Privacy Policy

1. Data Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

Kork-Studio Grobe
Owner: Brigitte Grobe
Am Dorfanger 3
14947 Nuthe-Urstromtal OT Holbeck
Germany

Phone: +49 (0)33733 60121
Email: info@korkie.de

Further information about our company can be found in our Legal Notice.

2. General Information on Data Processing

The protection of your personal data is important to us. We process personal data exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data means any information relating to an identified or identifiable natural person.

We process personal data only to the extent necessary for providing our website, online shop, services, and content, as well as for fulfilling contractual and legal obligations.

3. Categories of Processed Data

Within the scope of our online services, we may process the following categories of personal data:

• Master data (e.g. name, address)
• Contact data (e.g. email address, telephone number)
• Contract data
• Payment data
• Content data
• Communication data
• Usage data
• Connection data
• Device information
• Browser information
• IP addresses
• Location data (where technically required or expressly permitted)

4. Purposes of Data Processing

Personal data may be processed for the following purposes:

• Provision of our online services
• Operation of the online shop
• Processing orders
• Payment processing
• Shipping goods
• Customer support
• Responding to inquiries
• Providing customer accounts
• Sending newsletters
• Measuring website performance
• Marketing and advertising
• IT security
• Fraud and abuse prevention
• Compliance with legal obligations

5. Legal Bases for Processing

Where we obtain consent for the processing of personal data, Article 6(1)(a) GDPR serves as the legal basis.

Where processing is necessary for the performance of a contract or pre-contractual measures, Article 6(1)(b) GDPR serves as the legal basis.

Where processing is necessary to comply with a legal obligation, Article 6(1)(c) GDPR serves as the legal basis.

Where processing is necessary for the purposes of legitimate interests pursued by us or a third party and your interests, fundamental rights and freedoms do not override those interests, Article 6(1)(f) GDPR serves as the legal basis.

6. Hosting

Our website is hosted on servers operated by:

Hetzner Online GmbH
Industriestraße 25
91710 Gunzenhausen
Germany

For the secure and efficient operation of our website, Hetzner processes technical access data on our behalf.

A Data Processing Agreement pursuant to Article 28 GDPR has been concluded with the hosting provider.

The legal basis for processing is Article 6(1)(f) GDPR.

Our legitimate interest lies in the secure, stable and efficient provision of our online services.

7. Server Log Files

When visiting our website, information is automatically collected and stored in so-called server log files.

This may include:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL
• Accessed pages
• Host name of the accessing device
• Internet service provider

The storage of this information serves system security, technical administration, and the detection and prevention of misuse.

Processing is based on Article 6(1)(f) GDPR.

Log data is regularly deleted unless statutory retention obligations apply or further storage is required for evidentiary purposes.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Cookies are small text files stored on your device that contain certain information.

We distinguish between:

Technically Necessary Cookies

These cookies are required for the proper operation of our website and online shop.

This includes:

• Shopping cart functions
• Login functions
• Language settings
• Security settings
• Consent storage

Storage of these cookies is based on Section 25(2) TDDDG.

Analytics and Marketing Cookies

Analytics and marketing cookies are used for statistical evaluation and optimization of our website and advertising measures.

These cookies are only set after you have provided your explicit consent.

The legal basis is Article 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

9. Consent Management

Our website uses a consent management system to manage your consent regarding cookies and similar technologies.

When you first visit our website, you can determine which categories of cookies and services may be activated.

Your consent decision is documented and stored.

You may revoke or modify your consent at any time with effect for the future.

The legal basis for storing your consent decision is Article 6(1)(c) GDPR, Article 7 GDPR, and Section 25(2)(2) TDDDG.

10. Customer Account

You may create a customer account on our website.

As part of the registration process, we process in particular:

• Name
• Address
• Email address
• Telephone number
• Password
• Order history

The processing is carried out for the provision of the customer account and future orders.

The legal basis is Article 6(1)(b) GDPR.

The customer account may be deleted at any time, provided no statutory retention obligations prevent deletion.

11. Order Processing

As part of order processing, we process the data necessary to fulfill the contract.

This includes in particular:

• First and last name
• Billing address
• Shipping address
• Email address
• Telephone number
• Payment information
• Order details

Processing is carried out for contract fulfillment in accordance with Article 6(1)(b) GDPR.

The data will be deleted after expiration of the applicable statutory retention periods.

12. Guest Orders

Orders may also be placed without creating a customer account.

The data collected in this context is processed exclusively for the performance of the contractual relationship.

The legal basis is Article 6(1)(b) GDPR.

13. Payment Service Providers

To process payments, we offer various payment methods. Payment processing is carried out through external payment service providers.

Personal data is transferred only to the extent necessary to complete the respective payment transaction.

The legal basis for processing is Article 6(1)(b) GDPR.

PayPal

If you choose PayPal as your payment method, payment processing will be carried out by:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

The following data may be transferred:

• Name
• Address
• Email address
• Order value
• Payment information

PayPal may process additional data for fraud prevention and creditworthiness checks.

Further information:

https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Klarna

If you choose a Klarna payment method, payment processing will be carried out by:

Klarna Bank AB (publ)
Sveavägen 46
11134 Stockholm
Sweden

The following data may be processed:

• Name
• Address
• Email address
• Telephone number
• Date of birth
• Order information
• Payment information

Klarna may carry out creditworthiness checks.

Further information:

https://www.klarna.com/international/privacy-policy/

14. Shipping Service Providers

To deliver your order, we transfer the necessary data to the shipping service providers used by us.

Processing is carried out for the performance of the contract in accordance with Article 6(1)(b) GDPR.

DHL

For shipping, we primarily use the services of:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

The following data may be transferred:

• Name
• Delivery address
• Email address (where required)
• Telephone number (where required)

Further information:

https://www.dhl.com/global-en/home/footer/privacy-notice.html

GLS

We may also use the services of:

General Logistics Systems Germany GmbH & Co. OHG
GLS Germany-Straße 1–7
36286 Neuenstein
Germany

Only the data required for delivery will be transferred.

Further information:

https://gls-group.com/GROUP/en/privacy-statement/

15. Contacting Us

If you contact us, for example via:

• Contact form
• Email
• Telephone
• Postal mail
• Social media channels

the personal data you provide will be processed.

This may include:

• Name
• Email address
• Telephone number
• Address
• Content of your message

Processing is carried out for the purpose of handling your request.

Legal bases:

• Article 6(1)(b) GDPR (pre-contractual measures and contract-related inquiries)
• Article 6(1)(f) GDPR (general inquiries)

The data will be deleted once the request has been fully processed, provided no statutory retention obligations apply.

16. Contact Form

When using our contact form, the data entered by you will be processed for the purpose of handling your inquiry.

Data transmission is encrypted.

Mandatory fields are marked accordingly.

Processing is based on Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

17. Google reCAPTCHA

To protect our forms against automated entries and misuse, we use Google reCAPTCHA.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google reCAPTCHA may process the following data:

• IP address
• Browser information
• Device information
• Mouse movements
• Keyboard interactions
• Time spent on the website
• Referrer URL

Processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR in protecting our website against spam, abuse and automated attacks.

Further information:

https://policies.google.com/privacy

18. Newsletter

You have the option to subscribe to our newsletter.

For this purpose, we require your email address.

Subscription is carried out exclusively using the double opt-in procedure.

After registration, you will receive a confirmation email containing a verification link.

Your subscription will only become active after successful confirmation.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time with future effect.

An unsubscribe link is included in every newsletter.

19. Newsletter Distribution via Brevo

For sending our newsletter, we use:

Brevo (formerly Sendinblue)

Sendinblue GmbH
Köpenicker Straße 126
10179 Berlin
Germany

The following data may be processed in connection with newsletter distribution:

• Email address
• Name (if provided)
• Registration date and time
• Confirmation date and time
• IP address
• Open rates
• Click rates

Brevo enables statistical evaluation of newsletter campaigns in order to optimize our communications.

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR.

Further information:

https://www.brevo.com/legal/privacypolicy/

20. Blog and Magazine

Our website contains a blog and/or magazine section providing information about our products, materials and applications.

When accessing individual articles, the technically necessary data is processed.

Where comment functions are available, the data entered by users will be processed.

The legal basis is Article 6(1)(f) GDPR.

Our legitimate interest lies in providing information and communicating with customers and interested parties.

21. Customer Communication

For the purpose of processing orders, responding to inquiries and providing customer service, we may contact customers via:

• Email
• Telephone
• Postal mail

Processing is carried out for the performance of a contract pursuant to Article 6(1)(b) GDPR and on the basis of our legitimate interests pursuant to Article 6(1)(f) GDPR.

22. Shopware Analytics

Our website uses Shopware Analytics, a service provided by:

shopware AG
Ebbinghoff 10
48624 Schöppingen
Germany

Shopware Analytics enables the statistical evaluation of the use of our online shop in order to improve our products, services and user experience.

The following data may be processed:

• Visited pages
• Click paths
• Date and time of use
• Browser information
• Device information
• Referrer information
• Search queries
• Customer category (non-personalized)

Processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR or, where legally required, on the basis of your consent.

Further information:

https://www.shopware.com/en/privacy/

23. Google Tag Manager

We use Google Tag Manager provided by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Tag Manager is used to manage website tags through a central interface.

Google Tag Manager itself does not store personal data and does not set cookies. However, it may trigger other tags that process personal data.

Processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR in the efficient administration and management of our website.

Further information:

https://policies.google.com/privacy

24. Google Analytics 4

Subject to your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited.

Google Analytics helps us analyze and optimize the use of our website.

The following information may be processed:

• Visited pages
• Time spent on pages
• Click behavior
• Technical device information
• Browser information
• Referrer data
• Approximate location data
• IP address in anonymized form

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

IP anonymization is activated.

Where data is transferred to the United States, such transfer is based on the EU-U.S. Data Privacy Framework.

Further information:

https://policies.google.com/privacy

25. Google Ads Conversion Tracking and Remarketing

We use Google Ads and Google Remarketing services provided by Google Ireland Limited.

These services allow us to display targeted advertisements and measure their effectiveness.

Cookies and similar technologies may be used for this purpose.

The following information may be processed:

• Visited pages
• Viewed products
• Shopping cart activities
• Completed purchases
• Technical device information
• Browser information

Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Further information:

https://policies.google.com/privacy

26. Google Merchant Center and Google Shopping

We use Google Merchant Center to display our products in Google Shopping and other Google services.

Provider:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The following product data may be transmitted to Google:

• Product names
• Prices
• Availability
• Product images
• Product descriptions

Processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR in promoting and marketing our products.

Further information:

https://policies.google.com/privacy

27. Use of Artificial Intelligence (AI)

We use modern AI-supported systems to assist our business operations.

This may include:

• Creation of product descriptions
• Translations
• Customer communication
• Creation of marketing content
• Analysis of inquiries
• Optimization of content
• Administrative support processes

Where personal data is processed, such processing is carried out exclusively in accordance with applicable data protection laws.

Where external AI service providers are used, this is done solely on the basis of appropriate contractual and technical safeguards pursuant to Articles 28 and 44 et seq. GDPR.

No solely automated decision-making within the meaning of Article 22 GDPR takes place.

28. Recipients of Personal Data

Personal data is disclosed only where legally permissible or necessary for the performance of a contract.

Recipients may include:

• Hetzner Online GmbH (Hosting)
• shopware AG
• Google Ireland Limited
• PayPal
• Klarna
• DHL
• GLS
• Brevo
• Tax advisors
• IT service providers
• Public authorities where legally required

29. Transfer of Data to Third Countries

Where personal data is transferred to countries outside the European Union or the European Economic Area, such transfers are carried out in accordance with Articles 44 et seq. GDPR.

Appropriate safeguards may include:

• Adequacy decisions of the European Commission
• EU Standard Contractual Clauses
• EU-U.S. Data Privacy Framework

30. Data Retention Period

We store personal data only for as long as necessary to fulfill the respective purposes or as required by statutory retention obligations.

In particular, the following retention periods apply:

• 10 years for tax-relevant records
• 6 years for commercial and business records

After expiry of the applicable retention periods, the data will be deleted unless further storage is required by law.

31. Rights of Data Subjects

You have the following rights under the GDPR:

• Right of access pursuant to Article 15 GDPR
• Right to rectification pursuant to Article 16 GDPR
• Right to erasure pursuant to Article 17 GDPR
• Right to restriction of processing pursuant to Article 18 GDPR
• Right to data portability pursuant to Article 20 GDPR
• Right to object pursuant to Article 21 GDPR
• Right to withdraw consent pursuant to Article 7(3) GDPR

32. Right to Object

Where we process personal data on the basis of legitimate interests pursuant to Article 6(1)(f) GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation.

Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time without providing reasons.

33. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority concerning the processing of your personal data.

You may contact, in particular, the supervisory authority responsible for your place of residence, your workplace or our company headquarters.

34. Data Security

We implement appropriate technical and organizational security measures to protect your data against loss, manipulation, unauthorized access or other unauthorized processing.

Our security measures are continuously improved in line with technological developments.

35. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy whenever necessary due to legal, technical or organizational changes.

The current version of this Privacy Policy is always available on our website.

36. Version of this Privacy Policy

Version: June 2026