Privacy policy

Data protection

foreword

We at "braganza" Christian Zwiesler take the protection of your personal data seriously and would like to inform you about data protection in our company.

As part of our data protection responsibility, we are responsible for the entry into force of the EU General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: "DS-GVO") additional obligations have been imposed in order to protect the personal data of the person affected by processing (we will also speak to you as the person concerned below "Customer", "User", "She", "Them" or "affected" on) to ensure.

Insofar as we decide on the purposes and means of data processing either alone or together with others, this primarily includes the obligation to inform you transparently about the type, scope, purpose, duration and legal basis of the processing (cf. Art. 13 and 14 GDPR). With this Explanation (hereinafter: "Privacy Policy") we inform you about how your personal data is processed by us.

Our privacy policy is modular. They consist of a general part for any processing of personal data and processing situations that come into play every time a website is called up (A. General) and a special part, the content of which relates only to the processing situation specified there with the designation of the respective offer or product refers, in particular to visits to websites, which are described in more detail here (B. Visiting websites). In order to be able to find the parts that are relevant for you, please note the following overview of the breakdown of the data protection notice:

Part	designation	This part is for you
Part A	General	always relevant.
part B	Web-Shop	relevant if you use our web shop
Part C	website and Social media presence	relevant if you use our German website including appearances in social media.

General

(1) Definitions

Based on the model of Art. 4 GDPR, this data protection notice is based on the following definitions:

"Personal data" (Art. 4 No. 1 DS-GVO) is all information relating to an identified or identifiable natural person ("data subject"). A person can be identified if they can be identified directly or indirectly, in particular by means of an assignment to an identifier such as a name, an identification number, an online identifier, location data or using information about their physical, physiological, genetic, psychological, economic, cultural or social identity characteristics can be identified. The identifiability can also be provided by linking such information or other additional knowledge. It is irrelevant how the information came about, its form or its embodiment (photos, video or sound recordings can also contain personal data).
"Processing" (Art. 4 No. 2 DS-GVO) is any process in which personal data is handled, whether with or without the help of automated (i.e. technology-supported) processes. In particular, this includes collecting (ie acquiring), recording, organising, arranging, storing, adapting or changing, reading out, querying, using, disclosing through transmission, distribution or other provision, comparison , the linking, the restriction, the deletion or the destruction of personal data as well as the change of an objective or purpose on which data processing was originally based.

"Responsible" (Art. 4 No. 7 DS-GVO) is the natural or legal person, authority, institution or other body that alone or jointly with others decides on the purposes and means of processing personal data.

"Third party" (Art. 4 No. 10 DS-GVO) is any natural or legal person, authority, facility or other body other than the data subject, the person responsible, the processor and the persons who are under the direct responsibility of the person responsible or the processor are to process the personal data; this also includes other corporate legal entities.

– "Processor" (Art. 4 No. 8 DS-GVO) is a natural or legal person, authority, institution or other body that processes personal data on behalf of the person responsible, in particular in accordance with their instructions (e.g. IT Service provider). In terms of data protection law, a processor is in particular not a third party.

- "Consent" (Art. 4 No. 11 DS-GVO) of the data subject means any voluntarily given for the specific case, in an informed manner and unequivocally given expression of will in the form of a declaration or other clear confirmatory action with which the data subject agrees indicates that she consents to the processing of her personal data.

(2) Name and address of the person responsible for processing

We are responsible for the processing of your personal data within the meaning of Art. 4 No. 7 DS-GVO:

„braganza“ Christian Zwiesler
Unterbiberger Strasse 15a
85579 Neubiberg

Phone: +49 (0) 160 97 99 24 34
E-mail: info@braganza.de

For more information about our company, please refer to the imprint information on our website: https://braganza.de/pages/impressum

(3) Contact details of the data protection officer

Our company data protection officer is available to you at any time for all questions and as a contact person on the subject of data protection. His contact details are:

„braganza“ Christian Zwiesler
Unterbiberger Strasse 15a
85579 Neubiberg

E-mail: info@braganza.de

(4) Legal basis of data processing

In principle, any processing of personal data is prohibited by law and is only permitted if the data processing falls under one of the following justifications:

Article 6(1) sentence 1 lit agrees to the personal data concerning him for one or more specific purposes;
Art. 6 (1) sentence 1 lit. b GDPR: If the processing is necessary to fulfill a contract to which the data subject is a party or to carry out pre-contractual measures that are carried out at the request of the data subject;
Art. 6 Para. 1 S. 1 lit. c GDPR: If the processing is necessary to fulfill a legal obligation to which the person responsible is subject (e.g. a statutory retention obligation);
Art. 6 (1) sentence 1 lit. d GDPR: If the processing is necessary to protect the vital interests of the data subject or another natural person;
Art. 6 (1) sentence 1 lit. e GDPR: If the processing is necessary for the performance of a task that is in the public interest or in the exercise of official authority that has been transferred to the person responsible or
Article 6 paragraph 1 sentence 1 lit. f GDPR ("legitimate interests"): If the processing is necessary to protect legitimate (in particular legal or economic) interests of the person responsible or a third party, provided there are no conflicting interests or rights of the data subject predominate (especially if the person concerned is a minor).

For the processing operations we carry out, we indicate the applicable legal basis in the following. Processing can also be based on several legal bases.

(5) Data erasure and retention period

For the processing operations we carry out, we state below how long the data will be stored by us and when it will be deleted or blocked. Unless an express storage period is specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies. However, storage can take place beyond the specified time in the event of an (impending) legal dispute with you or other legal proceedings or if the storage is required by statutory provisions to which we are subject as the person responsible (e.g § 257 HGB, § 147 AO), is provided. If the storage period prescribed by the statutory provisions expires, the personal data will be blocked or deleted, unless further storage by us is necessary and there is a legal basis for this.

(6) Data Security

We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties (e.g. TSL encryption for our website), taking into account the state of the art and the implementation costs and the nature, scope, context and purpose of the processing and the existing risks of a data breach (including its likelihood and impact) for the data subject.

(7) Cooperation with processors

As with any company, we also use external domestic and foreign service providers to process our business transactions (e.g. for the areas of IT, telecommunications and marketing). These are only active according to our instructions and were iSv Art. 28 DS-GVO contractually obliged to comply with data protection regulations.

(8)No automated decision making (including profiling)

We do not intend to use any personal information collected from you for any automated decision-making process (including profiling).

(9) No obligation to provide personal data

We do not make the conclusion of contracts with us conditional on you providing us with personal data beforehand. In principle, there is no legal or contractual obligation for you as a customer to provide us with your personal data; however, it may be that we can only provide certain offers to a limited extent or not at all if you do not provide the data required for this. If this should exceptionally be the case with the products we offer presented below, you will be informed of this separately.

(10) Legal obligation to transmit certain data

Under certain circumstances, we may be subject to a special statutory or legal obligation to make lawfully processed personal data available to third parties, in particular public authorities (Art. 6 Abs. 1 S. 1 lit. c DS-GVO).

(11) Your Rights

You can assert your rights as a data subject with regard to your processed personal data at any time using the contact details given under A.(2) above. As a data subject, you have the right:

to request information about your data processed by us in accordance with Art. 15 DS-GVO. In particular, you can obtain information about the processing purposes, the category of data, the categories of recipients to whom your data was or will be disclosed, the planned storage period, the existence of a right to correction, deletion, restriction of processing or objection, the existence of a right of appeal , the origin of their data, if they were not collected from us, as well as the existence of automated decision-making including profiling and, if necessary, meaningful information about their details;

pursuant to Art. 16 GDPR, to immediately request the correction of incorrect data or the completion of your data stored by us;

according to Art. 17 DS-GVO to request the deletion of your data stored by us, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims is required;

pursuant to Art. 18 DS-GVO to demand the restriction of the processing of your data if you dispute the accuracy of the data or the processing is unlawful;

in accordance with Art. 20 GDPR, to receive your data that you have provided to us in a structured, common and machine-readable format or to request transmission to another person responsible ("data portability");

to object to the processing in accordance with Art. 21 GDPR if the processing is based on Art. 6 (1) sentence 1 lit. e or lit. f GDPR. This is particularly the case if the processing is not necessary for the performance of a contract with you. Unless it is an objection to direct advertising, we ask that you explain the reasons why we should not process your data as we have done when exercising such an objection. In the event of your justified objection, we will examine the situation and will either discontinue or adjust the data processing or show you our compelling reasons worthy of protection on the basis of which we will continue the processing;

According to Art. 7 Para. 3 DS-GVO your consent once given (also before the validity of the DS-GVO, i.e. before May 25th, 2018) - i.e. your voluntary, informed manner and unequivocally through a declaration or another clear confirmatory action You have made it clear that you agree to the processing of the personal data in question for one or more specific purposes - to revoke this at any time if you have given us such permission. As a result, we are no longer allowed to continue the data processing based on this consent for the future and

according to Art. 77 DS-GVO to complain to a data protection supervisory authority about the processing of your personal data in our company, for example to the data protection supervisory authority responsible for us: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, E -Mail: poststelle@lda.bayern.de.

(12) Changes to Privacy Notice

As part of the further development of data protection law and technological or organizational changes, our data protection information is regularly checked for any need for adjustment or supplementation. You will be informed about changes in particular on our website at www.braganza.de informed. This data protection notice is dated November 2020.

Online store

(1) Explanation of the function

on www.braganza.de you will find in particular the offers of our web shop. When using our web shops, personal data can be processed by you.

(2) Personal data processed

When you use our web shop, we collect, store and process the following categories of personal data:

"Contact details": If you contact us, the data transmitted will be processed. Depending on the type of contact (e.g. by e-mail), this can be e.g. E.g. gender, surname and first name, address, company, e-mail address and the time of transmission.

“Checkout Data”: If you place an order with us, your purchase transaction data will be collected, stored and processed by us. The purchase processing data includes in particular: data on the purchased goods (e.g. clothing size), payment method, order number, delivery and billing addresses, declarations of purchase (e.g. revocation), delivery, payment and, if applicable, return information, information (e.g. shipment number) the third parties involved in the execution of the contract (e.g. transport companies).

“Payment Details”: You can place your order with us via advance transfer, PayPal, invoice
as well as the payment options via the provider "Shopify" (credit card, accelerated checkouts (Shop Pay, Apple Pay and Google Pay), immediate transfer (Klarna), Klarna invoice, eps transfer, Ideal, Bancontact). When processing the payment, the payment data you provide will be collected, stored and processed. The payment data includes in particular: payment type, IBAN and BIC, credit card information, billing address.

The payment data also includes other information that arises in direct connection with the payment processing. This applies, for example, to information that external payment service providers use for identification, such as your PayPal ID (if you pay with PayPal).

“Customer Account Data”: You can also choose whether to create a customer account for your order or to order as a "guest" without creating a customer account. If you create a customer account for your order, the following data will be saved with password protection: name, delivery and billing addresses, email address, credit card information, newsletter subscription, consent to email marketing. The customer account has the advantage that you do not have to re-enter your data for further orders, as these are automatically listed in the order form. You can delete your customer account at any time. Please send us a message in text form (e.g. an e-mail to info@braganza.de) get.

(3) Purpose and legal basis of data processing

We process the personal data specified above in accordance with the provisions of the GDPR, the other relevant data protection regulations and only to the extent necessary. As far as the processing of personal data on Art. 6 Abs. 1 S. 1 lit. f DS-GVO is based, the stated purposes also represent our legitimate interests.

The contact data is processed to process customer inquiries (legal basis is Art. 6 Abs. 1 S. 1 lit. b oder lit. f DS-GVO).

The processing of the purchase transaction data takes place to process customer orders (legal basis is Art. 6 Para. 1 lit. b or lit. f DS-GVO).

The payment data is processed to process the payment transactions (legal basis is Art. 6 Para. 1 S.1 lit. b or lit f. GDPR).

The customer account data is processed to process customer orders and payment transactions (the legal basis is your consent in accordance with Art. 6 Para. 1 S.1 lit. a DS-GVO).

(4) Duration of data processing

Your data will only be processed for as long as is necessary to achieve the processing purposes set out above; the legal bases specified in the context of the processing purposes apply accordingly. Third parties used by us will store your data on their system for as long as is necessary in connection with the provision of services for us in accordance with the respective order. You can find more information on the storage period under A.(5).

(5) transfer of personal data to third parties; basis of justification

The following categories of recipients, which are usually processors (see A.(7)), may have access to your personal data:

Service providers for processing the payment (e.g. the payment service provider PayPal). The legal basis for the transfer is Article 6 Paragraph 1 Clause 1 Letter b or Letter f of the GDPR.
Service providers for processing the delivery of your orders (e.g. DHL, UPS). The legal basis for the transfer is Article 6 Paragraph 1 Clause 1 Letter b or Letter f of the GDPR.
State bodies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the transfer is then 6 Abs. 1 S. 1 lit. c DS-GVO;
Persons used to carry out our business operations (e.g. insurance companies, legal advisors). The legal basis for the transfer is then 6 Abs. 1 S. 1 lit. b oder lit. f DS-GVO.

In addition, we only pass on your personal data to third parties if you Art. 6 Abs. 1 S. 1 lit. a DS-GVO have given their express consent to do so.

(6) Payment Service Provider

Depending on the payment option you have selected (e.g. PayPal, Shopify payment options), your payment data will be transmitted to the respective payment service provider. The payment service provider is responsible for your payment data. Information in particular about the responsible body of the payment service provider, the contact details of the data protection officer of the payment service provider and the categories of personal data processed by the payment service provider can be found at the Internet address

visiting websites

(1) Explanation of the function

Information about our company and the services we offer can be found at www.braganza.de together with the associated sub-pages (hereinafter jointly: "websites"). When you visit our website, your personal data may be processed.

(2) Personal data processed

When using the website for informational purposes, we collect, store and process the following categories of personal data:

"Log data": When you visit our website, a so-called log data record (so-called server log files) is stored temporarily and anonymously on our web server. This consists of:

the page from which the page was requested (so-called referrer URL)
the name and URL of the requested page
the date and time of the call
the description of the type, language and version of the web browser used
the IP address of the requesting computer, which is shortened in such a way that a personal reference can no longer be established
the amount of data transferred
the operating system
the message whether the call was successful (access status/Http status code)
the GMT time zone difference

"Contact form data": When using our contact form, the data transmitted will be processed (e.g. gender, surname and first name, address, company, e-mail address and the time of transmission).

In addition to the purely informational use of our website, we offer the subscription to our newsletter, with which we inform you about current offers. If you register for our newsletter, the following "newsletter data" will be collected, stored and processed by us:

the page from which the page was requested (so-called referrer URL)
the date and time of the call
the description of the type of web browser used
the IP address of the requesting computer, which is shortened in such a way that a personal reference can no longer be established
the E-Mail adress
the date and time of registration and confirmation

(3) Purpose and legal basis of data processing

The processing of the log data serves statistical purposes and to improve the quality of our website, in particular the stability and security of the connection (legal basis is Art. 6 Abs. 1 S. 1 lit. f DS-GVO).

Contact form data is processed to process customer inquiries (legal basis is Art. 6 Abs. 1 S. 1 lit. b oder lit. f DS-GVO).

The newsletter data is processed for the purpose of sending the newsletter. When registering for our newsletter, you consent to the processing of your personal data (legal basis is Art. 6 Abs. 1 lit. a DS-GVO). We use the so-called double opt-in procedure to register for our newsletter. This means that after you have registered, we will send you an e-mail to the e-mail address provided, in which we ask you to confirm that you wish to receive the newsletter. The purpose of this procedure is to be able to prove your registration and, if necessary, to be able to clarify any possible misuse of your personal data. You can revoke your consent to the sending of the newsletter at any time and unsubscribe from the newsletter. You can revoke your consent by clicking on the link provided in every newsletter email info@braganza.de or by sending a message to the contact details given in the imprint.

(4) Duration of data processing

(5) transfer of personal data to third parties; basis of justification

The following categories of recipients, which are usually processors (see A.(7)), may have access to your personal data:

Service providers for the operation of our website and the processing of the data stored or transmitted by the systems (e.g. for data center services, payment processing, IT security). The legal basis for the transfer is then 6 Abs. 1 S. 1 lit. b oder lit. f DS-GVO, unless they are processors;
State bodies/authorities, insofar as this is necessary to fulfill a legal obligation. The legal basis for the transfer is then 6 Abs. 1 S. 1 lit. c DS-GVO;
Persons used to carry out our business operations (e.g. insurance companies, legal advisors). The legal basis for the transfer is then 6 Abs. 1 S. 1 lit. b oder lit. f DS-GVO.

In addition, we only pass on your personal data to third parties if you Art. 6 Abs. 1 S. 1 lit. a DS-GVO have given their express consent to do so.

(6) Use of cookies, plugins and other services on our website

a) General information about cookies

We use cookies on our website to optimize your visit to our website.

As far as technically necessary cookies are concerned, our legitimate interest in the use of cookies in accordance with Art. 6 Para. 1 S. 1 f) DSGVO is to present you with a functional website.

If the cookies are not technically necessary (e.g. cookies for the purpose of analysis by "Matomo" see b)), we only save the cookie on your end device with your prior consent via "opt-in". We will then explain the respective purpose of storing the cookie to you separately in the context of the respective service that stores the cookie on your end device.

You can consent to the storage of cookies at any time in the Cookie Settings withdraw.

You can also set your browser so that you are informed in advance about the setting of cookies and can decide in individual cases whether you exclude the acceptance of cookies for certain cases or in general, or that cookies are completely prevented. However, this can limit the functionality of the website.

b) Session cookies (“Shopify”)

We use so-called session cookies via the provider "Shopify" to optimize our website. A session cookie is a small text file that is sent by the respective server when you visit a website and is temporarily stored on your hard drive. This file as such contains a so-called session ID, with which various requests from your browser can be assigned to the joint session. This allows your computer to be recognized when you return to our website. These cookies are deleted after you close your browser. They serve z. B. that you can use the shopping cart function across multiple pages.

We also use a small amount of persistent cookies (also small text files that are stored on your device), which remain on your device and enable us to recognize your browser on your next visit. These cookies are stored on your hard drive and are automatically deleted after a specified period of time. Their lifespan is 1 month to 10 years. This enables us to present our offer to you in a more user-friendly, effective and secure manner and, for example, to show you information on the site that is specially tailored to your interests.

Specifically, we use the following cookies from "Shopify" (excerpt from the "Shopify" cookie policy available at: https://www.shopify.com/legal/cookies

User-centric security cookies to detect authentication abuse for a limited persistent duration, e.g. B. Repeated failed login attempts. These cookies are set for the specific task of increasing the security of the service.

Multimedia content player session cookies (flash cookies) are used for the duration of a session to store technical data necessary for the playback of video or audio content (e.g. image quality, network connection speed and buffering parameters).
Load balancing session cookies are used for the duration of the session to identify the same server in the pool so the load balancer can appropriately redirect user requests.
User interface customization persistent cookies are used to store a user's preferences in relation to a service across websites.
First Party Analytics Cookies - We use these cookies to estimate the number of unique visitors to improve our websites and our merchants' websites, and to identify the most searched words on search engines that lead to a webpage. These cookies are not used to target you with online marketing. We use these cookies to learn how our websites and our retailers' websites work and to make relevant improvements to improve your browsing experience.

For more information about Shopify, visit: https://www.shopify.de/legal/datenschutz

c) Web analysis service “google analytics”

We use the web analysis service Google (Universal) Analytics, a web analysis service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This uses cookies and helps us to evaluate your usage behavior in order to constantly improve visits to our website and our offer. We have set up “Analytics” in such a way that your IP address is immediately anonymised. The information obtained via cookie technology about your usage behavior with regard to our website will not be passed on to third parties. Further information to "Google Analytics" can be found at:

https://policies.google.com/privacy?hl=de&gl=de

Google Analytics is currently disabled. The anonymous recording of your usage behavior only begins with your active consent. To give your consent, please make the appropriate setting in the Cookie Settings before.

d) Social Media Plugins

We do not use any social media plugins on our websites. If our websites contain symbols from social media providers (e.g. Facebook, Instagram), we only use them for passive linking to the pages of the respective providers.