← Back to home

Privacy policy

This page is an English translation. The German version is authoritative.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

MRADO
Asternweg 28
61381 Friedrichsdorf
Germany

E-mail: info@mrado.de

Tel: +49 1590 5221624

2. General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data means all data with which you can be personally identified. The processing of personal data is always carried out in accordance with the GDPR and the German data protection regulations applicable to us.

3. Hosting and server log files

This website is hosted by Vercel. When you access this website, the hosting provider automatically records information in so-called server log files that your browser transmits automatically:

  • IP address
  • Date and time of the request
  • Browser type and version
  • Operating system
  • Referrer URL (the page visited previously)
  • Hostname of the accessing computer

This data cannot be assigned to specific persons and is not merged with other data sources. Collection is based on Art. 6 (1) (f) GDPR (legitimate interest in ensuring the technically error-free presentation and the security of the website). Log files are deleted after 7 days.

4. Contact via the contact form

If you send us enquiries using the contact form, the information you enter in the form, including the contact details you provide there (name, e-mail address, phone number, company, message), will be processed in order to handle the enquiry and for any follow-up questions.

The form is submitted via the formsubmit.co service operated by SmartWebDev SL, Avinguda Maresme 123, 08302 Mataró, Spain (“formsubmit”). For this purpose the form data is transferred to the service's servers and delivered to us there by e-mail. Further information on data processing by formsubmit can be found in its privacy policy: https://formsubmit.co/legal/privacy-policy.

The processing of this data is based on Art. 6 (1) (b) GDPR where your enquiry is related to the performance of a contract or is necessary for the taking of steps prior to entering into a contract. In all other cases the processing is based on our legitimate interest in handling enquiries addressed to us efficiently (Art. 6 (1) (f) GDPR). The data you send will remain with us until you ask us to delete it, withdraw your consent, or the purpose of the storage ceases to apply.

5. Payment processing (basket and Stripe Checkout)

The basket on our website is stored exclusively locally in your browser (so-called localStorage, key “mrado_basket”). No personal data is transferred to us as long as you do not start the payment process.

To process payments we use the payment service provider Stripe, Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA (or Stripe Payments Europe, Ltd., Ireland, for customers in the EU). Payment is made via the Checkout page hosted by Stripe, to which we link.

When you start the payment process, your browser transmits the basket data (products and quantities) to our server, where a Stripe Checkout session is created via our interface (API). Your payment data (for example the credit card number) is entered exclusively on Stripe's encrypted Checkout page; we have no access to this payment data.

As part of payment processing, we or you transmit the data required for payment (for example name, e-mail address, order and payment data) to Stripe. The processing of data by Stripe is based on Art. 6 (1) (b) GDPR (performance of the contract) as well as on Stripe's legitimate interest (Art. 6 (1) (f) GDPR). The transfer to the USA is carried out on the basis of the European Commission's standard contractual clauses.

Further information can be found in Stripe's privacy policy: https://stripe.com/en/privacy.

6. Cookies, tracking and analysis tools

This website uses no cookies and does not employ any tracking, analysis or marketing tools (such as Google Analytics). No usage behaviour is recorded beyond the basic page request logic.

7. Legal bases for processing

Where we obtain consent from the data subject for processing of personal data, Art. 6 (1) (a) GDPR serves as the legal basis. For the processing of personal data required for the performance of a contract, Art. 6 (1) (b) GDPR serves as the legal basis. For processing to comply with a legal obligation, Art. 6 (1) (c) GDPR serves as the legal basis. In all other cases, processing is based on Art. 6 (1) (f) GDPR (legitimate interest).

8. Retention period

Personal data is deleted or blocked as soon as the purpose of storage ceases to apply, statutory retention periods have expired and no other statutory retention obligations exist. Statutory retention periods (for example for tax-relevant documents under Section 147 of the German Fiscal Code: 10 years, for commercial letters under Section 257 of the German Commercial Code: 6 years) remain unaffected.

9. Your rights as a data subject

Under statutory provisions you have the following rights:

  • Access to your stored personal data (Art. 15 GDPR)
  • Rectification of incorrect data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

An informal notification to us is sufficient to exercise your rights (see section 1).

10. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The supervisory authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hesse), whose address can be found on the authority's website.

11. SSL/TLS encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. You can recognise an encrypted connection by “https://” in your browser's address bar.

12. Currency and amendment of this privacy policy

This privacy policy is currently valid. As our website continues to develop or as legal requirements change, it may become necessary to amend it. The current version can always be found on this page.