Privacy policy

Thank you for your interest in our offer. Protecting your personal data matters to us. Below we explain which data we process when you visit this website and the online shop, for what purpose and on which legal basis, and which rights you have.

Unless stated otherwise below, providing your personal data is neither required by law or contract nor necessary to conclude a contract. You are not obliged to provide it, and not doing so has no consequences.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Hosting and operation of the online shop (Shopify)

This website and the online shop run on the Shopify platform. Our contractual partner is Shopify International Limited, 2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. As a processor, Shopify handles all data arising when you visit the website and use the cart, the customer account and the checkout, including your IP address and your order and contact details.

The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in providing the service securely and reliably) and Art. 6 (1) (b) GDPR for the ordering process. Shopify involves affiliated companies in Canada (Shopify Inc., Ottawa) and the USA. An adequacy decision of the European Commission exists for Canada. For the USA, transfers rely on certification under the EU-U.S. Data Privacy Framework or on the European Commission’s standard contractual clauses. Further information: https://www.shopify.com/legal/privacy

3. Server log files

Each time you visit our website, Shopify and, for images and files of the documentation, our own servers (see section 9) automatically store log data: IP address, date and time of access, page or file requested, amount of data transferred, browser type and version, operating system and the previously visited page (referrer). This data is not merged with other data sources.

Processing is based on Art. 6 (1) (f) GDPR, our legitimate interest in trouble-free and secure operation. Log data is deleted after 14 days at the latest unless it is needed to investigate a security incident.

4. Cookies

We only use cookies that are technically necessary. A session cookie of our own (“session”) stores your language choice. Shopify sets cookies required for the cart, the customer account and the checkout. Storage is based on § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); subsequent processing on Art. 6 (1) (f) GDPR.

Cookies that require consent are only set when you expressly give it, for example by starting an embedded video (see section 10). We do not use cookies for analytics or advertising. Details and instructions for deleting cookies are in our cookie policy.

5. Customer account

You can open a customer account with us. We then process the data you provide (name, e-mail address, addresses, order history). Login is handled by Shopify’s login system. Processing serves the performance of contracts and is based on Art. 6 (1) (b) GDPR. You can have your account deleted at any time by notifying us; statutory retention obligations remain unaffected.

6. Orders

The data you enter during checkout (name, address, e-mail address, telephone number where given, items ordered, payment method) is processed to perform the contract, in particular for delivery, invoicing and handling of warranty cases. The legal basis is Art. 6 (1) (b) GDPR. Providing the data marked with an asterisk is required to conclude the contract.

Recipients of this data, where required for processing, are the payment service provider you choose, the carrier commissioned with delivery, our tax adviser and, where required by law, the tax authorities. We transfer your order data into our accounting records.

7. Payment service providers

To process payment we pass the necessary data (name, invoice amount, address where required) to the payment service provider you choose during checkout. The payment methods offered at checkout are handled by Shopify Payments (Shopify International Limited, Dublin, Ireland; payment processing by Stripe Payments Europe Ltd., Dublin, Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). The legal basis is Art. 6 (1) (b) GDPR. The payment provider’s own privacy policy applies to its processing: https://www.shopify.com/legal/privacy and https://www.paypal.com/en/legalhub/privacy-full

8. Shipping

For delivery we transmit your name and delivery address to the carrier commissioned, usually DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. The legal basis is Art. 6 (1) (b) GDPR. We only pass on your e-mail address or telephone number for delivery notifications if you have expressly agreed to this during checkout (Art. 6 (1) (a) GDPR). You can withdraw this consent at any time.

9. Documentation and downloads (our own servers)

The product documentation is served from our own content management system at cms.lokstoredigital.de. Downloads such as manuals and software are provided at docs.lokstoredigital.de and on a server we rent. When you retrieve images and files, your browser transmits your IP address to these servers. We operate these systems ourselves; they are hosted by Contabo GmbH, Aschheimer Straße 6, 81677 Munich, Germany, acting as our processor. The legal basis is Art. 6 (1) (f) GDPR; logging is as described in section 3.

10. Embedded videos (YouTube)

Our documentation embeds videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Videos are first shown as a placeholder only; no data is sent to YouTube when the page loads. Only when you click “Play video” is the video loaded in privacy-enhanced mode (youtube-nocookie.com) and your IP address transmitted to YouTube. Data may be transferred to the USA; Google is certified under the EU-U.S. Data Privacy Framework.

By clicking you consent to this processing (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw your consent with effect for the future at any time by not playing further videos. Further information: https://policies.google.com/privacy

11. Contact by e-mail or telephone

If you contact us by e-mail or telephone, we process your details (name, contact data, content of the enquiry) to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry concerns a contract, otherwise Art. 6 (1) (f) GDPR. We delete the data once the enquiry has been dealt with and no statutory retention obligations apply.

12. Application for the Aura beta programme

Through the form on the “Aura” page you can apply for the beta programme of our control software. We process your name, e-mail address, details of your operating system, hardware and layout, and your chosen language. The data is stored in our own content management system at cms.lokstoredigital.de (see section 9). To block automated submissions we use a hidden form field; no external service is involved.

Processing is based on your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future by e-mail to info@lokstoredigital.de. The data is deleted when the beta programme ends and at the latest twelve months after your application if you do not take part in the programme.

13. Retention periods

We retain contract and invoice data in accordance with commercial and tax law (§ 257 HGB, § 147 AO): books and invoices for ten years, accounting records for eight years. Server log files are deleted after 14 days at the latest. The session cookie ends when you close your browser. All other data is deleted once the purpose of processing no longer applies and no retention obligation exists.

14. Your rights

You have the rights of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent you have given at any time with effect for the future (Art. 7 (3) GDPR). To do so, use the contact details in section 1.

Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. You can object to processing for direct marketing at any time without giving reasons.

15. Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

16. Changes to this privacy policy

We update this privacy policy when the legal situation or our offer changes. The version published on this page applies.