Status December 2021

This privacy policy is in accordance with the legal provisions of the European Union’s General Data Protection Regulation (GDPR).

In this privacy policy, we inform you about the processing of personal data when using our website and about the handling of your data with regard to marketing measures and the purchase of our products.

1. Person responsible for data processing

Contact person and so-called controller for the processing of your personal data when visiting this website within the meaning of the EU General Data Protection Regulation (GDPR) is.

Mahaloha Gallery
Michael Eckhardt
Karl-Heine-Straße 93d
04229 Leipzig
Phone: +49 (0) 15678 654741
Email: info[at]mahaloha-gallery.com

For all questions regarding data protection in relation to our products, the use of our website or regarding the exercise of your rights, you can contact us at any time, either via the contact details described above or by email to: datenschutz[at]mahaloha-gallery.com

2. Processing of your data

2.1 Loading the web page

For any merely informational use of our website, i.e. if you do not register or otherwise contact us, we collect technical access data in so-called server log files, such as:

• IP address of the requesting device,
• Information about the browser used and the operating system,
• online identifiers (e.g. device identifiers),
• the name of the requested file,
• date and time of the request,
• amount of data transferred,
• requesting provider.

The data processing takes place on the legal basis of Art. 6 para. 1 lit. f) DSGVO. Our legitimate interest is exclusively to ensure trouble-free operation of the site, guarantee the security of our systems and in the evaluation to improve our offer. The information stored in the log files does not allow any direct inference to your person. Further personal data is only collected if you provide the information voluntarily, for example when making an inquiry or registering or via the settings of your browser.

2.2 Order

You have the possibility to order our products with a customer account or as a guest without a customer account.

a) Customer account

We set up for each customer who registers accordingly, a password-protected access to his personal data stored with us (customer account). Here you can view data about your orders and your address data.

For the purpose of registration, the following personal data is collected during the creation of the customer account:

• Personal data (surname, first name)
• Communication data (email address)
• Address data
• Date of registration

The legal basis for the processing of your data is your consent pursuant to Art. 6 para. 1 lit. a) DSGVO.

For the purpose of order processing, the following personal data will be collected and processed from you in addition to the information on the ordered product:

• Surname
• first name
• Billing and shipping address
• Email address
• Customer number
• Payment data
• IP address

b) Guest orders

You can also order conveniently without your own online customer account. Please note that even when ordering without registration, your personal data will be collected, processed and used for the respective order. With each order you must enter your information again.

For the purpose of order processing, the following personal data will be collected and processed from you in addition to the information on the ordered product:

• Surname
• first name
• Billing and shipping address
• Email address
• Customer number
• Payment data
• IP address

The legal basis for data processing in the context of a purchase or purchase initiation via your customer account or as a guest orderer is Art. 6 para. 1 b) DSGVO. This means that we use your data for the initiation and processing of purchase contracts concluded via Mahaloha Gallery as well as for the provision of advice on our products. In addition, we also use your personal data to assert rights arising from the purchase contracts concluded or initiated with you.

c) Payment methods

Within the scope of payment in our online store, we collect certain personal data from you, depending on the selected payment method, in order to process the payment transaction via one of the following payment service providers:

(1) PayPal

If you choose to pay via PayPal (Europe) S.à r.l. et Cie, S.C.A., 5th floor, 22-24 Boulevard Royal, L-2449 Luxembourg, the necessary data for payment processing (name, address, telephone number, IP address, e-mail address, order and billing information), will be transmitted to PayPal. Information on data processing by PayPal can be found in the privacy policy www.paypal.com/de/webapps/mpp/ua/privacy-full

(2) Prepayment

After sending the order, and deciding to pay in advance, you will receive a confirmation by email. In this email you will be informed of the data necessary for the transfer, such as invoice amount, order number and bank details. When making the transfer, please specify the exact purpose of use, which will be displayed in the email.

The data processing in the context of the payment process takes place in order to carry out the payment method selected by you. The legal basis for the transmission of your data to external payment service providers is on the one hand your consent according to Art. 6 para. 1 lit. a) DSGVO and on the other hand for the fulfillment of the contract according to Art. 6 para. 1 lit. b) DSGVO.

2.3 Contacting

You have various options for contacting us. These include the contact form and contacting us by email. In this context, we process your data exclusively for the purpose of communicating with you. In the context of communication with interested parties, the legal basis is our legitimate interest according to Art. 6 (1) f) DSGVO and if the data processing is necessary for the implementation of pre-contractual measures or for the performance of a contract, Art. 6 (1) b) DSGVO is relevant. The data collected by us when using the contact form will be automatically deleted after your request has been fully processed, unless we still need your request to fulfill contractual or legal obligations.

2.4. Existing customer advertising

If you have already purchased a product from us, we record your registration and contact data in our database and list you as an existing customer. Insofar as you have provided us with your email address as part of a registration, we use this to send you advertising for our own or similar goods and services. The legal basis for this processing of your data is Art. 6 para. 1 lit. f) DSGVOiVm. § 7 para. 3 UWG, based on our interest in carrying out direct advertising to our existing customers.

You can object to data processing for the aforementioned purposes at any time free of charge and with effect for the future. To do so, it is sufficient to unsubscribe via the link in the respective e-mail or by sending an e-mail to the above contact details.

2.5. Newsletter

You have the option to subscribe to our newsletter, in which we will inform you regularly about offers and news from Mahaloha Gallery. Which data is collected can be seen from the registration form. For the order of our newsletter we use the so-called double opt-in procedure, i.e. we will only send you the newsletter by email if you confirm in our notification email by clicking on a link that you are the owner of the specified email address. If you confirm your email address, we will store your email address, the time of registration and the IP address used for registration until you unsubscribe from the newsletter. The storage serves the sole purpose of sending you the newsletter and to be able to prove your registration. We have commissioned our external service provider Sendinblue GmbH (Köpenicker Straße 126, 10179 Berlin) to send the email.

We have integrated so-called tracking pixels in our newsletter (newsletter tracking). This allows us to record whether and when the newsletter was opened and which links in the email were frequently called up. We use this information for statistical evaluations in order to be able to understand the effectiveness of our advertising measures and to design the newsletter according to needs. The legal basis for the newsletter tracking is your consent (Art. 6 para. 1 lit. a) DSGVO), which you give in connection with the registration for the newsletter. You can revoke the tracking at any time by unsubscribing from the newsletter.

You can unsubscribe from the newsletter at any time. A corresponding unsubscribe link can be found in every newsletter. Alternatively, you can also send your unsubscribe request at any time to the contact details above. This will not incur any costs other than the transmission costs according to the prime rates of your Internet service provider. The legal basis for the processing is your consent pursuant to Art. 6 para. 1 lit. a) DSGVO.

3. Cookies

3.1. Technically necessary cookies

In order to make the visit to our website attractive and to enable the use of certain functions, we use so-called cookies. These are small text files that are stored on your device. Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and allow us to recognize your browser the next time you visit (persistent cookies). You can set your browser so that you are informed about the setting of cookies and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general. If you do not accept cookies, the functionality of our website may be limited.

Most web browsers (see help function in the menu bar of your browser) can be set by you to not accept new cookies, to receive a message that a new cookie has been placed or to disable all cookies received. For smartphones, tablets and other mobile and stationary end devices, you can read the necessary settings in the respective operating instructions.

However, we recommend that you leave the cookie functions completely switched on, as it is only possible to further improve our websites for your needs with cookies. Our cookies do not store sensitive data such as passwords, credit card details or similar. They do not cause any damage to your end device and do not contain viruses.

Cookies, die zur Durchführung des elektronischen Kommunikationsvorgangs oder zur Bereitstellung bestimmter, von Ihnen erwünschter Funktionen (z.B. Warenkorbfunktion, Spracheinstellungen) erforderlich sind, werden auf Grundlage von Art. 6 Abs. 1 lit. f) DSGVO gespeichert. Der Websitebetreiber hat ein berechtigtes Interesse an der Speicherung von Cookies zur technisch fehlerfreien und optimierten Bereitstellung seiner Dienste. Soweit andere Cookies (z.B. Cookies zur Analyse Ihres Surfverhaltens) gespeichert werden, werden diese in dieser Datenschutzerklärung gesondert behandelt.

3.2. Retargeting

If you have consented to the setting of statistics, personalization and marketing cookies, the collection, storage and evaluation of the following cookies/pixels is based on Art. 6 para. 1 lit. a) DSGVO. Should a transfer to an unsafe third country take place, this is done on the basis of Art. 49 para. 1 lit. a) DSGVO.

A) Facebook

Within our online offer, the so-called “Facebook pixel” of the social network Facebook, which is operated by Facebook Inc., 1601 South California Avenue, Palo Alto, CA 94304, USA, or if you are a resident of the EU, Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Facebook”), is used.

With the help of the Facebook pixel, it is possible for Facebook, on the one hand, to determine you as a visitor to our online offer as a target group for the display of ads (so-called “Facebook ads”). Accordingly, we use the Facebook pixel to display the Facebook ads placed by us only to those Facebook users who have also shown an interest in our online offer or who have certain characteristics (e.g. interests in certain topics or products determined on the basis of the websites visited) that we transmit to Facebook (so-called “Custom Audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interest of users and do not have a harassing effect. With the help of the Facebook pixel, we can further track the effectiveness of the Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called “conversion”). We only receive statistical data from Facebook for this purpose without any reference to a specific person.

If you do not want Facebook to assign the collected information directly to your Facebook user account, you can deactivate the Custom Audiences remarketing function here: www.facebook.com/set- tings?tab=ads]. To do this, you must be logged in to Facebook. Facebook privacy policy: https://www.facebook.com/policy.php

3.3. Statistics and marketing cookies

If you have consented to the setting of statistical, personalization and marketing cookies, the collection, storage and evaluation of the cookies listed below is based on Art. 6 para. 1 lit. a) DSGVO.If a transfer to an unsafe third country takes place, this is done on the basis of Art. 49 para. 1 lit. a) DSGVO.

a) Google Web Fonts

This page uses so-called web fonts provided by Google for the uniform display of fonts. When you call up a page, your browser loads the required web fonts into its browser cache in order to display texts and fonts correctly.

For this purpose, the browser you use must connect to Google’s servers. This enables Google to know that our website has been accessed via your IP address. The use of Google Web Fonts enables a uniform and appealing presentation of our online offers. If your browser does not support web fonts, a standard font will be used by your computer.

For more information on Google Web Fonts, please visit https://developers.google.com/fonts/faq and see Google’s privacy policy: https://www.google.com/policies/privacy/.

b) Google (Universal) Analytics

This website uses Google (Universal) Analytics, a web analytics service provided by Google Ireland Limited (www.google.de). Google (Universal) Analytics uses methods that enable an analysis of your use of the website, such as so-called “cookies”, text files that are stored on your computer. The information generated about your use of this website is usually transmitted to a Google server in the USA and stored there. By activating IP anonymization on this website, the IP address is shortened before transmission within the Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The anonymized IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

You can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link:http://tools.google.com/dlpage/gao- ptout?hl=en

As an alternative to the browser plugin, you can click this Link to prevent the collection by Google Analytics on this website in the future. This will place an opt-out cookie on your terminal device. If you delete your cookies, you must click the link again.

c) Microsoft Ads

Our website uses Microsoft Ads, an analytics service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; hereinafter “Microsoft Ads”.

If users visit our website, “Microsoft Ads” stores a “cookie” on the end device of users. With the help of “cookies” and “tracking pixels”, “Microsoft” processes the information generated by the end devices of the users about the use of our website and interactions with our website as well as access data (IP address, browser information, previously visited website, date and time of the server request) across all end devices for the purpose of playing and analyzing personalized advertisements. This means that users can be served targeted interest-based advertisements relating to search results in search engines from “Bing” and “Yahoo”. The advertisements may also relate to products and services that users have already viewed on our website. In addition, “Microsoft Ads” enables us, by means of ad server cookies, to measure your activity on our website and thus the reach of our advertisements, and thus to be able to track the effectiveness of these advertisements.

Data generated in this context may be transferred by Microsoft to a server in the USA for evaluation and stored there.

3.4. Overview of the cookies used

Notwendig

These cookies are absolutely necessary for the functions of the website and cannot be disabled.

Marketing

In these cookies, click behavior is recorded in order to serve relevant ads and remarketing on websites.

Google Analytics

These cookies allow us to count visits and traffic sources in order to measure the performance of our website and improve your user experience. We would like to point out that the data protection provisions of Google Analytics do not necessarily meet the European requirements according to EU-DSGVO and a data transfer to third countries or the USA cannot be excluded. How the data is processed there cannot be checked and traced.

Einstellungen ändern

4. Social media

4.1. Social media plug-ins

We offer you the option of using so-called “social media buttons” on our website. These buttons are only integrated on the website as a graphic that contains a link to the corresponding website of the button provider. By clicking on the graphic, you are thus redirected to the services of the respective provider. Only then will your data be sent to the respective providers. Unless you click on the graphic, no exchange of any kind takes place between you and the providers of the social media buttons. Information about the collection and use of your data in the social networks can be found in the respective terms of use of the respective providers.

We have integrated the social media buttons of the following companies on our website:

• Facebook Inc. (1601 S. California Ave – Palo Alto – CA 94304 – USA) for Facebook and Instagram

4.2. Social media profile

Mahaloha Gallery ( hereafter Mahaloha) regularly publishes and shares content and offers on its social media profiles. Below we explain our handling of your personal data on our social media pages.

a) Party responsible for the processing of your data

Mahaloha operates social media pages at the social networks of:

• Facebook Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) for the Facebook page
• Facebook Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland) for the Instagram page

Due to legal provisions, there is a joint responsibility between us, Mahaloha Gallery, and the operator of the respective social network according to Art. 26 DSGVO.

As far as you communicate directly with us via our social media profiles or share personal content with us, Mahaloha is responsible for the processing of your data. Exceptions apply to the data processing described below, e.g.

• for usage analysis (so-called analysis services or page insights); we are jointly responsible for this with the operator of the respective social media platform or

insofar as the operator of the respective social media platform determines the type, scope and purposes of data processing on its own responsibility.

b) What data is collected and for what purpose?

We maintain social media profiles for the purpose of providing information about products, promotions and offers and to engage with you as a visitor and user of the respective page. When you visit our social media pages, Mahaloha generally collects any communications, content and other information that you directly share with us there, such as when you post, like, share or send us a private message on a social media page.

The legal basis for the processing of your data are our above-mentioned legitimate interests according to Art. 6 para. 1 lit. f) DSGVO as well as Art. 6 para. 1 lit. b) DSGVO, if you send us an inquiry about our company, our products or services for the purpose of initiating or fulfilling a contract.

If you have an account with the respective social network, we can of course also see your public information, for example your username, profile picture, other information in your public profile and content that you share with a public audience. The legal basis here is your consent pursuant to Art. 6 (1) a) DSGVO.

c) Processing of your data by the operator of the respective social media platform

Please note that the operator of the respective social media platform is solely responsible for the processing of your data on the social media platform and determines the type, scope and purposes of the processing of your data itself when you use it. With each interaction on our social media pages, the operator of the respective social media platform records your usage behavior with cookies and similar technologies. Operators of social networks may view general statistics on the interests and demographic characteristics (such as age, gender, region) of users of social media platforms. We would like to point out that when you visit our social media sites, data about you as a user may also be processed outside the EU.

We have no influence on the data processing procedures on the social media platforms and on a possible transfer of your data to countries outside the EU and are not depicted in this data protection declaration. In this respect, we refer to the data protection information of the operator of the respective social media platform:

• Facebook Data Policy at https://www.facebook.com/policy ,
• Instagram Data Policy at https://help.instagram.com/519522125107875

With every interaction with our social media pages, the operator of the respective social media platform records the usage behavior of the visitors and followers of the respective social media pages using cookies and similar technologies. On this basis, the operators of the social media platforms receive so-called “page insights data”. Page insights only contain statistical, anonymized information about visitors, which thus cannot be assigned to any specific person. The anonymous usage statistics are based on comments, likes, shares, number of visitors, reach of a post, calls to individual page areas, and statistics on followers by age, language, origin, or interests. We have no access to the personal data used by the operators of the social media platforms to create page insights (“page insights data”). The selection and processing of page insights data is carried out exclusively by the operator of the respective social media platform.

With the help of page insights, we gain knowledge about how our social media profiles are used, what interests visitors to our social media profiles have, and which topics and content are particularly popular. This enables us to optimize our social media profile activities, for example, by better addressing the interests and usage habits of our audience when planning and selecting our content.

The legal basis for the processing is our legitimate interest (Art. 6 para. 1 lit. f) DSGVO) in analyzing the data provided to us by the operator of the respective social media platform for the purpose of optimizing our web offering and our marketing measures.

Mahaloha and the operator of the respective social media platform are jointly responsible for the data processing that serves to provide page insights. For more information on the processing of your personal data by the operator of the respective social media platform in the context of the creation and processing of usage statistics, please refer to the information on usage statistics on the following web pages of the respective social media platform:

• Facebook information about Page Insights data at https://de-de.facebook.com/legal/terms/information_about_page_insights_data ,
• Instagram-Insights at https://help.instagram.com/788388387972460?helpref=faq_content 

Further information on data processing by the operator of the respective social media platform in the context of interest-based advertising as well as the setting options of your profile and your advertising preferences can be found on the following websites of the respective social media platform

• Facebook at https://de-de.facebook.com/ads/preferences 
• Instagram at https://help.instagram.com/410983803065364?helpref=search&sr=6&query=werbung ,

d) What rights do you have and against whom can you exercise them?

If you no longer wish Mahaloha to process the data described here under 4. in the future, please cancel the connection of your user profile to the respective social media page of Mahaloha by using the functions “I no longer like this page” and/or “Do not subscribe to this page”.

With regard to data processing by Mahaloha, you can assert your rights mentioned in section 7. against Mahaloha and with regard to data processing by the operator of the respective social media platform against the respective operator at any time. Further information on this can be found in the data protection statements (see section 4.2. c)) of the operator of the respective social network.

If you have given Mahaloha Gallery consent, you can revoke this at any time with effect for the future by e-mail or by post using the above contact details. Insofar as the MahalohaGallery processes your data on the basis of a balance of interests, you can object to the processing.

5. Disclosure of data

A passing on of the data collected by us takes place in principle only if:

• you have given your express consent to this in accordance with Art. 6 (1) p. 1 lit. a DSGVO,
• the disclosure is necessary in accordance with Art. 6 (1) p. 1 lit. f DSGVO for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding legitimate interest in not having your data disclosed,
• we are legally obligated to disclose data pursuant to Art. 6 (1) p. 1 lit. c DSGVO or this is legally permissible and
• according to Art. 6 para. 1 p. 1 lit. b DSGVO is necessary for the processing of contractual relationships with you or for the implementation of pre-contractual measures that take place at your request.

Insofar as external service providers are used to operate the website or provide services, they may only use your data to fulfill their tasks. The service providers have been carefully selected and commissioned by us. They are contractually bound to our instructions, have suitable technical and organizational measures to protect the rights of the data subjects and are regularly monitored by us.

In addition, disclosure may take place in connection with official inquiries, court decisions and legal proceedings if it is necessary for legal prosecution or enforcement.

Data processing via our processors takes place predominantly in Germany or within another member state of the European Union.

If a service provider processes your data outside the European Union, we will inform you separately in this privacy policy. In this case, it may be that your data is transferred to a country that does not offer the same data protection standards as the European Union. In this case, we ensure that the respective service providers guarantee a level of data protection equivalent to the European Union by contract (e.g., by concluding standard contractual clauses in accordance with Commission Decision (EU) 2021/914 of June 4, 2021) or by other means.

6. Storage period

In principle, we store personal data only as long as necessary for the fulfillment of contractual or legal obligations. After complete processing of a contract or deletion of your customer account, your data will be blocked for further use and deleted after expiry of the retention periods under tax and commercial law, unless we still need the data until the expiry of the statutory limitation period for evidence purposes for civil claims or you have expressly consented to further use of your data. The deletion of your customer account is possible at any time and can be done either by sending an informal message to the contact details above or via a function provided for this purpose in the customer account.

7. Your rights

You have a right to information (Art. 15 GDPR), to correction (Art. 16 GDPR), to deletion (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). You also have a right of appeal to a data protection supervisory authority (Art. 77 DSGVO). You can assert this right at a supervisory authority in the member state of your residence, your workplace or the location of the alleged infringement. The competent supervisory authority in Saxony-Anhalt is: Landesbeauftragter für den Datenschutz Sachsen-Anhalt, Leiterstraße 9, 39104 Magdeburg.

If you have given us consent, you can revoke this at any time with effect for the future by e-mail or by post using the above contact details.

Insofar as we process your data on the basis of a balance of interests pursuant to Art. 6 (1) e) or f) DSGVO, you may object to the processing. If you object, your data will no longer be processed unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

8. Modification of the privacy policy

Occasionally, this privacy statement will be updated, for example, if we adapt our website or if legal or regulatory requirements change.

De