PRIVACY POLICY

AS OF: 02/2025

• General information

We are delighted that you are interested in our products, services and offers. Data protection and data security are our top priority. We therefore comply with the requirements of the GDPR and other applicable data protection regulations. In the following data protection information, we inform you about the processing of your personal data by KICKZ.com GmbH, Landwehrstraße 60, 80336 Munich ("KICKZ" and/or "we" and/or "controller")

The subject of data protection is personal data. According to Art. 4 No. 1 GDPR, this is any information relating to an identified or identifiable natural person - for example, your name, postal address, email address, telephone number or payment details.

This Privacy Policy applies to all our services and benefits that we offer you in the EU and the EEA. It does not matter whether you use our services via a website, in a store, by telephone, at events or via social networks and other channels. For ease of understanding, we summarize all these options under the term "services".

The following information gives you a simple overview of what happens to your personal data when you use our services. You can find detailed information in the following sections of this privacy policy.

• How do we collect data?

Your data is collected in various ways:

On the one hand, you provide us with this information directly, for example by entering it in a contact form or when using our services, such as when you register and enter your name, e-mail address or postal address. On the other hand, our IT systems automatically collect data as soon as you visit our website. This is primarily technical information, such as the Internet browser used, the operating system or the time the page was accessed. We also collect technical device and access data during your interaction with our services, such as information about the device you are using.

In addition, we generate data through our own analyses, for example as part of market research studies or the evaluation of customer reviews. In some cases, we also receive data from third parties, such as credit agencies or payment service providers. Depending on whether you contact us online, by telephone, in person or in any other way and which services you use, different data from different sources will be collected.

Your options:

In principle, you decide for yourself what information you wish to share with us. However, if you do not provide certain personal information, we may not be able to offer you the services you require, or only to a limited extent. For example, it is necessary to provide a delivery address in order to be able to deliver parcels. Mandatory information that is necessary for the use of a particular service is clearly marked so that you can easily recognize it.

• What categories of personal data are collected and processed?

We process various types of personal data in order to provide you with our services and to process your orders and inquiries in the best possible way. This includes in particular

• Personal data such as your name, address, date of birth, place of birth as well as delivery and delivery addresses.

• Physical data such as weight, height, shoe size and clothing size - but only to the extent that this does not allow direct identification of your person.

• Contact details such as telephone number and e-mail address that you provide to us during registration or when placing an order.

• Data from electronic traffic such as IP addresses, cookies, pixel data, which are automatically collected when you use our online services.

• Order data on orders, including order number, item information (e.g. description, size, color, purchase price), payment method, billing and delivery address as well as the status of deliveries, payments and returns.

• Advertising and sales data to enable personalized offers and marketing measures.

• Communication data collected through requests to our customer service or via product reviews. This includes your name, your contact details and the content of your messages.

• Data to fulfill legal and regulatory obligations, in particular to prevent fraud and to comply with legal requirements.

• Data for contract fulfillment, e.g. for processing warranty claims, warranty inquiries or complaints.

• Payment details, such as your preferred payment method, billing address or credit card details.

In addition, we process data for the analysis of purchasing and payment behavior as well as interests, which are either collected by us or by our partners. This information helps us to optimize your user experience and provide you with relevant products and content.

Data is collected and processed both when you use our website and by external partners, for example via social media platforms or online marketing networks.

• Name and contact details of the controller

The controller within the meaning of the GDPR is

KICKZ.com GmbH

Landwehrstrasse 60

D-80336 Munich

Germany

Phone: +49 (0) 89 324 781 0

Fax: +49 (0) 89 324 781 99

E-mail: [email protected]

represented by its management.

• III. Contact details of the data protection officer

If you have any questions about data protection, you can contact our data protection officer at any time:

Said-Elham Sadat - DSB Münster GmbH Martin-Luther-King-Weg 42-44 48155 Münster

You can also send us an e-mail to [email protected].

• IV. Scope and purpose of the processing of personal data

  • When visiting this website

  • Server log files

When you use our website, certain connection data and data provided by your internet browser are temporarily stored. In order to ensure the proper and secure operation of the website, the following data is recorded and stored in log files:

• IP address of the calling computer

• Operating system of the calling computer

• Browser version of the calling computer

• Name of the retrieved file

• Date and time of retrieval

• Referring URL

• Type of end device (e.g. desktop/smartphone)

• Connection logging

The logging of this data and its processing in log files is technically absolutely necessary for the proper and secure operation of the website.

The storage and/or reading of data on your end device is carried out in accordance with Section 25 (2) No. 1 TDDDG. The processing of this personal data is based on Art. 6 para. 1 lit. f) GDPR. This is our legitimate interest

• quickly establish the connection to the company's website,

• to enable a user-friendly use of this website,

• recognize and ensure the security and stability of the systems and

• to facilitate and improve the administration of this website

The processing is expressly not carried out in order to gain knowledge about you as a person.

The data is deleted as soon as the purpose for which it was collected has been achieved. In the case of storage for the provision of the website, this occurs at the end of the respective session. Log files are deleted after 30 days at the latest. Longer storage is possible if the IP addresses are anonymized so that it is no longer possible to assign them to a user.

• Cookies on our website

Cookies are small files that your browser stores on your device when you visit a website. They help to recognize your device and store certain information, such as language settings, login data or preferred settings. This allows your user experience to be optimized and adapted to your preferences.

If you do not want cookies to be saved, you can change this in your browser settings. There you have the option of blocking the storage of cookies or deleting cookies that have already been stored. Please note, however, that deactivating technically necessary cookies may mean that some functions of the website can only be used to a limited extent or not at all.

The exact management of cookies depends on the browser used. In most cases, you will find the relevant options in the "Privacy" or "Security" section. If you need detailed instructions, you can use the help function of your browser.

By adjusting your cookie settings, you can determine which information is stored and customize your online experience accordingly.

Below you will find the most common types of cookies and their functions:

• Session cookies:

  These are stored temporarily while you are actively using a website. They contain a session identifier, for example to prevent you from having to log in again every time you change pages. As soon as you log out or end your session, these cookies are automatically deleted or lose their validity.

• Permanent cookies:

  These cookies remain stored on your device for a set period of time and have an expiration date. They enable websites to remember your settings and information for future visits. For example, you do not have to reset your language settings each time. After the stored time has expired, the cookie is automatically deleted as soon as you visit the relevant website again.

• Third-party cookies:

  These cookies are set and managed by external partners. They can be used for statistical analyses on our website or for marketing purposes, among other things.

• Technically necessary cookies:

  These cookies are essential for the use of the website, as they enable basic functions such as page navigation and access to protected areas. Some areas of our website only work with these cookies, as they need to recognize your browser even after a page change.

The technically necessary cookies we use are essential to provide the website and its basic functions, such as language settings. Their storage and/or reading is based on Section 25 (2) No. 1 TDDDG, as they are necessary for the provision of the digital service you have requested.

All other cookies require consent and are subject to Section 25 (1) TDDDG. When you visit our website for the first time, you will be shown a banner that provides you with information about the cookies used and allows you to choose whether you consent to non-mandatory cookies. You can change your cookie settings and adjust your selection at any time via our consent management platform.

• Use of our contact form

If you have any questions, you can contact us using the contact form provided on our website. We will ask you about the nature of your query, for example whether it concerns an order, payment, shipping or a general request. This allows us to assign and process your request more quickly.

To contact us, we need at least your name, a valid e-mail address and a description of your request so that we know who sent the request and can answer it accordingly. Optionally, you can also enter your order number if your request relates to an order, or leave your telephone number if a quick clarification by callback is useful.

We use the personal data you provide exclusively to answer your request and for the associated technical administration. Your data will not be passed on to third parties. Your data is processed either on the basis of Art. 6 para. 1 lit. b) GDPR, if it is a customer inquiry, or in accordance with Art. 6 para. 1 lit. f) GDPR, if we have a legitimate interest in processing and responding to general inquiries.

Your personal data will be automatically deleted as soon as your request has been finally processed and there is no legal basis for further storage.

• Through third-party tools with tracking or analysis functions

For the third-party services listed in this section, you yourself decide whether they are used by giving your consent in accordance with Art. 6 para. 1 lit. a) GDPR and Section 25 para. 1 TDDDG. If you agree to the storage and use of your data by a specific tracking tool, you can activate it in our Consent Manager. This tool is displayed as a banner on your first visit to our website and allows you to individually determine whether and which tracking tools may be used.

With the tracking measures used, we want to design our website to meet your needs and continuously optimize it. At the same time, these technologies help us to statistically record and evaluate the use of our website in order to improve our offering for you. You can read about the specific purposes of data processing and the categories of data concerned in the respective descriptions of the tracking tools used.

We use common tracking technologies in all our services to analyze device and access data. This enables us to recognize how our services are used. Identification cookies and similar technologies are used for this purpose. These enable us to see which content is particularly popular, the times at which our services are frequently used, the regions (down to city level) from which they are accessed, and which browsers and devices are used.

We also occasionally carry out A/B tests. This method, also known as split testing, compares two versions of a website to find out which version works better, is more popular or makes it easier for users to find the content they want. By comparing version A with version B, we obtain data that helps us to make informed decisions about improvements and adjustments to our services.

• AWIN Partner Programs

We use the AWIN partner program, an affiliate network that connects merchants (merchants) with sales partners (affiliates). This model enables website operators to place third-party advertisements and be remunerated based on clicks or sales. The advertising media, such as banners or other ad formats, are provided via AWIN and distributed by affiliates on their platforms or via channels such as keyword advertising or email marketing.

Your data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG. AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany, is responsible for AWIN.

AWIN uses tracking cookies that do not store any directly personal data. Instead, they contain an affiliate ID, a visit identifier and a reference to the advertising material clicked on. This serves to track successful transactions and ensure fair remuneration between advertisers and sales partners.

You can deactivate the storage of cookies at any time via your browser settings and remove AWIN cookies that have already been stored.

You can find further information on data processing by AWIN at: https:

• Cheap conversion

We use billiger.de / solute.de conversion tracking to evaluate the effectiveness of our marketing measures. This tracking enables us to analyze which clicks on our offers via billiger.de leads to a purchase.

The purpose of conversion tracking is to optimize the performance of our advertising campaigns and to track the success of partner placements via billiger.de. Clicks on our offers are registered and linked to subsequent transactions. If you have reached our website via an advertisement on the provider's domain, the success of the advertisement can be tracked with the help of cookies and comparable technologies such as tracking pixels, web beacons, pings or HTTP requests.

For this purpose, tracking technology is used to read certain end device and browser information, including your IP address if applicable. This allows us to record and analyze predefined user actions such as completed transactions, leads, search queries on the website or product page views. This data enables us to compile statistics on user behavior on our website after redirection from an advertisement in order to further optimize our offer.

Your data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG. No tracking will be carried out without your consent.

The recipients of the data are solute GmbH, the operator of billiger.de, and in individual cases partners who are commissioned to process the transaction.

There is no transfer of personal data to third countries outside the European Economic Area (EEA).

The tracking cookies are valid for 30 days. If a transaction takes place within this period, it is assigned to the original click. After the 30 days have expired, the cookies lose their validity.

You can deactivate the setting of cookies at any time via your browser settings and delete cookies that have already been saved. Please note, however, that disabling tracking cookies may result in certain personalized content or offers not being displayed optimally.

You can find further information in solute GmbH's privacy policy at https://www.solute.de/ger/datenschutz/.

• Contentsquare

We use the Contentsquare platform, operated by Content Square S.A.S., 7 Rue de Madrid, 75008 Paris, France, to improve the user-friendliness of our website, increase user satisfaction and ultimately optimize conversion rates.

The platform analyzes digital user behavior by recording interactions on our website. This allows us to identify points of friction in the user experience in order to derive targeted optimization measures and increase user engagement.

Your data is processed on the basis of your consent in accordance with Art. 6 para. 1, sentence 1 lit. a GDPR and § 25 para. 1 TDDDG. No processing will take place without your consent.

The recipient of the data is Contentsquare GmbH, Implerstraße 25a, 81371 Munich, Germany. The data collected is primarily processed within the European Union. In certain cases, data may be transferred to third countries outside the European Economic Area (EEA). These countries may not offer the same level of data protection. However, Contentsquare uses appropriate security measures to ensure the protection of your data. You can find more information on this in Contentsquare's privacy policy at https://contentsquare.com/privacy-and-security/.

Contentsquare uses cookies, pixels and scripts that are stored in your browser to collect data. The following information can be collected and analyzed:

• Date and time of the visit,

• Duration of visit,

• Geographical location,

• Information about the operating system and the screen resolution,

• Purchase activity,

• Referrer URL,

• Unique device identifier,

• Usage data,

• Visited websites,

• Hashed IP address,

• Mouse movements, screen tips, scrolling activity,

• Interactions with forms.

You can withdraw your consent to Contentsquare's data collection at any time by adjusting your cookie settings on our website. You can find more information in Contentsquare's privacy policy at https://contentsquare.com/privacy-and-security/.

• Conversion Linker - Floodlight

We use Google's Floodlight conversion tracking system to measure the effectiveness of our advertising campaigns, limit the frequency of ads and only show you relevant ads based on your interests. The system helps us to analyze user interactions with our ads and understand which of them lead to certain actions such as purchases or inquiries. Google uses various tracking technologies, including cookies and similar technologies, to record website visits and user activities. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Your data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG.

In particular, Floodlight collects information about advertisements you have clicked on and your previous user behavior on third-party sites. Google uses a cookie ID to track which ads were shown in which browser and to prevent you from seeing the same ads more than once. Google can also record conversions, for example, if you visit our website after clicking on an advertisement and carry out a transaction.

By integrating the Floodlight tag, your browser automatically establishes a direct connection to the Google servers. This provides Google with the information that you have visited our website or clicked on one of our ads. Floodlight also enables us to analyze whether you perform a certain action on our website after seeing or clicking on one of our display or video ads on another platform. Google uses this information to display targeted advertising.

The recipients of the data are Google and affiliated companies or external service providers who are commissioned to carry out advertising campaigns. The main service provider is Google Ireland Limited, Ireland.

Data may be transferred to third countries outside the European Economic Area (EEA). Google is a participant in the EU-US Data Privacy Framework, which ensures the secure transfer of personal data between the EU and the USA. In addition, Google relies on standard contractual clauses in accordance with Art. 46 GDPR to ensure compliance with European data protection standards when processing in third countries. You can find more information on this at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_de.

Cookies are stored for up to 180 days (applies only to cookies set via this website).

You can find more information on data processing by Google in their privacy policy at https://policies.google.com/privacy.

• Coveo

On our website, you use the Coveo service, a search and analysis tool from Coveo Solutions Inc, 3175 Chemin des Quatre-Bourgeois, Suite 200, Québec, QC G1W 2K7, Canada. Coveo helps to optimize the search functions on our website and to provide you with relevant content.

Coveo collects and processes data that is generated during your use of the search functions. This includes

• search terms and your click behavior to improve the search results,

• Your IP address,

• Technical information about your device, such as browser type and operating system.

This data is used to optimize your user experience. In addition, Coveo may use this information to analyze and further develop its services.

Your data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR. Your consent is voluntary and can be revoked at any time by adjusting your settings in our Cookie Consent Manager.

The data may be transferred to countries outside the European Union, in particular to Canada. Canada is recognized by an adequacy decision of the European Commission as a country with an adequate level of data protection. In addition, Coveo has contractually committed to comply with data protection standards in accordance with the GDPR.

Your data will only be stored for as long as is necessary for the above-mentioned purposes or as required by statutory retention obligations.

Further information on data processing by Coveo can be found in their privacy policy at https://www.coveo.com/privacy-policy.

• Emarsys Marketing Platform

We use the SAP Emarsys Marketing Platform, a marketing software solution from Emarsys North America Inc, 10 W Market St., Suite 1350, Indianapolis, IN 46204, USA (registration number: EIN 47-3961985). This platform allows us to create personalized one-to-one interactions with you by automating and evaluating targeted marketing campaigns. This allows us to improve our communication and provide you with personalized offers.

Your data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG.

When you use SAP Emarsys, various personal data is processed, including your contact details (name, email address, telephone number), demographic information (age, gender, place of residence), usage data (interactions with emails, pages visited, purchase history) and technical information (IP address, browser type, operating system). This data helps us to better understand your user behavior, optimize marketing strategies and tailor content to your interests.

The recipient of the data is Emarsys North America Inc. and other technical service providers required for the operation and analysis of the platform. As Emarsys is based in the USA, data may be transferred to third countries outside the EU/EEA. To ensure an adequate level of data protection, we have concluded standard contractual clauses with Emarsys in accordance with Art. 46 GDPR. Further information can be found in the Emarsys privacy policy at https://emarsys.com/de/privacy-policy/.

Your data will only be stored for as long as is necessary for the above-mentioned purposes or as long as statutory retention obligations require longer storage. As soon as the data is no longer required or you revoke your consent, it will be deleted, provided there are no legal deadlines to the contrary.

• Everysize

We use the platform everysize, operated by everysize GmbH, Schellengasse 2, 74072 Heilbronn, Germany (commercial register number: HRB 753352), to offer you the opportunity to compare various retailers in the shoes category. You can browse offers via the platform and buy goods directly. In addition, everysize enables us to transmit advertising messages and subsequently measure the success of our advertising campaigns.

We use the everysize conversion tracking pixel to measure the success of our advertising. This pixel helps us to analyze how targeted and efficient our advertising campaigns on everysize are. The tracking pixel is provided by everysize GmbH and processes data on our behalf on the basis of an agreed data processing agreement in accordance with Art. 28 GDPR.

The processing of your data is based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR. Everysize guarantees that the data collected will not be merged with data from other websites or used for its own purposes.

The following personal data is processed when you use everysize:

• IP address (shortened to prevent direct identification).

The recipient of the data is exclusively everysize GmbH, which carries out the performance measurement for us. Data is not transferred to third countries.

The data is only stored for as long as is necessary to measure success. As soon as the analysis is completed or you withdraw your consent, the data will be deleted.

Further information can be found in the privacy policy of everysize at

• Facebook Custom Audiences

We use Facebook Custom Audiences, an advertising tool from Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, to display targeted ads to you if you have shown an interest in our offers. With the help of the Facebook pixel or comparable technologies, Meta can recognize which users visit our website or have certain interests. This allows you to be categorized in so-called Custom Audiences in order to display relevant advertising to you on Facebook or in the Audience Network.

Your data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG.

When using Facebook Custom Audiences, the following personal data may be processed:

• Usage data: websites visited, interactions with content, click behavior,

• Meta/communication data: IP address, device information, browser type, operating system,

• Event data: Purchase activities, app installations, interactions with advertisements.

This data is used for various purposes, including

• Personalized advertising to address you in a targeted manner,

• Remarketing to address you again as a visitor to our website on other platforms,

• Measuring the success of marketing campaigns,

• Creation of user profiles to display more relevant ads.

We are jointly responsible with Meta Platforms Ireland Ltd. for the collection and transmission of event data. Further processing is the sole responsibility of Meta. The details of the joint responsibility are regulated in an agreement, which you can view at https://www.facebook.com/legal/terms/page_controller_addendum.

The recipient of the data is Meta Platforms Ireland Ltd. The data may be passed on to Meta Platforms Inc, 1601 Willow Road, Menlo Park, CA 94025, USA. Meta may also use this data for its own purposes, in particular to personalize advertising.

Data may be transferred to third countries, in particular the USA. Meta is certified under the EU-US Data Privacy Framework to ensure an adequate level of data protection. In addition, Meta uses standard contractual clauses in accordance with Art. 46 GDPR and additional security measures such as IP masking. You can find more information on this at https://www.facebook.com/legal/terms/data_security_terms.

Your data will be stored for a maximum of two years. The target groups created by Facebook remain active as long as our Facebook account exists.

You can withdraw your consent at any time by adjusting the cookie settings on our website. You can find more information in the Facebook Custom Audiences privacy policy at https://www.facebook.com/legal/terms/customaudience.

You can withdraw your consent at any time by adjusting the cookie settings on our website. You can find more information in the Facebook Custom Audiences privacy policy at https://www.facebook.com/legal/terms/customaudience.

• Google Ads

We use Google Ads on our website, an online advertising platform of Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland. This enables us to present you with relevant advertisements and to measure the success of our advertising campaigns. By using Google Ads, we can analyze user behavior on our website in order to optimize our marketing strategies. Your personal data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TTDSG.

Among other things, the following data is collected as part of Google Ads: Click path, visibility of ads, mouse movements, timestamps, clicks on ads, conversion tracking, IP address, time and date, location data, visitor behavior, user agent, language settings, websites visited and time zone. The data collected is transmitted to Google Ireland Ltd. and processed there. It is possible that this data may also be forwarded to Google LLC, based in the USA.

Please note that your personal data may be processed outside the European Economic Area (EEA), in particular in the USA. These countries may not have a level of data protection comparable to that in the EU, which means that the enforcement of your rights may be restricted or not possible. The cookies set by Google Ads usually remain stored on your device for 30 days and are then automatically deleted. The data collected will be stored for as long as is necessary for the above-mentioned purposes or until you withdraw your consent.

You can revoke your consent at any time with effect for the future by adjusting the cookie settings on our website or by making the appropriate settings in your browser. You can find more information on data protection at Google Ads in Google's privacy policy at https://policies.google.com/privacy and in the information on data use in advertising services at

• Google Analytics

We use the Google Analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze user behavior on our website and to optimize our content. Google Analytics uses cookies that collect pseudonymized data about your use of our website. This includes your shortened IP address, pages visited, length of visit, interactions and technical information about your device, such as the operating system used or the browser type.

Your data is processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. The data collected by Google Analytics is transmitted to Google servers in various data center locations and stored there. You can view an overview of the current locations at https://www.google.com/about/datacenters/locations/ If your data is processed outside the EU, we have concluded the standard contractual clauses approved by the EU Commission with Google LLC in accordance with Art. 46 para. 2 lit. c GDPR. Further information on order processing by Google can be found at

As Google operates data centers worldwide, your data may be transferred to countries that do not have an adequate level of data protection. In the USA in particular, there is a risk that government agencies may be able to access your data. However, Google takes additional technical and organizational measures to protect your data in the best possible way. Google is also certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection for the transfer of personal data to the USA. You can find details on this at

The data collected by Google Analytics is stored for a maximum of 14 months. After that, only aggregated statistics without personal reference are stored. Google Analytics is used exclusively on the basis of your consent. You can withdraw your consent at any time by adjusting your cookie settings on our website. You can also use a browser plugin to prevent Google Analytics from collecting data about your usage. You can find the plugin at https://tools.google.com/dlpage/gaoptout?hl=de.

You can find further information on the processing of your data by Google in the privacy policy at and in the information on the use of data by Google Analytics at: https:

• Google Tag Manager

We use the Google Tag Manager in a server-side hosted version by Ingenious Technologies AG, Stresemannstr. 123, 10963 Berlin, Germany. Google Tag Manager enables us to manage various website tags via a central interface and to flexibly integrate additional services in order to better analyze the use of our website.

Server-side hosting by Ingenious Technologies AG ensures that personal data, in particular the IP address, is not transmitted directly to Google when our website is accessed. Instead, the container is retrieved from an Ingenious Technologies AG server in Germany. This reduces the risk of unintentional transmission of personal data to the USA.

The Google Tag Manager itself does not set any cookies and does not store any personal data. However, it can load other services which in turn process personal data. In such cases, the legal basis depends on the type of integrated services:

If only technically necessary services are integrated, the processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR in the optimization and secure administration of our website.

If tracking or marketing services are activated via the Google Tag Manager, data processing will only take place with your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG if the use of cookies or similar technologies is required.

You can manage or withdraw your consent at any time via the cookie settings on our website.

The storage period of the processed data is determined by Ingenious Technologies AG and cannot be influenced by us. Further information on data processing by Ingenious Technologies can be found in their privacy policy: https://www.ingenioustechnologies.com/privacy-policy/.

• Microsoft Advertising

We use Microsoft Advertising, a service of Microsoft Ireland Operations Ltd. based in Dublin, Ireland, to provide targeted advertising in Bing, Yahoo and DuckDuckGo search results and on third-party websites. Automatically collected data about your use of our website is usually transferred to Microsoft Corporation servers in the USA and stored there. The transfer of personal data to the USA is based on the adequacy decision of the European Commission for the EU-US Data Privacy Framework (DPF) in accordance with Art. 45 GDPR. Microsoft is certified under the DPF to ensure an adequate level of data protection. If data processing takes place outside the DPF, Microsoft also uses the standard contractual clauses of the EU Commission to ensure a high level of data protection.

To enable targeted advertising, a Microsoft Advertising cookie is stored on your device when you visit our website. This cookie is used to collect pseudonymous information, including

• Usage data: Which pages you visit and which elements you click on,

• Device and browser information: IP address, operating system, device type,

• Data about advertisements: Which ads were displayed to you and whether you clicked on them,

• Data from advertising partners: Pseudonymized user IDs that are used to measure success.

With the help of conversion tracking, Microsoft can recognize whether an advertisement has led to a specific user action on our website. We only receive aggregated reports on how many users have reached our website via a Microsoft Advertising ad and have reached a predefined target page (conversion page). Personal information about the identity of users is not passed on.

The use of Microsoft Advertising is based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG.

Your data will be stored for as long as is necessary to fulfill the stated purposes or as long as required by statutory retention obligations (e.g. for tax or accounting purposes).

You can prevent the collection and processing of your data by Microsoft by clicking:

• deactivate the storage of third-party cookies in your browser,

• Activate the "Do Not Track" function in your browser,

• script blocker such as NoScript (https://noscript.net/) or Ghostery (https://www.ghostery.com),

• Disable Microsoft's privacy options for ad customization:

  https:

Further information on data processing by Microsoft can be found in their privacy policy: https://privacy.microsoft.com/de-de/privacystatement.

• Snapchat Ads

We use Snapchat Ads on our website, an advertising technology from Snap Inc, Market Street, Venice, CA 90291, USA. With the help of Snap Pixel, we can measure, evaluate and target advertising campaigns. The tracking tool helps us to analyze the use of our website and improve the effectiveness of our Snapchat ads.

Snap Pixel enables us to identify visitors to our website as a potential target group for the display of personalized advertising ("Snapchat Ads"). As a result, our ads are targeted to users who have already shown interest in our content or whose behavior on other websites indicates that they are potentially interested in our products or services ("Custom Audiences"). Snap Pixel also ensures that our ads are more relevant and that users are not bothered with irrelevant advertising.

The tracking tool also allows us to evaluate the success of our advertising measures ("conversion tracking") by analyzing whether users have reached our website after clicking on one of our Snapchat ads and performed certain actions there. This helps us to better understand the effectiveness of our Snapchat campaigns and to adapt our marketing strategies accordingly.

Your personal data is processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG.

The data collected includes the IP address, interactions with our content, pages visited on our website and other device and browser-related information. Snapchat collects this data in pseudonymized form so that no direct identification is possible. However, Snapchat can link the collected data to your Snapchat user account and use it for its own purposes, in particular to personalize advertising and improve the user experience.

It is possible that Snapchat may store and process your data outside the European Union, in particular in the USA. However, Snapchat is certified under the EU-U.S. Data Privacy Framework, so that there is an adequate level of data protection for the transfer of personal data to the USA in accordance with Art. 45 GDPR.

The data collected by Snapchat will be stored for as long as is necessary for the above-mentioned purposes or until you withdraw your consent. After expiry of this period or your revocation, the data will be deleted, provided there are no statutory retention obligations.

You can find further information on the processing of personal data by Snapchat in Snapchat's privacy policy at: https:

• TikTok Ads

We use TikTok Ads, an advertising service of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, to place targeted advertisements and analyze their impact. With the help of the TikTok pixel, we record how you interact with our ads and whether certain actions are carried out on our website after clicking on an ad (conversion tracking). This data helps us to optimize the effectiveness of our advertising campaigns and to provide personalized content that is better tailored to your interests.

The TikTok Pixel makes it possible to define specific user groups ("Custom Audiences") so that our advertisements are only displayed to users who have already shown an interest in our content or who have certain characteristics. We also use this information to avoid repeated, irrelevant ads.

Your personal data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG.

The following data is processed: IP address, device and browser information, pages visited and interactions on our website, timestamp and referrer URL as well as user activities such as click and scroll behavior. This data is processed pseudonymously so that no direct identification is possible. However, TikTok can link it to your TikTok user account and use it for its own purposes, in particular to optimize advertising and user experience.

TikTok may transfer the collected data to countries outside the European Union, in particular to the USA. TikTok is certified under the EU-U.S. Data Privacy Framework, so that an adequate level of data protection is guaranteed for the transfer of personal data in accordance with Art. 45 GDPR.

In addition to us, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited, WeWork, 125 Kingsway, London, WC2B 6NH, are responsible for the data that you transmit directly to TikTok.

Insofar as data is processed jointly with TikTok, there is joint responsibility in accordance with Art. 26 GDPR. To this end, we have concluded an agreement with TikTok on joint data processing, which you can view at the following link

https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms

The stored data will be kept for as long as is necessary for the stated purposes or until you withdraw your consent. After expiry of this period or your revocation, the data will be deleted, provided there are no statutory retention obligations.

Further information on data processing by TikTok can be found here:

https://www.tiktok.com/legal/page/eea/privacy-policy/de-DE

https://www.tiktok.com/legal/page/global/cookie-policy/de-DE

• Trust Pilot

We use Trustpilot to give you the opportunity to rate our services and leave feedback. This service is provided by Trustpilot A/S, Pilestræde 58, 5, 1112 Copenhagen, Denmark. If you have used our services, you may receive an invitation to submit a review if you have previously consented to this request being sent.

To ensure that only genuine customers leave reviews, we provide Trustpilot with certain information, including your name, email address and a reference number. This information is used solely for verification and contact purposes as part of the review request.

Your personal data is processed on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR. If you have consented to this, for example by clicking on a link or checkbox, you will receive a message with a link to the review page.

Your personal data will not be stored by us beyond the duration of the existing contractual relationship. The storage and processing by Trustpilot is subject to their privacy policy, which you can find here:

https://de.legal.trustpilot.com/end-user-privacy-terms.

Trustpilot receives the data as the recipient and processes it independently. If you have consented to the processing, you can revoke your consent at any time for the future by contacting Trustpilot directly at [email protected].

If you would like to submit a review without first going through verification, you will need to create an account with Trustpilot. In this case, only Trustpilot's terms of use and privacy policy apply. We have no direct influence on published reviews and cannot remove them independently. If you would like to have a review or your Trustpilot account deleted, please contact Trustpilot directly at[email protected]

We also include a Trustpilot widget on our website. This element displays current ratings and loads content directly from Trustpilot's servers. In order to display the content correctly, a connection to Trustpilot is established when you visit our website, which gives Trustpilot access to technical data such as your IP address. Trustpilot can also recognize that you have visited our website and may store this information in cookies in order to analyze your user behavior or use it for advertising purposes.

The processing of your data by the Trustpilot widget is based on our legitimate interest in accordance with Art. 6 para. 1 lit. f) GDPR to transparently present the quality of our services. If you do not want data to be stored by cookies, you can adjust your settings in the cookie banner or change them via "Edit cookie settings" on our website. If consent to the storage of cookies is required, the processing is carried out on the basis of Art. 6 para. 1 lit. a) GDPR.

• Voucher and advertising system from VCHFY GmbH

We use the voucher and advertising system of VCHFY GmbH, Tornquiststraße 51, 20259 Hamburg, Germany, to fulfill a contract or to carry out pre-contractual measures for the sale of our products on the basis of Art. 6 para. 1 lit. b) GDPR. When this program is called up, personal data (IP address, order number as well as article and order values) are forwarded to VCHFY for order processing as part of order processing. The voucher and advertising system uses cookies for this purpose. These are necessary for the fulfillment of the contract or for pre-contractual measures and are also based on Art. 6 para. 1 lit. b) GDPR.

Details on the handling of user data can be found in VCHFY GmbH's privacy policy at: https:

• Google reCaptcha

We have integrated Google reCaptcha components on our website. Google reCaptcha is a service of Google Ireland Limited and enables us to distinguish whether a contact request comes from a natural person or is automated by means of a program. When you access this content, you establish a connection to the servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, whereby your IP address and possibly browser data such as your user agent are transmitted. Furthermore, Google reCaptcha records the time spent on the site and the user's mouse movements in order to distinguish automated requests from human requests. This data is processed exclusively for the above-mentioned purposes and to maintain the security and functionality of Google reCaptcha.

The service is used on the basis of our legitimate interests, i.e. for protection during the transmission of forms in accordance with Art. 6 para. 1 lit. f). GDPR. The specific storage period of the processed data cannot be influenced by us, but is determined by Google Ireland Limited. Google LLC and its subsidiaries are certified under the Data Privacy Framework. Details can be found at https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active. Further information can be found in the privacy policy for Google reCaptcha: https://policies.google.com/privacy?hl=en-US.

• Additional processing when using our web store

  • Registration with Facebook Connect and Google SSO

We offer you the option of registering in our online store via single sign-on services (SSO) such as Facebook or Google. This allows you to log in with the access data of an existing account without having to create a separate account with us. The prerequisite is that you are already registered with one of these providers and authenticate yourself there. Registration takes place directly with the respective provider, who will send us a user ID. Depending on your release and data protection settings, we may receive further data such as your name or email address - your password will not be passed on to us.

If your provider supports it, your data stored with us can be synchronized automatically, e.g. when you change your email address. The use of SSO is either based on your consent (Art. 6 para. 1 lit. a GDPR) or is necessary for the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR). If you wish to terminate the connection, you can do so directly in the settings of your SSO provider. Deleting your account with us must be done separately.

In doing so, we process inventory and contact data as well as authentication information. Supported services are Facebook SSO (Meta Platforms Ireland Ltd., https://www.facebook.com/about/privacy) and Google SSO (Google Ireland Limited, https://policies.google.com/privacy)

If you require further information on data processing by the respective providers, you can read this directly in the privacy policies of the respective services.

• Processing in the context of marketing campaigns and events

• Newsletter

We offer you various newsletters that inform you about events, products and updates. To register, we collect your e-mail address and the time of your consent. The newsletter is sent using the double opt-in procedure (single opt-in in some countries), which requires you to verify your registration via a confirmation link.

We use the Emarsys service, which acts as a processor, to send your data. We have concluded a contract with Emarsys that ensures the protection of your data. You can find more information here: Emarsys privacy policy.

When you use our newsletter, we collect technical access data such as browser type, operating system, IP address and opening and clicking behavior. This data helps us to tailor the newsletter to your interests.

The processing is based on your consent in accordance with Art. 6 para. 1 lit. a) GDPR. You can unsubscribe from the newsletter at any time using the unsubscribe link or by sending an email to the contact address provided. If you object, we may store your email address in a blacklist.

Please note: A separate revocation of the performance measurement is not possible - in this case you must unsubscribe from the entire newsletter.

If we process your data on the basis of legitimate interests in accordance with Art. 6 para. 1 lit. f) GDPR, you can object in accordance with Art. 21 GDPR, in particular in the case of direct advertising. All you need to do is send an email to the contact address provided.

To ensure the error-free operation of our newsletter and to enable the prompt resolution of potential technical issues, we conduct monitoring in the event of error messages. In this context, we process the email addresses of the affected users in order to analyze error reports related to the use of the newsletter and to address them in a targeted manner. This processing is carried out solely for this purpose and is based on our legitimate interest under Article 6(1)(f) of the GDPR, namely to ensure the proper functionality of our newsletter communications and to swiftly identify and eliminate potential sources of error.

• Sending newsletters to existing customers

If you have entered your e-mail address when purchasing products or services, we reserve the right to regularly send you offers for similar items from our range by e-mail. No separate consent is required for this mailing in accordance with Section 7 (3) UWG. Your data is processed on the basis of our legitimate interest in targeted direct advertising in accordance with Art. 6 para. 1 lit. f GDPR.

If you have objected to the use of your e-mail address for this purpose from the outset, you will not receive any promotional e-mails from us. You can object to the use of your email address for the aforementioned purpose at any time with effect for the future. All you need to do is send a short message to the controller named at the beginning or an email to [email protected]. You will only incur the usual transmission costs according to the basic rates. Once we have received your objection, we will immediately stop sending the data.

• Promotions, surveys and competitions

We use your personal data if you take part in a promotion offered by KICKZ, such as a competition or a survey (e.g. customer satisfaction surveys as part of market research). We ask you to provide your personal details in order to carry out the campaign properly.

In a competition, we usually ask for your name and e-mail address in order to notify you if you win and to ensure that each person only takes part once. Depending on the type of promotion or survey, we may ask you for further information. This is particularly the case if we are running a promotion with a partner and they need certain information to provide you with the prize.

Your data is processed on the basis of your consent in accordance with Art. 6 (1) (a) GDPR. If the data is required to carry out a campaign (e.g. to run a competition), the processing is based on Art. 6 para. 1 lit. b) GDPR.

The recipients of the data are primarily KICKZ and, if applicable, partner companies if the campaign is carried out in cooperation with a third party. In such cases, we will inform you separately about the required data and its use by us and the respective partner.

The data will only be stored for as long as is necessary to carry out the campaign and, if applicable, to process the prize. As soon as the purpose no longer applies, we will delete your data, provided there are no statutory retention obligations.

You can withdraw your consent at any time by contacting us using the contact details provided. In this case, however, you may no longer be able to take part in the promotion or competition.

• Further processing by partner companies in the context of order and order processing

We offer you various payment options to enable you to process your orders securely and conveniently. We work together with banks, credit institutions and other payment service providers. These payment services are used either to fulfill the contract in accordance with Art. 6 para. 1 lit. b) GDPR or on the basis of our legitimate interests in an efficient and secure payment system in accordance with Art. 6 para. 1 lit. f) GDPR.

Depending on the payment method selected, certain personal data is processed by the payment service providers. This includes inventory data such as name and address, bank data such as account numbers or credit card numbers, as well as information on transactions such as invoice amounts, payment status and recipient data. However, the payment data entered is processed and stored exclusively by the payment service providers. We do not receive any account or credit card details, only a confirmation or rejection of the payment. Some payment service providers carry out credit checks and transmit data to credit agencies for this purpose. Further information on this can be found in the privacy policies of the respective providers.

The use of payment services is subject to the respective terms and conditions and data protection guidelines of the payment service providers. If you wish to exercise your rights such as revocation, information or deletion, please contact the relevant payment service provider directly.

We use the following payment service providers:

• Apple Pay

  Service provider: Apple Inc, Infinite Loop, Cupertino, CA 95014, USA Website:

  https://www.apple.com/de/apple-pay/

  Privacy policy:

  https://www.apple.com/legal/privacy/de-ww/

• Google Pay

  Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland Parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA Website:

  https://pay.google.com/intl/de_de/about/

  Privacy policy:

  https://policies.google.com/privacy

• Klarna / Sofortüberweisung

  Service provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden Website:

  https://www.klarna.com/de

  Privacy policy:

  https://www.klarna.com/de/datenschutz

• Mastercard

  Service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium Website:

  https://www.mastercard.de/de-de.html

  Privacy policy:

  https://www.mastercard.de/de-de/datenschutz.html

• PayPal

  Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg Website: https://www.paypal.com/de/home Privacy policy:

  https://www.paypal.com/de/webapps/mpp/ua/privacy-full

• Visa

  Service provider: Visa Europe Services Inc, London Branch, 1 Sheldon Square, London W2 6TT, UK Website:

  https://www.visa.de

  Privacy policy:

  https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html

If you require further information about the processing of your personal data, we recommend that you consult the privacy policies of the respective payment service providers.

• Social media

We operate publicly accessible profiles on various social networks to get in touch with you and provide information. Our website does not contain any social media plugins, but merely links to our profiles on social networks. The signs and logos of YouTube, Pinterest, Twitter, Discord, LinkedIn, Facebook, Instagram, TikTok, Snapchat and Spotify visible on our pages are exclusively links to the corresponding platforms. If you click on one of these symbols, the respective service provider will not receive any personal data from us. You can share and display content from KICKZ there. By using these services, you are subject to the data protection provisions of the respective providers. You can find further information on this in our notes on links to external websites.

Various data processing operations are triggered when you visit our social media presences. If you are logged into your account and visit our profile, the respective social network can track this and assign it to your user profile. Even if you are not logged in or do not have an account, platform operators can use cookies and similar technologies to collect certain information, including your IP address and your usage behavior. This data is combined in user profiles in order to display targeted, personalized advertising - both within the platforms and on other websites. If you have an account with the respective network, this advertising can be displayed across devices.

Our social media presence serves to make our content and offers accessible to a wide audience, to make our services better known and to enable exchange with interested parties. This constitutes a legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR. In addition to providing information and community interaction, we also use the platforms to provide support and answer questions about our services. The exact legal basis for data processing by the social media operators depends on their own guidelines.

If you interact with us via our social media profiles, for example through comments, likes or private messages, we will only use the data you provide to communicate with you. The legal basis for this is Art. 6 para. 1 lit. a) and b) GDPR. Content that you publish on our pages, such as comments, images or videos, remain visible until you delete them or we remove them if they violate legal requirements or our guidelines.

The data collected by us will be deleted at your request if you withdraw your consent or the purpose for which it was stored no longer applies. Please note, however, that statutory retention periods may continue to apply. We have no influence on the storage period of the data collected by the platform operators. They may also transfer your data to countries outside the EU, in particular the USA. All platform operators ensure that they guarantee an appropriate level of data protection.

We are jointly responsible for data processing with the respective platform operators, but we do not have complete control over how they process your data. To assert your rights such as information, correction or deletion, you can contact us as well as the operator of the respective platform.

We use the following social networks:

• YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland is responsible. Privacy policy: https://policies.google.com/privacy

• Pinterest: Responsible is Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Privacy policy: https://policy.pinterest.com/de/privacy-policy

• Twitter (X): Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland is responsible. Privacy policy: https://twitter.com/de/privacy

• Discord: Responsible is Discord Inc, 444 De Haro Street #200, San Francisco, CA 94107, USA. Privacy policy: https://discord.com/privacy

• LinkedIn: Responsible is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Privacy policy: https://www.linkedin.com/legal/privacy-policy

• Facebook: Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland is responsible. Privacy policy: https://www.facebook.com/privacy/explanation

• Instagram: Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland is responsible. Privacy policy: https://help.instagram.com/519522125107875

• TikTok: Responsible is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Privacy policy: https://www.tiktok.com/legal/privacy-policy

• Snapchat: Snap Inc, 2772 Donald Douglas Loop North, Santa Monica, CA 90405, USA is responsible. Privacy policy: https://www.snap.com/en-US/privacy/privacy-policy

• Spotify: Responsible is Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden. Privacy policy: https://www.spotify.com/de/legal/privacy-policy/

For further information on the processing of your data, please contact the respective platform operator directly.

• Legal basis for data processing

Unless the legal bases for data processing have already been specifically stated, the following applies:

If we obtain consent for the processing of your personal data, the processing is based on Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future.

If the processing is necessary to fulfill a contractual or pre-contractual obligation, such as a purchase, a service request or a registration, the processing is carried out in accordance with Art. 6 para. 1 lit. b) GDPR. This applies to both paid and unpaid contracts.

If we have to process personal data due to legal obligations, for example to fulfill tax or commercial law retention obligations or to comply with regulatory requirements, the processing is carried out on the basis of Art. 6 para. 1 lit. c) GDPR.

In certain cases, processing may be based on our legitimate interest or that of a third party, provided that your interests, fundamental rights and freedoms do not outweigh this. Such a legitimate interest may exist, for example, if we

• make our website more secure,

• Send direct advertising to existing customers,

• Prevent fraud or abuse,

• assert our rights or defend ourselves against legal claims.

In these cases, the processing is carried out in accordance with Art. 6 para. 1 lit. f) GDPR. If you wish to object to processing on the basis of legitimate interests, you can do so at any time. Further information on your rights can be found in the relevant sections of this privacy policy.

• Storage duration

Unless otherwise stated in this declaration, we only store your personal data for as long as is necessary to fulfill the respective purposes.

Your personal data will be deleted as soon as the purpose of the data processing no longer applies. However, if there is a legitimate reason for deletion within the meaning of Art. 17 para. 3 GDPR, such as a legal obligation to retain data, the processing of your data will be restricted for this period.

Statutory retention obligations exist in particular due to documentation requirements under tax and commercial law. In such cases, the data is deleted as soon as the reason for further storage no longer applies, for example after the legally prescribed storage period has expired.

In addition, it may be necessary to store data for longer if this is necessary for the assertion, exercise or defense of legal claims. If you have given your consent to the processing of certain data, this data will remain stored until you revoke your consent, unless there is a further legal obligation to store it.

• Recipient of the data

KICKZ attaches great importance to ensuring that personal data is only passed on to authorized recipients. Within our company, only those departments and employees who need your data to fulfill contractual, legal or regulatory obligations and to protect legitimate interests will have access to it.

In addition, KICKZ uses external service providers for certain processes who act as processors. These include, for example, IT service providers, payment providers, logistics partners, printers and other companies that support us in efficiently organizing our business processes. These partners only receive the data that is required for the respective task. There are contractual agreements with all processors that oblige them to comply with the same data protection standards that apply to KICKZ.

In addition, it may be necessary for personal data to be transmitted to third parties with whom KICKZ cooperates within the scope of the specified processing purposes. These include, for example, payment providers or trading platforms, especially if you make purchases from KICKZ via one of these platforms. In cases where there is a legal or official obligation, public authorities may also have access to personal data.

Personal data will only be transferred to countries outside the European Union provided that the respective country offers an adequate level of data protection in accordance with Art. 45 GDPR or other suitable guarantees in accordance with Art. 46 GDPR are in place to ensure the protection of your data. Within the group of companies, KICKZ has developed internal data protection guidelines in accordance with Art. 46 para. 2 lit. b GDPR, which must be approved by the data protection authorities. In addition, standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR are used to ensure the security of data transfers.

In addition, your data may be passed on within our Group if this is necessary for the performance of the contract, to improve our customer service or to optimize internal processes. This includes, for example, coordination between different Group companies in order to process orders more efficiently, to better coordinate support and service requests or to provide you with personalized offers and information across locations. This enables us to ensure that you receive the best possible service at all times and that our business processes run smoothly. It goes without saying that the data is passed on in compliance with the applicable data protection regulations.

• VIII. Automated decision making and profiling.

• Automated decision making

If you opt for the "purchase on account" payment method, an automated decision-making process is used to check your identity and creditworthiness. In this case, you will be asked for your consent during the ordering process so that the data required for payment processing and credit checks can be transmitted to the respective payment service provider. If you give your consent, your personal data such as first and last name, address, date of birth and telephone number as well as relevant order data will be passed on to the payment service provider.

For identity and credit checks, the payment service provider or a commissioned partner company may transmit this data to credit agencies and receive creditworthiness information from them on the basis of mathematical-statistical procedures. Among other things, address data is included in the calculation. In addition, the payment service provider may use third-party fraud prevention tools. The data collected in this process may be stored in encrypted form by third-party providers and can only be read by the payment service provider.

• Profiling

In addition to identity and credit checks, we analyse your purchasing behaviour in order to offer you an optimized and personalized shopping experience. In doing so, we take your preferences, interests and previous orders into account. The evaluation of this data helps us to show you suitable products and improve our offer for you. If we use cookies or similar technologies for this purpose, we will obtain your consent unless their use is necessary for legitimate interests.

In order to offer you the best possible shopping experience, KICKZ analyzes your interests, preferences and purchasing behavior in order to provide you with personalized offers and recommendations - both in the web store and in the stores. For this purpose, the data provided by you as well as your shopping and usage behavior are evaluated in accordance with the statutory provisions.

If cookies or pixels are used for this purpose, KICKZ will obtain your consent within the framework of the cookie policy, unless the use is necessary for communication or is permitted without consent due to legitimate interests. Rights of data subjects

• ChatBot

In our webshop, we provide you with the “SLAM” chatbot to answer any queries you may have about your orders and general customer service matters easily and automatically. SLAM is designed solely to assist with customer service enquiries and is not intended to process personal data. You will only be asked for your order number in the chat. Please do not enter any personal information such as your name, address, telephone number or email address. This information is not required to use SLAM.

Your input will be processed on the basis of your consent in accordance with Art. 6 (1) (a) of the GDPR and Section 25 (1) of the TDDDG. Using the chatbot, i.e. by entering a message, constitutes your consent to this processing. The chatbot uses cookies that are necessary for technical reasons to control the session. We do not use tracking cookies or analysis tools.

Only content that you enter into the chat yourself will be processed. In addition, an anonymous session ID is used for technical processing purposes. We do not store IP addresses.
The AI is not trained using your input. There is no profiling or automated decision-making within the meaning of Art. 22 of the GDPR.

The data you enter is transmitted via an API to an AI model from OpenAI. Processing is session-based. The data is stored on Hetzner Online GmbH servers in Germany. Every chat history (regardless of content) is stored for three months and then automatically deleted.

OpenAI Ireland Ltd acts as a technical service provider and operates in accordance with a data processing agreement under Art. 28 of the GDPR. Processing is carried out in accordance with OpenAI's terms of business, which stipulate that content from API usage will not be used for training purposes. OpenAI may transfer data to the USA as part of its use of the API. Data transfer is carried out on the basis of appropriate safeguards in accordance with Art. 46 of the GDPR (standard contractual clauses).

• Your rights

You have various data protection rights to which you are entitled under the GDPR. If you have any questions about the processing of your data or wish to exercise one of your rights, you can contact our data protection officer or KICKZ Customer Service at any time

We take the protection of your data very seriously. To ensure that personal data is not passed on to third parties, please send your request by e-mail or post to the above address, clearly identifying yourself.

In accordance with Art. 15 GDPR, you have the right to receive information free of charge at any time about what personal data we have stored about you. If you discover that your data is incorrect or incomplete, you have the right to have it corrected or completed in accordance with Art. 16 GDPR.

If you want your data to be deleted, you can request this under the conditions of Art. 17 GDPR. If erasure is not possible, for example because there are statutory retention obligations, you can instead request a restriction of processing in accordance with Art. 18 GDPR. In both cases, we will also inform the recipients of your data about your request and ask them to act accordingly.

In accordance with Art. 20 GDPR, you can also request that we provide you with your stored personal data in a structured, common and machine-readable format if you wish to transfer it to another provider.

If the processing of your data is based on consent, you can revoke this consent at any time in accordance with Art. 7 para. 3 GDPR. You also have the right to object to processing in accordance with Art. 21 GDPR if we process your data on the basis of a legitimate interest. In this case, we will check whether your objection is justified and whether we should stop processing your data.

In addition, in accordance with Art. 22 GDPR, you have the right not to be subject to automated decision-making or profiling if this has a legal effect or significantly affects you in a similar way.

To exercise one of these rights, you can contact our Customer Service or our Data Protection Officer directly.

• Right to lodge a complaint with the data protection supervisory authority

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), which can be contacted

Bayerisches Landesamt für Datenschutzaufsicht

P.O. Box 1349,

91504 Ansbach

Phone: 0981 180093-0

E-mail: [email protected]

You can find an overview of all supervisory authorities at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

• Status and updating of this privacy policy

This privacy policy is effective as of February 2025. We reserve the right to adapt the privacy policy at regular intervals to the underlying data processing processes or due to changes in the legal situation.