Privacy Policy

1. General information and principles of data processing

We are pleased that you are visiting our website. The protection of your privacy and the protection of your personal data when using our website is important to us.

According to Art. 4 No. 1 GDPR, personal data is any information relating to an identified or identifiable natural person. This includes, for example, information such as your first and last name, your address, your telephone number, your email address, but also your IP address.

Data for which no reference to your person can be established, for example through anonymization, is not personal data. Processing (e.g. collection, storage, retrieval, consultation, use, transmission, erasure or destruction) in accordance with Art. 4 No. 2 GDPR always requires a legal basis or your consent. Processed personal data must be deleted as soon as the purpose of the processing has been achieved and there are no longer any statutory retention obligations to be complied with.

This privacy policy applies only to this website. It does not apply to other websites to which we merely refer via a hyperlink.

2. Responsible body

Responsible for the processing of personal data on this website is:

thedriedfruits Panagiotis Litsios Oberrheinplatz 1 79618 Rheinfelden, Germany

Phone: +49 175 4409589 E-mail: info@thedriedfruits.com

3. Provision and use of the website / server log files

a) Type and scope of data processing

If you use this website, we collect technically necessary data via server log files, which are automatically transmitted to our server, including:

• IP address
• Date and time of the request
• Name and URL of the retrieved file
• Website from which the access is made (referrer URL)
• Access status/HTTP status code
• Browser type
• Language and version of the browser software
• Operating system

b) Purpose and legal basis

This processing is technically necessary in order to display our website to you. We also use the data to ensure the security and stability of our website.

The legal basis for this processing is Art. 6 para. 1 lit. f) GDPR.

c) Storage period

As soon as the aforementioned personal data is no longer required to display the website, it will be deleted. Further storage may take place in individual cases if this is required by law.

4. Local storage (localStorage)

a) Type, scope and purpose of data processing

We use your browser's local storage (localStorage) to save your shopping cart. The products, quantities and variants you have selected are stored locally on your device. This data is not transmitted to our servers unless you complete a purchase.

In addition, we store your cookie selection in local storage under the key cc_cookie. This allows us to recognise on a return visit which categories (essential, analytics, marketing) you have agreed to or declined (see section 10).

b) Legal basis

The use of local storage for the shopping cart is technically necessary; legal basis is Art. 6 para. 1 lit. f) GDPR. The storage of your cookie selection serves to document your consent pursuant to Art. 7 para. 1 GDPR and is permitted without consent under § 25 para. 2 no. 2 TDDDG, as it is strictly necessary for providing the service explicitly requested by you (cookie banner).

c) Storage period

The shopping cart data remains in your browser's local storage until you clear your shopping cart or manually delete the browser data. The cookie selection (cc_cookie) is kept for 6 months unless you reset it earlier yourself.

5. Data collection for the implementation of pre-contractual measures and for contract fulfillment

a) Type and scope of data processing

We collect personal data about you in the pre-contractual area and when the contract is concluded. This concerns, for example, your first and last name, address, e-mail address and telephone number.

b) Purpose and legal basis

We collect and process this data exclusively for the purpose of executing the contract or fulfilling pre-contractual obligations.

The legal basis for this is Art. 6 para. 1 lit. b) GDPR.

c) Storage period

The data will be deleted as soon as it is no longer required for the purpose of its processing. Statutory retention obligations may apply (e.g. retention obligations under commercial or tax law of up to 10 years).

6. Ordering process

You can order products on our website. Payment processing is handled by the external payment service provider Mollie (see section 11).

a) Type and scope of data processing

Our data collection as part of the ordering process includes:

• First and last name
• Delivery address
• E-mail address
• Ordered products and quantities

b) Purpose and legal basis

The purpose of the data processing is the proper handling of your order. The legal basis is Art. 6 para. 1 lit. b) GDPR.

c) Storage period

The data will be deleted as soon as it is no longer required for its purpose. Statutory retention obligations may apply (e.g. tax retention obligations of up to 10 years).

7. Contact form

a) Type and scope of data processing

On our website we offer you the option of contacting us via a provided form. If you use the contact form, the following personal data will be processed:

• Name
• E-mail address
• Subject
• Content of the message

b) Purpose and legal basis

Your e-mail address is used for the purpose of sending you a reply to your inquiry by e-mail. When using the contact form, your personal data will not be passed on to third parties.

The legal basis for processing is Art. 6 para. 1 lit. f) GDPR. There is a legitimate interest in processing in order to handle your concern properly.

c) Storage period

The data you enter in the contact form will remain with us until you request us to delete it or the purpose of data storage no longer applies. Mandatory legal provisions, in particular retention periods, remain unaffected.

8. Contact by e-mail

a) Type and scope of data processing

You can contact us by e-mail. Our data collection is limited to the e-mail address of the e-mail account you used to contact us and the personal data you voluntarily provide as part of the contact.

b) Purpose and legal basis

The purpose of data processing is to be able to respond to your inquiry properly. The legal basis is Art. 6 para. 1 lit. f) GDPR.

c) Storage period

Your personal data will be deleted regularly once the purpose of the communication has been fulfilled and storage is no longer necessary.

9. Newsletter

a) Type and scope of data processing

On our website you can subscribe to our e-mail newsletter, with which we inform you about news, products and offers. For the subscription we process your e-mail address as well as technical data to confirm the subscription (time of subscription and confirmation) and your chosen language.

The subscription uses the so-called double opt-in procedure: after you enter your e-mail address, we send you an e-mail containing a confirmation link. Only when you click this link does your subscription become effective and you are added to our newsletter distribution list. This ensures that the subscription actually originates from you.

As a thank you for subscribing, you receive a single-use discount voucher after confirmation. For this purpose we store the voucher code assigned to you.

The newsletter is sent via our service provider Mailjet SAS (see section 11). For this, confirmed subscriptions are transferred to a contact list maintained at Mailjet.

b) Purpose and legal basis

The purpose of the processing is to send our newsletter with information and advertising about our products. The legal basis is your consent pursuant to Art. 6 para. 1 lit. a) GDPR in conjunction with § 7 para. 2 no. 3 UWG.

c) Withdrawal

You can unsubscribe from the newsletter at any time with effect for the future and thereby withdraw your consent (Art. 7 para. 3 GDPR). To do so, you will find an unsubscribe link in every newsletter e-mail. After unsubscribing, you will be removed from the distribution list. The lawfulness of the processing carried out until the withdrawal remains unaffected.

d) Storage period

Your data is stored for sending the newsletter for as long as your consent exists. After you unsubscribe, you are removed from the active distribution list. If the subscription is not confirmed within a reasonable time, the unconfirmed subscription is deleted.

10. Cookies and consent (Consent Mode)

a) Type and scope

We use cookies and similar technologies (e.g. local storage) on our website. We divide them into two categories:

• Strictly necessary cookies and storage processes: Required to operate the shop (shopping cart, checkout, security, storage of your cookie selection). They are set without your consent because they are strictly necessary for providing the telemedia service you have explicitly requested (§ 25 para. 2 no. 2 TDDDG).
• Optional cookies and storage processes (analytics and marketing): Set only with your explicit consent (§ 25 para. 1 TDDDG, Art. 6 para. 1 lit. a) GDPR).

On your first visit, a cookie banner appears in which you can make your choice (Accept all, Reject all, or individual settings).

b) Google Consent Mode v2

We use Google Consent Mode v2. As long as you have not given consent, the storage areas analytics_storage, ad_storage, ad_user_data and ad_personalization are set to denied by default. In this state, no personal data is transferred to Google or Meta. Only after your consent are the relevant areas set to granted and the associated services (see section 11) activated.

c) Withdrawal

You can withdraw your consent at any time with effect for the future. To do so, click the "Cookie settings" link in the footer. There you can change or completely reset your selection. Optional cookies that have already been set will be deleted automatically upon withdrawal.

d) Storage of the selection

Your cookie selection is stored under the key cc_cookie in your browser's local storage (see section 4).

11. Data transmission and processors

We only pass on your personal data to third parties if this is necessary for contract fulfillment, there is a legal obligation or you have expressly consented.

We use the following external service providers (processors):

Mollie B.V. (Payment processing)

We use Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands for payment processing. When you place an order, your payment data (e.g. credit card data) is transmitted directly to Mollie and processed by Mollie. We do not have access to your complete payment data.

Mollie is a payment service provider established in the EU (Netherlands); your payment data is not transferred to a third country in this process. Further information on data protection at Mollie: https://www.mollie.com/privacy

Legal basis: Art. 6 para. 1 lit. b) GDPR (contract fulfillment).

Mailjet SAS (E-mail delivery)

For sending transactional e-mails (e.g. order confirmations, contact form responses) as well as for sending our newsletter (see section 9), we use Mailjet SAS, 13-13bis Rue de l'Aubrac, 75012 Paris, France. Your e-mail address and the content of the e-mail are transmitted to Mailjet; for the newsletter, your e-mail address is additionally stored in a contact list maintained at Mailjet.

Mailjet processes data within the EU. Further information: https://www.mailjet.com/privacy-policy/

Legal basis: Art. 6 para. 1 lit. b) and f) GDPR (transactional e-mails) and Art. 6 para. 1 lit. a) GDPR (newsletter).

Cloudflare Inc. (Hosting and CDN)

Our website is hosted via Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you visit our website, your requests are routed through Cloudflare's servers. Server log data (e.g. IP address) may be processed.

Cloudflare is certified under the EU-US Data Privacy Framework. Further information: https://www.cloudflare.com/privacypolicy/

Legal basis: Art. 6 para. 1 lit. f) GDPR (legitimate interest in secure and performant provision of the website).

Google Ireland Limited (Google Tag Manager, Web + Server-side / sGTM)

We use Google Tag Manager (GTM) and Server-side Google Tag Manager (sGTM), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager serves as a central tool for controlling additional services (in particular Google Analytics 4 and Meta Pixel/Conversions API). Through sGTM, requests are processed server-side via our own subdomain before being forwarded to the respective endpoints.

GTM itself does not collect personal data. Services controlled via GTM are activated exclusively after your consent (Google Consent Mode v2, see section 10).

Google is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy

Legal basis: Art. 6 para. 1 lit. a) GDPR (consent).

Google Ireland Limited (Google Analytics 4)

For the statistical analysis of website usage we use Google Analytics 4 (GA4). Data collected includes pages visited, time spent, device information and a truncated IP address. We do not perform any identification of individual persons.

GA4 is activated exclusively after your consent in the "Analytics" category. A transfer of data to the USA cannot be excluded. Google is certified under the EU-US Data Privacy Framework.

Storage period: 2 months by default, configurable up to a maximum of 14 months.

Further information: https://policies.google.com/privacy

Legal basis: Art. 6 para. 1 lit. a) GDPR (consent).

Meta Platforms Ireland Limited (Meta Pixel + Conversions API)

For measuring advertising campaigns and remarketing we use the Meta Pixel and the Meta Conversions API (CAPI), provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Data is transmitted to Meta via our Server-side Tag Manager (sGTM), not directly from your browser. Transmitted data includes event data (e.g. page views, purchases, cart actions) and, where applicable, hashed identifiers such as e-mail address for attribution to advertising campaigns.

A transfer to the USA takes place; Meta is certified under the EU-US Data Privacy Framework.

These services are activated exclusively after your consent in the "Marketing" category.

Further information: https://www.facebook.com/privacy/policy

Legal basis: Art. 6 para. 1 lit. a) GDPR (consent).

12. Links to social networks

Our website contains links to the social networks Instagram and TikTok. These links are not social media plugins and do not transfer any data to the respective networks when you merely visit our website. Only when you actively click on a link will you be redirected to the external website. The privacy policies of the respective provider then apply.

13. Data security and protective measures

We are committed to protecting your privacy and treating your personal data confidentially. To this end, we take extensive technical and organizational security precautions, which are regularly reviewed and adapted to technological progress.

This includes the use of recognized encryption methods (SSL/TLS).

14. Telephone contact and AI phone assistant

a) Type and scope of data processing

If you contact us by phone, we process the phone number you provide and the data communicated during the call (e.g. name, request, order data where applicable). Your call is answered and handled by an AI-based phone assistant. The voice content of the call may be processed, converted to text and stored in order to handle your request. By calling, you confirm the contact request and the validity of this privacy policy.

b) Purpose and legal basis

The purpose of processing is to receive and handle your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient customer communication). For the operation of the AI phone assistant we use a service provider as a processor (Art. 28 GDPR): [add provider of the AI phone assistant].

c) Storage period

We process the data only for as long as necessary to handle your request and delete it afterwards, unless statutory retention obligations apply.

15. Voluntary post-purchase survey ("How did you hear about us?")

a) Nature and scope of the data processing

After you have successfully completed an order, we ask you on the confirmation page which channel you first heard about us through (e.g. Instagram, TikTok, Google, friends or other). Taking part is explicitly voluntary; you can skip the survey at any time without any disadvantage. We store only the channel you select from a fixed list of options. There is no free-text field, and in this context we do not store any further personal data such as your name, address or e-mail address.

b) Purpose and legal basis

The purpose of the processing is the statistical evaluation of which channels customers use to find us, so that we can improve our offerings and communication in a targeted way. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in assessing the effectiveness of our channels. As the information is provided voluntarily and is limited to a single selected value, no overriding interests worthy of protection on your part are affected.

c) Storage period

The information is stored linked to the associated order and is deleted together with it as soon as it is no longer required for the stated purposes and no statutory retention obligations prevent deletion.

16. Changes to the privacy policy

We reserve the right to update this declaration as needed at any time.

17. Your rights

Here you will find your rights with regard to your personal data. Details can be found in Articles 7, 15-22 and 77 GDPR. You can contact the responsible body (section 2) in this regard.

• Right of revocation of your data protection consent pursuant to Art. 7 para. 3 sentence 1 GDPR: You can revoke your consent to the processing of your personal data at any time with effect for the future. The lawfulness of the processing carried out until the revocation is not affected.

• Right of access pursuant to Art. 15 GDPR: You have the right to request confirmation as to whether we process personal data concerning you.

• Right to rectification and completion pursuant to Art. 16 GDPR: You have the right to demand the immediate rectification of inaccurate data.

• Right to erasure ("right to be forgotten") pursuant to Art. 17 GDPR: You have a right to erasure insofar as processing is not necessary.

• Right to restriction of processing pursuant to Art. 18 GDPR: You have a right to restriction of processing, e.g. if you believe the personal data is inaccurate.

• Right to data portability pursuant to Art. 20 GDPR: You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format.

• Right to object pursuant to Art. 21 GDPR: You have the right to object at any time, on grounds relating to your particular situation, to the processing of certain personal data concerning you.

• Automated decision-making including profiling pursuant to Art. 22 GDPR: Automated decision-making based exclusively on automated processing, including profiling, does not take place.

• Complaint to a data protection supervisory authority pursuant to Art. 77 GDPR: You can lodge a complaint with a data protection supervisory authority at any time.