Privacy policy

Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither required by law or contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide the data has no consequences. This applies only insofar as no other information is given in the subsequent processing operations.
"Personal data" means any information relating to an identified or identifiable natural person.

Server log files

You may visit our websites without providing any information about yourself.

Each time you access our website, usage data are transmitted by your internet browser to us or our web host / IT service provider and stored in protocol data (so-called server log files). These stored data include, for example, the name of the page accessed, the date and time of the request, the IP address, the volume of data transferred and the requesting provider.
Processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our offering.

Contact

Controller
Please contact us if you wish. The controller for data processing is: Thomas Nachtmann, Dr.-Müller-Str. 18, 92637 Weiden Germany, 0961 38833530, info@mountainhill.de

Unsolicited contact by the customer via e-mail
If you contact us unsolicited by e-mail for business purposes, we collect your personal data (name, e-mail address, message text) only to the extent provided by you. The data processing serves the handling and answering of your contact enquiry.
If the contact serves the performance of pre-contractual measures (e.g. advice in the event of an interest in purchasing, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR.
If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in handling and answering your enquiry. In this case, you have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you which is based on Art. 6(1)(f) GDPR.
We use your e-mail address only to process your enquiry. Your data are subsequently deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form
When using the contact form, we collect your personal data (name, e-mail address, message text) only to the extent provided by you. The data processing serves the purpose of contacting you.
If the contact serves the performance of pre-contractual measures (e.g. advice in the event of an interest in purchasing, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR.
If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in handling and answering your enquiry. In this case, you have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you which is based on Art. 6(1)(f) GDPR.
We use your e-mail address only to process your enquiry. Your data are subsequently deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Customer account Orders

Customer account
When opening a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time by notifying us, without affecting the lawfulness of processing based on consent before its withdrawal. Your customer account will then be deleted.

Collection, processing and disclosure of personal data in the case of orders

When you place an order, we collect and process your personal data only insofar as this is necessary for the performance and handling of your order and for processing your enquiries. The provision of the data is required for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. Processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.

Your data are disclosed, for example, to shipping companies, dropshipping or fulfilment providers, payment service providers, service providers for order processing and IT service providers. In all cases we strictly observe the statutory requirements. The scope of the data transfer is limited to the minimum necessary.

Reviews Advertising

Collection of data when writing a comment or a review
When commenting on/reviewing an item or a post, we collect your personal data (name, e-mail address, comment text) only to the extent provided by you. Processing serves the purpose of enabling a comment/review and of displaying comments/reviews.

By submitting the comment/review, you consent to the processing of the data transmitted. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time by notifying us, without affecting the lawfulness of processing based on consent before its withdrawal. Your personal data will then be deleted.

When your comment/review is published, only the e-mail address you have provided is published.

Use of the e-mail address for sending newsletters
We use your e-mail address to send information and offers by newsletter, provided you have expressly consented to this. The data processing serves exclusively the purpose of advertising. For this purpose we process your e-mail address and, where applicable, further data that you have provided voluntarily when registering for our newsletter.
Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
You may unsubscribe from the newsletter at any time by using the corresponding link in the newsletter or by notifying us. Your e-mail address will then be removed from the mailing list. Despite removal from the mailing list, we may continue to store your e-mail address in a so-called blacklist in order to prevent you from receiving newsletter e-mails from us in the future. This storage is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our and your legitimate interest in preventing the reuse of your e-mail address for sending our newsletter. You have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you.

Payment service providers

Use of PayPal Express
We use on our website the payment service PayPal Express of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal"). The data processing serves the purpose of being able to offer you payment via the payment service PayPal Express. To integrate this payment service, it is necessary that PayPal, when the website is accessed, collects, stores and analyses data (e.g. IP address, device type, operating system, browser type, location of your device). Cookies may also be used for this purpose. The cookies enable your browser to be recognised.
The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you.
Upon selection and use of PayPal Express, the data required for payment processing are transmitted to PayPal in order to be able to perform the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR. Further information on data processing when using the payment service PayPal Express can be found in the associated privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS.

Use of PayPal Check-Out
We use on our website the payment service PayPal Check-Out of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal"). The data processing serves the purpose of being able to offer you payment via the payment service. Upon selection and use of payment via PayPal, credit card via PayPal, direct debit via PayPal or “Pay Later” via PayPal, the data required for payment processing are transmitted to PayPal in order to be able to perform the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Cookies may be stored in this context which enable your browser to be recognised. The data processing thereby taking place is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you.

Credit card via PayPal, direct debit via PayPal & “Pay later” via PayPal
For individual payment methods such as credit card via PayPal, direct debit via PayPal or “Pay later” via PayPal, PayPal reserves the right, where applicable, to obtain a credit check on the basis of mathematical-statistical procedures using credit agencies. For this purpose, PayPal transmits the personal data required for a credit assessment to a credit agency and uses the information received about the statistical probability of a payment default for a considered decision on the establishment, performance or termination of the contractual relationship. The credit check may include probability values (score values) which are calculated on the basis of scientifically recognised mathematical-statistical procedures and in the calculation of which, among other things, address data are included. Your interests worthy of protection are taken into account in accordance with the statutory provisions. The data processing serves the purpose of the credit check for the initiation of a contract. Processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in protection against payment default when PayPal makes an advance payment.
You have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you which is based on Art. 6(1)(f) GDPR by notifying PayPal. The provision of the data is required for the conclusion of the contract with the payment method requested by you. Failure to provide the data means that the contract cannot be concluded with the payment method selected by you.

Third-party providers
When paying via the payment method of a third-party provider, the data required for payment processing are transmitted to PayPal. This processing is carried out on the basis of Art. 6(1)(b) GDPR. To carry out this payment method, the data may then be forwarded by PayPal to the respective provider. This processing is carried out on the basis of Art. 6(1)(b) GDPR. Local third-party providers may include, for example:

Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Purchase on account via PayPal
When paying via the payment method purchase on account, the data required for payment processing are first transmitted to PayPal. To carry out this payment method, the data are then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to be able to perform the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR. Ratepay may, where applicable, carry out a credit check on the basis of mathematical-statistical procedures (probability or score values) using credit agencies in accordance with the process already described above. The data processing serves the purpose of the credit check for the initiation of a contract. Processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in protection against payment default when Ratepay makes an advance payment. Further information on data protection and which credit agencies Ratepay uses can be found at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

Further information on data processing when using PayPal can be found in the associated privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Use of Amazon Payments
We use on our website the payment service Amazon Payments of Amazon Payments Europe s.c.a. (38 avenue John F. Kennedy, L-1855 Luxembourg; “Amazon Payments”).
The data processing serves the purpose of being able to offer you payment via the payment service Amazon Payments.
To integrate this payment service, it is necessary that Amazon Payments, when the website is accessed, collects, stores and analyses data (e.g. IP address, device type, operating system, browser type, location of your device). Cookies may also be used for this purpose. The cookies enable your browser to be recognised.
The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you.
Upon selection and use of “Amazon Payments”, the data required for payment processing are transmitted to Amazon Payments in order to be able to perform the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.
Further information on data processing when using the payment service Amazon Payments can be found in the associated privacy policy at: https://pay.amazon.com/de/help/201212490

Use of the payment service provider Mollie
We use for payment processing on our website the payment service provider Mollie B.V. (Keizersgracht 313, 1016 EE Amsterdam, Netherlands; „Mollie“). The data processing serves the purpose of being able to offer you various payment methods through payment processing via the payment service provider Mollie. If you have chosen one of the payment options of the payment service provider Mollie, the data required for payment processing are transmitted to Mollie. These include your payment data (for example bank account number or credit card number), your IP address, your internet browser and device type and, in some cases, your first and last name, your address data and information about the product or service that you have purchased from us. This data processing is carried out on the basis of Art. 6(1)(b) GDPR. Further information on data processing when using the payment service provider Mollie can be found in the associated privacy policy https://www.mollie.com/de/legal/privacy

Legal basis: Art. 6(1)(a) GDPR (consent, Statistics category).

Reach measurement in our own shop (first-party analytics)

If you accept the “Statistics” category in the cookie banner, we record the use of this online shop with our own server-based statistics. Neither Google Analytics nor any other external analytics tool is used. The data are processed on our systems and evaluated internally (including in our merchandise management system) in order to improve the shop.

For this purpose we store a random session identifier in the cookie os_analytics_sid (httpOnly, storage duration 30 days). Your consent itself is stored in the cookie os_cookie_consent (1 year). In addition, the statistics cookies product_interest_sid and listing_click_sid may be set.

In particular, the following are recorded: pages accessed and time spent, landing page, referrer, UTM parameters of the first session, rough technical details (device, browser, operating system), product views as well as shopping cart and checkout steps. An order is assigned to the session only if a valid statistics consent is in place at the time of the order.

Assignment is made exclusively via the random session identifier. In the statistics we do not store an IP address and no direct order data such as name, e-mail or address.

We do not store an IP address for this statistics. If our hosting transmits a country code (ISO-3166-1 alpha-2, e.g. via Cloudflare), we may store the country of origin of the session. Without this header, the country remains unknown.

The raw data are automatically deleted after 18 months.

You may withdraw your consent at any time via the cookie settings in the footer with effect for the future. The statistics cookies will then be deleted and no further tracking will take place. Already stored, non-personal evaluation data remain until the expiry of the storage period.

Cookies

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on a user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide on their acceptance individually, as well as prevent the storage of cookies and the transmission of the data contained therein. Cookies already stored can be deleted at any time. We would, however, point out that you may then not be able to use all functions of this website to their full extent.

Under the following links you can find out how to manage (including disable) cookies in the most important browsers:

Chrome: https://support.google.com/accounts/answer/61416?hl=de
Microsoft Edge: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-lB6schen-63947406-40ac-c3b8-57b9-2a946a29ae09

Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen

Safari: https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Technically necessary cookies

Unless otherwise stated below in this privacy policy, we use only these technically necessary cookies for the purpose of making our offering more user-friendly, effective and secure. Furthermore, cookies enable our systems to recognise your browser even after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these it is necessary that the browser is recognised again after a page change.

The use of cookies or comparable technologies is carried out on the basis of Section 25(2) TDDDG. The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in ensuring the optimal functionality of the website as well as a user-friendly and effective design of our offering.

You have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you.

Overview of the cookies used

We use technically necessary cookies without consent. We set statistics cookies only with your consent via our cookie banner.

Necessary cookies

i18n_locale — Stores your language selection (365 days, Shop)
os_cookie_consent — Stores your cookie settings (365 days, Shop)
cart_id — Shopping cart assignment (30 days, HttpOnly, Shop)
NextAuth-Session-Cookies — Login session and CSRF protection, e.g. authjs.session-token, authjs.csrf-token (Session, Shop)
__stripe_mid / __stripe_sid — Stripe payment processing in checkout (Stripe, Inc.)
exit_popup_dismissed — Stores that the newsletter popup was closed (60 days, Shop)
exit_popup_subscribed — Stores a newsletter registration via the exit popup (60 days, Shop)

Statistics cookies (only with consent)

os_analytics_sid — Random session identifier for our own shop statistics (30 days, httpOnly, Shop)
os_cookie_consent — Stores your consent, including the Statistics category (1 year, Shop)
product_interest_sid — Anonymous counting of product views (30 days, httpOnly, Shop)
listing_click_sid — Anonymous counting of product clicks in categories (30 days, httpOnly, Shop)

Cookie consent via our shop banner
We use on our website our own cookie consent banner. This enables you to give consent to statistics cookies and to exercise your right of withdrawal in respect of consents already given. Your selection is stored in the cookie os_cookie_consent (1 year). We set technically necessary cookies independently of your consent, as they are required for the operation of the shop. Processing is carried out to fulfil legal obligations and on the basis of Art. 6(1)(c) GDPR as well as Section 25(2) TDDDG. We set optional statistics cookies only with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Use of Consentmanager
We use on our website the consent management tool Consentmanager of Consentmanager AB (Håltegelvägen 1b, 72348 Västerås, Sweden; "Consentmanager").
The tool enables you to give consents to data processing via the website, in particular the setting of cookies, and to exercise your right of withdrawal in respect of consents already given.
The data processing serves the purpose of obtaining and documenting the required consents to data processing and thereby complying with legal obligations.
Cookies may be used for this purpose. In this context, the following information, among other things, may be collected and transmitted to Consentmanager: date and time of the page access, information about the browser you use and the device you use, anonymised IP address, opt-in and opt-out data. These data are not disclosed to any other third parties.
The data processing is carried out to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR.
Further information on data protection at Consentmanager can be found at: https://www.consentmanager.net/privacy.php

Advertising tracking

Use of the remarketing or "Similar Audiences" function of Google Inc.
We use on our website the remarketing or "Similar Audiences" function of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google").
The application serves the purpose of analysing visitor behaviour and visitor interests. To carry out the analysis of website use, which forms the basis for the creation of interest-related advertisements, Google uses cookies. Via the cookies, visits to the website as well as anonymised data about the use of the website are recorded. No personal data of website visitors are stored. If you subsequently visit another website in the Google Display Network, advertisements will be displayed to you which with a high degree of probability take into account previously accessed product and information areas.
Your data may, where applicable, be transmitted to servers of Google LLC in the USA. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.
The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Further information on Google Remarketing and the associated privacy policy can be found at: https://www.google.com/privacy/ads/ and https://business.safety.google/privacy/

Plug-ins and other

Use of Google Tag Manager
We use on our website the Google Tag Manager of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google").
This application is used to manage JavaScript tags and HTML tags that are used in particular to implement tracking and analytics tools. The data processing serves the purpose of designing our website according to needs and of optimising it.
Google Tag Manager itself neither stores cookies nor are personal data processed thereby. However, it enables the triggering of further tags that can collect and process personal data.
Further information on terms of use and data protection can be found here.

Use of Google reCAPTCHA
We use on our website the service reCAPTCHA of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") in the context of commissioned data processing. The query serves the purpose of distinguishing whether the input is made by a human or by automated, machine processing. For this purpose, your input is transmitted to Google and used further there. In addition, the IP address and, where applicable, further data required by Google for the reCAPTCHA service are transmitted to Google. These data are processed by Google within the European Union and may, where applicable, also be transmitted to servers of Google LLC in the USA. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.
The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Use of the authorized.by Badge
We use on our website the “authorized.by Badge” of Stayble Market GmbH (Theresienstraße 66, 80333 Munich; “Stayble Market”).
The data processing serves the purpose of displaying and confirming to you our status as an authorised partner of the manufacturers we distribute.
To display the badge, it is necessary that data (e.g. IP address, device type, operating system, browser type) are transmitted to Stayble Market when the website is accessed.
This data processing is carried out on the basis of Art. 6(1)(f) GDPR on the basis of our overriding legitimate interest in an optimal marketing of our offering and in demonstrating that we are authorised partners of the manufacturers we distribute. You have the right to object, on grounds relating to your particular situation, at any time to this processing of personal data concerning you which is based on Art. 6(1)(f) GDPR.
Further information on data protection at Stayble Market can be found at: https://www.authorized.by/datenschutz/

Data subject rights and storage duration

Duration of storage
After complete performance of the contract, the data are first stored for the duration of the warranty period, thereafter taking into account statutory, in particular tax and commercial law, retention periods, and are then deleted after expiry of the period, unless you have consented to further processing and use.

Rights of the data subject
Provided the statutory requirements are met, you have the following rights under Art. 15 to 20 GDPR: right of access, to rectification, to erasure, to restriction of processing, to data portability.
In addition, under Art. 21(1) GDPR you have a right to object to processing based on Art. 6(1)(f) GDPR, as well as to processing for the purposes of direct marketing.

Right to lodge a complaint with the supervisory authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you consider that the processing of your personal data is not lawful.

You may lodge a complaint, among others, with the supervisory authority responsible for us, which you can reach under the following contact details:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Tel.: +49 981 1800930
Fax: +49 981 180093800
E-mail: poststelle@lda.bayern.de

Right to object
If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to this processing with effect for the future.
After an objection has been lodged, the processing of the data concerned will be terminated, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

Google business reviews