Privacy Policy

Privacy Policy

We, as the operators of the website at www.madras-carry.com (also known as the " Online Shop "), are responsible within the meaning of applicable data protection law, in particular the General Data Protection Regulation ("GDPR"), for the personal data of the user (" you ") of this website.

In accordance with our legal obligations under Articles 13 et seq. of the GDPR, we hereby inform you clearly about which data is processed when you visit our website and on what legal basis this processing takes place. You will also receive information about how we protect your data from a technical and organizational perspective and what rights you have vis-à-vis us and the competent supervisory authority.

  1. Information about the responsible party

Madras Carry UG (limited liability)

Bückeburger Str. 50

28205 Bremen

Mobile: +49 (0) 174 335 15 42

Email: info@madras-carry.com

  1. Processing of your personal data

 

Informational use of our website

When you access our website simply to visit it, so-called log files are processed by being automatically collected by our system.

The following log files are processed automatically:

  • IP address of the requesting computer
  • Type of internet browser used
  • Language of the internet browser used
  • Version of the internet browser used
  • Operating system and its version
  • Operating system interface
  • Pages visited
  • Date and time of visit
  • Time zone difference to Greenwich Mean Time (GMT)
  • Access status/http status code
  • Amount of data transferred
  • Success or failure of the charging process
  • Referrer
  • Websites accessed by the visitor's system via our website
  • User's Internet service provider

The log files contain your IP address, but it is shortened before being stored. Therefore, it is not possible to identify you, and your data is not stored together with other personal data.

The processing of the above-mentioned data is necessary for the provision of our website.

The legal basis for processing the data for anonymization purposes is Art. 6 (1) lit. f GDPR.

  1. Use of offers

 3.1. Customer account

You have the option to create a customer account on our website using your personal data. This is voluntary, and the data will not be shared with third parties. If you choose to create a customer account, you will need to provide us with the following information:

  • E-mail address

All other information is voluntary. We store the following voluntary information along with your email address if you provide it to us:

  • First and Last Name
  • address

When you submit your registration , we store your IP address and the date and time of your registration along with the data you provided. By submitting your registration, you consent to the processing of your data by us.

Your data will be used for the purpose of managing your customer account and providing the associated functions, such as processing your customer data and displaying your orders. The legal basis for storing your customer account data is Article 6(1)(a) GDPR.

We store the data you provided during your voluntary registration until you delete your customer account. If you make changes to your information, the old information will be deleted and only the updated data will be stored. Beyond this, we only store your data to comply with our contractual or legal obligations (e.g., tax obligations) (Art. 6 (1) lit. c GDPR). In this case, we restrict the processing of your data to the extent that it is only used for the necessary purposes.

You can delete or modify your voluntary customer account with us at any time. You will find the functions for changing your information in your profile. If you wish to close your customer account with us, please send us a message to info@madras-carry.com and we will delete your account immediately.

 

3.2. Orders

When you place an order on our website, we need the following data to fulfill the contract with you:

  • First name, last name and (billing and delivery) address in order to send you your order.
  • Email address to send you the order confirmation and to provide you with the contract documents and invoice immediately after the order.

In order to send you your order, we will pass on your address details to our shipping or logistics service provider for the purpose of delivery.

The legal basis for processing your data is Article 6(1)(b) GDPR. We store your data for 12 months and then delete it. Beyond this period, we only store your data to comply with our contractual or legal obligations (e.g., tax obligations) (Article 6(1)(c) GDPR). In this case, we restrict the processing of your data to the extent that it is only processed for the necessary purposes.

3.3. Payment methods

When you select a payment provider on our payment page, that provider also receives your personal data, such as your name, address, and bank account details. Additionally, our bank receives your bank account details when an electronic payment is received.

PayPal : If you pay with PayPal (PayPal (Europe) S.à rl et Cie, SCA 22-24 Boulevard Royal L-2449 Luxembourg) on ​​our website, PayPal will receive your payment details for processing the payment. You can find more information here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#rAnnex .

Credit card: We process credit card payments via the payment service provider Stripe Payments Europe Ltd., Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland. Stripe receives your personal data, such as your name, address, and bank account details, for electronic payment processing. The legal basis for this data processing is Article 6(1)(f) GDPR. When you pay with your credit card on our website, your credit card provider receives the information that you have placed an order with us. Your credit card provider may conduct a credit check. You can find more information about this on your credit card provider's website.

Direct debit/prepayment : If you pay by direct debit on our website, our bank will receive your bank details for payment processing.

  1. contact

4.1. Contact form

You can contact us electronically via our contact form , for example to give us feedback or to ask us questions. If you use this option, you will be submitting the following data to us:

  • Email address (to contact you)
  • First and last names (optional)
  • Telephone number (optional)

In addition to the data you voluntarily provide, we store the date and time of your data transmission to us, as well as your IP address. Processing this data is based on our legitimate interest (Art. 6 (1) lit. f GDPR) in ensuring the security of our systems and preventing misuse. This additional data, which we collect during your contact, will be deleted as soon as it is no longer needed, at the latest when your inquiry has been fully resolved.

By submitting the contact form, you consent to the processing of your data by us. The legal basis for processing your data for the purpose of handling your inquiry is Article 6(1)(a) GDPR. Your data will be deleted six months after the purpose of the conversation with you has been fulfilled or after your request has been fully resolved.

If your contact is aimed at concluding a contract with us, the additional legal basis for processing your personal data is Article 6(1)(b) GDPR. This data will be stored for as long as it is necessary for the performance of the contract. Beyond that, we only store your data to comply with contractual or legal obligations (e.g., tax obligations) (Article 6(1)(c) GDPR).

4.2. Contact via email

You have the option of contacting us by email . The personal data you transmit in your email will be stored by us. This data will not be shared with third parties. The data will be processed solely for the purpose of handling your inquiry. The legal basis for processing your personal data is Article 6(1)(f) GDPR. The data will be stored until it is no longer needed to fulfill the purpose of our conversation with you and your inquiry has been fully resolved.

If your email aims to conclude a contract with us, the additional legal basis for processing your personal data is Article 6(1)(b) GDPR. This data will be stored for as long as it is necessary for the performance of the contract. Beyond that, we only store your data to comply with contractual or legal obligations (e.g., tax obligations) (Article 6(1)(c) GDPR).

In addition to the data you voluntarily provide, we receive the date and time of your data transmission, as well as your IP address. Processing this data is in our legitimate interest (Art. 6 (1) lit. f GDPR) to ensure the security of our systems and prevent misuse. This additional data, which we collect during your contact, will be deleted as soon as it is no longer needed, at the latest when your inquiry has been fully resolved.

4.3. Contact by telephone

You have the option of contacting us by telephone . The personal data you provide over the phone will be stored by us. This data will not be shared with third parties. The data will be processed solely for the purpose of handling your inquiry. The legal basis for processing your personal data is Article 6(1)(f) GDPR. The data will be stored until it is no longer needed to fulfill the purpose of our conversation with you and your inquiry has been fully resolved.

If your call is aimed at concluding a contract with us, the additional legal basis for processing your personal data is Article 6(1)(b) GDPR. This data will be stored for as long as it is necessary for the performance of the contract. Beyond this, we only store your data to comply with contractual or legal obligations (e.g., tax obligations) (Article 6(1)(c) GDPR). In this case, we restrict your data processing to the extent that it is only processed for the necessary purposes.

  1. Newsletter via MailChimp

On our website, we offer you the opportunity to subscribe to our newsletter free of charge. In addition to your declaration of consent, we require your email address for this. Further information, such as your name, is voluntary and serves to personalize our communications with you. The legal basis for sending the newsletter and for any voluntary additional information is Article 6(1)(a) GDPR. By submitting your newsletter subscription, you consent to the processing of your data by us.

We will only send you the newsletter after you have confirmed your subscription by clicking the link in the confirmation email we send you for this purpose. This ensures that only you can subscribe to the newsletter. Your confirmation must be completed promptly after receiving the confirmation email, otherwise your newsletter subscription will be automatically deleted from our database.

Additionally, when you subscribe to our newsletter, we store the date and time of your data transmission to us, as well as your IP address. The processing of this data is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, in order to ensure the security of our systems and to prevent misuse.

Your data will be processed solely in connection with sending newsletters. The purpose of processing your email address is to enable us to send you the newsletter. Further data collected during the registration process serves either to address you personally or to ensure the security of our services and prevent misuse of the email address used.

Your data will only be stored for as long as necessary to fulfill the purpose for which it was collected. Therefore, your email address will be stored for the duration of your active newsletter subscription, provided you have given your consent. The additional data we automatically collect during your registration (IP address, date, and time) will be deleted no later than when you unsubscribe from the newsletter.

We use MailChimp , a service provided by The Rocket Science Group LLC, 675 Ponce de Leon Avenue NE, Suite 5000, Atlanta, GA 30308, USA, for sending our newsletter. The data is transferred to the USA (a non-EU country), however, the level of data protection is guaranteed by MailChimp's Privacy Shield certification. After careful consideration, we have concluded that it is in our legitimate interests to use this service provider for our purposes (because MailChimp is simply excellent, and we are confident that your data is secure with MailChimp). Furthermore, after weighing the interests against yours, we have concluded that your interests and fundamental rights do not conflict with the use of MailChimp and do not outweigh our interests. Therefore, we base the transfer of data to MailChimp on the legal basis of Art. 6 (1) lit. f GDPR (you can object to this at any time by unsubscribing from the newsletter; more information below).

MailChimp can track whether the newsletter has been opened and whether the links within it have been clicked. We cannot disable this tracking; however, if you wish to object, you can unsubscribe from the newsletter (more information below). This feature is helpful for us to understand whether our newsletter is opened and which topics are of particular interest. This aligns with our legitimate business interests. The legal basis for this data processing is therefore Article 6(1)(f) GDPR.

We're not interested in which specific person clicks on the newsletter (although that's technically possible), but rather in the aggregated statistics that MailChimp automatically generates. Generally, we only see the percentage of recipients who opened the newsletter or which content performed best. However, if you submit a specific support request regarding the newsletter, we could (technically speaking) also analyze your individual newsletter usage.

Right to object / Unsubscribe from newsletter

You can unsubscribe from our newsletter at any time. You'll find the link at the bottom of every newsletter. By doing so , you revoke your consent or object to the further use of your data for newsletter distribution.

 

  1. Cookies

Please note the following: You can prevent all cookies from being stored on your computer, or allow only specific cookies to be stored. You can select this in your internet browser settings. There you can also view and delete stored cookies.

If you block all cookies, you may not be able to use all the features of our website.

We use cookies on our website. Cookies are text files that are sent from our web server to your browser during your visit to our website and stored on your computer for later retrieval. A cookie allows your internet browser to be identified when you visit the website again. There are session cookies, which are deleted when you close your browser, and persistent cookies, which are stored on your hard drive until their preset expiration date is reached or until you actively delete them.

6.1. Own cookies

We use our own cookies to ensure the functionality of our website . Some elements of our website require that your internet browser be recognized after a page change. The legal basis for processing personal data in cookies that we place on our website to ensure the functionality of our website and our services is Article 6(1)(f) GDPR.

 

Opportunity to object and have the matter rectified

As mentioned at the beginning of this section, you can enable or restrict the transmission of cookies by changing the settings in your internet browser. You can delete cookies that have already been stored by your internet browser at any time. If cookies are restricted or disabled for our website, some functionalities may not be available.

 

6.2. Third-party cookies

We use cookies from so-called "third-party providers" on our website. This means that during your visit to our website, data from your web browser is transferred to the third party's web server and stored there.

 Google Analytics

Our website uses the Google Analytics service provided by Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA (hereinafter referred to as " Google Analytics ").

Google Analytics uses cookies that store the following information:

  • Type of internet browser used
  • Internet browser version
  • the operating system you are using,
  • Referrer (previously visited website)
  • Your shortened IP address
  • Time of server request

Cookie name

Purpose of the cookie

Storage duration

_ga

Used to distinguish users in order to generate statistical data about website usage.

2 years

_gat

Limits the request rate for Google Analytics

until the browser session ends

_gid

Used to distinguish users in order to generate statistical data about website usage.

24 hours

We use Google Analytics' feature to anonymize your IP address before storing or processing it. Your IP address is typically shortened within the European Union/EEA before being transferred to Google servers in the USA. Your information is processed pseudonymously, and we will not combine it with any other personal data you provide.

We use the data collected in this way for statistical purposes in order to optimize our website and services. The legal basis for this is Article 6(1)(f) GDPR.

Furthermore, you can prevent Google from collecting and processing data generated by the cookie relating to your use of the website (including your IP address) by downloading and installing the browser plugin available at the following link ( http://tools.google.com/dlpage/gaoptout?hl=de ).

You can prevent the storage of Google cookies either directly in your browser settings, or prevent the processing of your data by clicking the following link and opting out: [Please insert link]. This will set an opt-out cookie that prevents your user data from being collected on this website.

You can find Google's privacy policy at the following link: https://policies.google.com/privacy?hl=de .

 

  1. Facebook fan page

We operate on the social media platform Facebook (Facebook Inc., Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland, (hereinafter: " Facebook ") a fan page that we link to from our company page via the Facebook icon. As long as you do not click on the link, Facebook does not receive any data from you. If you click on the link, for example to view our company's Facebook page or to "like" our page, Facebook receives data from you (which data Facebook receives also depends on whether you are logged into Facebook with your user profile while clicking on the page or not).

While Facebook uses this data independently to create profiles, among other things, our company website only displays aggregated data, i.e., statistics that are no longer personally identifiable. This is called "Page Insights." You can find more information about Page Insights at the following link:

https://www.facebook.com/legal/terms/information_about_page_insights_data .

Due to the requirements of the GDPR, we have entered into an agreement provided by Facebook with Facebook, which regulates joint responsibility for our fan page. You can find this agreement in German at the following link:

https://www.facebook.com/legal/terms/page_controller_addendum .

This means that Facebook is primarily responsible for the aggregated Insights data. Furthermore, Facebook will fulfill all obligations under the GDPR regarding the processing of Insights data (including Articles 12, 13, 15–22, and 32–34). If you send us an inquiry regarding our Facebook fan page, we will inform Facebook promptly. According to our agreement, Facebook will respond to the inquiry.

Our legitimate interest in processing personal data lies in the use and linking of different communication channels. This processing is based on the legal grounds of [relevant legal basis]. Article 6 paragraph 1 letter f GDPR. You can find Facebook's data policy at the following link: https://www.facebook.com/policy.php . 

 

  1. Social Media Plugins (with Shariff function)

Please note the following: Our website includes social media plugins from social networks (Facebook, Twitter, Pinterest, and Google+). However, data is not transmitted to the respective social media platforms directly when you visit our website, but only when you actively click on the respective share button ( Shariff function ). You can recognize this because the buttons are initially grayed out; they change color when you hover your mouse over them.

If you are already logged into the social media platform when you click the button, a window will appear asking you to confirm whether you want to share the post on that platform. If you are not already logged in, the login field will appear for the respective platform.

  1. Facebook Plug-In (with Shariff)

The social network Facebook is offered (in Europe) by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: Facebook ). Facebook is primarily responsible for data processing on Facebook . When the plug-in (a Facebook component) is clicked, Facebook receives information that you have activated the component from one of our pages. If you are logged into Facebook at the same time, Facebook will associate this information with your Facebook user profile. The integration of the Facebook share function on our website and the associated data processing is in our legitimate interests, as we also wish to present ourselves in this way. The legal basis for this is therefore Art. 6 lit. f GDPR. If you choose to activate the button to share a post, the legal basis for the resulting data processing and data transfer to Facebook is your consent, Art. 6 lit. a GDPR. You can find the Facebook Data Policy here: https://www.facebook.com/policy.php .

 

  1. Pinterest plug-in (with Shariff)

The social network Pinterest is offered by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA (hereinafter: Pinterest ). Pinterest is primarily responsible for data processing on Pinterest . When the plug-in (a Pinterest component) is clicked, Pinterest receives information that you have activated the component from one of our pages. If you are logged into Pinterest at the same time, Pinterest will associate this information with your user profile on Pinterest . The integration of the Pinterest share function on our website and the associated data processing is in our legitimate interests, as we also want to present ourselves in this way. The legal basis for this is therefore Art. 6 lit. f GDPR. If you choose to activate the button to share a post, the legal basis for the resulting data processing and data transfer to Pinterest is your consent, Art. 6 lit. a GDPR. You can find the Pinterest data policy here: https://policy.pinterest.com/de/privacy-policy .

 

  1. Other third-party content that is integrated into our website

 

YouTube

For the purpose of making our website more visually appealing, we embed videos from YouTube, a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: " YouTube "). We use YouTube's enhanced privacy mode, so that information about you is only shared with YouTube if you activate the video by clicking the play button.

By activating the video, YouTube uses cookies to collect information for analysis and to improve user experience. According to YouTube, the data is processed pseudonymously. However, if you are logged into your Google or YouTube account, the data may be directly linked to your YouTube account.

Further information on data protection, including the storage period of your data at YouTube, can be found in Google's privacy policy at: https://policies.google.com/privacy?hl=de&gl=de .

The legal basis for integrating the YouTube service on our website and the associated processing of your data is Art. 6 (1) lit. f GDPR.

 

  1. Your rights

When we process your data, you are a "data subject" within the meaning of the GDPR. You have the following rights: right of access , right to rectification , right to restriction of processing, right to erasure , right to be informed , and right to data portability . Furthermore, you have the right to object and the right to withdraw your consent .

Below you will find details about each right:

  1. Right to information

You have the right to request confirmation from us as to whether we process your personal data.

If we process your personal data, you have the right to obtain information about the following:

  • the processing purposes
  • the categories of personal data that are processed;
  • the recipients or categories of recipients to whom your personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
  • If possible, the planned duration for which your personal data will be stored, or, if this is not possible, the criteria used to determine that duration;
  • the existence of a right to rectification or erasure of personal data concerning you or to restriction of processing by us or a right to object to such processing;
  • the existence of a right to lodge a complaint with a supervisory authority;
  • If the personal data was not collected directly from you, all available information about the origin of the data;
  • the existence of automated decision-making including profiling pursuant to Art. 22 (1) and (4) GDPR and – at least in these cases – meaningful information about the logic involved as well as the scope and intended effects of such processing for you.

If we transfer your data to an international organization or to a third country, you also have the right to request information as to whether appropriate safeguards exist in accordance with Art. 46 GDPR in connection with the transfer.

  1. Right of rectification

You have the right to correct and/or complete the data we have stored about you if this data is incorrect or incomplete. We will carry out the correction or completion without undue delay.

 

  1. Right to restrict processing

Under certain conditions, you have the right to request that we restrict the processing of your personal data. At least one of the following conditions must be met:

  • You confirm the accuracy of the personal data, for a period that allows us to verify the accuracy of the personal data.
  • The processing is unlawful and you refuse to have your personal data erased and instead request the restriction of its use;
  • We no longer need the personal data for the purposes of processing, but you need it to establish, exercise or defend legal claims, or
  • You have objected to the processing pursuant to Art. 21 (1) GDPR, pending verification of whether our legitimate grounds override your interests.

  1. Right to erasure

You have the right to request that we delete your personal data immediately if we are legally obligated to do so. This is the case if one of the following conditions is met:

  • Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
  • You withdraw your consent on which the processing was based pursuant to Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR, and there is no other legal basis for the processing.
  • You object to the processing pursuant to Article 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21 (2) GDPR.
  • Your personal data has been processed unlawfully.
  • The erasure of personal data is necessary for compliance with a legal obligation under Union or Member State law to which we are subject.
  • Your personal data was collected in relation to information society services offered, in accordance with Article 8 (1) GDPR.

 

If we have made your personal data public and we are obliged to delete it in accordance with the aforementioned conditions, we will take reasonable steps, including technical measures, taking into account available technology and the cost of implementation, to inform other data controllers who are processing the personal data that you have requested us to delete all links to, or copies or replications of, that personal data.

However, your right to erasure does not apply if processing is necessary for the following reasons (exceptions):

  • To exercise the right to freedom of expression and information;
  • to fulfill a legal obligation which requires processing under Union or Member State law to which we are subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in us;
  • for reasons of public interest in the area of ​​public health pursuant to Art. 9 (2) lit. h and i and Art. 9 (3) GDPR;
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, insofar as the right referred to in (1) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
  • for the establishment, exercise or defense of legal claims.

 

  1. Right to be informed

If you have asserted your right to rectification, erasure or restriction of processing against us, we are obliged to inform all recipients to whom we have disclosed your personal data of the rectification, erasure or restriction of the processing of your data, unless this proves impossible or involves disproportionate effort.

 

  1. Right to data portability

Under the following conditions, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and the right to have this data transmitted to another controller:

  • The processing is based on consent pursuant to Art. 6 (1) lit. a or Art. 9 (2) lit. a GDPR or on a contract pursuant to Art. 6 (1) lit. b and
  • The processing is carried out using automated procedures.

You have the right to request that we transmit your personal data directly to another controller, provided that this is technically feasible and does not infringe upon the rights and freedoms of other persons.

This right to data portability does not apply if the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

  1. Right to object

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on those provisions.

After you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing. This also applies to profiling insofar as it is related to direct marketing.

If you object to the processing of your personal data for direct marketing purposes, we will no longer process it for these purposes.

You have the option, in connection with the use of information society services – notwithstanding Directive 2002/58/EC (Directive on privacy and electronic communications) – to exercise your right to object by means of automated procedures using technical specifications.

 

  1. Right of withdrawal

According to Article 7(3) GDPR, you have the right to withdraw your consent at any time. The withdrawal of consent does not retroactively invalidate the lawfulness of the processing.

 

  1. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority, without prejudice to any other administrative or judicial remedy. In particular, you can exercise your right to lodge a complaint in the Member State of your residence, your place of work, or the place of the alleged infringement if you believe that the processing of your personal data infringes the GDPR.

An overview of the respective state data protection commissioners and their contact details can be found at the following link:

https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html .

 

  1. Updates and changes to this privacy policy

As of November 2018.