Privacy policy
Privacy Policy
We are pleased that you are interested in our offerings. Below, we explain how we process your personal data, particularly in connection with an order, and provide additional relevant information in this regard.
1. Who is responsible for processing your personal data?
Groundies GmbH, Heinrich-von-Stephan-Str. 17, 79100 Freiburg, Tel. 0761 – 45 89 29 52, Email: contact@groundies.com, www.groundies.com is the data controller within the meaning of the General Data Protection Regulation (GDPR).
2. Data Protection Contact
For all questions related to the processing of your personal data and the exercise of your rights under the GDPR, you can contact our data protection officer at
datenschutz@Groundies.com.
3. For what purposes and on what legal basis do we process personal data?
We process personal data about you solely for the purpose of fulfilling your order, and only to the extent necessary for this purpose. The legal basis for this is Art. 6(1)(b) of the GDPR. If you contact us for any other reason, we are required by commercial law to retain business correspondence. To the extent that you consent to further use of your data independently of this, the legal basis is Article 6(1)(a) of the GDPR. You may object to such use at any time by sending us a message.
4. What categories of personal data do we process?
We process data regarding your personal information, address, contact information, order details, and bank details that you provide to us in connection with your order or other communications. We process only the data that you yourself provide to us.
“Groundies Society” Loyalty Program
We offer you the opportunity to participate in our “Groundies Society” loyalty program. We use the Influence.io (REVIEWS.io) service to manage the loyalty program.
As part of your participation, personal data is processed, specifically your customer data, email address, order information, membership status, and information about points and rewards earned and redeemed. This processing is carried out exclusively for the purpose of providing and managing the loyalty program, as well as for awarding and redeeming rewards.
The legal basis for this processing is the performance of the contract concluded with you regarding participation in the loyalty program, in accordance with Article 6(1)(b) of the GDPR.
For more information on data processing by Influence.io, please see Influence.io’s Privacy Policy
Participation in the loyalty program is contingent solely on your active registration. Without your explicit participation, you will not become a member of the Groundies Society.
5. From which sources do we obtain personal data if we do not collect it directly from you?
We process only the data that you yourself provide to us.
6. What categories of recipients are there?
We only transfer your personal data to parties necessary for processing your order (parcel service, bank, accounting department).
7. Is the transfer to a third country intended?
We do not intend to transfer data to a third country.
8. How long will your data be stored?
We store your personal data for as long as required for tax purposes.
9. Is access data collected when you use the website?
We, or our hosting provider, collect data on every access to the server (log files) based on legitimate interests (Art. 6(1)(f) GDPR). Access data includes the name of the website accessed, the file, the date, the time, the amount of data transferred, a notification of successful retrieval, the browser type and version, the user’s operating system, the previously visited website, the IP address, and the requesting provider. Log files are stored for security reasons (e.g., to investigate attacks) and for troubleshooting. Any other use (for the purpose of preserving evidence) occurs only in the event of security incidents (e.g., attacks on the website).
We use the following hosting provider: Shopify uses Google Cloud Platform (GCP) at Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. The servers used by Shopify are located in data centers in Europe (EEA, UK, and/or Switzerland). To ensure data processing complies with privacy regulations, we have entered into a data processing agreement with our hosting provider. Our hosting provider will process your data only to the extent necessary to fulfill its service obligations and will follow our instructions regarding this data.
10. Payment Service Providers: PayPal, Shopify Pay, and Billie GmbH
We process payments through the payment service providers PayPal, ShopifyPay, and Billie GmbH, with the following addresses: PayPal (22-24 Boulevard Royal, L-2449 Luxembourg), ShopifyPay (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland), and Billie GmbH (Am Postbahnhof 15, 10243 Berlin). In this context, we share the transaction data with PayPal, ShopifyPay, and Billie GmbH. Without the transfer of your personal data, we cannot process a payment through the aforementioned payment service providers.
PayPal, ShopifyPay, and Billie assume a dual role as data controllers and data processors in their data processing activities. As data controllers, PayPal, ShopifyPay, and Billie use the data you provide to fulfill regulatory obligations. This is based on a legitimate interest (pursuant to Art. 6(1)(f) of the GDPR) and serves the purpose of contract performance (pursuant to Art. 6(1)(b) of the GDPR). We have no influence over this process.
As data processors, PayPal, ShopifyPay, and Billie act to complete transactions within the payment networks. Within the framework of the data processing relationship, PayPal, ShopifyPay, and Billie act exclusively in accordance with our instructions and are contractually bound in accordance with Article 28 of the GDPR.
Groundies GmbH has implemented compliance measures for international data transfers. These apply to all global activities in which Groundies GmbH processes personal data of natural persons in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs).
For more information on your rights to object and request the deletion of your data from Groundies GmbH, please visit: https://groundies.com/policies/refund-policy.
11. Google Analytics
We use the web analytics service Google Analytics. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google uses cookies. The information generated by the cookie regarding your use of the website is generally transmitted to a Google server in the United States and stored there. Google is certified under the EU Data Privacy Framework and is obligated to comply with European data protection law. See Commission Implementing Decision (EU) 2023/1795 of July 10, 2023, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequacy of the level of protection of personal data under the EU-U.S. Privacy Shield (OJ L 231, September 20, 2023, p. 118).
Google will use this information solely on our behalf to evaluate how users interact with our online services. We use Google Analytics only with IP anonymization enabled. Only in exceptional cases is the full IP address transmitted to a Google server and truncated there. The IP address transmitted by the user’s browser is not combined with other data held by Google.
You can prevent cookies from being stored by adjusting your browser settings accordingly. You can also prevent the collection and use of data by installing a browser plugin: http://tools.google.com/dlpage/gaoptout?hl=de.
For more information on Google’s use of data, as well as options for settings and opting out, please visit https://www.google.com/intl/de/policies/privacy/partners (“How Google uses data when you use our partners’ websites or apps”), http://www.google.com/policies/technologies/ads (“Use of data for advertising purposes”), http://www.google.de/settings/ads (“Manage the information Google uses to show you ads”).
We have entered into a data processing agreement with Google and fully comply with the strict requirements of the German data protection authorities regarding the use of Google Analytics. Please note, however, that U.S. authorities and intelligence agencies may, under U.S. law, gain access to personal data that has been transferred to the United States.
12. Google Tag Manager
Google Tag Manager (GTM) is a tool for websites to load additional tools. This is done using so-called tags. GTM is a service provider and processes personal data itself for technically necessary purposes. It ensures that other components are loaded, which may in turn collect data, but it does not access this data.
The providers are Google Ireland Ltd. (service provider), Gordon House, Barrow Street, Dublin 4, Ireland, and Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. To use the features of Google Tag Manager, it is necessary to store your IP address. This information is generally transmitted to a Google server in the United States and stored there. The provider of this site has no influence over this data transfer. We have entered into a contract with Google for commissioned data processing. Please note, however, that U.S. authorities and intelligence agencies may, under U.S. law, gain access to personal data that has been transferred to the United States.
For more information on how Google handles user data, please see Google’s Privacy Policy at https://policies.google.com/privacy?hl=de, the Google Tag Manager Terms of Service at https://support.google.com/tagmanager/answer/7157428?hl=de, and https://marketingplatform.google.com/about/analytics/tag-manager/use-policy/
13. Contact Form
If you submit inquiries to us via the contact form, the information you provide in the form—including the contact details you enter there—will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We will not share this data without your consent. The contact form is encrypted. Data retention complies with the obligations regarding the retention of business correspondence.
14. Newsletter
We hereby provide information about the registration and distribution process for our newsletter, as well as your rights to object. By subscribing to our newsletter, you agree to the procedures described herein. We send newsletters only with the recipients’ consent or when permitted by law.
Subscription to our newsletter is handled via a double opt-in process. After subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can subscribe using someone else’s email address. Newsletter sign-ups are logged to provide proof of the sign-up process in accordance with legal requirements. This includes storing the time of sign-up and confirmation, as well as the IP address. Changes to your data stored with the email service provider are also logged.
Subscription Information: To subscribe to the newsletter, simply provide your email address. Optionally, we ask you to provide a name so we can address you personally in the newsletter.
The newsletter is sent based on the recipients’ consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 7(2)(3) UWG, or based on the statutory authorization pursuant to § 7(3) UWG. The registration process is logged based on our legitimate interests pursuant to Article 6(1)(f) of the GDPR to ensure proof of consent.
You may unsubscribe from our newsletter or revoke your consent at any time. A link to unsubscribe from the newsletter can be found at the end of each newsletter. We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to be able to provide evidence of consent that was previously given. The processing of this data is limited to the purpose of potentially defending against claims.
15. Does our website use cookies?
a) What are cookies?
Our website uses cookies. Cookies are text files that are stored in or by the web browser on the user’s computer system. When a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a unique string of characters that allows the browser to be uniquely identified when the website is visited again.
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some features of our website cannot be provided without the use of cookies. For these features, it is necessary for the browser to be recognized even after changing pages.
The following data is generally stored and transmitted in cookies: name of the pages accessed, file, date, time, browser type and version, user’s operating system, and IP address.
b) Do cookies require your consent?
Cookies generally do not require consent if they are strictly necessary for us to provide you with a service you have expressly requested, or if their sole purpose is to facilitate the transmission of a message via an electronic communications network (necessary cookies).
c) Consent
To the extent that your consent is required for the use of certain cookies, we will not set these cookies when you use the website until you have first given your consent. When you visit our website, we display a cookie banner where you can give your consent to the use of cookies on this website. See section e) below for more information.
We also store your consent in the form of a cookie (“opt-in cookie”) on your device so that, when you visit the website again, we can determine whether you have already given your consent. The opt-in cookie has a limited validity period of 12 months. Essential cookies cannot be disabled via this website’s cookie management feature. However, you can generally disable or delete these cookies in your browser at any time.
If you consent to the use of cookies via the Consent Manager, you will find details and further information regarding the use of this data under the “Privacy Settings” link at the bottom of this website, where you can also change your consent at any time. The legal basis is Art. 6(1)(a) of the GDPR.
d) Managing Cookies in Your Browser
You can also manage the use of cookies in your browser settings. These settings vary depending on the browser. If you disable cookies entirely, some features of the website may not work or may no longer function properly. You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.
e) Cookie Consent with Usercentrics
Our website uses Usercentrics’ cookie consent technology to obtain your consent to the storage of certain cookies in your browser and to document this consent in compliance with data protection regulations. This technology is provided by Usercentrics. When you visit our website, a Usercentrics cookie is stored in your browser, which records the consents you have granted or any revocation of those consents.
The collected data is stored until you request that we delete it, delete the Usercentrics cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention periods remain unaffected. Details regarding the processing of cookie data can be found in the Privacy Policy at
The Usercentrics cookie consent technology is used to obtain the legally required consents for the use of cookies. We have entered into a data processing agreement with Usercentrics. This is a contract required under data protection law that ensures that ## processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
If you consent to the use of cookies via the Consent Manager, you can find details and further information regarding the use of this data under the “Privacy Settings” link at the bottom of this website, where you can also change your consent at any time. The legal basis is Article 6(1)(a) of the GDPR.
16. What rights do you have?
Depending on the specific situation, you have the following data protection rights, which you may exercise at any time by contacting us using the contact information provided in sections 1 and 2:
a) A right of access regarding your personal data processed by us, the purpose of its use, the category of data used, its recipients and those authorized to access it, as well as the planned duration of data storage or the criteria for determining this duration.
b) The right to rectification, erasure, or restriction of processing, or, where applicable, the right to have incomplete personal data concerning you completed.
c) The right to object, insofar as the processing of your personal data is based on Article 6(1)(f) of the GDPR. We will then no longer process this data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
d) A right to withdraw consent at any time if the processing is based on consent, without affecting the lawfulness of the processing carried out on the basis of consent prior to withdrawal.
e) The right to have personal data concerning you erased without delay, provided that:
- it is no longer necessary for the purposes for which it was collected or otherwise processed
- you object pursuant to c) and there are no overriding legitimate grounds for the processing;
- the personal data has been processed unlawfully;
- erasure is necessary to comply with a legal obligation.
This does not apply if the processing is necessary:
- to comply with a legal obligation;
- to assert, exercise, or defend legal claims.
f) A right to restriction of processing, provided that
- you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data,
- the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use;
- we no longer need the personal data for the purposes of processing, but you need it to assert, exercise, or defend legal claims, or
- you have objected to the processing pursuant to c), as long as it has not yet been determined whether our legitimate grounds override yours.
If processing has been restricted, this personal data—apart from its storage—may be processed only with your consent, or for the purpose of asserting, exercising, or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important public interest of the Union or a Member State.
If you have obtained a restriction on processing, we will notify you before the restriction is lifted.
g) A right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place where the alleged infringement occurred, if you believe that the processing of personal data concerning you violates the GDPR. The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information, Lautenschlagerstr. 20, 70173 Stuttgart, Tel.: 0711/615541-0, Fax: 0711/615541-15, Email: poststelle@lfdi.bwl.de
