period. Thereafter, it will be retained in accordance with statutory retention periods, particularly those under tax and commercial law, and will be deleted upon expiration of these periods, unless you have consented to further processing and use.

Rights of the Data Subject

Within the framework of applicable legal provisions, you have the right at any time to:

Access your stored personal data, its origin and recipients, as well as the purpose of data processing (Art. 15 GDPR).
Rectification of inaccurate data or completion of your data stored with us (Art. 16 GDPR).
Erasure of your data stored by us, provided there is no legitimate reason for further retention (Art. 17 GDPR).
Restriction of processing if we are not yet permitted to erase your data due to legal obligations (Art. 18 GDPR).
Data portability, to receive your data in a commonly used format or to transfer it to another controller (Art. 20 GDPR).
Objection to the future processing of your data (Art. 21 GDPR) as well as withdrawal of consent once given.

Contacting Us

If you have any questions, comments, or complaints, or if you wish to exercise your rights as a data subject in connection with this Privacy Notice and the processing of your personal data, you can contact us directly via the email address provided above.

Right to lodge a complaint with the supervisory authority

Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.
You may lodge a complaint with, among others, the supervisory authority responsible for us, which you can reach at the following contact details:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Tel.: +49 981 1800930
Fax: +49 981 180093800
E-Mail: poststelle@lda.bayern.de

Right to Object

If the processing of personal data described here is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation, with effect for the future.
Once an objection has been lodged, the processing of the data in question will cease, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

As of: May 8, 2026