1. Controller responsible for data processing
Spende Dein Pfand gUG (haftungsbeschränkt)
Am Wassermann 31
50829 Cologne
Email: info@spendedeinpfand.com
Phone: 0221 29246389
2. Data protection officer
Dipl. jur. Shahwan Borto, LL.B.
Email: borto@spendedeinpfand.com
3. Visiting our website and hosting
Each time you access our website, technical data is automatically collected:
- IP address
- Date and time of access
- Browser type and version
- Operating system
- Referrer URL
- Host name of the accessing computer
This data is used to provide the website, to ensure system security and for administrative purposes. The legal basis is our legitimate interest in secure and trouble-free operation (Art. 6 (1) (f) GDPR). The server logs are deleted after no more than seven days.
Our website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The servers are located in Germany. Our emails are also sent via the same provider. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.
4. Cookies and consent
To manage your consent, we use Complianz . The software runs on our own server; no data is transmitted to third parties. Your decision is stored locally in your browser.
We distinguish between four categories:
- Functional: Essential for the operation of the website, such as the shopping basket and language setting. These cookies are always active (Art. 6 (1) (f) GDPR and Section 25 (2) TDDDG).
- Preferences: Store your settings for future visits.
- Statistics: Enable audience measurement with Google Analytics.
- Marketing: Enable services such as our live chat.
The Preferences, Statistics and Marketing categories only become active after your express consent (Art. 6 (1) (a) GDPR). You can change or withdraw your decision at any time with effect for the future via the “Cookie settings” link in the footer.
5. Services used and recipients
Below we list all services that may process personal data on our website.
a) Audience measurement
Google Analytics (via Google Site Kit, measurement ID GT-P8ZPWGHW)
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: analysis of website usage in aggregated form in order to improve our content
Legal basis: your consent to the “Statistics” category (Art. 6 (1) (a) GDPR)
Third-country transfer: Google may transfer data to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework.
We use Google Consent Mode v2 : as long as you have not given your consent, any storage on your device is expressly prohibited (“denied”), no analytics cookies are set and no identifiers are stored. Measurement is only activated once you give your consent.
b) Live chat
Tidio Chat
Provider: Tidio Poland sp. z o.o., ul. Wojska Polskiego 81, 70-481 Szczecin, Poland
Purpose: answering your questions in the chat window
Legal basis: your consent to the “Marketing” category (Art. 6 (1) (a) GDPR)
Third-country transfer: possible, safeguarded by standard contractual clauses. The chat is not loaded without your consent.
c) Orders and payments
We process orders in our shop using WooCommerce . The software runs on our own server. We process your order and invoice data for the performance of the contract (Art. 6 (1) (b) GDPR).
Depending on the payment method selected, we pass on the data required for the payment to:
- PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg
- Stripe – Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland; credit card, Apple Pay, Google Pay and Klarna are handled via Stripe. Stripe may transfer data to Stripe Inc. in the USA and is certified under the EU-US Data Privacy Framework.
- Klarna – Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden
- Direct bank transfer – no data is transmitted to third parties in this case.
The legal basis in each case is Art. 6 (1) (b) GDPR. The payment service providers process your data as independent controllers; their own privacy notices also apply.
d) Newsletter
MailPoet
Provider: runs on our own server, sending via the SMTP service of our hosting provider ALL-INKL.COM
Purpose: sending our newsletter
Legal basis: your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time via the unsubscribe link in every email
Third-country transfer: none
e) Appointment booking
LatePoint
Provider: runs on our own server
Purpose: arranging and managing consultation appointments
Legal basis: implementation of pre-contractual measures at your request (Art. 6 (1) (b) GDPR)
Third-country transfer: none
f) Security
Wordfence Security
Provider: Defiant, Inc., 1700 Westlake Ave N, Suite 200, Seattle, WA 98109, USA
Purpose: defence against attacks; IP addresses are checked and suspicious access attempts are blocked
Legal basis: our legitimate interest in protecting the website (Art. 6 (1) (f) GDPR)
Third-country transfer: possible, safeguarded by standard contractual clauses
g) Fonts and display
The fonts used on our website (Manrope and Plus Jakarta Sans) are delivered from our own server. When you access our pages, no connection to Google servers is established for this purpose and no IP address is transmitted to Google.
For the English version, we use TranslatePress ; this software also runs exclusively on our server.
6. Contacting us
If you write to us via the contact form or by email, we store your details in order to process your enquiry. The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry relates to a contract, otherwise our legitimate interest in responding (Art. 6 (1) (f) GDPR). We delete this data as soon as your enquiry has been fully dealt with and no retention obligations prevent this.
7. Data transfers to third countries
Data is only transferred to countries outside the EU and the EEA in the cases mentioned in section 5. Each transfer is safeguarded by an adequacy decision of the European Commission (EU-US Data Privacy Framework) or by standard contractual clauses pursuant to Art. 46 (2) (c) GDPR. Please note that the USA does not offer a level of data protection comparable to that of the EU and that access by authorities there cannot be completely ruled out.
8. Storage period
- Server logs: after no more than seven days.
- Enquiries: once they have been fully dealt with.
- Bestell- und Rechnungsdaten: in accordance with the retention periods of six or ten years under commercial and tax law.
- Newsletter: until you withdraw your consent.
- Consents: as evidence for the duration of the statutory limitation periods.
9. Your rights as a data subject
You have the right to:
- Access to the data stored about you (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16 GDPR).
- Erasure, provided no retention obligations prevent this (Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability in a commonly used format (Art. 20 GDPR).
- Objection to processing based on legitimate interests (Art. 21 GDPR).
- Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR).
To do so, please use the contact details listed in section 1 or 2.
10. Security of your data
Your data is protected by technical and organisational measures, in particular by continuous SSL/TLS encryption of the connection. Our systems are regularly updated and reviewed.
11. Links to external websites
This privacy policy does not apply to linked external websites. Please refer to the privacy policies provided there.
12. Changes to this privacy policy
We will amend this policy if the services we use or the legal situation change. The current version can always be found on this page.
Last updated: 8 August 2026
13. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen)
Kavalleriestraße 2-4
40213 Düsseldorf
www.ldi.nrw.de