Privacy policy
Privacy Policy
This English translation is provided for convenience only. Only the German version of this Privacy Policy (Datenschutzerklärung) is legally binding. In the event of any discrepancy between the German version and this English translation, the German version shall prevail.
Last updated: March 17, 2026
1. Controller and Contact
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States as well as other data protection regulations is:
Eickhorn Solingen
Kolumbusstraße 6
42655 Solingen
Germany
Email: info@eickhorn-solingen.de
Phone: +49 212 66050
Data Protection Officer: We have appointed a company data protection officer. You can reach them at the contact address stated above or directly at datenschutz@eickhorn-solingen.de.
Competent supervisory authority: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Postfach 20 04 44
40102 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Internet:
2. General Information on Data Processing
2.1. Scope of the Processing of Personal Data
As a matter of principle, we process personal data of our users only to the extent necessary to provide a functional website as well as our content and services. The processing of our users' personal data regularly takes place only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by statutory provisions.
2.2. Legal Basis for Data Processing
Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.
For the processing of personal data required for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required to carry out pre-contractual measures.
Insofar as the processing of personal data is necessary to fulfill a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.
In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.
If the processing is necessary to safeguard a legitimate interest of our company or of a third party, and if the interests, fundamental rights, and freedoms of the data subject do not outweigh the former interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.
2.3. Data Erasure and Storage Duration
The personal data of the data subject will be erased or blocked as soon as the purpose of storage ceases to apply. Storage may also take place beyond this if this has been provided for by the European or national legislator in EU regulations, laws, or other provisions to which the controller is subject. Data will also be blocked or erased when a storage period prescribed by the aforementioned standards expires, unless further storage of the data is necessary for the conclusion or performance of a contract.
Specific retention periods:
• Order data and customer data: 10 years after performance of the contract (pursuant to § 257 HGB (German Commercial Code), § 147 AO (German Fiscal Code))
• Invoice data: 10 years after issue of the invoice (pursuant to § 257 HGB, § 147 AO)
• Communication data: 3 years after the last communication, unless statutory retention obligations exist
• Contact data of prospective customers: 2 years after the last contact, unless consent to further storage has been given
• Consent to marketing measures: until the consent is withdrawn
• Webshop usage data: 2 years after the last use of the webshop
3. Cookies and Similar Technologies
3.1. Description and Scope of Data Processing
Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again.
We use the following types of cookies:
(1) Technically necessary cookies: These cookies are strictly necessary for the operation of the website. They enable basic functionalities such as the shopping cart function, the ordering process, and security. These cookies cannot be deactivated.
(2) Functional cookies: These cookies enable us to improve the functionality of the website and to offer the user personalized functions (e.g. language settings, wish list).
(3) Marketing cookies: These cookies are used to display personalized advertising to the user and to analyze their user behavior. These cookies require express consent.
(4) Analytics cookies: These cookies help us understand how visitors use our website. They provide information on metrics such as number of visitors, bounce rate, and traffic source. These cookies require express consent.
3.2. Legal Basis for Data Processing
The legal basis for the processing of personal data using technically necessary cookies is Art. 6(1)(f) GDPR (legitimate interest in providing the website).
The legal basis for the processing of personal data using cookies for analytics and marketing purposes is § 25(1) TTDSG (German Telecommunications-Digital-Services Data Protection Act) in conjunction with Art. 6(1)(a) GDPR (consent).
3.3. Purpose of Data Processing
The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary for the browser to be recognized even after a page change.
For analytics cookies, the data collected serves to improve the quality of our website and its content. Through the analytics cookies, we learn how the website is used and can thus continuously optimize our offering.
Marketing cookies enable us to display personalized advertising and to analyze user behavior across different websites.
3.4. Storage Duration, Possibility of Objection, and Deletion
Cookies are stored on the user's computer and transmitted from it to our site. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website to their full extent.
Cookie consent management: We use a cookie consent banner that gives you the option to individually grant or refuse your consent for different cookie categories. You can withdraw your consent at any time with effect for the future by adjusting the cookie settings in your browser or by using the "Cookie settings" link in our footer.
4. Collection of Data When Visiting the Website
4.1. Description and Scope of Data Processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.
The following data is collected:
• Information about the browser type and version used
• The user's operating system
• The user's internet service provider
• The user's IP address
• Date and time of access
• Websites from which the user's system reaches our website
• Websites accessed by the user's system via our website
4.2. Legal Basis for Data Processing
The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR (legitimate interest in providing the website and in the security of our information technology systems).
4.3. Purpose of Data Processing
The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user's computer. For this purpose, the user's IP address must remain stored for the duration of the session.
Storage in log files takes place to ensure the functionality of the website. In addition, the data serves us to optimize the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.
4.4. Duration of Storage
The data will be erased as soon as it is no longer required to achieve the purpose for which it was collected. In the case of data collected for the provision of the website, this is the case when the respective session has ended. The log files are deleted after 7 days, unless further storage is required for evidentiary purposes.
5. Registration and Orders in Our Webshop
5.1. Description and Scope of Data Processing
On our website, we offer users the opportunity to register and place orders by providing personal data. The data is entered into an input mask, transmitted to us, and stored.
The following data is collected at the time of registration and ordering:
• First name and last name
• Billing address
• Delivery address (if different from the billing address)
• Email address
• Phone number
• Payment data (depending on the chosen payment method)
• Password (upon registration)
5.2. Legal Basis for Data Processing
The legal basis for the processing of data during registration and ordering is Art. 6(1)(b) GDPR (performance of a contract and implementation of pre-contractual measures).
For the processing of data for marketing purposes (e.g. newsletter subscription), the legal basis is Art. 6(1)(a) GDPR (consent).
5.3. Purpose of Data Processing
Registration and ordering enable the user to purchase products from our range. The data entered during registration and ordering serves to process the contract and to handle the user's inquiries.
5.4. Duration of Storage
The data will be erased as soon as it is no longer required to achieve the purpose for which it was collected. For the data collected during the registration and ordering process, this is the case when the registration is deleted or the contract has been fully performed and settled. The retention periods under commercial and tax law (in particular § 257 HGB, § 147 AO) remain unaffected.
6. Use of Shopify and Cooperation with Service Providers
6.1. Shopify as Platform Provider
Our webshop is operated on the Shopify platform. Shopify is a Canadian company that provides us with hosting and e-commerce services.
Responsibilities:
• Processing on our behalf: For the basic hosting services and the provision of the webshop functionality, Shopify acts as a processor within the meaning of Art. 28 GDPR. We have concluded a data processing agreement with Shopify that contains the required data protection guarantees.
• Joint controllership: For certain extended functions (e.g. Shopify Analytics, Shopify marketing functions), we may be jointly responsible with Shopify within the meaning of Art. 26 GDPR. The details of this cooperation are governed by a joint controllership agreement.
Further information on data processing by Shopify can be found in the Shopify Consumer Privacy Policy.
6.2. Other Processors
We use other service providers who process personal data on our behalf:
• Payment providers: PayPal Express Checkout, Shopify Payments Shop Pay
• Shipping service providers: DHL, UPS
• Email marketing: none
• Analytics tools: Shopify Analytics
• Customer support: none
All processors are carefully selected and contractually obliged to comply with data protection regulations.
6.3. Legal Basis
The legal basis for the use of processors is Art. 6(1)(b) GDPR (performance of a contract) in conjunction with Art. 28 GDPR.
7. Payment Processing
Depending on which payment method you choose during the ordering process, we pass on the data required to process the payment (e.g. name, address, payment card or bank details, invoice amount, currency, and transaction number) to the respective payment service provider. The legal basis is the performance of the contract with you (Art. 6(1)(b) GDPR). Beyond this, the payment service providers process your data under their own privacy policies and under their own responsibility.
PayPal
You can use the payment service provider PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg for your order. If you pay with PayPal, the payment data you enter will be transmitted to PayPal. Details on the nature, scope, and purpose of the processing of personal data by PayPal can be found in PayPal's privacy policy at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE
Shopify Payments and Shop Pay
You can also process your order via the payment service provider Shopify Payments. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. The technical payment processing is carried out via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. As part of the processing, data may also be transferred to Shopify Inc. (Canada) as well as to affiliated companies in the USA. Further information can be found at https://www.shopify.com/legal/privacy and https://stripe.com/de/privacy.
8. Newsletter and Marketing
8.1. Description and Scope of Data Processing
On our website, it is possible to subscribe to a free newsletter. When subscribing to the newsletter, the data from the input mask is transmitted to us.
In addition, the following data is collected upon subscription to the newsletter:
• IP address of the accessing computer
• Date and time of registration
Your consent is obtained for the processing of the data as part of the subscription process, and reference is made to this privacy policy.
8.2. Legal Basis for Data Processing
The legal basis for the processing of data after subscription to the newsletter is Art. 6(1)(a) GDPR (consent).
8.3. Purpose of Data Processing
The collection of the user's email address serves to deliver the newsletter.
The collection of other personal data as part of the subscription process serves to prevent misuse of the services or of the email address used.
8.4. Duration of Storage
The data will be erased as soon as it is no longer required to achieve the purpose for which it was collected. The user's email address will therefore be stored for as long as the newsletter subscription is active.
8.5. Possibility of Objection
The newsletter subscription can be canceled by the user concerned at any time. Each newsletter contains a corresponding link for this purpose. This also makes it possible to withdraw consent to the storage of the personal data collected during the subscription process.
9. Contact Options and Communication
9.1. Description and Scope of Data Processing
A contact form is available on our website, which can be used for electronic contact. If a user makes use of this form, the data entered into the input mask is transmitted to us and stored.
At the time the message is sent, the following data is also stored:
• The user's IP address
• Date and time of registration
Your consent is obtained for the processing of the data as part of the sending process, and reference is made to this privacy policy.
Alternatively, you can contact us by email. In this case, the user's personal data transmitted with the email will be stored.
9.2. Legal Basis for Data Processing
The legal basis for the processing of the data, where the user has given consent, is Art. 6(1)(a) GDPR.
The legal basis for the processing of data transmitted in the course of sending an email is Art. 6(1)(f) GDPR (legitimate interest in processing the inquiry). If the email contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR.
9.3. Purpose of Data Processing
The processing of the personal data from the input mask serves solely to handle the contact. In the event of contact by email, this also constitutes the necessary legitimate interest in processing the data.
9.4. Duration of Storage
The data will be erased as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask and the data sent by email, this is the case when the respective conversation with the user has ended. The conversation has ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved.
10. Analysis Tools and Web Analytics
10.1. Google Analytics (or Other Analysis Tools)
We use web analytics tools on our website to analyze the usage behavior of our visitors. The tools collect and store information from pseudonymous user profiles for web analytics and for displaying our advertising.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing and optimizing our web offering)
Possibility of objection: You can object to the storage of cookies and the use of your data for analytics purposes at any time by changing the corresponding settings in your browser or by using the cookie consent banner.
10.2. Social Media Plugins
We use social media plugins from Facebook, Pinterest, and Twitter on our website. These plugins are embedded directly into your webpage by the respective providers.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving our online presence and communication with customers)
Possibility of objection: You can prevent these plugins from loading by adjusting the corresponding settings in your browser.
11. Rights of the Data Subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
11.1. Right of Access (Art. 15 GDPR)
You can request confirmation from the controller as to whether personal data concerning you is being processed by us.
If such processing is taking place, you can request the following information from the controller:
• the purposes for which the personal data is processed;
• the categories of personal data being processed;
• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
• the planned duration of storage of the personal data concerning you or, if specific information on this is not possible, the criteria for determining the storage duration;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to this processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information on the origin of the data if the personal data was not collected from the data subject;
• the existence of automated decision-making, including profiling, pursuant to Art. 22(1) and (4) GDPR and — at least in these cases — meaningful information about the logic involved as well as the significance and envisaged consequences of such processing for the data subject.
You have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organization. In this context, you can request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.
11.2. Right to Rectification (Art. 16 GDPR)
You have a right to rectification and/or completion vis-à-vis the controller if the personal data processed concerning you is inaccurate or incomplete. The controller must carry out the rectification without undue delay.
11.3. Right to Erasure (Art. 17 GDPR)
You can request that the controller erase the personal data concerning you without undue delay, and the controller is obliged to erase this data without undue delay if one of the following reasons applies:
• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing was based pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
• You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
• The personal data concerning you has been processed unlawfully.
• The erasure of the personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the controller is subject.
• The personal data concerning you was collected in relation to information society services offered pursuant to Art. 8(1) GDPR.
11.4. Right to Restriction of Processing (Art. 18 GDPR)
You have the right to request that the controller restrict processing if one of the following conditions is met:
• the accuracy of the personal data concerning you is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
• the controller no longer needs the personal data for the purposes of the processing, but the data subject requires it for the establishment, exercise, or defense of legal claims; or
• the data subject has objected to the processing pursuant to Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.
11.5. Right to Data Portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, where
• the processing is based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR, and
• the processing is carried out by automated means.
11.6. Right to Object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Art. 6(1)(f) GDPR. The controller will then no longer process the personal data concerning you unless the controller can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or the processing serves the establishment, exercise, or defense of legal claims.
If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of the personal data concerning you for the purposes of such marketing. This also applies to profiling insofar as it is associated with such direct marketing.
If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.
11.7. Right to Withdraw Consent Under Data Protection Law
You have the right to withdraw your consent under data protection law at any time. Withdrawing your consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.
11.8. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you consider that the processing of the personal data concerning you infringes the GDPR.
The competent supervisory authority is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Postfach 20 04 44
40102 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Internet:
12. Transfer of Data to Third Countries
We transfer your personal data to recipients in third countries (countries outside the European Union and the European Economic Area). This takes place in particular in the context of the use of Shopify (Canada) and other service providers based in third countries.
For these transfers, we ensure that an adequate level of protection for your personal data is guaranteed. This is done through:
(1) Standard Contractual Clauses (SCCs): We use the standard contractual clauses approved by the European Commission pursuant to Art. 46(2)(c) GDPR. These clauses ensure that data protection is carried out in accordance with the requirements of the GDPR.
(2) Adequacy decisions: Where the European Commission has issued an adequacy decision for a third country, we base the transfer on that decision.
Further information on the transfer mechanisms we use can be requested at the contact address stated above.
13. Security Measures
In accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.
The measures include in particular:
• Encryption: the pseudonymization and encryption of personal data
• Availability: ensuring the confidentiality, integrity, availability, and resilience of our systems
• Review: procedures for regularly testing, assessing, and evaluating the effectiveness of the technical and organizational measures
• Training: training of our employees in the area of data protection
• Entry controls: entry controls to our premises
• Access controls: access controls to our IT systems
• Firewalls and virus scanners: use of firewalls and antivirus programs
• Data backups: regular data backups
Despite all security measures, absolute security cannot be guaranteed when transmitting data over the internet. We therefore recommend not transmitting sensitive data unencrypted.
14. Children and Minors
Our offering is not directed at children under 16 years of age. We do not process personal data of children under 16 years of age without the express consent of their parents or legal guardians, insofar as this is required by law. Parents or legal guardians can contact us at any time if they discover that we have processed their child's data without their consent. We will erase this data without undue delay.
15. Changes to Our Privacy Policy
We reserve the right to amend this privacy policy from time to time in order to adapt it to changed legal or technical requirements or to improve our service. We will inform you of any material changes to our privacy policy in an appropriate manner, e.g. by a clear notice on our website or by email.
The current version of this privacy policy can be found on our website at any time.
16. Links to Other Websites
Our website contains links to other websites. We are not responsible for the privacy practices of other websites and recommend that you read the privacy policies of those websites.
17. Contact
If you have any questions about data protection, about exercising your rights as a data subject, or about our privacy policy, you can contact us at any time as follows:
Eickhorn Solingen
Kolumbusstraße 6
42655 Solingen
Germany
Email: info@eickhorn-solingen.de
Phone: +49 212 66050
If you wish to exercise your right to lodge a complaint with a supervisory authority, you can contact the authority named in section 11.8.