Privacy policy

1. Data Protection at a Glance
General Information

We are delighted that you have visited our website and are interested in our company and our products. FlaveAir GmbH attaches great importance to the protection of your personal data. We process personal data exclusively in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and the Telecommunications and Digital Services Data Protection Act (TDDDG).

Personal data refers to any information relating to an identified or identifiable natural person. This includes, for example, your name, address, email address, telephone number, order details, payment information or the IP address of your device.

This privacy policy provides you with comprehensive information about,

  • what personal data we collect,
  • for what purposes we process this data,
  • the legal basis on which the processing takes place,
  • how long personal data is stored,
  • to which recipients data is disclosed,
  • what rights you have as a data subject, and
  • what technical and organisational measures we take to protect your data.

As a general rule, personal data is processed only to the extent necessary to provide a fully functional website, our online shop, our products and services, and to carry out pre-contractual or contractual measures, or where you have expressly consented to such processing.

Data collection on this website
Who is responsible for data collection?

Data processing on this website is carried out by FlaveAir GmbH as the data controller within the meaning of Article 4(7) of the GDPR.

The full contact details of the data controller can be found in section 3 of this privacy policy.

How do we collect your data?

Your personal data is collected in various ways.

Firstly, we collect data that you provide to us voluntarily. This happens, for example, when you

  • place an order,
  • create a customer account,
  • use our contact form,
  • subscribe to our newsletter,
  • contact us by email,
  • exercise your right of withdrawal via the electronic withdrawal button, or
  • make other enquiries to us.

Furthermore, when you visit our website, technical information is automatically collected by our IT systems. This includes, in particular,

  • IP address,
  • date and time of access,
  • browser type and version,
  • operating system used,
  • referrer URL,
  • pages accessed,
  • language settings,
  • device information and
  • other technical log data.

This data is processed automatically as soon as you visit our website.

In addition – depending on the consents you have given via the cookie banner – cookies, similar technologies and analytics and marketing services may be used to statistically analyse the use of our website, improve our services and display interest-based advertising to you.


What do we use your data for?

We process personal data exclusively for the purposes that are permitted and specified in each case.

These include, in particular

  • the provision of our website,
  • the operation of our online shop,
  • the processing and fulfilment of orders,
  • payment processing,
  • the dispatch of our products,
  • the handling of customer enquiries,
  • the management of customer accounts,
  • the handling of cancellation and returns processes,
  • the dispatch of our newsletter,
  • improving our online offering,
  • statistical analysis,
  • fraud prevention,
  • IT security, and
  • marketing activities, provided you have given your consent to this.

No automated decision-making, including profiling within the meaning of Article 22 of the GDPR, takes place, unless otherwise specified in the following sections.

What is the legal basis for the processing?

The processing of personal data is carried out – depending on the processing operation – in particular on the basis of

  • your consent in accordance with Article 6(1)(a) of the GDPR,
  • the performance of a contract or pre-contractual measures in accordance with Article 6(1)(b) of the GDPR,
  • compliance with legal obligations in accordance with Article 6(1)(c) of the GDPR,
  • our legitimate interests in accordance with Article 6(1)(f) of the GDPR, and
  • Section 25 of the TDDDG, insofar as consent is required for the use of cookies or similar technologies.

The relevant legal basis in each case is explained in more detail in the corresponding sections of this privacy policy.


What rights do you have?

In accordance with the statutory provisions, you have the following rights in particular:

  • Right of access under Article 15 of the GDPR,
  • Right to rectification under Article 16 of the GDPR,
  • Right to erasure under Article 17 of the GDPR,
  • Right to restriction of processing under Article 18 of the GDPR,
  • the right to data portability under Article 20 of the GDPR,
  • the right to object under Article 21 of the GDPR,
  • the right to withdraw consent under Article 7(3) of the GDPR, and
  • the right to lodge a complaint with a data protection supervisory authority under Article 77 of the GDPR.

A detailed description of your rights as a data subject can be found in section 9 of this privacy policy.


Security of your data

We implement appropriate technical and organisational security measures to protect your personal data. These include, in particular, modern encryption methods, access restrictions, authorisation policies and measures to ensure the confidentiality, integrity and availability of the data being processed.

Despite all technical security measures, we would like to point out that data transmission over the internet may be subject to security vulnerabilities and that absolute protection against access by third parties cannot be guaranteed.



2. Hosting and operation of our website

We use various technical service providers to ensure the secure, stable and high-performance operation of our online shop. These include, in particular, hosting, content delivery and shop platform service providers, who process personal data exclusively in accordance with legal requirements and – where necessary – on the basis of data processing agreements in accordance with Article 28 of the GDPR.

The processing is carried out for the purpose of providing our online services, ensuring IT security, analysing errors, and executing and processing orders.

The legal bases for the processing are Article 6(1)(b) of the GDPR (performance of a contract), Article 6(1)(c) of the GDPR (legal obligations) and Article 6(1)(f) of the GDPR (legitimate interest in the secure, cost-effective and efficient operation of our online shop).

2.1 Hosting by united-domains

Our domain is managed by

united-domains GmbH
Gautinger Straße 10
82319 Starnberg
Germany

Technical connection data may be processed as part of the technical provision of the domain and DNS management. This includes, in particular, IP addresses, the times of server requests and other technical log data, insofar as this is necessary for the provision of the domain and to ensure system security.

Processing is carried out on the basis of our legitimate interest in the secure and reliable provision of our website in accordance with Article 6(1)(f) of the GDPR.

Further information on data protection can be found at:

https://www.united-domains.de/unternehmen/datenschutz/

2.2 Content Delivery Network (CDN) and security provided by Cloudflare

To protect our website and to improve its loading speed and availability, we use the Content Delivery Network (CDN) and security services provided by

Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
USA

In particular, Cloudflare processes

  • IP address,
  • browser information,
  • device information,
  • timestamps,
  • HTTP requests,
  • referrer,
  • security information and
  • other technical connection data,

in order to detect and prevent attacks on our website, deliver content more quickly and ensure general system security.

Cloudflare acts as an intermediary network service between your device and our servers.

Processing is carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR in

  • the secure provision of our online shop,
  • protection against cyber attacks,
  • high availability of our website and
  • optimised loading speed.

Where personal data is transferred to the United States, this is done on the basis of the EU-US Data Privacy Framework (DPF) and – where necessary – the standard contractual clauses approved by the European Commission in accordance with Article 46 of the GDPR.

Further information can be found at:

https://www.cloudflare.com/privacypolicy/

2.3 Shopify e-commerce platform

Our online shop is operated via the e-commerce platform

Shopify International Limited
2nd Floor, 1–2 Haddington Road
Dublin 4
D04 XN32
Ireland

Shopify provides the technical infrastructure for our online shop and processes personal data to the extent necessary to operate our shop and to process and fulfil orders.

In particular, the following data may be processed:

  • Customer details
  • Contact details
  • Customer account details
  • Billing and delivery addresses
  • Order details
  • Payment information
  • Communication data
  • Device information
  • Browser information
  • IP address
  • Log data
  • Cookies
  • Usage data

The processing is carried out in particular for the purpose of

  • Provision of our online shop,
  • management of customer accounts,
  • processing of orders,
  • technical administration,
  • error analysis,
  • fraud prevention,
  • ensuring IT security, and
  • optimisation of our online offering.

The legal bases for this are

  • Article 6(1)(b) of the GDPR (performance of a contract),
  • Article 6(1)(c) of the GDPR (legal obligations),
  • Article 6(1)(f) of the GDPR (legitimate interest in the secure operation of our online shop).

Shopify may engage further sub-processors in the course of providing its technical services. The processing of personal data takes place exclusively in accordance with the applicable data protection regulations and on the basis of corresponding data processing agreements or other suitable safeguards in accordance with Article 28 or Article 46 of the GDPR.

Where personal data is processed outside the European Economic Area, this is carried out exclusively on the basis of appropriate safeguards under Chapter V of the GDPR, in particular on the basis of the EU-US Data Privacy Framework (DPF) or the Standard Contractual Clauses approved by the European Commission.

Shopify may also transfer personal data to other companies within the Shopify group, insofar as this is necessary for the provision of the shop platform, the fulfilment of contracts or the provision of technical services.

Further information on data protection at Shopify can be found at:

https://www.shopify.com/legal/privacy


2.4 Server log files

Every time our website is accessed, information is automatically recorded in so-called server log files by the hosting and infrastructure service providers we use.

In particular, the following data may be processed:

  • IP address of the accessing device,
  • date and time of access,
  • browser type and version,
  • operating system used,
  • referrer URL,
  • pages and files accessed,
  • HTTP status code,
  • volume of data transferred, and
  • other technical connection information.

This data is processed solely to ensure the smooth operation of the website, to guarantee system security, to analyse errors and to defend against attempts at misuse and attacks.

This data is not combined with other data sources.

The legal basis is Article 6(1)(f) of the GDPR.

Log files are generally deleted after 14 days, unless longer retention is necessary to investigate specific security incidents or to establish, exercise or defend legal claims.

 

3. General information and mandatory details
3.1 Data controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation is:

FlaveAir GmbH
An den Flachsrösten 21
41844 Wegberg
Germany

Telephone: +49 2434 8094196

Email: hello@flave-air.com

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

3.2 Data Protection Officer

FlaveAir GmbH does not have a data protection officer appointed by law. The following contact person is available to deal with data protection enquiries:

Data Protection Contact
Jan-Philipp Francke
Email: jp.francke@flave-air.com

Data subjects may contact our data protection contact person directly at any time should they have any questions regarding data protection or the processing of personal data.

3.3 Principles of data processing

We process personal data exclusively in accordance with the applicable data protection regulations.

In doing so, we observe in particular the principles set out in Article 5 of the GDPR:

  • Lawfulness, processing in good faith and transparency,
  • Purpose limitation,
  • Data minimisation,
  • Accuracy,
  • Storage limitation,
  • Integrity and confidentiality, and
  • Accountability.

Personal data is, as a general rule, only processed to the extent necessary for the provision of our website and our online shop, for the performance of contracts, to comply with legal obligations, or on the basis of consent given by you.

3.4 Legal bases for data processing

Depending on the nature and purpose of the processing in question, we base the processing of personal data on various legal bases under the GDPR.

In particular, the following legal bases may apply:

Article 6(1)(a) of the GDPR

Processing based on your voluntary consent.

This applies in particular to:

  • cookies and similar technologies,
  • analytics and marketing services,
  • newsletters,
  • consent to be contacted,
  • other voluntary information provided.

Consent once given may be withdrawn at any time with effect for the future.

Article 6(1)(b) of the GDPR

Processing for the purpose of taking steps prior to entering into a contract or for the performance of a contract.

This includes, in particular:

  • orders,
  • payment processing,
  • dispatch,
  • customer accounts,
  • processing of cancellations,
  • returns,
  • customer service.

Article 6(1)(c) of the GDPR

Processing for the purpose of complying with legal obligations.

This applies, for example, to

  • retention obligations under commercial law,
  • tax obligations,
  • statutory documentation requirements,
  • statutory obligations to provide evidence.

Article 6(1)(f) of the GDPR

Processing on the basis of legitimate interests.

These include, in particular:

  • IT security,
  • fraud prevention,
  • ensuring secure operations,
  • optimising our online services,
  • enforcing legal claims,
  • internal administrative purposes.

Prior to any processing based on legitimate interests, a balancing of interests is carried out in accordance with Article 6(1)(f) of the GDPR.

Section 25 of the TDDDG

Where information is stored on or read from your device (e.g. cookies or similar technologies), this is done on the basis of the Telecommunications and Digital Services Data Protection Act (TDDDG).

Essential cookies are used on the basis of Section 25(2) of the TDDDG.

For all technologies requiring consent, processing takes place exclusively with your express consent in accordance with Section 25(1) of the TDDDG.

3.5 Recipients of personal data

As part of our business activities, we work with various external service providers.

Personal data is transferred only where

  • this is necessary for the performance of a contract,
  • there is a legal obligation to do so,
  • you have given your consent, or
  • there is a legitimate interest.

Recipients of personal data may include, in particular:

  • hosting service providers,
  • e-commerce platforms,
  • payment service providers,
  • delivery service providers,
  • newsletter service providers,
  • analytics and marketing service providers,
  • IT service providers,
  • tax advisers,
  • public authorities,
  • courts and
  • other recipients authorised by law.

Where external service providers process personal data on our behalf, this is done exclusively on the basis of a data processing agreement in accordance with Article 28 of the GDPR.

3.6 Transfers to third countries

In individual cases, personal data may also be processed outside the European Union or the European Economic Area.

Where personal data is transferred to recipients in so-called third countries, this is done exclusively in compliance with the requirements set out in Articles 44 et seq. of the GDPR.

Suitable safeguards may include, in particular:

  • Adequacy decisions by the European Commission,
  • the EU-US Data Privacy Framework (DPF),
  • Standard Contractual Clauses of the European Commission,
  • other suitable safeguards in accordance with Article 46 of the GDPR.

Further information on this can be found in the descriptions of the individual services set out in this privacy policy.

3.7 Retention period

Unless more specific retention periods are stated in this privacy policy, we store personal data only for as long as is necessary for the respective processing purposes. The data is then deleted, provided that no statutory retention obligations – in particular under the German Commercial Code (HGB) or the German Fiscal Code (AO) – prevent such deletion. In such cases, the data is deleted once the relevant statutory retention periods have expired.

Furthermore, we only store personal data where there are statutory retention obligations or where legitimate interests justify further storage.

In particular, the following retention periods generally apply:

Data category                   Retention period
Server log files                  14 days
Enquiries                            up to 6 months after completion of processing
Newsletter data                 until unsubscription
Double opt-in logs             3 years
Cookie consents                12 months
Consent logs                      3 years
Order and invoicing data   depending on the type of document, generally 6, 8 or 10 years in accordance with statutory                                                     commercial and tax retention obligations

Once the relevant purpose of processing no longer applies and statutory retention periods have expired, personal data is routinely deleted or blocked.

3.8 Data security

To protect your personal data, we implement appropriate technical and organisational security measures in accordance with Article 32 of the GDPR.

These include, in particular:

  • SSL/TLS encryption,
  • role-based access control,
  • access restrictions,
  • firewalls,
  • data backups,
  • security updates,
  • logging,
  • measures to ensure availability, and
  • regular reviews of our security measures.

Our security measures are continuously adapted in line with technological developments.

 

4. Data collection on our website

When you use our website and our online shop, we process personal data to varying degrees. The data processed depends on which functions of our website you use and which consents you provide.

Data processing is carried out exclusively in accordance with the applicable data protection regulations.

4.1 Consent management with Cookiebot

Our website uses the Cookiebot consent management platform provided by

Usercentrics A/S (formerly Cybot A/S)
Havnegade 39
1058 Copenhagen
Denmark.

Cookiebot enables us to obtain, manage and provide evidence of the legally required consents for the use of cookies, similar technologies, and analytics and marketing services.

When you visit our website for the first time, a cookie banner will be displayed, allowing you to decide individually which categories of cookies and technologies you wish to consent to.

In doing so, Cookiebot processes the following data in particular:

  • IP address (truncated or anonymised, where technically possible),
  • time of consent,
  • consent status,
  • browser information,
  • device information,
  • consent ID,
  • URL of the page visited,
  • consent logs.

The consent information is stored so that we can document our compliance with our statutory record-keeping obligations.

The processing of consent and record-keeping data is carried out in accordance with Article 6(1)(c) of the GDPR to fulfil our statutory record-keeping and accountability obligations.

Where Cookiebot stores information on your device or reads it from it, this is done in accordance with Section 25 of the TDDDG.

Consent logs are stored on a regular basis for a period of three years.

Further information can be found at:

https://www.cookiebot.com/de/privacy-policy/

4.2 Contacting us

When you contact us, we process the personal data you provide solely for the purpose of dealing with your enquiry.

You can contact us in particular via

  • the contact form,
  • email,
  • telephone,
  • or other electronic means of communication.

Depending on the nature of your enquiry, the following data in particular may be processed:

  • name,
  • email address,
  • telephone number,
  • order number,
  • content of your message,
  • time of contact,
  • and any other voluntary information.

Mandatory details are limited to the information required to process your enquiry.

Data processing takes place

in accordance with Article 6(1)(b) of the GDPR for contract-related enquiries,
and in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest in efficient customer communication.

If you use our contact form, the data you enter will be processed and stored via the systems of our shop and hosting service provider, Shopify, to the extent necessary to process your enquiry. Data will only be disclosed to other recipients if this is necessary to process your enquiry or if we are legally obliged to do so.

The data will generally be deleted no later than six months after your enquiry has been fully processed, provided that no statutory retention obligations prevent this.

4.3 Customer account

You have the option of creating a personal customer account on our website.

During registration, the following personal data in particular is processed:

  • First name and surname,
  • email address,
  • billing and delivery addresses,
  • password (encrypted),
  • order history,
  • voluntary information.

The customer account enables you, in particular, to

  • streamline the ordering process,
  • view previous orders,
  • manage your personal data,
  • manage your delivery addresses.

Data processing is carried out in accordance with Article 6(1)(b) of the GDPR.

You may have your customer account deleted at any time, provided that there are no statutory retention obligations preventing this.

4.4 Orders and shopping basket

In order to process your order, we process the personal data necessary for the conclusion and fulfilment of the sales contract.

This includes, in particular:

  • Name,
  • Address,
  • Email address,
  • Telephone number (optional),
  • Order details,
  • Payment details,
  • Delivery details,
  • Customer communications.

This data is processed solely for the purpose of contract fulfilment.

The legal basis is Article 6(1)(b) of the GDPR.

The provision of data marked as mandatory fields is necessary for the conclusion and performance of the sales contract. Without this information, we cannot process your order or fulfil the contract. Any further information provided is voluntary.

4.5 Electronic withdrawal button

To comply with legal requirements, we provide consumers with an electronic withdrawal button.

This allows consumers to submit notices of withdrawal regarding concluded sales contracts directly via our website.

For this purpose, we use the Shopify app ‘EU Withdrawal Button’.

When the withdrawal button is used, we process, in particular:

  • name,
  • email address,
  • order number,
  • content of the notice of withdrawal,
  • date and time of submission, and
  • any further information provided voluntarily.

The processing is carried out solely for the purpose of

  • receiving,
  • processing,
  • documenting and
  • handling your withdrawal in accordance with the law.

The legal bases are

  • Article 6(1)(b) of the GDPR,
  • Article 6(1)(c) of the GDPR.

Where technical provision is carried out via an external service provider, the latter processes personal data exclusively on our behalf and in accordance with the applicable data protection regulations.

4.6 Cookies and similar technologies

Our website uses cookies and similar technologies (e.g. local storage or pixel technologies).

Cookies are small text files that are stored on your device and contain certain information.

We distinguish between

Technically necessary cookies

These cookies are necessary to provide the basic functions of our online shop.

These include, for example,

  • shopping basket,
  • login,
  • security,
  • language settings,
  • payment processing,
  • consent management.

These cookies cannot be disabled.

The legal basis is

  • Section 25(2) of the TDDDG,
  • Article 6(1)(f) of the GDPR.

    Analytics and marketing cookies

Analytics and marketing cookies help us to

  • analyse the use of our website,
  • measure reach,
  • evaluate marketing campaigns,
  • display personalised advertising,
  • and continuously improve our online shop.

These technologies are used exclusively with your express consent.

The legal bases are

  • Section 25(1) of the TDDDG,
  • Article 6(1)(a) of the GDPR.

You may withdraw or amend your consent at any time via our cookie banner, with effect for the future.

4.7 Data security for forms

All forms on our website are transmitted exclusively via encrypted SSL/TLS connections.

This ensures that personal data is protected against unauthorised access during transmission.

 

5. Analytics, marketing and advertising services

We use various analytics, tracking and marketing services to optimise the performance of our online shop, analyse the use of our website, and measure the success of and optimise our advertising campaigns.

In particular, these services help us to

  • better understand the use of our website,
  • identify technical errors,
  • continuously improve user-friendliness,
  • measure the success of our marketing campaigns,
  • display interest-based advertising,
  • evaluate conversions, and
  • continuously develop our online offering.

Where cookies or similar technologies are used for this purpose, or where personal data is processed, this is done exclusively on the basis of your explicit consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG.

You may withdraw or amend your consent at any time with future effect via our cookie management tool.

5.1 Google Tag Manager

Our website uses Google Tag Manager provided by

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland.

Google Tag Manager is used exclusively for the management and deployment of various analytics and marketing services.

Google Tag Manager itself

  • does not, as a rule, store any cookies,
  • does not create user profiles and
  • does not carry out any independent analyses.

It merely ensures that other services can be technically integrated.

However, depending on the service integrated, personal data may be processed.

Legal basis:

Article 6(1)(a) of the GDPR.

Further information:

https://policies.google.com/privacy

5.2 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited.

Google Analytics helps us to statistically analyse the use of our website.

In particular, the following information may be processed:

  • IP address (truncated),
  • device information,
  • browser information,
  • operating system,
  • pages visited,
  • time spent on the site,
  • click behaviour,
  • scroll behaviour,
  • session information,
  • referrer,
  • geographical region,
  • language settings,
  • conversion data.

Google Analytics uses cookies and similar technologies to recognise your device.

IP anonymisation is enabled.

We do not directly link this data to you personally.

We use Google Analytics exclusively with your consent.

Legal basis:

  • Article 6(1)(a) of the GDPR
  • Section 25(1) of the TDDDG

Further information:

https://support.google.com/analytics

5.3 Google Ads

We use Google Ads to advertise our products within Google Search and on the Google Display Network.

In doing so, information may be processed regarding

  • ad clicks,
  • conversion events,
  • devices,
  • browsers,
  • location information,
  • ad interactions.

This enables us, in particular, to track

  • which adverts were successful,
  • which campaigns are cost-effective,
  • and which products are in particularly high demand.

Processing takes place exclusively with your consent.

Legal basis:

  • Art. 6(1)(a) GDPR
  • § 25(1) TDDDG

Further information:

https://policies.google.com/privacy

5.4 Google Consent Mode v2

We use Google Consent Mode v2 to manage the Google services we use in a manner that complies with data protection regulations.

Consent Mode enables us to transmit your consent decisions regarding analytics and marketing cookies to Google.

If you do not give your consent, Google services will only be carried out to the extent permitted by law or will be restricted accordingly.

Processing takes place exclusively in accordance with the selection you have made via Cookiebot.

5.5 Meta Pixel (Facebook and Instagram)

Our website uses the Meta Pixel provided by

Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland.

The Meta Pixel enables us to

  • measure the success of our adverts,
  • create visitor groups,
  • serve interest-based adverts,
  • optimise advertising campaigns,
  • track conversions.

In particular, the following information may be processed:

  • IP address,
  • device information,
  • browser information,
  • pages visited,
  • purchases made,
  • shopping basket activity,
  • form interactions,
  • referrers,
  • conversion data,
  • event data.

Meta may link this information to your Facebook or Instagram account, provided you are logged in to it.

We receive only aggregated and statistical analyses.

We do not directly identify individual persons.

Legal basis:

  • Art. 6(1)(a) GDPR
  • § 25(1) TDDDG

Further information:

https://www.facebook.com/privacy/policy

5.6 Meta Conversions API (where used)

Where technically enabled, we also use the Meta Conversions API (CAPI).

The Conversions API enables the server-side transmission of certain event data to Meta in order to evaluate advertising campaigns more reliably and measure their success.

In particular, order and conversion events, as well as pseudonymised identification data, may be processed in this context.

Processing takes place exclusively in accordance with the consent you have given.

Legal bases:

  • Article 6(1)(a) of the GDPR
  • Section 25(1) of the TDDDG

If the Meta Conversions API is not used, this section does not apply.

5.7 Data transfers to third countries

When using the aforementioned services, it cannot be ruled out that personal data may be transferred to companies based outside the European Economic Area, in particular to the United States of America.

Where such a transfer takes place, we base it on the legal requirements set out in Articles 44 et seq. of the GDPR, in particular on:

  • the EU-US Data Privacy Framework (DPF),
  • the European Commission’s Standard Contractual Clauses, or
  • other appropriate safeguards in accordance with Article 46 of the GDPR.

For further information, please refer to the privacy policies of the respective providers.

 

6. Newsletter
6.1 Sending our newsletter

You have the option to subscribe to our newsletter on our website.

Through our newsletter, we regularly keep you informed about

  • the latest news about FlaveAir,
  • new products,
  • special offers,
  • discount campaigns,
  • exclusive offers,
  • competitions,
  • company news and
  • further information about our products and services.

The newsletter is sent out only with your express consent.

The legal basis is Article 6(1)(a) of the GDPR.

6.2 Double opt-in procedure

Subscription to our newsletter is carried out using the so-called double opt-in procedure.

After you have registered, you will first receive an email in which you must confirm your registration again.

Only after this confirmation will your email address be added to our newsletter mailing list.

This ensures that only the actual owner of the email address provided can subscribe to the newsletter.

As proof of your consent, we store the following in particular:

  • email address,
  • time of registration,
  • time of confirmation,
  • IP address,
  • device used (where technically necessary),
  • registration log data.

This data is used solely to provide evidence of proper consent in accordance with Article 7 of the GDPR.

6.3 Newsletter service provider BirdsView GmbH

We use the following platform to send and manage our newsletter:

BirdsView GmbH

Reudnitzer Straße 1
04103 Leipzig
Germany

(hereinafter “BirdsView”).

BirdsView processes personal data exclusively on our behalf and in accordance with our instructions.

In particular, the following data may be processed:

  • Email address,
  • Name (if provided),
  • Subscription date,
  • IP address,
  • Double opt-in logs,
  • Open rates,
  • Click behaviour within the newsletter,
  • Technical delivery information.

Processing is carried out solely for the purpose of

  • sending the newsletter,
  • managing your consent,
  • measuring the performance of our newsletters,
  • improving our content,
  • and technical delivery.

Where BirdsView processes personal data on our behalf, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR.

6.4 Performance measurement

Our newsletters contain so-called tracking technologies.

This enables us, in particular, to determine

  • whether a newsletter has been opened,
  • when a newsletter was opened,
  • which links were clicked on,
  • which content was of particular interest,
  • and which newsletters were successfully delivered.

These evaluations are carried out solely for the purposes of statistical analysis and the continuous improvement of our newsletter service.

Processing is carried out solely on the basis of your consent in accordance with Article 6(1)(a) of the GDPR.

No automated decision-making takes place in this context.

6.5 Withdrawal of your consent

You may withdraw your consent to receive our newsletter at any time with future effect.

You may withdraw your consent, in particular,

  • via the unsubscribe link in each newsletter,
  • by email to hello@flave-air.com,
  • or by any other means by notifying FlaveAir GmbH.

The lawfulness of any data processing carried out up to the point of withdrawal remains unaffected by this.

6.6 Retention period

Your personal data will be stored for the purpose of sending the newsletter for as long as you remain subscribed to it.

Once you have unsubscribed, your email address will generally be deleted from the active newsletter distribution list.

Where necessary to fulfil statutory record-keeping obligations, data relating to the consent given (double opt-in logs) may be stored for a period of up to three years.

In addition, we may store your email address on a so-called blacklist, insofar as this is necessary to prevent the newsletter from being sent again despite your stated withdrawal of consent.

In this case, processing is carried out on the basis of our legitimate interest in accordance with Article 6(1)(f) of the GDPR.

6.7 Contact in connection with orders

Transaction-related emails, in particular

  • order confirmations,
  • dispatch confirmations,
  • information regarding the fulfilment of the contract,
  • security-related notifications or
  • information required by law,

do not constitute a newsletter and are sent irrespective of consent to receive a newsletter, insofar as this is necessary for the performance of the contract or to fulfil legal obligations.

The legal basis for this is Article 6(1)(b) of the GDPR.

 

7. Payment processing, dispatch and order fulfilment

To fulfil your order and meet our contractual obligations, we work with various payment and dispatch service providers.

Personal data is transferred to the respective service providers only to the extent necessary for the fulfilment of the contract.

Processing is carried out on the basis of Article 6(1)(b) of the GDPR.

Where statutory retention obligations apply or you have given your consent, processing is additionally carried out on the basis of Article 6(1)(c) or Article 6(1)(a) of the GDPR.

7.1 Delivery service provider DHL

To deliver your order, we use

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

To arrange delivery, we only pass on to DHL the personal data that is necessary for the delivery.

This includes, in particular:

  • First name and surname
  • Delivery address
  • Billing address (where required)
  • Email address (for tracking purposes, where permitted)
  • Telephone number (if provided voluntarily)
  • Parcel information
  • Order reference

The processing is carried out solely for the purpose of

  • delivering your order,
  • tracking the parcel,
  • notifying you of delivery,
  • communicating with you regarding delivery, and
  • resolving any delivery issues.

The legal basis is Article 6(1)(b) of the GDPR.

Further information can be found at:

https://www.dhl.de/datenschutz

7.2 Shopify Payments

We use Shopify Payments for payment processing.

The provider within Europe is

Shopify International Limited
2nd Floor
1–2 Haddington Road
Dublin 4
Ireland.

When you select Shopify Payments, the personal data required for payment processing will be processed.

This includes, in particular:

  • name,
  • billing address,
  • delivery address,
  • payment amount,
  • order details,
  • payment details,
  • IP address,
  • device information,
  • fraud prevention data.


Data processing is carried out solely for the purpose of completing the payment transaction.
The technical processing of payments is carried out via Shopify Payments, in some cases with the involvement of the Stripe Group. To the extent necessary for the completion of the payment transaction, personal data may be transferred to companies within the Stripe Group and processed there. Processing is carried out exclusively in accordance with the applicable data protection regulations.

The legal basis is Article 6(1)(b) of the GDPR.

Further information can be found at:

https://www.shopify.com/legal/privacy

7.3 PayPal

If you select PayPal as your payment method, the payment will be processed by

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg.

To process the payment, the personal data required for this purpose will be transferred to PayPal.

This applies in particular to

  • name,
  • billing address,
  • payment amount,
  • order details,
  • email address,
  • IP address.

Data processing is carried out solely for the purpose of payment processing.

The legal basis is Article 6(1)(b) of the GDPR.

Further information can be found at:

https://www.paypal.com/de/legalhub/privacy-full

7.4 Klarna

If you select Klarna as your payment method, payment processing is carried out by

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden.

In order to process the payment, the personal data required for this purpose will be transferred to Klarna. This may include, in particular, your name, billing and delivery addresses, email address, telephone number, order details, payment amount and any other data required for payment processing.

The data is processed solely for the purpose of payment processing and – where necessary – for fraud prevention and credit checks by Klarna in accordance with its applicable data protection provisions.

The legal basis is Article 6(1)(b) of the GDPR.

Further information can be found at:

https://www.klarna.com/de/datenschutz/

7.5 Apple Pay

If you select Apple Pay, payment processing is carried out by Apple.

The data protection provisions of Apple Inc. apply in addition.

Further information can be found at:

https://www.apple.com/legal/privacy/

7.6 Google Pay

If you select Google Pay, payment processing is carried out by Google.

The data protection provisions of Google Ireland Limited apply in addition.

Further information can be found at:

https://policies.google.com/privacy

7.7 Fraud prevention

To protect our company and our customers, payment service providers may use automated fraud prevention procedures.

In particular, the following data may be processed:

  • IP address,
  • device information,
  • payment information,
  • order history,
  • location information,
  • technical risk assessments.

The decision on whether to process a payment transaction is taken exclusively by the relevant payment service provider.

FlaveAir does not receive any information regarding internal risk assessments or scoring procedures.

7.8 Storage of contractual data

We store the personal data required to process and document your order.

This includes, in particular:

  • orders,
  • invoices,
  • payment details,
  • delivery details,
  • cancellations,
  • returns,
  • customer communications.

This data is stored in accordance with statutory retention obligations under the German Commercial Code (HGB) and the German Fiscal Code (AO).

The retention period depends on the type of document in question. In accordance with commercial and tax law provisions, this is generally six, eight or ten years. Once the relevant retention period has expired, the data will be deleted, provided there are no other legal or contractual reasons preventing such deletion.

 

8. Other services, social media and final provisions
8.1 Social media presence

We maintain company profiles on various social media platforms, in particular on Instagram, Facebook, TikTok, YouTube and LinkedIn, to provide information about our company, our products and services, and to communicate with prospective and existing customers.

When you visit our social media pages, personal data is processed both by us and by the respective platform operator.

Please note that we do not have complete control over the data processing carried out by the operators of the respective platforms. The scope, nature and purpose of the data processing are governed by the privacy policies of the respective provider.

Depending on the platform, the following data in particular may be processed:

  • IP address,
  • device information,
  • browser information,
  • usage behaviour,
  • interactions with posts,
  • direct messages,
  • comments,
  • likes,
  • shared content,
  • profile data.

Where we receive personal data via the relevant platform, we use it exclusively to process your enquiries, for communication purposes or to provide the information you have requested.

Processing is carried out on the basis of Article 6(1)(f) of the GDPR, based on our legitimate interest in modern corporate communication.

Where consent is required, processing is carried out on the basis of Article 6(1)(a) of the GDPR.

For further information, please refer to the privacy policies of the respective platform operators.

Our website does not currently use any social media plugins that transmit personal data directly to social networks as soon as the website is accessed. Data is therefore generally only transmitted to the operators of our social media pages once you click on a relevant external link or use the respective platform yourself.

8.2 Links to external websites

Our website may contain links to third-party websites.

By clicking on an external link, you will leave our website.

Please note that we have no influence over the content, security or data protection practices of these external websites.

The respective operator is solely responsible for data processing on their respective websites.

Please refer to the applicable data protection policies on those websites.

8.3 Amendments to this Privacy Policy

We reserve the right to amend this privacy policy should this become necessary due to changes in the law, technical developments or the introduction of new services.

The version published at the time of your visit to our website shall apply.

8.4 Questions regarding data protection

If you have any questions regarding the processing of your personal data or the exercise of your rights as a data subject, you may contact us or our data protection officer at any time.

FlaveAir GmbH
An den Flachsrösten 21
41844 Wegberg
Germany

Email: hello@flave-air.com

Data Protection Officer:

Jan-Philipp Francke

Email: jp.francke@flave-air.com

8.5 Date of this Privacy Policy

Date: July 2026

 

9. Rights of data subjects

If your personal data is being processed, you, as a data subject, are entitled to the following rights under the General Data Protection Regulation (GDPR).

9.1 Right of access (Art. 15 GDPR)

You have the right to request, at any time and free of charge, information as to whether and which personal data we process about you.

This includes, in particular, information on

  • the purposes of processing,
  • the categories of personal data,
  • the recipients or categories of recipients,
  • the intended period of storage,
  • the origin of the data, where it was not collected from you,
  • the existence of automated decision-making, including profiling, and
  • appropriate safeguards in the event of data transfers to third countries.


9.2 Right to rectification (Art. 16 GDPR)

You have the right to request the immediate rectification of inaccurate personal data and the completion of incomplete personal data.

9.3 Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided that the legal conditions for this are met.

This right applies in particular where

  • the data is no longer necessary for the original purposes,
  • you withdraw your consent,
  • you have validly objected to the processing,
  • the processing is unlawful, or
  • there is a legal obligation to erase the data.

The right to erasure does not apply where statutory retention obligations or other legal exceptions to erasure apply.

9.4 Right to restriction of processing (Art. 18 GDPR)

You have the right, subject to the statutory conditions, to request the restriction of the processing of your personal data.

For the duration of any restriction, the personal data in question – apart from its storage – may, in principle, only be processed with your consent or in the cases provided for by law.

9.5 Right to data portability (Art. 20 GDPR)

You have the right to receive the personal data you have provided to us and which is processed by automated means in a structured, commonly used and machine-readable format, or – where technically feasible – to request that it be transmitted to another controller.

9.6 Right to object (Art. 21 GDPR)

Where we process personal data on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

Where personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing. This also applies to any profiling insofar as it is related to such direct marketing.

Once you have objected, your personal data will no longer be processed for these purposes.

9.7 Withdrawal of consent (Article 7(3) of the GDPR)

You may withdraw your consent at any time with effect for the future.

This does not affect the lawfulness of the processing carried out prior to the withdrawal.

9.8 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place where the alleged infringement of data protection law occurred.

An overview of the data protection supervisory authorities in Germany can be found on the website of the German Data Protection Conference (DSK).



.