Lade Rechtliche Seite...
Timon Schenkbier, Einzelunternehmen, Orleansstr. 32, 31135 Hildesheim Email: to follow
This website runs on servers of Hetzner Online GmbH, Gunzenhausen (servers in Germany). The database (PostgreSQL) and all files are stored on this server. A data processing agreement exists with the provider (Art. 28 GDPR). The data is processed on servers in Germany.
When you visit, our server stores technically necessary access data (IP address, date and time, page requested, amount of data transferred, browser identifier) in log files to ensure operation and security (Art. 6(1)(f) GDPR, legitimate interest in secure operation). We keep log data for at most 14 days and delete it afterwards.
Product images that come from partner companies are fetched by our server and delivered to you in optimised form from our own domain. Your browser does not contact the partners' servers for this.
For an account we store your email address and the details you give in your profile. Sign-in is passwordless through a link we send to your email address. The legal basis is performance of the user contract (Art. 6(1)(b) GDPR).
We send emails through our own mail server. Delivery runs through a mail relay of STRATO GmbH (Berlin), which technically processes the sender, the recipient address and the content of the message. A data processing agreement exists between us and the provider.
After sign-in we set a session cookie (30 days) so that you stay signed in. We keep your account data until you delete your account; afterwards we delete it unless a legal retention duty applies (see section 7). You can delete your account at any time or ask us by email to do so.
If you write diary entries or posts and upload images, we store this content together with your profile and the time on our servers. Your settings and the type of post decide whether other users can see it (Art. 6(1)(b) GDPR).
Please do not upload images in which other people are recognisable unless they have consented. Images can contain additional information (for example the place of capture). We keep it until you delete it or your account. You can delete your content yourself at any time; when you delete your account we also delete your content, unless a legal obligation prevents it.
Some features of the website (for example evaluations, suggestions or descriptions) use artificial intelligence. For this we send your input (text and, where applicable, images) that you enter here to an AI service and return the answer to you. Depending on the configuration this is OpenRouter (OpenRouter, Inc., USA), which forwards the input to Google AI models (Gemini), or Google directly (Vertex AI or Gemini API of Google Cloud). Use is voluntary; without these features you can use the rest of the website. The legal basis is performance of the function you request (Art. 6(1)(b) GDPR). We label AI answers as such. We store your conversations with the AI assistant in your account until you delete them or your account; raw text in technical logs is deleted after at most 14 days.
Your input may be processed in a country outside the EU, in particular the USA. We base the transfer on appropriate safeguards under Art. 44 et seq. GDPR (for example standard contractual clauses or the EU-US Data Privacy Framework where the provider is certified).
Please do not enter health data or real names or other personal details of third parties in AI features. We do not use your input to make decisions about you with legal effect; there is no automated decision-making under Art. 22 GDPR.
We show certain items (smoking accessories and vaporizers) only after you confirm that you are at least 18 years old. For this we set a cookie (grv-alter) after your click that contains only the time of confirmation and a signature, no details about you. We do not check ID and do not store ID data. The legal basis is our legitimate interest in youth-protection-compliant sales (Art. 6(1)(f) GDPR, section 25(2) no. 2 TDDDG). The cookie is valid for 180 days; the time of confirmation given with an order is stored with the order data (section 7).
For an order we process your name, email address, delivery address, optionally your phone number, the goods ordered, the time of your age confirmation and the payment method. The purpose is performance of the contract of sale (Art. 6(1)(b) GDPR). Without these details we cannot fulfil the order. Your browser stores the cart locally (localStorage) until you empty it.
We pass the data needed for delivery (name, delivery address, goods ordered, email address or phone number if needed) to the partner company that ships your order directly to you on our behalf, and from there to its shipping service provider. If you order from several partners, each partner receives only the data of its own shipment. We do not pass data on for advertising.
We keep order data for as long as commercial and tax retention periods require (up to ten years, Art. 6(1)(c) GDPR). After this mandatory retention period of 10 years (section 147 AO, section 257 HGB) we pseudonymise the data so that it can no longer be attributed to you; the booking record remains for accounting. Until then we use it only for those obligations.
You currently pay for smoking accessories and vaporizers in advance by bank transfer. We receive your name, account details and payment reference from your bank. If we offer another payment method for other items, we will first add the payment provider to this policy.
We use technically necessary cookies and comparable storage (section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR): a session cookie for sign-in (30 days), the age confirmation (180 days), access cookies for protected areas (30 days), the language choice, the choice between light and dark display (1 year), your cookie choice (180 days) and the cart in local storage. If you arrive through a referral or campaign link, we remember the code it contains for 30 days so that a later sign-up or order is attributed correctly. A complete list with durations is in the cookie policy. When a referral code is redeemed, we log the attempt (code, result and irreversible checksums of IP address and browser identifier) to detect abuse (Art. 6(1)(f) GDPR); we delete these entries after 90 days.
We load services that need consent only if you agree in the cookie notice (section 25(1) TDDDG, Art. 6(1)(a) GDPR). This concerns only the audience measurement with Umami, which we host ourselves; there is no external recipient. Without your consent no audience measurement runs, and we do not use third-party advertising or tracking services. You can change your choice at any time in the footer of the page. To prove your choice we store a record with the time and one irreversible checksum each of IP address and browser identifier (Art. 6(1)(c) GDPR, proof obligation); we delete it after three years at the latest.
On the page for supply partners you can upload a product file (CSV or XLSX, up to 5 MB) using the partner code from your invitation. We store the file, its name, size, a checksum and the time in our database and assign it to your company through the partner code; the partner code itself exists only as an irreversible checksum. The file usually contains product and price data but may also contain names and contact details of contact persons. An administrator checks the file and triggers the import. The purpose is to take on and maintain your range (Art. 6(1)(b) GDPR, pre-contractual measures and performance of the cooperation).
To protect against abuse we use a hidden form field and limit the number of uploads per IP address (6 per hour) and per partner (20 per day). The IP address is counted only briefly in the server's working memory for this and not stored permanently (Art. 6(1)(f) GDPR, legitimate interest in secure operation).
We keep uploaded files until the import has been done or rejected and delete them 90 days afterwards. The imported product data remain part of our range as long as we work together.
If you write to us through the contact form, we process your name, email address and message in order to reply (Art. 6(1)(b) GDPR where the message relates to a contract or contract initiation, otherwise (f) GDPR, legitimate interest in answering enquiries). The message reaches us as an email (delivery through the mail server and relay named in section 3). To protect against abuse we limit the number of messages per IP address; the IP address is counted only briefly in working memory for this.
We delete enquiries without a business context at the latest twelve months after processing is finished. If the message belongs to a business transaction (commercial letter), we keep it for up to six years (section 257 HGB, section 147 AO).
Recipients of your data, as described above, are: our hosting provider, the email delivery provider, the AI service (only if you use AI features) and the delivering partner company including its shipping service provider. Files and messages from sections 10 and 11 are seen only by us. Beyond that we pass data on only if there is a legal obligation.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Contact to follow for this. You can also get access and a data export directly in your account.
You can lodge a complaint with a data protection supervisory authority, for example with: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, poststelle@lfd.niedersachsen.de