1) Information on the collection of personal data and contact details of the controller

1.1) We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how your personal data is handled when you use our website. Personal data is all data that can be used to identify you personally.

1.2) The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Christian Bauer, PNB GmbH, Edeldorfer Weg 1, 92637 Weiden, email: christianbauer@pnb.com.de. The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

1.3) This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller). You can recognize an encrypted connection by the character string "https://" and the lock symbol in your browser bar.

2) Data collection when visiting our website

If you use our website purely for informational purposes, i.e., if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• Domain: Domain: The website we visit
• Anonymized client IP: From which IP the page was accessed
• Timestamp: This indicates the day and time the website was accessed.
• Referer - Client: Path of the target address without the domain. e.g., "/image.jpg".
• Status code: e.g 404
• Referer - Client: Source/reference from which you accessed the page
• User Agent - Client: Type and version of the browser and the operating system used by the visitor.
• Response Body Size: The size of the downloaded files.

Processing is carried out in accordance with Art. 6 (1) (f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used for any other purpose. However, we reserve the right to subsequently review the server log files if there are concrete indications of illegal use.

3) Cookies

No cookies are collected.

4) Contacting Us

When you contact us (e.g., by email), personal data is collected. This data is stored and used exclusively for the purpose of answering your request or for the contact and the associated technical administration. The legal basis for processing this data is our legitimate interest in answering your request in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted after your request has been processed. This will be the case if the circumstances indicate that the matter in question has been conclusively resolved and provided there are no statutory retention periods to the contrary.

5) Use of customer data for direct marketing

5.1 Registration for our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required to receive the newsletter is your email address. Providing additional data is voluntary and will be used to address you personally. We use the so-called double opt-in process to send the newsletter. This means that we will only send you an email newsletter after you have expressly confirmed that you consent to receiving the newsletter. We will then send you a confirmation email asking you to confirm that you wish to receive the newsletter in the future by clicking on a corresponding link.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) (a) GDPR. When you register for the newsletter, we save your IP address entered by your Internet Service Provider (ISP), as well as the date and time of registration, in order to be able to trace any possible misuse of your email address at a later date. The data we collect when you register for the newsletter will be used exclusively for the purposes of advertising via the newsletter. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or you can unsubscribe by sending a corresponding message to the person responsible named above. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to use the data in any other way that is permitted by law and about which we will inform you in this declaration.

The newsletter is processed via rapidmail. https://www.rapidmail.de/

6) Data processing for order processing

6.1 To process your order, we work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information. The personal data we collect will be passed on to the transport company commissioned with the delivery as part of the contract processing, insofar as this is necessary for the delivery of the goods. We will pass on your payment details to the commissioned credit institution as part of the payment processing, insofar as this is necessary for the payment processing. If payment service providers are used, we will explicitly inform you of this below. The legal basis for the transfer of data is Art. 6 (1) (b) GDPR.

6.2 Transfer of personal data to shipping service providers

- Deutsche Post
If the goods are delivered by Deutsche Post (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn), we will pass on your email address to Deutsche Post in accordance with Art. 6 (1) (a) GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing delivery notification, provided you have given your express consent to this during the ordering process. Otherwise, we will only pass on the recipient's name and delivery address to Deutsche Post for the purpose of delivery in accordance with Art. 6 (1) (b) GDPR. This data will only be transferred to the extent necessary for the delivery of the goods. In this case, prior coordination of the delivery date with Deutsche Post or a delivery notification is not possible. Consent can be revoked at any time with future effect by contacting the above-named controller or Deutsche Post.

- DHL
If the goods are delivered by the transport service provider DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn), we will pass on your email address to DHL in accordance with Art. 6 (1) (a) GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or providing delivery notification, provided you have given your express consent to this during the ordering process. Otherwise, we will only pass on the recipient's name and delivery address to DHL for the purpose of delivery in accordance with Art. 6 (1) (b) GDPR. This information will only be passed on to the extent necessary for the delivery of the goods. In this case, prior coordination of the delivery date with DHL or the delivery notification is not possible. Consent can be revoked at any time with future effect by contacting the above-named controller or the transport service provider DHL.

7) Rights of the Data Subject

7.1 Applicable data protection law grants you comprehensive data subject rights (rights to information and intervention) vis-à-vis the controller regarding the processing of your personal data, which we inform you about below:

• Right of information pursuant to Art. 15 GDPR: In particular, you have the right to information about your personal data processed by us, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, the right to lodge a complaint with a supervisory authority, the origin of your data if it was not collected from you by us, the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved and the scope and intended effects of such processing concerning you, as well as your right to be informed of the safeguards in place pursuant to Art. 46 GDPR when transferring your data to third countries;
• Right to rectification pursuant to Art. 16 GDPR: You have the right to have inaccurate data concerning you rectified without undue delay and/or to have incomplete data stored by us completed;
• Right to erasure pursuant to Art. 17 GDPR: You have the right to have your personal data erased if the requirements of Art. 17 (1) GDPR are met. However, this right does not apply, in particular, if processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims;
• Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data as long as the accuracy of your data, which you contest, is being verified; if you refuse to delete your data due to unlawful data processing and instead request the restriction of the processing of your data; if you need your data to assert, exercise, or defend legal claims after we no longer need this data after the purpose has been achieved; or if you have lodged an objection for reasons related to your particular situation, as long as it has not yet been determined whether our legitimate reasons prevail;
• Right to information pursuant to Art. 19 GDPR: If you have asserted your right to rectification, erasure, or restriction of processing vis-à-vis the controller, the controller is obliged to inform all recipients to whom the personal data concerning you was disclosed of said rectification, erasure, or restriction of processing, unless doing so proves impossible or involves disproportionate effort. You have the right to be informed of these recipients.
• Right to data portability pursuant to Art. 20 GDPR: You have the right to receive your personal data that you have provided to us in a structured, common, and machine-readable format or to request that it be transmitted to another controller, where technically feasible;
• Right to revoke consent granted pursuant to Art. 7 (3) GDPR: You have the right to revoke your consent to the processing of data at any time with future effect. In the event of revocation, we will delete the data in question immediately unless further processing can be based on a legal basis for processing without consent. The revocation of consent does not affect the legality of the processing carried out on the basis of the consent until the revocation;
• Right to lodge a complaint pursuant to Art. 77 GDPR: If you believe that the processing of personal data concerning you violates the GDPR, you have – without prejudice to any other administrative or judicial remedy – the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

7.2 Right of Objection

If, as part of a balancing of interests, we process your personal data based on our predominantly legitimate interest, you have the right to object to this processing at any time with future effect for reasons arising from your particular situation.

If you exercise your right of objection, we will stop processing the data in question. However, we reserve the right to further processing if we can demonstrate compelling legitimate grounds for the processing that protect your interests, fundamental rights, and the establishment, exercise, or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purposes of such advertising. You can exercise your objection as described above. If you exercise your right of objection, we will stop processing the data concerned for direct marketing purposes.

8) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of the processing, and – where applicable – also by the respective statutory retention period (e.g., retention periods under commercial and tax law).

When personal data is processed on the basis of express consent in accordance with Art. 6 (1) (a) GDPR, this data will be stored until the data subject revokes their consent.

If statutory retention periods exist for data processed within the framework of legal or quasi-legal obligations based on Art. 6 (1) (b) GDPR, this data will be routinely deleted after the retention periods have expired, provided it is no longer required for the fulfillment or initiation of a contract and/or we no longer have a legitimate interest in continuing to store it.

When personal data is processed on the basis of Art. 6 (1) (f) GDPR, this data will be stored until the data subject exercises their right of objection pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing serves to assert, exercise, or defend legal claims.

When personal data is processed for direct marketing purposes on the basis of Art. 6 (1) (f) GDPR, this data will be stored until the data subject exercises their right of objection pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this declaration regarding specific processing situations, stored personal data will be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.