Privacy Policy

1) Introduction and Contact Details of the Data Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data includes all data that can be used to personally identify you.
1.2 The data controller for the processing of data on this website within the meaning of the General Data Protection Regulation (GDPR) is Lounu UG (limited liability), Tannenhof 7, 45661 Recklinghausen, Germany, Tel.: 01733239013, Email: info@lounu.de. The data controller for the processing of personal data is the natural or legal person that alone or jointly with others decides on the purposes and means of processing personal data.

 

2) Data Collection When Visiting Our Website

2.1 When you use our website solely for informational purposes, i.e., when you do not register or otherwise provide us with information, we only collect the data that your browser transmits to the page server (so-called “server log files”). When you access our website, we collect the following data that is technically necessary for us to display the website to you:
- The website we visited
- Date and time of access
- Amount of data sent in bytes
- Source/referral from which you accessed the page
- Browser used
- Operating system used
- IP address used (if applicable: in anonymized form)
Processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not disclosed or used in any other way. However, we reserve the right to review the server log files ex post facto should there be concrete indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to us), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the “https://” string and the padlock symbol in your browser bar.

 

3) Hosting & Content Delivery Network

3.1 Shopify
For the hosting of our website and the display of page content, we use the system of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.
All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider, which ensures the protection of our page visitors' data and prohibits unauthorized disclosure to third parties.
In the event of a data transfer to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
3.2 Shopify
We use a Content Delivery Network from the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)
Data may also be transferred to:
- Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
- Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA
This service allows us to deliver large media files such as graphics, page content, or scripts faster via a network of regionally distributed servers. Processing takes place to safeguard our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider, which ensures the protection of our page visitors' data and prohibits unauthorized disclosure to third parties.
In the event of a data transfer to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
For data transfers to the USA, the data recipient has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

 

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e., small text files that are stored on your end device. Some of these cookies are automatically deleted again when the browser is closed (so-called “session cookies”), while some cookies remain on your end device longer and enable the storage of page settings (so-called “persistent cookies”). In the latter case, you can find out the storage duration in the overview of your web browser's cookie settings.
If any of the cookies we use process personal data, the processing takes place in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in the case of granted consent in accordance with Art. 6(1)(a) GDPR, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.
You can set your browser so that you are informed about the setting of cookies and can decide individually on their acceptance or exclude the acceptance of cookies for certain cases or generally.
Please note that if cookies are not accepted, the functionality of our website may be limited.

 

5) Contact

When contacting us (e.g., via a contact form or email), personal data is processed – exclusively for the purpose of processing and answering your request and only to the extent required for this purpose.
The legal basis for the processing of this data is our legitimate interest in answering your request in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent this.

 

6) Data Processing for Order Fulfillment

6.1 As far as necessary for contract fulfillment for delivery and payment purposes, the personal data we collect is passed on to the appointed transport company and the appointed credit institution in accordance with Art. 6(1)(b) GDPR.
If we owe you updates for goods with digital elements or for digital products based on a corresponding contract, we process the contact data you provided when ordering to personally inform you within the scope of our statutory information obligations in accordance with Art. 6(1)(c) GDPR. Your contact data is strictly used for purpose-bound notifications about updates we owe and is only processed by us to the extent required for the respective information.
6.2 Disclosure of Personal Data to Shipping Service Providers
- DHL
As a transport service provider, we use the following provider: DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany.
In accordance with Art. 6(1)(a) GDPR, we pass on your email address and/or phone number to the provider before the delivery of the goods for the purpose of coordinating a delivery date or for the delivery notification, provided that you have given your express consent to this in the ordering process. Otherwise, for the purpose of delivery in accordance with Art. 6(1)(b) GDPR, we only pass on the name of the recipient and the delivery address to the provider. The disclosure takes place only insofar as this is necessary for the delivery of the goods. In this case, prior coordination of the delivery date with the provider or the delivery notification is not possible.
You can revoke the consent at any time with future effect towards the data controller designated above or towards the provider.
6.3 Use of Payment Service Providers (Payment Services)
- PayPal Checkout
This website uses PayPal Checkout, an online payment system from PayPal, which consists of PayPal's own payment methods and local payment methods from third-party providers.
When paying via PayPal, credit card via PayPal, direct debit via PayPal, or – if offered – “Pay Later” via PayPal, we pass on your payment data within the scope of payment processing to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”). The disclosure takes place in accordance with Art. 6(1)(b) GDPR and only insofar as this is necessary for payment processing.
PayPal reserves the right to perform a credit check before payment for the payment methods credit card via PayPal, direct debit via PayPal, or – if offered – “Pay Later” via PayPal. For this purpose, your payment data may be passed on to credit reporting agencies in accordance with Art. 6(1)(f) GDPR on the basis of PayPal's legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check in terms of the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method. The credit check may contain probability values (so-called score values). Insofar as score values are included in the result of the credit check, they are based on a scientifically recognized mathematical-statistical method. Among others, but not exclusively, address data flows into the calculation of the score values. You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still be entitled to process your personal data if this is necessary for the contractual payment processing.
If the PayPal payment method “Invoice” is available and selected, your payment data is initially transmitted to PayPal to prepare the payment, after which PayPal forwards it to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (“Ratepay”) to carry out the payment. The legal basis is always Art. 6(1)(b) GDPR. In this case, RatePay conducts an identity and credit check in its own name to determine creditworthiness according to the principle already mentioned above and passes on your payment data to credit reporting agencies based on the legitimate interest in determining creditworthiness in accordance with Art. 6(1)(f) GDPR. You can find a list of the credit reporting agencies that Ratepay can access here: https://www.ratepay.com/legal-payment-creditagencies/
When using a local third-party payment method, your payment data is initially passed on to PayPal in accordance with Art. 6(1)(b) GDPR to prepare the payment. Depending on your selection of an available local payment method, PayPal then transmits your payment data to the respective provider in accordance with Art. 6(1)(b) GDPR to carry out the payment:
- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
- iDEAL (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
- BLIK (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
- EPS (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2 1200 Vienna, Austria)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)
For further data protection information, please refer to PayPal's privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- Shopify Payments
One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
When selecting a payment method from the provider where you make an advance payment (e.g., credit card payment), your payment data shared during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the content of your order are passed on to them in accordance with Art. 6(1)(b) GDPR. In this case, the disclosure of your data takes place exclusively for the purpose of payment processing with the provider and only insofar as it is necessary for this purpose.
6.4 Electronic Revocation Function for Distance Contracts
Consumers who conclude contracts on this website for which a statutory right of withdrawal exists have the option to declare the withdrawal via an electronic revocation function in accordance with the applicable withdrawal provisions.
When using the revocation function, in addition to information identifying the contract to be revoked, other personal information such as the consumer's first and last name as well as their email address must also be provided or confirmed.
The collection of this information and its transmission to us takes place in accordance with Art. 6(1)(b) GDPR and only insofar as it is necessary for the proper processing of the revocation. Also on the basis of Art. 6(1)(b) GDPR, the provided personal data is used to confirm the receipt of the revocation declaration via email. Another legal basis for processing is Art. 6(1)(c) GDPR. We are legally obliged to provide an electronic revocation function for paid consumer distance contracts.

 

7) Web Analysis Services

Google Tag Manager
This website uses the “Google Tag Manager”, a service from the following provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).
The Google Tag Manager provides a technical basis for bundling various web applications, including tracking and analysis services, and for calibrating, controlling, and making them conditional on conditions via a single user interface. The Google Tag Manager itself does not store any information on user devices or read it. The service also does not perform independent data analysis. However, when visiting a page, your IP address is transmitted to Google via the Google Tag Manager and may be stored there. Transmission to servers of Google LLC. in the USA is also possible.
This processing only takes place if you have given us your express consent to this in accordance with Art. 6(1)(a) GDPR. Without this consent, the use of Google Tag Manager during your page visit is omitted. You can revoke your granted consent at any time with future effect. To exercise your revocation, please deactivate this service in the “Cookie Consent Tool” provided on the website.
We have concluded a data processing agreement with the provider, which ensures the protection of our page visitors' data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.
Further legal notices regarding Google Tag Manager can be found at https://policies.google.com/privacy?hl=de&gl=de.

 

8) Page Functionalities

8.1 Judge.me
Graphic elements from the following provider are embedded on our website to display external customer reviews and/or an externally awarded seal of approval: Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB, United Kingdom.
When you access a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider's servers to load the elements properly. Certain browser information, including your IP address, is transmitted to the provider.
If personal data is also processed during this process, it takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in optimally marketing our offer and appealingly designing our online presence.
We have concluded a data processing agreement with the provider, which ensures the protection of our page visitors' data and prohibits unauthorized disclosure to third parties.
In the event of a data transfer to the provider's location, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
8.2 - hCaptcha
On this website, we use the CAPTCHA service from the following provider: Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA
The service checks whether an input is made by a natural person or abusively by machine and automated processing, and blocks spam, DDoS attacks, as well as similar automated malicious access. To ensure that an action is performed by a human and not by an automated bot, the provider collects the IP address of your used end device, identification data of your used browser and operating system type, as well as the date and duration of your visit, and transmits this for evaluation to the provider's servers.
The legal basis is our legitimate interest in determining individual personal responsibility on the internet and avoiding abuse and spam in accordance with Art. 6(1)(f) GDPR.
We have concluded a data processing agreement with the provider, which ensures the protection of our page visitors' data and prohibits unauthorized disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

 

9) Tools and Other Items

9.1 sevDesk
For bookkeeping purposes, we use the cloud-based accounting software service provided by the following provider: sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany
The provider processes incoming and outgoing invoices and, where applicable, our company's bank transactions to automatically record invoices, match them to transactions, and create financial accounting records in a partially automated process.
We have entered into a data processing agreement with the provider, which ensures the protection of our customers' data and prohibits unauthorized disclosure to third parties.
If personal data is also processed in this context, the processing is based on our legal obligation to maintain proper records in accordance with Art. 6(1)(c) GDPR.
9.2 Cookie Consent Tool
This website uses a so-called "cookie consent tool" to obtain valid user consent for cookies requiring consent and cookie-based applications. The "cookie consent tool" is displayed to you in the form of an interactive user interface when you visit the site, where you can grant consent to specific cookies and/or cookie-based applications by ticking the corresponding boxes. By using the tool, all cookies/services requiring consent are only loaded if you grant the corresponding consent by ticking the relevant boxes. This ensures that such cookies are only set on your respective device if consent has been granted.
The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context.
If personal data (such as an IP address) is processed in individual cases for the purpose of storing, assigning, or logging cookie settings, this is done pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in ensuring legally compliant, user-specific, and user-friendly cookie consent management and, consequently, a legally compliant design of our website.
Another legal basis for processing is Art. 6(1)(c) GDPR. As the data controller, we are legally obliged to make the use of cookies that are not technically necessary dependent on the respective user's consent.
Where necessary, we have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.
Further information about the operator and the adjustment options of the cookie consent tool can be found directly in the corresponding user interface on our website.

 

10) Data Subject Rights

 

10.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) against us as the data controller regarding the processing of your personal data, whereby the respective requirements for exercising each right are set out in the cited legal basis:
- Right of access pursuant to Art. 15 GDPR;
- Right to rectification pursuant to Art. 16 GDPR;
- Right to erasure pursuant to Art. 17 GDPR;
- Right to restriction of processing pursuant to Art. 18 GDPR;
- Right to be informed pursuant to Art. 19 GDPR;
- Right to data portability pursuant to Art. 20 GDPR;
- Right to withdraw consent pursuant to Art. 7(3) GDPR;
- Right to lodge a complaint pursuant to Art. 77 GDPR.
10.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTERESTS AFTER WEIGHING THE INTERESTS INVOLVED, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO SUCH PROCESSING FOR GROUNDS RELATED TO YOUR PARTICULAR SITUATION WITH EFFECT FOR THE FUTURE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPULSORY PROTECTIVE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING IS NECESSARY FOR THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES. YOU MAY EXERCISE THIS RIGHT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

 

11) Duration of Storage of Personal Data

The duration for which personal data is stored is determined by the respective legal basis, the purpose of processing and, where applicable, additionally by the respective statutory retention period (e.g., commercial and tax retention periods).
When personal data is processed on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.
If statutory retention periods apply to data processed pursuant to Art. 6(1)(b) GDPR in connection with or similar to contractual obligations, this data will be routinely deleted after the retention periods expire, unless it is no longer required for the performance or establishment of the contract and/or we no longer have a legitimate interest in continuing to store it.
When personal data is processed pursuant to Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling protective grounds for processing that override your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims.
When personal data is processed for direct marketing purposes pursuant to Art. 6(1)(f) GDPR, this data will be stored until you exercise your right to object pursuant to Art. 21(2) GDPR.
Unless the other information in this declaration indicates otherwise regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Copyright Notice

This privacy policy was created by the IT Law Attorneys at IT-Recht Kanzlei and is protected by copyright (https://www.it-recht-kanzlei.de)

As of 22.10.2026