Privacy Notice

This privacy notice explains how personal data is processed when you visit our website, place orders in our online shop or contact AUTOMATICFLOW.

1. Controller and contact details

Please use these contact details for privacy enquiries or to exercise your data protection rights.

2. Purposes and legal bases

We process personal data to provide our website, respond to enquiries, handle orders, deliver goods and meet our legal obligations.

• Contracts and pre-contractual steps: Article 6(1)(b) GDPR, particularly for orders and product-related enquiries.
• Legal obligations: Article 6(1)(c) GDPR, particularly for statutory record-keeping and retention requirements.
• Legitimate interests: Article 6(1)(f) GDPR, particularly in operating a secure and functional website, responding to general business enquiries and establishing, exercising or defending legal claims.
• Consent: Article 6(1)(a) GDPR, where we request your consent for a particular processing activity.

3. Website, hosting and technical access data

We use Webnode to provide our website and online shop. The provider is Webnode AG, Badenerstrasse 47, 8004 Zurich, Switzerland.

When you access our website, technical connection and access data is processed. This may include your IP address, access date and time, pages and files requested, browser information, operating system and the referring page.

This processing enables delivery of the website, identification of technical errors and protection against misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

Where Webnode processes personal data on our behalf, this is governed by its data processing terms under Article 28 GDPR. Technical data is retained only for as long as necessary for the relevant operational and security purposes or legal obligations.

Further information: Webnode privacy information and Webnode data processing terms . The linked documents are in German.

4. Cookies and browser storage

Our website uses cookies and similar storage technologies. These may be needed, for example, for the shopping cart, saving privacy preferences and providing features you expressly request.

Storage and access that are strictly necessary to provide a digital service expressly requested by the user fall under Section 25(2), point 2, of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Non-essential storage and access generally require consent under Section 25(1) TDDDG. Any subsequent processing of personal data also requires a legal basis under the GDPR.

Saved language preference

When you choose German or English using Anna's language selector, your choice is saved in your browser's Local Storage under the key af-anna-language-v1. The cookie preferred_lang is also set with an intended lifetime of one year.

The Local Storage entry remains until you delete it or clear the relevant website data in your browser. It allows the website to recognise your expressly selected language on future visits. The language selector itself is not an external chat service.

You can delete cookies and website data through your browser settings. This may remove saved preferences. You can reopen your cookie choices using the “Cookies” link in the footer.

5. Google Tag Manager and Webnode technical services

Our website includes Google Tag Manager. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager manages code embedded in the website. Loading it may transmit technical connection information, particularly your IP address, to Google. Any further processing depends on the tags actually included and triggered.

The container GTM-5C62ZHGD is entered in our Webnode settings. Webnode additionally includes the container GTM-542MMSL. According to Webnode, its own integration is used to identify technical issues.

Necessary technical diagnostic processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the stable and secure operation of the website.

Additional processing that requires consent is governed by Article 6(1)(a) GDPR. Relevant non-essential storage and access on your device also require consent under Section 25(1) TDDDG.

Information from Webnode: Google Tag Manager and Webnode's own integrations . Information from Google: Google Privacy Policy .

6. Orders and customer accounts

When you place an order, we process the information needed to enter into and perform the contract. This includes your name, billing and delivery addresses, contact details, products ordered, order value, selected payment method, payment status and related correspondence.

If you create a customer account, we also process the registration and account information you provide. Processing is based on Article 6(1)(b) GDPR for the contractual relationship and Article 6(1)(c) GDPR for legal obligations.

Information marked as required during checkout is necessary to enter into the contract and deliver your goods. Without it, we may be unable to accept or fulfil your order.

7. Payment processing

Our shop has bank transfer, cash on delivery and PayPal configured as payment methods.

Bank transfer

For bank transfers, we process the payment information made available to us, particularly the payer's name, amount, payment reference and, where provided, bank account details. This enables us to identify and record your payment.

Cash on delivery

For cash-on-delivery payments, the information necessary to deliver the goods and collect the invoice amount is passed to the delivery provider handling the collection.

PayPal

If you select PayPal, payment is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Order, contact and transaction data necessary for payment processing is processed or transmitted to PayPal.

PayPal acts as an independent controller for its own processing purposes, particularly payment handling, security and legal obligations. Details of its processing and retention periods are available in the PayPal Privacy Statement .

Our payment-related processing is based on Article 6(1)(b) GDPR. We meet statutory documentation and retention obligations under Article 6(1)(c) GDPR.

8. Delivery with DHL and Hermes

We use DHL and Hermes to deliver goods. We provide the selected delivery provider with the information necessary for delivery, particularly your name and delivery address. For cash-on-delivery orders, this also includes information needed to collect payment.

The legal basis is Article 6(1)(b) GDPR, because this disclosure is necessary to deliver the goods you ordered.

9. Contact and email

If you contact us by email, contact form or telephone, we process your contact details, the content of your enquiry and any further information needed to respond.

Contract-related enquiries are handled under Article 6(1)(b) GDPR. General enquiries are handled under Article 6(1)(f) GDPR, based on our legitimate interest in appropriate business communication.

Our email mailbox is provided through Webnode. Messages are technically processed and stored there. Please provide only the information needed for your enquiry.

10. Applications and business cooperation

If you apply for a position with us, we process your contact and application information to decide whether to enter into an employment relationship. The legal basis is Section 26(1) of the German Federal Data Protection Act (BDSG). Access is limited to people who need to participate in handling the application.

Application data is deleted after the process has ended once it is no longer needed for that purpose or any necessary legal defence. Retention in an applicant pool requires separate consent.

For enquiries about retailer partnerships, affiliate cooperation or other business relationships, we process your information to respond and, where relevant, take steps towards a contract.

The legal basis is Article 6(1)(b) GDPR or, for general business enquiries, Article 6(1)(f) GDPR.

11. Trustpilot

Our website includes a Trustpilot review widget to display ratings and experiences relating to AUTOMATICFLOW. The provider is Trustpilot A/S, Pilestræde 58, 5th floor, DK-1112 Copenhagen K, Denmark.

Loading the widget may transmit your IP address, browser and device information, and information about the content accessed to Trustpilot or its technical service providers. Depending on the function, Trustpilot may use cookies and similar technologies.

Your consent under Article 6(1)(a) GDPR is the legal basis for the integration and associated non-essential processing. Non-essential storage and access on your device also require consent under Section 25(1) TDDDG.

You can withdraw consent for future processing through the cookie settings.

If you visit the Trustpilot platform or submit a review there, Trustpilot's own privacy information also applies: Trustpilot Privacy Policy .

12. External links and social networks

Our website links to external services, including social networks, WhatsApp, retailers, review platforms, mapping and sales portals, and partner offers.

Following a link takes you to the relevant provider's service. That provider processes data under its own privacy terms. Affiliate links may contain identifiers allowing a referred visit or purchase to be attributed.

If you contact us through a linked service, we process messages and contact information available to us to respond to your enquiry. The legal bases described in this notice for contact enquiries apply.

13. Recipients and international processing

Personal data is disclosed only to parties that need it for the purposes described. These include Webnode as our technical service provider, payment and delivery providers, and the providers identified for individual features. Data is disclosed to public authorities where required by law.

Some providers are established outside the European Union or European Economic Area, or use service providers there. This includes Webnode's registered office in Switzerland and possible international processing by Google, PayPal and Trustpilot.

Transfers to third countries must also meet the requirements of Articles 44 onwards GDPR. Relevant mechanisms may include an applicable adequacy decision or appropriate safeguards such as EU Standard Contractual Clauses.

Information about the mechanisms used by each provider is available in its linked privacy information. You may also contact us for further information.

14. Retention periods

We retain personal data for as long as necessary for the relevant purpose. It is then deleted unless statutory retention requirements or other necessary grounds justify further storage.

Order, invoice and business records are retained according to the applicable tax and commercial-law requirements. Information still needed to establish, exercise or defend legal claims may be retained until the matter is resolved or the relevant limitation periods have expired.

Providers acting as independent controllers apply their own retention periods. Storage periods for our language selector are described in Section 4.

15. Your data protection rights

Subject to the applicable legal conditions, you have the following rights:

• Access to your personal data under Article 15 GDPR.
• Rectification of inaccurate data under Article 16 GDPR.
• Erasure of your data under Article 17 GDPR.
• Restriction of processing under Article 18 GDPR.
• Data portability under Article 20 GDPR.
• Objection to certain processing under Article 21 GDPR.
• Withdrawal of consent at any time for future processing under Article 7(3) GDPR.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Right to object

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

You may object at any time to the processing of your personal data for direct marketing.

Right to lodge a complaint

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for private businesses in Bavaria is: