Privacy Policy

This privacy policy was written in German. Versions in other languages are automatically generated translations. In the event of deviations or discrepancies between the translation and the German original, the German version is the legally binding version.

expondo GmbH attaches great importance to the protection of privacy and complies with the statutory data protection provisions, in particular the Datenschutzgrundverordnung (hereinafter “DSGVO”) and the Bundesdatenschutzgesetz (“BDSG”).

Below we explain how we handle your personal data when you use our website. Personal data comprises all data that can be related to you (hereinafter “personal data”).

1 Who is responsible?

1.1 The following informs you about the handling of your personal data when using our website. Personal data means all data by which you can be personally identified.

1.2 The party responsible for data processing on this website within the meaning of the DSGVO is expondo GmbH, Dessauer Str. 28-29, 10963 Berlin, Germany, contact: www.expondo.ie/contact/. The person responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2 Data Protection Officer

The controller has appointed a Data Protection Officer, who can be contacted as follows:

Dr Sebastian Kraska

Marienplatz 2

80331 München

+49 (0) 8918917360

[email protected]

3 Categories of personal data that we collect about you in various processing situations

When you visit our website (our app, our blog or our social media accounts), we collect personal data that fall into the following categories:

3.1 When visiting our website:

• the website(s) visited
• date and time of access
• amount of data sent in bytes
• source/referrer from which you reached the site
• browser used
• operating system used
• IP address used (where applicable in anonymised form)

3.2 When contacting us:

• date and time of the call
• duration of the conversation
• anonymised telephone number of the caller or the called party
• recording of the telephone conversation upon explicit consent, which can be withdrawn at any time
• personal data when contacting us via contact form or email

3.3 When opening a customer account and for contract processing:

• personal data that you provide for the performance of a contract or when opening a customer account (as can be seen from the respective input forms)

3.4 For direct marketing:

• email address used
• personal data
• IP address used (where applicable in anonymised form)
• date and time of registration

3.5 For order processing:

• Disclosure of personal data to service providers for order processing and fulfilment
• Disclosure of personal data to shipping service providers
• Disclosure of personal data to payment service providers (payment services)

3.6 Contact for review reminder:

• Email address

4 Purposes for which we process your personal data

We use the personal data that we collect via our websites for the following purposes:

• to administer our website, for internal operations, including troubleshooting, data analysis, testing, statistics and surveys,
• to improve our websites,
• for marketing and advertising,
• for the purpose of creating a customer account,
• to contact you,
• to process payments by us or our cooperation partners,
• for fraud checks by us or our cooperation partners, as well as
• for participation in prize draws.

5 Legal bases for processing

The processing of your personal data is carried out on the basis of a statutory permission.

This is either on the basis of:

• your consent pursuant to Art. 6 Abs. 1 a) DSGVO,
• our overriding legitimate interest in the processing pursuant to Art. 6 Abs. 1 f) DSGVO,
• the performance of the contract with you or the implementation of pre-contractual measures pursuant to Art. 6 Abs. 1 b) DSGVO
• or compliance with a necessary legal obligation to which expondo GmbH is subject pursuant to Art. 6 Abs. 1 c) DSGVO.

6 Recipients of personal data

We reserve the right to share and disclose data (including personal data) under the following limited circumstances:

• to providers that perform tasks on our behalf (such companies include, for example, our payment processing providers, shipping service providers, website analytics companies, providers of product feedback or helpdesk software, CRM service providers and email service providers),
• to companies of the expondo Group, for purposes that are consistent with our Privacy Policy.

Where products on our website are sold via an expondo marketplace partner, the data strictly necessary for the transaction will be transmitted to the partner. In addition, disclosure may take place in connection with regulatory requests, court orders and legal proceedings, where necessary for the pursuit or enforcement of rights. For details, please refer, where applicable, to the notices relating to the respective processing.

7 Data transfer to third countries

We use services whose providers are in some cases located in so-called third countries (outside the European Union or the European Economic Area) or process personal data there, i.e. countries whose level of data protection does not correspond to that of the European Union. Insofar as this is the case and the European Commission has not issued an adequacy decision for these countries (Art. 45 DSGVO), we have taken appropriate safeguards to ensure an adequate level of data protection for any data transfers. These include, among other things, the European Union’s Standard Contractual Clauses. Where this is not possible, we base the data transfer on the exceptions of Art. 49 DSGVO, in particular your explicit consent or the necessity of the transfer for the performance of a contract or for the implementation of pre-contractual measures.

8 Duration of retention of personal data

The duration of the storage of personal data is determined by the respective legal basis, the purpose of processing and—where applicable—in addition by the respective statutory retention period (e.g. commercial and tax law retention periods).

Where personal data are processed on the basis of explicit consent pursuant to Art. 6 Abs. 1 lit. a DSGVO, such data will be stored until the data subject withdraws their consent.

If there are statutory retention periods for data processed in the context of contractual or quasi-contractual obligations on the basis of Art. 6 Abs. 1 lit. b DSGVO, such data will be routinely deleted upon expiry of the retention periods, provided they are no longer required for the performance of a contract or for initiating a contract and/or we no longer have a legitimate interest in their continued storage.

Where personal data are processed on the basis of Art. 6 Abs. 1 lit. f DSGVO, such data will be stored until the data subject exercises their right to object pursuant to Art. 21 Abs. 1 DSGVO, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data are processed for the purposes of direct marketing on the basis of Art. 6 Abs. 1 lit. f DSGVO, such data will be stored until the data subject exercises their right to object pursuant to Art. 21 Abs. 2 DSGVO.

Unless otherwise indicated by the other information in this statement regarding specific processing situations, stored personal data will otherwise be deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.

9 Details on data processing in various processing situations:

9.1 Data processing when visiting our website

When you use our website for information only, i.e. when you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (so-called “server log files”). When you access our website, we collect the following data, which are technically necessary for us to display the website to you:

• website(s) visited
• date and time at the time of access
• amount of data sent in bytes
• source/referrer from which you reached the page
• browser used
• operating system used
• IP address used (where applicable: in anonymised form)

Processing is carried out in accordance with Art. 6 Abs. 1 lit. f DSGVO on the basis of our legitimate interest in improving the stability and functionality of our website. The data are not disclosed or otherwise used. However, we reserve the right to check the server log files retrospectively should there be concrete indications of unlawful use.

The data collected in the course of visiting our website are retained only for the period necessary to achieve the above purposes. The files are stored for a maximum of 7 days and then deleted.

9.1.1 Datadog Ireland Limited

When using the services provided by Datadog, the personal data required for this purpose are transmitted to Datadog Ireland Limited, 4th Floor, 1 Dockland Central, Guild Street, Dublin 1, D01 E4X0 Ireland, so that the corresponding functionalities can be provided and analysed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO, pursuant to which the processing of personal data is permitted for the performance of a contract or in order to take steps prior to entering into a contract.

Further information on data protection at Datadog can be found on the Datadog website at: https://www.datadoghq.com/legal/privacy/

9.2 Contact

9.2.1 Bloomreach

When using the services provided by Bloomreach, the personal data required for this purpose are transmitted to Bloomreach B.V., Keizersgracht 125–127, 1015 CJ Amsterdam, The Netherlands, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO, pursuant to which the processing of personal data is permitted for the performance of a contract or in order to take steps prior to entering into a contract.

Further information on data protection at Bloomreach can be found on the Bloomreach website at: https://www.bloomreach.com/en/legal/privacy

9.2.2 Salesforce

When using the services provided by Salesforce, the personal data required for this purpose will be transmitted to Salesforce, Inc., Salesforce Tower, 415 Mission Street, 3rd Floor, San Francisco, CA 94105, United States, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO, according to which the processing of personal data is permitted for the performance of a contract or for the implementation of pre-contractual measures.

Further information on data protection at Salesforce can be found on the Salesforce website at: https://www.salesforce.com/company/legal/privacy/

9.3 Processing of data for the purpose of shipment handling

9.3.1 Raben

When using the services provided by Raben, the personal data required for this purpose will be transmitted to Raben Trans European Germany GmbH, Holländerstraße 11, 68219 Mannheim, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO, according to which the processing of personal data is permitted for the performance of a contract or for the implementation of pre-contractual measures.

Further information on data protection at Raben can be found on the Raben website at: https://deutschland.raben-group.com/datenschutzerklarung

9.3.2 GLS PL

When using the services provided by GLS, the personal data required for this purpose will be transmitted to GLS PL General Logistics Systems Poland Sp. z o.o., ul. Tęczowa 10, Głuchowo, 62-052 Komorniki, Poland, so that the corresponding functionalities can be made available and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO, according to which the processing of personal data is permitted for the performance of a contract or for the implementation of pre-contractual measures.

Further information on data protection at GLS can be found on the GLS website at: https://gls-group.com/PL/pl/polityka-prywatnosci/

9.3.3 GLS DE

When using the services provided by GLS, the personal data required for this purpose will be transmitted to General Logistics Systems Germany GmbH & Co. OHG, GLS Germany-Straße 1–7, DE-36286 Neuenstein, so that the corresponding functionalities can be made available and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO, according to which the processing of personal data is permitted for the performance of a contract or for the implementation of pre-contractual measures.

Further information on data protection at GLS can be found on the GLS website at: https://www.gls-pakete.de/datenschutzerklaerung

9.3.4 DACHSER

When using the services provided by DACHSER, the personal data required for this purpose are transmitted to DACHSER SE, Head Office, Thomas-Dachser-Str. 2, 87439 Kempten, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO, according to which the processing of personal data is permitted for the performance of a contract or for the implementation of pre-contractual measures.

Further information on data protection at DACHSER can be found on the DACHSER website at: https://www.dachser.de/de/datenschutz-277

9.3.5 DHL

When using the services provided by DHL, the personal data required for this purpose are transmitted to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at DHL can be found on the DHL website at: https://www.dhl.de/de/toolbar/footer/datenschutz.html

9.3.6 DPD

When using the services provided by DPD, the personal data required for this purpose are transmitted to DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany, so that the corresponding functionalities can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at DPD can be found on the DPD website at: https://www.dpd.com/de/datenschutz/

9.3.7 UPS

When using the services provided by UPS, the personal data required for this purpose are transmitted to United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany, so that the relevant functionalities can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at UPS can be found on the UPS website at: https://www.ups.com/de/de/support/shipping-support/legal-terms-conditions/privacy-notice

9.3.8 FedEx International

When using the international services provided by FedEx, the personal data required for this purpose are transmitted to FedEx Express Deutschland GmbH, Haberstraße 2, 53842 Troisdorf, Germany, so that the relevant functionalities can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at FedEx can be found on the FedEx website at: https://www.fedex.com/de-de/privacy-policy.html

9.3.9 FEDEX DOMESTIC (PL)

When using the domestic services provided by FedEx in Poland, the personal data required for this purpose are transmitted to FedEx Express Poland Sp. z o.o., ul. 17 Stycznia 24, 02-146 Warszawa, Poland, so that the corresponding functionalities can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at FedEx can be found on the FedEx website at: https://www.fedex.com/pl-pl/privacy-policy.html

9.3.10 Allegro

When using the shipping services provided by Allegro, including Allegro Orlen Paczka, Allegro Punkt Orlen Paczka, Allegro Kurier DHL (AD), Allegro Odbiór W Punkcie DHL (AD), Allegro Automat DHL Box 24/7 (AD), Allegro One Box Dpd, One Kurier – Delivery Tomorrow, One Box, One Kurier and Inpost Paczkomaty, the personal data required for this purpose are transmitted to Allegro.eu SA 6, rue Eugène Ruppert, L-2453 Luxembourg, so that the corresponding shipping and delivery functions can be provided. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Allegro can be found on the Allegro website at: https://allegro.pl/regulamin#artykul-13-prywatnosc-i-poufnosc

9.4 Use of specialised service providers for order processing and handling

9.4.1 Linnworks

When using the services provided by Linnworks, the personal data required for this purpose are transmitted to Linn Systems Limited (Linnworks), Suite 3, 2–4 Southgate, Chichester, West Sussex, PO19 8DJ, United Kingdom, in order to enable the provision and processing of the corresponding functionalities. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Linnworks can be found on the Linnworks website at: https://community.linnworks.com/privacy-policy

9.4.2 ParcelPerform

When using the services provided by ParcelPerform, the personal data required for this purpose are transmitted to Parcel Perform Pte. Ltd., 138 Cecil Street #16-00, Singapore 069538, Singapore, in order to enable the provision and processing of the corresponding functionalities. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at ParcelPerform can be found on the ParcelPerform website at: https://www.parcelperform.com/privacy

9.4.3 Trusted Returns

When using the services provided by Trusted Returns, the personal data required for this purpose are transmitted to Trusted Returns GmbH, Mittelstrasse 2-1053175 Bonn, Germany, in order to enable the provision and processing of the corresponding functionalities. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Trusted Returns can be found on the Trusted Returns website at: https://trustedreturns.com/de/data-security

9.4.4 SendIT

When using the services provided by SendIT, the personal data required for this purpose are transmitted to SendIT Solutions, Lda., Rua Fradesso da Silveira No. 4 - 3B, 1300-609 Lisbon, Portugal, so that the corresponding functionalities can be made available and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at SendIT can be found on the SendIT website at: https://sendit.pt/privacy-policy/

9.4.5 Channel Engine

When using the services provided by Channel Engine, the personal data required for this purpose are transmitted to Channel Engine B.V., Vondellaan 47, 2332 AA, Leiden, Netherlands, so that the corresponding functionalities can be made available and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Channel Engine can be found on the Channel Engine website at: https://www.channelengine.com/privacy-policy/

9.4.6 Commercetools GmbH

When using the services provided by commercetools, the personal data required for this purpose are transmitted to commercetools GmbH, Adams-Lehmann-Str. 44, 80797 Munich, Germany, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at commercetools can be found on the commercetools website at: https://commercetools.com/privacy

9.4.7 NetSuite

When using the services provided by NetSuite, the personal data required for this purpose are transmitted to Oracle NetSuite or a company affiliated with Oracle, e.g. Oracle International Corporation, 2300 Oracle WayAustin, TX 7874, USA, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO. Further information on data protection at Oracle/NetSuite can be found on the Oracle website at: https://www.oracle.com/europe/legal/privacy/privacy-policy/

9.4.8 Innoship Technology SRL

When using the services provided by Innoship, the personal data required for this purpose are transmitted to Innoship Technology S.A. Râmnicu Vâlcea, Gheorghe Petre Govora Street, no. 3, attic, room 2, Vâlcea county, Romania, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Innoship can be found on the Innoship website at: https://www.innoship.com/privacy

9.4.9 Adyen

When using the services provided by Adyen, the personal data required for this purpose are transmitted to Adyen N.V., Simon Carmiggeltstraat 6–50, 1011 DJ Amsterdam, The Netherlands, so that the corresponding payment and settlement services can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO. and settlement services can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Adyen can be found on the Adyen website at: https://www.adyen.com/privacy-policy

9.4.10 Base (formerly Baselinker).

When using the services provided by Base, the personal data required for this purpose are transmitted to BaseLinker spółka z ograniczoną odpowiedzialnością, Plac Solny 15, 50-062 Wrocław, Poland, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Base can be found on the Base website at: https://base.com/de-DE/politik/

9.4.11 InvoiceOcean

When using the services provided by InvoiceOcean, the personal data required for this purpose are transmitted to Fakturownia sp. z o. o., ul. Juliana Smulikowskiego 6/8, 00-389 Warsaw, Poland, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at InvoiceOcean can be found on the InvoiceOcean website at: https://invoiceocean.com/privacy-policy

9.4.12 Afterbuy

When using the services provided by Afterbuy, the personal data required for this purpose are transmitted to ViA-Online GmbH, Kimplerstraße 296, 47807 Krefeld, Germany, so that the corresponding functionalities can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Afterbuy can be found on the Afterbuy website at: https://afterbuy.de/datenschutz/

9.4.13 Microsoft Azure (Microsoft Foundry)

When using the services provided by Microsoft Azure (Microsoft Foundry), the necessary personal data is transferred to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, in order to provide and process the corresponding functionalities. The legal basis for this processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Microsoft Azure (Microsoft Foundry) can be found on the Microsoft website at: https://www.microsoft.com/de-de/privacy/privacystatement

9.4.14 Vatstack

After entering the VAT identification number, the customer's company data can be automatically filled in during the checkout process, with the information retrieved from public registers using the services of Vatstack, Gatemill, Inc., 16192 Coastal Highway, Lewes, DE 19958. The legal basis for this processing is Artikel 6 Abs. 1b and, where applicable, Artikel 6 Abs. 1f DSGVO.

Further information on data protection at Vatstack can be found on the Vatstack website at: https://vatstack.com/privacy

9.5 Use of payment service providers

9.5.1 PayPal

When paying via PayPal, the personal data required for this purpose will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxemburg, so that you can authorise the payment to us with PayPal. A PayPal account is required for this. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at PayPal can be found on the PayPal website at: https://www.paypal.com/de/legalhub/paypal/privacy-full

9.5.2 Google Pay

When paying via Google Pay, the personal data required for this purpose will be transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that you can authorise the payment to us via Google Pay. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Google Pay can be found on the Google website at: https://business.safety.google/privacy/

9.5.3 Apple Pay

When paying via Apple Pay, the personal data required for this purpose will be transmitted to Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, so that you can authorise the payment to us via Apple Pay. The legal basis is Art. 6 Abs. 1 b) DSGVO. Further information on data protection for Apple Pay can be found on Apple’s website at: https://www.apple.com/legal/privacy/de-ww/

9.5.4 Vipps MobilePay

When paying via Mobile Pay, the personal data required for this purpose will be transmitted to MobilePay A/S, Havneholmen 29, 6th floor, 1561 Copenhagen V, Denmark, so that you can authorise the payment to us via Mobile Pay. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection for Mobile Pay can be found on the Mobile Pay website at: https://mobilepay.dk/betingelser

9.5.5 TWINT

When paying via Twint, the personal data required for this purpose will be transmitted to TWINT AG, Stauffacherstrasse 4, CH-8004 Zurich, Switzerland, so that you can authorise the payment to us via Twint. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection for Twint can be found on the Twint website at: https://www.twint.ch/datenschutz/

9.5.6 iDEAL

When paying via iDEAL, the personal data required for this purpose will be transmitted to Currence iDEAL B.V., P.O. Box 95301, 1090 HH Amsterdam, Netherlands, so that you can authorise the payment to us via iDEAL. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at iDEAL can be found on the iDEAL website at: https://ideal.nl/en/ideal-privacy-cookiestatement

9.5.7 BLIK

When paying via BLIK, the personal data required for this purpose will be transmitted to Polskie Standardy Płatności S.A., ul. Czerniakowska 87A, 00-718 Warszawa, Poland, so that you can authorise the payment to us via BLIK. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at BLIK can be found on the BLIK website at: https://blikmobile.pl/polityka-prywatnosci

9.5.8 Przelewy24

When paying via Przelewy24, the personal data required for this purpose will be transmitted to PayPro SA., ul. Pastelowa 8, 60-198 Poznań, Poland, so that you can authorise the payment to us via Przelewy24. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Przelewy24 can be found on the Przelewy24 website at: https://www.przelewy24.pl/polityka-prywatnosci

9.5.9 Multibanco

When paying via Multibanco, the personal data required for this purpose will be transmitted to SIBS Forward Payment Solutions, S.A, Alfrapark, Edifício E, Estrada de Alfragide, n.º 67, 2610-008 Amadora, Portugal, so that you can authorise the payment to us via Multibanco. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Multibanco can be found on the SIBS website at: https://www.multibanco.pt/politica-de-privacidade/

9.5.10 Billie GmbH

When paying via Billie, the personal data required for this purpose will be transmitted to Billie GmbH, Am Postbahnhof 15, 10243 Berlin, Germany, so that you can authorise the payment to us via Billie. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Billie can be found on the Billie website at: https://www.billie.io/datenschutz

9.5.11 Klarna

When paying via Klarna, the personal data required for this purpose will be transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, so that you can authorise the payment to us via Klarna. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Klarna can be found on the Klarna website at: https://www.klarna.com/de/datenschutz/

9.5.12 Klarna Installments

When paying via Klarna Installments, the personal data required for this purpose are transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, so that you can authorise the payment to us via Klarna Installments. Rechtsgrundlage ist Art. 6 Abs. 1 b) DSGVO.

Further information on data protection for Klarna Installments can be found on the Klarna website at: https://www.klarna.com/de/datenschutz/

9.6 Contact for requesting customer review information

9.6.1 Trustpilot

When using the services provided by Trustpilot, the personal data required for this purpose are transmitted to Trustpilot A/S, Pilestraede 58, 5th floor, DK-1112 Copenhagen, Denmark, so that the relevant rating and feedback functions can be provided and processed. Rechtsgrundlage für die vorgenannten Datenverarbeitungen ist Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Trustpilot can be found on the Trustpilot website at: https://de.corporate.trustpilot.com/legal/for-businesses/privacy-policy

9.6.2 Google Customer Reviews

When using the services provided by Google Customer Reviews, the personal data required for this purpose are transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that the relevant review functions can be provided and processed. Rechtsgrundlage ist Art. 6 Abs. 1 b) DSGVO.

Further information on data protection for Google Customer Reviews can be found on the Google website at: https://business.safety.google/privacy/

9.6.3 Seznam.cz

When using the services provided by Seznam, the personal data required for this purpose are transmitted to Seznam.cz, a.s., Radlická 3294/10, 150 00 Prague 5, Czech Republic so that the relevant rating and feedback functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Seznam can be found on the Seznam website at: https://o-seznam.cz/pravni-informace/ochrana-udaju/

9.6.4 Heureka Group

When using the services provided by Heureka, the personal data required for this purpose are transmitted to Heureka FinCo CZ a.s., Karolinská 650/1, Karlín, 186 00 Prague 8, Czech Republic so that the relevant rating and comparison functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Heureka can be found on the Heureka website at: https://heureka.group/cz-cs/podminky-pouzivani/ochrana-osobnich-udaju-na-portalech-heureka-group-a-s/

9.6.5 Ceneo.pl

When using the services provided by Ceneo, the personal data required for this purpose are transferred to Ceneo.pl Sp. z o. o., ul. Legnicka 48A, 54-202 Wrocław, Poland, so that the relevant rating and comparison functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Ceneo can be found on the Ceneo website at: https://info.ceneo.pl/prywatnosc

9.7 Use of videos

9.7.1 YouTube

When using the services provided by YouTube, the personal data required for this purpose are transferred to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that the corresponding functions of YouTube can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at YouTube can be found on the YouTube website at: https://business.safety.google/privacy/

9.8 Online marketing

9.8.1 Google Ads

When using the services provided by Google Ads, the personal data required for this purpose are transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that the corresponding advertising and analytics functions can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Google Ads can be found on the Google website at: https://business.safety.google/privacy/

9.8.2 Meta

When using the services provided by Meta (e.g. Facebook, Instagram), the personal data required for this purpose are transmitted to Meta Platforms Technologies Ireland Limited, Merrion Road, Dublin 4 D04 X2K5, Ireland, so that the corresponding advertising and analytics functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Meta can be found on the Meta website at: https://www.facebook.com/privacy/policy

9.8.3 Criteo SA

When using the services provided by Criteo, the personal data required for this purpose are transmitted to Criteo SA, 32 Rue Blanche, 75009 Paris, France, so that the corresponding retargeting and advertising functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Criteo can be found on the Criteo website at: https://www.criteo.com/privacy/

9.9 Web analytics services

9.9.1 Google Analytics

When using the services provided by Google Analytics, the personal data required for this purpose are transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that the corresponding analytics functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Google Analytics can be found on the Google website at: https://business.safety.google/privacy/

9.9.2 A/B Tasty

When using the services provided by A/B Tasty, the personal data required for this purpose are transmitted to A/B Tasty SAS, 64-66 Rue des Archives, 75003 Paris, France, so that the corresponding A/B testing and optimisation functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at A/B Tasty can be found on the A/B Tasty website at: https://www.abtasty.com/privacy-policy/

9.9.3 Bloomreach

When using the services provided by Bloomreach, the personal data required for this purpose are transmitted to Bloomreach B.V., Oosteinde 11, 1017 WT Amsterdam, The Netherlands, so that the corresponding personalisation and analytics functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Bloomreach can be found on the Bloomreach website at: https://www.bloomreach.com/en/legal/privacy

9.10 Retargeting/remarketing/referral advertising

9.10.1 Google Ads

When using the services provided by Google Ads, the personal data required for this purpose is transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, so that the corresponding advertising and analytics functions can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Google Ads can be found on the Google website at: https://business.safety.google/privacy/

9.10.2 Criteo SA

When using the services provided by Criteo, the personal data required for this purpose is transmitted to Criteo SA, 32 Rue Blanche, 75009 Paris, France, so that the corresponding retargeting and advertising functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Criteo can be found on the Criteo website at: https://www.criteo.com/privacy/

9.10.3 Microsoft advertising

When using the services provided by Microsoft Advertising, the personal data required for this purpose are transferred to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, so that the relevant advertising and analytics functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Microsoft Advertising can be found on the Microsoft website at: https://privacy.microsoft.com/de-de/privacystatement

9.10.4 Meta

When using the services provided by Meta (e.g. Facebook, Instagram), the personal data required for this purpose are transferred to Meta Platforms Technologies Ireland Limited, Merrion Road, Dublin 4 D04 X2K5, Ireland, so that the relevant advertising and analytics functions can be provided and processed. The legal basis is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection at Meta can be found on the Meta website at: https://www.facebook.com/privacy/policy

9.11 Other

9.11.1 Microsoft Power BI

When using the services provided by Microsoft Power BI, the personal data required for this purpose are transferred to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA, so that the relevant analytics and reporting functions can be provided and processed. The legal basis for the aforementioned data processing is Art. 6 Abs. 1 b) DSGVO.

Further information on data protection for Microsoft Power BI can be found on the Microsoft website at: https://privacy.microsoft.com/de-de/privacystatement

10 Right to object and right to withdraw consent

You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data which takes place on the basis of Art. 6 Abs. 1 S. 1 lit. f DSGVO, for example via our contact form at www.expondo.ie/contact/.

You have the right to withdraw your consent to the processing of your personal data which takes place on the basis of Art. 6 Abs. 1 a) DSGVO at any time with effect for the future, for example via our contact form at www.expondo.ie/contact/.

11 Rights of the data subject

The applicable data protection law grants you the following rights as a data subject (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data; the cited legal basis indicates the respective conditions for exercising these rights:

• Right of access pursuant to Art. 15 DSGVO
• Right to rectification pursuant to Art. 16 DSGVO
• Right to erasure pursuant to Art. 17 DSGVO
• Right to restriction of processing pursuant to Art. 18 DSGVO
• Right to notification pursuant to Art. 19 DSGVO
• Right to data portability pursuant to Art. 20 DSGVO
• Right to object pursuant to Art. 21 DSGVO
• Right to withdraw consent given pursuant to Art. 7 Abs. 3 DSGVO
• Right to lodge a complaint pursuant to Art. 77 DSGVO