Privacy Policy

General information

Protecting your personal data is important to us. We treat your personal data confidentially and in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications and Digital Services Data Protection Act (TDDDG), and all other applicable statutory provisions.

This Privacy Policy explains which personal data we collect when you use our website and online shop, the purposes for which we process it, the legal basis for such processing, the recipients to whom data may be disclosed, and your rights.

Personal data means any information relating to an identified or identifiable natural person.

Who is responsible for data processing?

Controller within the meaning of the GDPR:

KWON KG
Unterfeldring 3
D-85256 Vierkirchen
Germany
Telephone: 0 81 39 / 88 311
E-mail: info@kwon.de

Data Protection Officer

We have appointed a Data Protection Officer:
Mr Andreas Fischer
E-mail: af@datenschutz24.bayern

What data do we collect?

We process personal data in particular when you:

·         visit our website

·         place an order in our online shop

·         create a customer account

·         contact us

·         contact us via WhatsApp

·         subscribe to our newsletter

·         make a payment

·         receive a delivery

·         contact us through other communication channels, or

·         consent to the use of certain analytics, marketing or convenience services.

Depending on how you use our website, the following data may be processed:

·         first and last name

·         billing and delivery address

·         e-mail address

·         telephone number

·         order, customer and contract data

·         payment and transaction data

·         contents of communications

·         technical data relating to the device used

·         IP address

·         browser type and version

·         operating system

·         referrer URL

·         time of access

·         usage and interaction data

·         data generated in connection with your consent choices.

The data actually processed in each individual case depends on which functions of our website you use.

2. Legal bases for processing

We process personal data in particular on the following legal bases:

Art. 6(1)(a) GDPR
where you have given us consent to process your personal data for one or more specific purposes.

Art. 6(1)(b) GDPR
where processing is necessary for the performance of a contract with you or for taking steps at your request prior to entering into a contract.

Art. 6(1)(c) GDPR
where processing is necessary for compliance with a legal obligation.

Art. 6(1)(f) GDPR
where processing is necessary for the purposes of our legitimate interests or those of a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.

In addition, the requirements of Section 25 TDDDG apply to access to information stored on your terminal device. Non-essential cookies, tracking technologies and comparable procedures are generally used only after you have given the required consent, unless a statutory exception applies.

3. Your rights

Right of access

You may request access to your personal data processed by us and to the information specified in Art. 15 GDPR.

Right to rectification

You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.

Right to erasure

You may request the erasure of your personal data under the conditions set out in Art. 17 GDPR.

Right to restriction of processing

You may request restriction of processing under the conditions set out in Art. 18 GDPR.

Right to data portability

Under the conditions of Art. 20 GDPR, you have the right to receive personal data that you have provided to us and that we process by automated means on the basis of your consent or for contract performance in a structured, commonly used and machine-readable format.

Right to object

You have the right, on grounds relating to your particular situation, to object at any time to processing based on Art. 6(1)(e) or (f) GDPR. Where personal data are processed for direct marketing, you may object to such processing at any time. This also applies to profiling insofar as it is related to such direct marketing.

Withdrawal of consent

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for our company is generally: Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 27, 91522 Ansbach, Germany.

4. Data security and SSL/TLS encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or enquiries.

You can recognize an encrypted connection by the address bar beginning with “https://” and the padlock symbol.

We implement appropriate technical and organizational measures to protect personal data against loss, destruction, manipulation and unauthorized access. These security measures are continuously reviewed and adapted in line with technological developments.

5. Visiting our website and server log files

Whenever our website is accessed, information is automatically processed by the web server. This may include:

·         IP address

·         date and time of access

·         page or file accessed

·         referrer URL

·         browser type and version

·         operating system

·         hostname of the accessing computer

·         amount of data transferred

·         status of the request.

Processing serves to technically provide the website, ensure its stability and security, detect and remedy errors, and detect and prevent misuse and attacks on our systems.

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure and technically reliable operation of our website.

Server log files are deleted or anonymized as soon as they are no longer required for these purposes. The specific retention period depends on the technical and security requirements of operation.

Hosting provider:
Profihost GmbH · Hildesheimer Str. 25 · 30880 Laatzen

6. Cookies and consent management

Our website uses cookies and comparable technologies. Cookies are small text files stored on your terminal device. They may be used to make the website technically functional, save settings, recognize users or collect information about website usage.

Technically necessary cookies

Some cookies are technically necessary for our website and online shop to function. These may include cookies for:

·         shopping cart

·         login

·         session management

·         security functions

·         language settings

·         other functions expressly requested by you.

No consent is required for technically necessary cookies insofar as the statutory requirements of Section 25(2) TDDDG are met. Processing of personal data associated with such cookies is, where applicable, based on Art. 6(1)(b) or (f) GDPR.

Analytics and marketing technologies

Non-essential cookies and tracking technologies, in particular those used for analytics and personalized advertising, are activated only after you have given the required consent.

Your consent decision is stored through our consent management system.

Consent management system

We use a consent management system developed by our Shopware 6 agency and integrated into our online shop. It enables you to give, refuse, change or withdraw consent to the use of non-essential cookies and comparable technologies by category and service.

Your decision is documented so that we can demonstrate whether and to what extent you consented to the relevant processing.

The consent management system processes information about your consent decision, the time of the decision, the categories or services selected by you, and technical information required to store and manage your decision.

This processing is carried out to comply with our data protection documentation obligations and to manage consents. The legal basis is Art. 6(1)(c) GDPR insofar as processing is necessary to comply with a legal obligation, and Art. 6(1)(f) GDPR insofar as it is necessary to protect our legitimate interest in properly documenting and managing consents.

You can change or withdraw your consent decision at any time via the privacy settings available on our website.

7. Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to manage and technically integrate website tags. It can be used to integrate and control analytics and marketing services.

We configure Google Tag Manager so that non-essential tags and tracking technologies are controlled according to your consent decision. In particular, analytics and marketing tags are generally activated only after the required consent has been obtained.

Where Google Tag Manager or technologies associated with it store information on your terminal device or access information already stored there, the requirements of Section 25 TDDDG are observed.

The legal basis for processing in connection with non-essential analytics and marketing tags is generally your consent pursuant to Art. 6(1)(a) GDPR.

8. Google Analytics

We use Google Analytics to analyze the use of our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses technologies that enable analysis of website usage. This may include page views, duration of use, interactions, devices used and the origin of visitors.

Google Analytics is activated on our website only where the required consent has been given. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG insofar as consent is required.

You may withdraw your consent at any time via our cookie settings. Google may process personal data in countries outside the EU/EEA. Such transfers are subject to the applicable requirements of Chapter V GDPR, including adequacy decisions or appropriate safeguards. Further information is available in Google's privacy information.

9. Google Ads and conversion tracking

We may use Google Ads to advertise our products and offers through Google's advertising network. We may use Google conversion tracking to determine whether users perform certain actions on our website after viewing or clicking an advertisement.

Non-essential cookies and comparable technologies used for this purpose are activated only after your consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG. You may withdraw your consent at any time via our cookie settings.

10. Meta Pixel

We use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel enables us to measure use of our website and the effectiveness of our advertising on Meta platforms. This may include page views, interactions, purchases and other actions performed on our website.

The information collected may also be used by Meta to deliver and measure advertising and create audiences for advertising purposes.

The Meta Pixel is activated on our website only after you have given the required consent. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG. You may withdraw your consent at any time via our cookie settings.

Use of the Meta Pixel may involve transfers of personal data to Meta and processing in countries outside the EU/EEA. Such transfers are subject to Chapter V GDPR. Further information is available in Meta's privacy information.

11. Contact form and contacting us

When you contact us via the contact form or by e-mail, we process the personal data you provide. This may include your name, e-mail address, telephone number, the content of your message and other information you voluntarily provide.

Processing serves to handle your enquiry. If your enquiry concerns the conclusion or performance of a contract, processing is based on Art. 6(1)(b) GDPR. In all other cases, processing is generally based on Art. 6(1)(f) GDPR; our legitimate interest is the proper handling and response to enquiries. Where you expressly provide consent, processing is based on Art. 6(1)(a) GDPR.

Data are deleted as soon as the purpose of processing no longer applies and no statutory retention obligations prevent deletion.

12. WhatsApp Business

We offer you the option of communicating with us via WhatsApp Business. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If you contact us via WhatsApp, we process in particular your telephone number and the data and message content you provide during the communication.

If your enquiry relates to an existing contract or order, processing is carried out for contract performance or handling your enquiry on the basis of Art. 6(1)(b) GDPR. For general enquiries, processing is generally based on Art. 6(1)(f) GDPR.

WhatsApp processes data under its own responsibility and may transfer data to other companies of the Meta group or recipients in third countries. We have no complete control over WhatsApp's data processing. For further information, please refer to WhatsApp's current privacy policy.

13. Customer account and registration

You may create a customer account on our website. During registration we process the information required for this purpose, in particular name, e-mail address, address and login credentials.

Processing serves to set up and administer your customer account and provide the associated services. The legal basis is Art. 6(1)(b) GDPR.

We store the data for as long as the customer account exists, unless statutory retention obligations or other legitimate reasons require longer storage. When the account is deleted, the associated data are deleted unless statutory retention obligations apply.

14. Orders and contract processing

When you place an order, we process the personal data required to handle and perform the purchase contract. This includes in particular name, billing address, delivery address, e-mail address, telephone number where required, order information, payment information and communication data.

Processing is based on Art. 6(1)(b) GDPR for contract performance. We also process data to comply with legal obligations, in particular commercial and tax retention obligations, on the basis of Art. 6(1)(c) GDPR.

After the contract has been fully processed, data are deleted as soon as they are no longer required for the stated purposes and no statutory retention obligations apply.

15. Shipping and delivery

For order fulfillment, we transmit the personal data required for delivery to the shipping service provider used for the respective shipment.

We use in particular: DHL; in exceptional cases DPD; in exceptional cases UPS.

Data transmitted may include the recipient's name, delivery address, e-mail address where applicable, telephone number where applicable, and shipment and order data.

The transfer is necessary to perform the purchase contract and is therefore based on Art. 6(1)(b) GDPR. Shipping providers process the transmitted data under their own responsibility in accordance with their applicable privacy policies.

16. Payment processing

We use payment service providers to process payments. Depending on the payment method selected, personal data may be transmitted to the relevant payment service provider.

PayPal

For PayPal payments, the data required for payment processing are transmitted to PayPal. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

The data processed by PayPal depend on the payment method and on whether you pay using a PayPal account. Processing for payment execution is generally based on Art. 6(1)(b) GDPR. PayPal may also process personal data for fraud prevention, legal compliance and other purposes for which PayPal may be an independent controller. Further information is available in PayPal's current privacy policy.

Unzer

For certain payment methods we use services of Unzer. Provider: Unzer Luxembourg S.A., Parc d’Activité Syrdall 2, 18–20 rue Gabriel Lippmann, L-5365 Munsbach, Luxembourg.

Where you select a payment method handled by Unzer, the data required for payment processing are transmitted to Unzer. This may include name, address, payment information, order information and technical data.

Processing is carried out for payment and contract performance on the basis of Art. 6(1)(b) GDPR and, where required by law, for compliance with legal obligations under Art. 6(1)(c) GDPR. Further information is available in Unzer's current privacy information.

17. Credit assessment

Where we provide payment in advance or there is a particular risk of default, we may carry out a credit assessment to protect our legitimate interests. Personal data, in particular name and address, may be transmitted to a credit reference agency.

A credit assessment is carried out only where necessary for the relevant payment or contractual decision and legally permissible. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to prevent payment defaults.

Where automated decisions within the meaning of Art. 22 GDPR are made, we comply with the applicable statutory information and data subject rights.

18. Debt collection and receivables management

If outstanding amounts are not paid despite reminders, we may transmit personal data to a debt collection service provider commissioned by us.

This may include name, address, contact details, receivables data, order and contract data, and payment and reminder data.

Processing serves to enforce existing claims and is based on Art. 6(1)(f) GDPR or, where applicable, Art. 6(1)(b) GDPR.

We currently work with:
Agenda Inkassobüro GmbH
Troppauerstraße 10
83395 Freilassing
Germany

19. Newsletter

If you subscribe to our newsletter, we process your e-mail address and, where applicable, other information provided during registration. Registration uses a double opt-in procedure. After registration, you receive an e-mail requiring confirmation.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future using the unsubscribe link in the newsletter. The lawfulness of processing before withdrawal remains unaffected.

Newsletter distribution with CleverReach

We use CleverReach for newsletter distribution and subscription management. Provider: CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.

Personal data may be transmitted to CleverReach for newsletter distribution and subscription management. Where required, we have concluded a data processing agreement pursuant to Art. 28 GDPR.

Newsletter tracking

Our newsletter may contain technical procedures for measuring reach and use, such as determining whether a newsletter was opened or which links were clicked. We use this information to evaluate and improve our newsletters. Where consent is required for such tracking, it is carried out only on the basis of consent.

You may unsubscribe at any time. After unsubscribing, data stored for newsletter distribution are deleted unless other statutory retention obligations apply.

20. YouTube

Our website may embed content from YouTube. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When a page containing embedded YouTube content is accessed, a connection to YouTube servers may be established. In particular, the IP address and technical information about the device used may be processed.

Where embedding YouTube content involves processing personal data or accessing information on your terminal device, activation takes place only after your consent where legally required. The legal basis in such cases is Art. 6(1)(a) GDPR in conjunction with Section 25 TDDDG. You may withdraw your consent at any time via our cookie settings.

21. OpenStreetMap

We use maps from OpenStreetMap to display the locations of our stores and dealers visually.

Provider is the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

When maps are displayed, map data or map tiles may be retrieved from servers of the OpenStreetMap Foundation or its infrastructure. In doing so, your IP address and technical information about your device and the request may be processed.

The map is integrated through our consent management system and is loaded only after you have given consent for the relevant convenience function.

The legal basis is Art. 6(1)(a) GDPR. Where the integration accesses information on your terminal device, this is based on your consent pursuant to Section 25 TDDDG.

Further information is available in the OpenStreetMap Foundation's privacy policy.

22. Google reCAPTCHA

We use Google reCAPTCHA to protect certain functions of our online shop against automated access and misuse. The CAPTCHA function is technically necessary to enable certain shop functions that require a prior selection or input by the customer.

reCAPTCHA may process technical information, in particular information about the device used, the IP address, and interaction and usage data, insofar as required to detect automated access and protect the relevant functions.

Processing serves to ensure the security and functionality of our online shop and is based on Art. 6(1)(f) GDPR. Our legitimate interest is to protect our systems against misuse, automated access and spam.

To the extent that the specific technical integration involves access to information on the terminal device within the meaning of Section 25 TDDDG, the statutory exception for a technology that is strictly necessary for the function expressly requested by the user applies, insofar as its legal requirements are met.

23. Advertising and direct marketing

We may process personal data for our own advertising purposes within the scope permitted by law. Electronic advertising, in particular by e-mail, is generally sent only where consent has been given or a statutory exception applies.

You may object to the use of your personal data for direct marketing at any time. An objection may be sent, in particular, to info@kwon.de.

24. Recipients of personal data

We disclose personal data to third parties only where there is a legal basis for doing so. Recipients may include:

·         payment service providers such as PayPal and Unzer

·         shipping providers such as DHL and, in exceptional cases, DPD or UPS

·         IT and hosting service providers

·         maintenance and technical support providers

·         CleverReach for newsletter distribution

·         Google for Google services you have authorized

·         Meta for the Meta Pixel you have authorized

·         debt collection service providers

·         tax advisers, auditors and other professionals bound by confidentiality

·         authorities and other bodies where required by law.

Where we use processors, we conclude agreements pursuant to Art. 28 GDPR where required.

25. Transfers of personal data to third countries

When using certain services, in particular Google, Meta or other international service providers, personal data may be transferred to countries outside the EU/EEA.

Such transfers take place only where the requirements of Arts. 44 et seq. GDPR are met, including adequacy decisions or appropriate safeguards such as standard contractual clauses.

Where a provider is subject to the EU-U.S. Data Privacy Framework and appropriately certified, a transfer may be based on the applicable adequacy decision.

26. Retention period

We generally retain personal data only for as long as necessary for the relevant processing purpose. Statutory retention obligations may require longer storage, in particular under commercial and tax law. After the applicable retention period has expired, data are deleted unless another legal basis or legitimate interest permits further storage.

27. No automated decision-making

We generally do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects within the meaning of Art. 22 GDPR, unless expressly stated otherwise in this Privacy Policy.

If automated credit assessment or decision-making takes place for individual payment methods, the applicable statutory information and data subject rights are observed.

28. Updates to this Privacy Policy

We reserve the right to amend this Privacy Policy if legal requirements, the services we use or our data processing activities change. The current version published on our website shall apply.

Version: September 2026