Privacy Policy

Information on Data Protection

This privacy policy informs you about how we handle your data. To make the processing of your data understandable for you, we would like to provide you with an overview of these processes with the following information. To ensure fair processing, this privacy policy includes general information about how we handle your data as well as information about your rights under the European General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

We also provide you with detailed information on:

I. General Information 

II. Data processing on our website and marketplace 

III. Data processing on our social media pages

Responsible for data processing is Grit and Grind, represented by Peter Stein (hereinafter referred to as "we" or "us").

I. General Information

1. Contact

If you have questions or suggestions regarding this information, or if you wish to assert your rights and contact us, please direct your inquiry to:

Peter Stein

Weinstr. 98

76829 Ranschbach

Email: contact@grit-and-grind-com

2. Legal Bases

The data protection term "personal data" refers to all information relating to a specific or identifiable individual.

We process personal data in accordance with the relevant data protection regulations, especially the GDPR and the BDSG. Any data processing by us only takes place based on legal permission. We process personal data only with your consent (Art. 6 para. 1 letter a) GDPR), for the fulfillment of a contract to which you are a party, or upon your request for the implementation of pre-contractual measures (Art. 6 para. 1 letter b) GDPR), for compliance with a legal obligation (Art. 6 para. 1 letter c) GDPR), or if processing is necessary to safeguard our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights and freedoms, which require the protection of personal data, do not prevail (Art. 6 para. 1 letter f) GDPR).

3. Duration of Storage

Unless otherwise stated in the following notes, we store data only as long as is necessary to achieve the purpose of processing or to fulfill our contractual or legal obligations. Such statutory retention obligations can particularly arise from commercial or tax-related provisions.

4. Recipients of Data

We employ appointed service providers for specific processing tasks. These include, for example, hosting, maintenance, and support of IT systems, marketing initiatives, or the destruction of files and data carriers. These service providers process the data only upon explicit instruction and are contractually bound to ensure appropriate technical and organizational measures for data protection. Besides, we may, if necessary, transfer personal data of our customers to entities such as postal and delivery services, payment and information services, our main bank, tax consultants/auditors, or financial authorities.

5. Processing in the Exercise of Your Rights Pursuant to Art. 15 to 22 GDPR

When you exercise your rights in accordance with Articles 12 to 22 GDPR, we process the transmitted personal data for the purpose of implementing these rights on our part and to be able to provide evidence thereof. For the purpose of providing information and its preparation, data we store will only be processed for this purpose and for data protection control purposes, while otherwise restricting processing in accordance with Art. 18 GDPR.

These processing activities are based on the legal foundation of Art. 6 para. 1 letter c) GDPR in conjunction with Art. 15 to 22 GDPR and § 34 para. 2 BDSG.

6. Your Rights

As a data subject, you have the right to assert your rights with respect to us. In particular, you have the following rights:

• In accordance with Art. 15 GDPR and § 34 BDSG, you have the right to request information as to whether and to what extent we process personal data relating to you or not.

• In accordance with Art. 16 GDPR, you have the right to request the correction of your data from us.

• In accordance with Art. 17 GDPR and § 35 BDSG, you have the right to request the deletion of your personal data from us.

• In accordance with Art. 18 GDPR, you have the right to request the restriction of the processing of your personal data.

• In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit this data to another controller.

• If you have given us separate consent to data processing, you can revoke this consent at any time in accordance with Art. 7 para. 3 GDPR. Such a revocation does not affect the legality of the processing carried out based on the consent until the revocation.

• If you believe that the processing of personal data concerning you violates the provisions of the GDPR, in accordance with Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority.

7. Right to Object

In accordance with Art. 21 para. 1 GDPR, you have the right to object to processes based on the legal basis of Art. 6 para. 1 letter e) or f) GDPR, for reasons arising from your particular situation. If we process personal data about you for the purpose of direct marketing, you can object to this processing according to Art. 21 para. 2 and para. 3 GDPR.

8. Data Protection Officer

You can reach our data protection officer at the following contact details:

contact@grit-and-grind.com

II. Data processing on our website 

When using the website and the platform, we collect information that you provide yourself. Furthermore, specific information about your use of the website is automatically recorded by us during your visit. In terms of data protection law, the IP address is generally also considered personal data. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.

1. Processing of Server Log Files

During the purely informational use of our website, general information is automatically saved (i.e., not through registration) which your browser transmits to our server. These typically include: browser type/version, operating system used, accessed page, previously visited page (referrer URL), IP address, date and time of the server request, and HTTP status code. The processing is carried out to safeguard our legitimate interests and is based on Art. 6 Para. 1 Letter f) GDPR. This processing serves the technical administration and security of the website. The stored data is anonymized immediately after collection, so no personal data is stored. We are not able to identify you as an affected person based on the stored information. Art. 15 to 22 GDPR therefore do not apply in accordance with Art. 11 Para. 2 GDPR, unless you provide additional information to exercise your rights as set out in these articles, enabling your identification.

2. Data transfer to third countries

Visiting our website may involve the transfer of certain personal data to third countries, i.e., countries in which the GDPR is not applicable law. Such a transfer is permitted if the European Commission has determined that an adequate level of data protection is provided in such a third country.
If the European Commission has not made such a decision, personal data will only be transferred to a third country if the requirements of Art. 46 GDPR are met or if one of the conditions of Art. 49 GDPR exists.
Unless stated otherwise, we use the EU standard contractual clauses for the transfer of personal data to processors in third countries as appropriate guarantees: https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=CELEX%3A32010D0087.

3. Contact Form

Our website contains a contact form through which you can send us messages. The transfer of your data takes place encrypted (recognizable by the "https" in the browser's address bar). All data fields marked as mandatory are required to process your request. Failure to provide this will mean we cannot process your request. Providing further data is voluntary. Alternatively, you can also send us a message via the contact email. We process the data for the purpose of responding to your request. If your request relates to the conclusion or execution of a contract with us, Art. 6 Para. 1 Letter b) GDPR is the legal basis for data processing. Otherwise, we process the data based on our legitimate interest in contacting interested parties. The legal basis for data processing is then Art. 6 Para. 1 Letter f) GDPR.

4. Cookies

We use cookies on our website and the marketplace. Cookies are small text files that are stored by your browser when you visit a website. This identifies the browser used and can be recognized by our web server. If this use of cookies results in the processing of personal data, this is based on the legal basis of Art. 6 Para. 1 Letter f) GDPR. This processing serves our legitimate interest in making our website and marketplace more user-friendly, efficient, and secure. We use so-called "session cookies", which are deleted when the browser session ends. Other cookies ("persistent cookies") are automatically deleted after a specified period, which can vary depending on the cookie. You can delete the cookies in your browser's security settings at any time. You can object to the use of cookies in your browser settings in general or for specific cases. Further information on this is provided by the Federal Office for Information Security at https://www.bsi-fuer-buerger.de/BSIFB/DE/Empfehlungen/EinrichtungSoftware/EinrichtungBrowser/Sicherheitsmassnahmen/Cookies/cookies_node.html.

If the use of cookies is enabled on our website, you will be informed about it via a so-called consent banner, giving you the opportunity to object to the use of cookies.

5. Google Analytics

We use the Google Analytics service from Google Ireland Limited (Ireland/EU) to evaluate our website and marketplace visits. Google uses cookies that enable an analysis of your use of our website and the marketplace. In this context, personal data in the form of online identifiers (including cookie IDs), IP addresses, device identifiers, and information about the interaction with our website are processed. The information generated by the cookie about users' use of our website and the marketplace is usually transferred to a Google server in the USA and stored there. Google will use this information on our behalf to evaluate the use of our online offer by users, to compile reports on the activities within our website and the marketplace, and to provide us with other services related to the use of our website and marketplace and the use of the internet. Pseudonymous user profiles can be created from the processed data.

We only use Google Analytics with activated IP anonymization. This means that Google will shorten the IP address of users within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. The IP address transmitted by the user's browser is not merged with other Google data.

The setting of cookies and the further processing of personal data described here takes place with your consent. The legal basis for data processing in connection with the Google Analytics service is therefore Art. 6 Para. 1 Letter a) GDPR. You can prevent the storage of cookies by Google Analytics by adjusting our cookie settings accordingly. You can also prevent the collection of the information generated by the cookie by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout. Please also note that we document any consent you give in order to meet our obligation to provide evidence under Art. 7 Para. 1 GDPR. As we are obligated to do this, this storage is based on the legal basis of Art. 6 Para. 1 Letter c) GDPR.

When using Google Analytics, we cannot exclude a transfer of the processed data to Google LLC based in the USA. Google LLC (USA) is certified under the EU-US Privacy Shield.

6. Facebook Pixel (Conversion und Custom Audience)

We use the Facebook Pixel on our online presence, a service provided by Facebook Inc. (USA) or, if you are based in the EU, Facebook Ireland Ltd. (Ireland/EU) (“Facebook”). When you access our website and marketplace, the Facebook Pixel is triggered and may store a so-called cookie, a small file, on your device. Through this, we can execute various functions, which are detailed below.

Should personal data be transmitted to the USA in the context of these functions, Facebook is certified under the EU-US Privacy Shield.

Function: Conversion-Tracking

With the help of the Facebook Pixel, we can track users' behavior after they have been redirected to the provider's website by clicking on a Facebook ad (so-called "Conversion"). This allows us to gauge the effectiveness of Facebook ads for statistical and market research purposes. The data collected in this way is anonymous to us, meaning we don't see the personal data of individual users. However, Facebook stores and processes this data, and we inform you of this based on our knowledge. Facebook can link this data to your Facebook account and use it for its advertising purposes, in accordance with Facebook's data usage policy: https://www.facebook.com/about/privacy/. A cookie may also be stored on your computer for these purposes.

If you log into Facebook or visit Facebook while logged in, our online offer's visit will be noted in your profile. The data collected about you remains anonymous to us but is stored and processed by Facebook, enabling a link to the respective user profile and use by Facebook for its market research and advertising purposes.

This processing aims to obtain information about the effectiveness of Facebook ads. It is based on your consent, pursuant to Art. 6 Para. 1 Letter a) GDPR.

You can also object to the collection by the Facebook Pixel and the use of your data to display Facebook Ads at the following address: https://www.facebook.com/settings?tab=ads.

Function: Custom Audience

Through the Facebook Pixel, we also use the Custom Audience service. Here, Facebook captures our website visitors and their data to target them with ads (Facebook Ads) based on the information obtained via the Pixel. This process includes transmitting general session browser information to Facebook and a non-reversible, non-personal checksum (hash value) derived from your Facebook ID.

Additionally, we use the "Extended Match" mode within the Custom Audience function. In this context, specific data you enter on our website is encrypted as a hash value and transferred to Facebook. This data can then be matched by Facebook with the corresponding hash values of data provided by its users. This way, it's determined which of our customers are also Facebook users to display targeted ads to them on the Facebook platform.

Details regarding Facebook's handling of your data, as well as your rights and settings options to protect your personal data, can be found in Facebook's data protection notes: https://www.facebook.com/privacy/explanation.

This processing aims to market our offers through targeted advertising and is based on your consent, pursuant to Art. 6 Para. 1 Letter a) GDPR. You can withdraw your consent by changing the "Cookie Settings" and revoking your consent.

Moreover, if you wish to object to the use of Facebook Website Custom Audiences as a Facebook user in the future ("Opt Out"), you can do so at https://www.facebook.com/ads/website_custom_audiences.

III. Data processing on our social media channels

We are present on various social networks to connect with you and inform you about our services and offers. Below, we inform you about the processing of personal data in the context of using these networks.

Our presence on:

• Facebook
• Instagram
• YouTube
• Tiktok
• Twitter

means that we, along with the provider of the social network, are responsible for the data processing that takes place when visiting our company pages on these platforms.

Data collection during the visit of our social media presences:

When you visit one of our profiles on these platforms or interact with it, your personal data may be processed. Additionally, the information shared during your interactions using your profile can be treated as personal data. This includes comments, shared content, messages, and associated metadata. Furthermore, social network operators collect data on user behavior and interests during your visit to show you targeted advertising both within and outside of the platforms. Typically, cookies that store data about your user behavior are set on your device.

It should be noted that data processing by social networks can also take place outside the European Union. However, most companies have committed to the data protection provisions of the EU-US Privacy Shield.

1. Data Processing During a Visit to a Social Media Page

a) Facebook and Instagram Pages

Upon visiting our Facebook or Instagram page, where we represent our company or specific products from our portfolio, certain information about you is processed. The sole entity responsible for this data processing is Facebook Ireland Ltd (Ireland/EU - "Facebook"). For more information about how Facebook processes personal data, please visit https://www.facebook.com/privacy/explanation.

Facebook provides the option to object to certain data processing. Information and opt-out options can be found at https://www.facebook.com/settings?tab=ads.

For our Facebook and Instagram pages, Facebook provides us with anonymized statistics and insights that give us information about the types of actions people take on our page (known as "Page Insights"). These Page Insights are based on specific information about individuals who have visited our page. This processing of personal data is done by both Facebook and us as joint controllers. The processing serves our legitimate interest to evaluate the types of actions performed on our page and to improve our page based on these insights. The legal basis for this processing is Art. 6 (1) letter f) DSGVO (GDPR). We cannot associate the information obtained from Page Insights with individual Facebook profiles that interact with our Facebook page. We have an agreement with Facebook regarding processing as joint controllers, which defines the distribution of data protection obligations between us and Facebook. Details about the processing of personal data for the creation of Page Insights and the agreement between us and Facebook can be found at https://www.facebook.com/legal/terms/information_about_page_insights_data. With regard to these data processing activities, you have the opportunity to assert your rights (see "Your Rights") against Facebook. Further information can be found in Facebook's privacy policy at https://www.facebook.com/privacy/explanation.

Please note that according to Facebook's privacy policy, user data may also be processed in the USA or other third countries. Facebook only transfers user data to countries that have received an adequacy decision from the European Commission in accordance with Art. 45 DSGVO (GDPR) or based on appropriate guarantees under Art. 46 DSGVO. The Facebook Inc. is certified under the EU-US Privacy Shield and thus offers an adequate level of data protection in accordance with Art. 45 DSGVO.

b) YouTube

For the processing of personal data when visiting our YouTube channel, Google Ireland Limited (Ireland/EU) is generally the sole responsible entity. For further information on how YouTube or Google Ireland Limited processes personal data, please visit https://policies.google.com/privacy.

2. Processing of Data that You Share with Us on Our Corporate Pages

We also process information that you provide to us via our corporate page on the respective social media platform. Such information can include the username used, contact details, or a message to us. We typically process this personal data only if we have expressly asked you beforehand to share this data with us, for example, as part of a survey or a contest. We are the sole controller for these data processing activities.

We process this data based on our legitimate interest to communicate with those making inquiries. The legal basis for this data processing is Art. 6 (1) letter f) DSGVO (GDPR).

Additionally, we might process such shared data for evaluation and marketing purposes. These processing activities are based on the legal foundation of Art. 6 (1) letter f) DSGVO and serve our interest in further developing our offering and informing you specifically about offers from [Sample LLC]. Further data processing may take place if you have given your consent (Art. 6 (1) letter a) DSGVO) or if it is necessary for the fulfillment of a legal obligation (Art. 6 (1) letter c) DSGVO).

If you provided us with the information due to participation in a contest, we process this data solely to possibly send you a prize. After delivering the prize, or if you did not win, we will delete the data. The legal basis for this processing is Art. 6 (1) letter b) DSGVO.