Privacy Policy
1) Introduction and Contact Details of the Data Controller
1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how your personal data is processed when using our website. Personal data is any information by which you can be personally identified.
1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is One Optic GmbH, Am Schilfpark 23 b, 21029 Hamburg, Germany, Tel.: +49 (0) 40 23 96 98 93, Email: mail@oneoptic.de. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
2) Data Collection When Visiting Our Website
2.1 When you use our website for informational purposes only, meaning if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary to display the website to you:
Our visited website
Date and time of access
Amount of data transferred in bytes
Source/reference from which you accessed the website
Browser used
Operating system used
IP address used (where applicable, in anonymised form)
The processing is carried out in accordance with Article 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used in any other way. However, we reserve the right to subsequently review the server log files if there are concrete indications of unlawful use.
2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries submitted to the controller), this website uses SSL and/or TLS encryption. You can recognise an encrypted connection by the "https://" address and the padlock symbol in your browser's address bar.
3) Hosting & Content Delivery Network
Shopify
We use the services of the following provider to host our website and display its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify").
Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.
All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider to ensure the protection of our website visitors' data and to prohibit any unauthorised disclosure to third parties.
For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
4) Cookies
To make your visit to our website more attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called "session cookies"), while others remain on your device for a longer period and allow website settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of your web browser's cookie settings.
If personal data is processed through individual cookies used by us, such processing is carried out in accordance with Article 6(1)(b) GDPR for the performance of a contract, Article 6(1)(a) GDPR where consent has been given, or Article 6(1)(f) GDPR based on our legitimate interest in ensuring the best possible functionality of the website and a user-friendly and effective browsing experience.
You can configure your browser to notify you when cookies are set and decide individually whether to accept them, or to exclude the acceptance of cookies for certain cases or in general.
Please note that if you do not accept cookies, the functionality of our website may be limited.
5) Contact
5.1 When you contact us (e.g. via the contact form or by email), personal data is processed exclusively for the purpose of handling and responding to your enquiry, and only to the extent necessary for that purpose.
The legal basis for processing this data is our legitimate interest in responding to your enquiry pursuant to Article 6(1)(f) GDPR. If your enquiry is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR. Your data will be deleted once the circumstances indicate that the matter in question has been conclusively resolved, provided that there are no statutory retention obligations to the contrary.
5.2 - Klaviyo
We use the following provider to send transactional emails, i.e. event-related messages triggered by a specific user interaction (such as the conclusion of a contract, registration, or password reset): Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA.
Based on our legitimate interest in effective and user-friendly email communication, we transfer the data you provide when performing such a user action to this provider in accordance with Article 6(1)(f) GDPR so that it can send emails on our behalf.
We have concluded a data processing agreement with the provider to ensure the protection of our website visitors' data and to prohibit any unauthorised disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
6) Data Processing When Opening a Customer Account
In accordance with Article 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it when opening a customer account. The data required for account registration can be found in the input form on the relevant form on our website.
You may delete your customer account at any time by sending a message to the controller at the above-mentioned address. Once your customer account has been deleted, your data will also be deleted, provided that all contracts concluded through the account have been fully performed, no statutory retention obligations apply, and we have no legitimate interest in retaining the data.
7) Use of Customer Data for Direct Marketing
7.1 Registration for Our Email Newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing additional information is voluntary and is used to address you personally. We use the so-called double opt-in procedure for newsletter registration to ensure that you only receive our newsletter after expressly confirming your consent by clicking the verification link sent to the email address you provided.
By activating the confirmation link, you give us your consent to use your personal data in accordance with Article 6(1)(a) GDPR. In doing so, we store the IP address assigned by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later date. The data collected when registering for the newsletter is used strictly for the intended purpose.
You may unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a corresponding message to the controller named above. Once you have unsubscribed, your email address will be removed from our newsletter mailing list without undue delay, unless you have expressly consented to further use of your data or we reserve the right to use your data in another manner that is permitted by law and about which we inform you in this Privacy Policy.
7.2 Klaviyo
Our email newsletters and other promotional email communications are sent through the following provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA.
Based on our legitimate interest in effective and user-friendly email marketing, we transfer the data you provide when subscribing to this provider in accordance with Article 6(1)(f) GDPR so that it can send emails on our behalf.
Subject to your express consent in accordance with Article 6(1)(a) GDPR, the provider also performs statistical analyses of email campaigns using web beacons or tracking pixels embedded in the emails. These technologies can measure open rates and specific interactions with the newsletter content. Device information (e.g. time of access, IP address, browser type, and operating system) is also collected and analysed, but is not combined with other data sets.
You may withdraw your consent to email tracking at any time with effect for the future.
We have concluded a data processing agreement with the provider to ensure the protection of our website visitors' data and to prohibit any unauthorised disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
8) Data Processing for Order Fulfilment
8.1 Transmission of Image Files for Order Fulfilment by Email
On our website, we offer customers the opportunity to personalise products by submitting image files via email. The submitted image will be used as a template for the personalisation of the selected product.
Using the email address provided on our website, customers can send us one or more image files stored on their device. We collect, store, and use these files exclusively for the production of the personalised product in accordance with the respective service description on our website. If the submitted image files are forwarded to specialised service providers for the production and fulfilment of the order, you will be explicitly informed of this in the following sections. No further disclosure will take place. If the submitted files or the digital images contain personal data (in particular images of identifiable persons), all of the processing activities described above are carried out exclusively for the purpose of fulfilling your online order in accordance with Article 6(1)(b) GDPR.
After the order has been fully completed, the submitted image files will be automatically and permanently deleted.
8.2 To the extent necessary for contract fulfilment for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned shipping company and the commissioned financial institution in accordance with Article 6(1)(b) GDPR.
If, under the terms of a corresponding contract, we are required to provide updates for goods with digital elements or for digital products, we will process the contact details you provided when placing your order in order to personally inform you of such updates as part of our legal information obligations pursuant to Article 6(1)(c) GDPR. Your contact details will be used strictly for the purpose of informing you about updates we are required to provide and will only be processed to the extent necessary for this purpose.
To fulfil your order, we also work with the following service provider(s), who support us in whole or in part in the performance of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.
8.3 simpleSell
We use the services of the following provider to prepare shipments: simpleSell GmbH, Im Moos 5, 93462 Lam.
In accordance with Article 6(1)(b) GDPR, we transmit digital shipping labels containing your delivery information exclusively for the purpose of processing your online order from our order processing system to the provider, which then forwards them to our local printers to enable printing. Data is only transferred to the extent actually necessary for order fulfilment.
8.4 - Anthropic Claude
To provide our services, we use artificial intelligence software from the following provider: Anthropic Ireland Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland.
Information you provide within the scope of a contractual relationship may be entered into the provider's software for the purpose of organising, analysing, aggregating, modifying, evaluating, or processing it in connection with the provision of our services.
Information may also be transferred to: Anthropic PBC, USA.
The collection and further processing of this information is carried out strictly for the purpose of fulfilling the contract. Processing for the purpose of training or further developing the provider's AI language models is expressly excluded.
Where the processing also involves personal data, it is carried out on the basis of our legitimate interest in the efficient provision of our services and the optimal use of available resources and technologies in accordance with Article 6(1)(f) GDPR.
We have concluded a data processing agreement with the provider to ensure the protection of personal data processed by the provider and to prohibit any unauthorised disclosure to third parties.
For transfers of data to the USA, the provider relies on the European Commission's Standard Contractual Clauses to ensure compliance with the European level of data protection.
8.5 Electronic Right of Withdrawal Function for Distance Selling Contracts
Consumers who conclude contracts on this website that are subject to a statutory right of withdrawal have the option of exercising this right via an electronic withdrawal function in accordance with the applicable withdrawal provisions.
To provide the electronic withdrawal function, we use a solution from the following provider: EU Widerruf App.
When using the withdrawal function, in addition to the information required to identify the contract to be withdrawn from, further personal information such as the consumer's first and last name and email address must be provided or confirmed.
This information is initially collected by the provider on the basis of our legitimate interest in a user-friendly, stable, and process-optimised solution pursuant to Article 6(1)(f) GDPR. It is then used to confirm receipt of the withdrawal declaration by email on our behalf and subsequently transmitted to us. We then process the transmitted information for the proper handling of the withdrawal in accordance with Article 6(1)(b) GDPR and Article 6(1)(c) GDPR on the basis of our legal obligation to provide an electronic withdrawal function for chargeable distance selling contracts with consumers.
The information collected by the provider will be routinely deleted after the withdrawal has been fully processed, provided that no statutory retention obligations apply.
We have concluded a data processing agreement with the provider to ensure the protection of data processed within the scope of the withdrawal function and to prohibit any unauthorised disclosure to third parties.
9) Website Functionalities
9.1 - Google reCAPTCHA
This website uses the CAPTCHA service provided by the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.
Data may also be transferred to: Google LLC, USA.
For the visual design of the CAPTCHA window, the provider uses "Google Fonts", i.e. fonts loaded from Google via the Internet. No additional information other than that already transmitted to Google through the functionality of reCAPTCHA is processed.
The service checks whether an input is made by a natural person or abusively through automated and machine processing, and prevents spam, DDoS attacks, and similar automated malicious activities. To ensure that an action is performed by a human rather than an automated bot, the provider collects the IP address of the device used, identification data of the browser and operating system used, as well as the date and duration of the visit, and transmits this information to the provider's servers for evaluation. Cookies, i.e. small text files stored in the browser of the device used, may also be used.
If the processing described above is based on the use of cookies, these will only be set if you have given us your express consent in accordance with Article 6(1)(a) GDPR. You may withdraw your consent at any time with future effect by disabling this service in the "Cookie Consent Tool" provided on the website.
If the processing described above is carried out without the use of cookies, the legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR in verifying individual responsibility on the Internet and preventing misuse and spam.
We have concluded a data processing agreement with the provider to ensure the protection of our website visitors' data and to prohibit any unauthorised disclosure to third parties.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
9.2 Google Translate
This website uses the translation service "Google Translate" via an API integration provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). To automatically display the translation into your selected language, your browser connects to Google's servers. During this process, certain browser information, including your IP address, is transmitted to Google.
Google may use so-called "cookies", i.e. small text files stored on your device, to save your language preferences. The information generated by the cookie about your use of this website (including the shortened IP address) is generally transmitted to a Google server and stored there.
The processing described above may also involve the transfer of data to the servers of Google LLC in the USA.
If cookies are set when using Google Translate, the processing described above will only take place if you have given us your express consent in accordance with Article 6(1)(a) GDPR. You may withdraw your consent at any time with future effect by disabling this service in the "Cookie Consent Tool" provided on the website.
If no cookies are set, the processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in the optimal marketing of our services and the broad accessibility of our website.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
Further information on Google's privacy policy can be found here: https://business.safety.google/intl/en/privacy/
9.3 Google Customer Reviews (formerly Google Certified Shops Program)
We participate in the "Google Customer Reviews" programme offered by Google. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This programme enables us to collect customer reviews from users of our website. After using our services, you will be asked on our website whether you would like to participate in a Google email survey.
If you give your consent in accordance with Article 6(1)(a) GDPR, we will transmit your email address to Google. You will receive an email from Google Customer Reviews asking you to rate your purchase experience on our website. The review you submit will then be combined with our other reviews and displayed in our Google Customer Reviews badge and in our Merchant Center dashboard. Your review will also be used for Google Seller Ratings. As part of the use of Google Customer Reviews, personal data may also be transferred to the servers of Google LLC in the USA.
You may withdraw your consent at any time by notifying the controller responsible for data processing or Google.
For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
Further information on Google's privacy policy can be found here: https://business.safety.google/intl/en/privacy/
10) Tools and Miscellaneous
Billbee
We use the cloud-based accounting software service provided by the following provider for our bookkeeping: Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany.
The provider processes incoming and outgoing invoices and, where applicable, our company's banking transactions in order to automatically record invoices, match them to transactions, and generate financial accounting records through a partially automated process.
Where personal data is also processed in this context, the processing is carried out on the basis of our legitimate interest in the efficient organisation and documentation of our business processes in accordance with Article 6(1)(f) GDPR.
11) Rights of the Data Subject
11.1 Under applicable data protection law, you have the following rights as a data subject with regard to the processing of your personal data by the controller (rights of access and intervention), whereby reference is made to the legal basis stated for the respective conditions of exercise:
Right of access pursuant to Article 15 GDPR;
Right to rectification pursuant to Article 16 GDPR;
Right to erasure pursuant to Article 17 GDPR;
Right to restriction of processing pursuant to Article 18 GDPR;
Right to be informed pursuant to Article 19 GDPR;
Right to data portability pursuant to Article 20 GDPR;
Right to withdraw consent granted pursuant to Article 7(3) GDPR;
Right to lodge a complaint pursuant to Article 77 GDPR.
11.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST FOLLOWING A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH FUTURE EFFECT ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENCE OF LEGAL CLAIMS.
IF WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING PURPOSES. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.
12) Retention Period for Personal Data
The retention period for personal data is determined by the applicable legal basis, the purpose of processing and – where applicable – the relevant statutory retention period (e.g. retention periods under commercial and tax law).
Where personal data is processed on the basis of your express consent pursuant to Article 6(1)(a) GDPR, such data will be stored until you withdraw your consent.
Where statutory retention periods apply to data processed within the scope of contractual or quasi-contractual obligations on the basis of Article 6(1)(b) GDPR, such data will be routinely deleted after the expiry of the applicable retention periods, provided that it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in retaining it.
Where personal data is processed on the basis of Article 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Article 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.
Where personal data is processed for direct marketing purposes on the basis of Article 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Article 21(2) GDPR.
Unless otherwise stated in the other information contained in this Privacy Policy regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.
