Imprint

The following privacy policy applies to the use of our online services [www.VillaMeraki.de (hereinafter referred to as the „Website“). We attach great importance to data protection. The collection and processing of your personal data is carried out in accordance with current data protection regulations, in particular the General Data Protection Regulation (GDPR).


1. Responsible person
The controller for the collection, processing, and use of your personal data within the meaning of Article 4 No. 7 GDPR is


Villa Meraki
Maresa Beham, Markus Beham, Ralf Reichert, Sebastian Beham
Sailerbachstraße 56A
83115 Neubeuern
Telephone: +49 8035/6669
E-Mail: info@villameraki.de

If you wish to object, in whole or in part, to the collection, processing or use of your data by us in accordance with this privacy policy, you can address your objection to the responsible party. You can save and print this privacy policy at any time.

2. General purposes of processing
We use personal data for the purpose of operating the website and for order processing. Your IP address or similar data that would enable an assignment of the cookie to you are not stored in the cookie. Based on cookie technology, we only receive pseudonymised information, for example, about which pages of our shop were visited, which products were viewed, etc. You can set up your browser so that you are informed in advance about the setting of cookies and can decide on a case-by-case basis whether to exclude the acceptance of cookies for specific cases or in general, or to prevent cookies entirely. This may limit the functionality of the website.

2.1 Data for the fulfilment of our contractual obligations
We process personal data that we require to fulfil our contractual obligations, such as name, address, e-mail address, ordered products, invoice and payment data. The collection of this data is necessary for the conclusion of the contract. The data will be deleted after the expiry of warranty periods and statutory retention periods. The legal basis for processing this data is Art. 6(1)(b) of the GDPR, as this data is required for us to fulfil our contractual obligations to you.

3. Storage duration
Unless specifically stated, we only store personal data for as long as is necessary to fulfil the purposes pursued. In some cases, the law requires the retention of personal data, for example in tax or commercial law. In these cases, we will only continue to store the data for these legal purposes, but it will not be processed otherwise and will be deleted after the expiry of the statutory retention period.

4. Your Rights as a Data Subject
Under applicable laws, you have various rights concerning your personal data. Should you wish to exercise these rights, please submit your request by email or post, clearly identifying yourself, to the address mentioned in section 1. Below is an overview of your rights.

4.1 Right to confirmation and access
You have the right to clear information about the processing of your personal data.

In detail:
You have the right at any time to obtain confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to request information free of charge from us about the personal data stored about you, together with a copy of this data. Furthermore, there is a right to the following information:

  1. the processing purposes;
  2. the categories of personal data processed;
  3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  4. if possible, the planned duration for which the personal data will be stored, or, if this is not possible, the criteria for determining this duration;
  5. the existence of a right to rectification or erasure of your personal data or to restrict processing by the controller, or a right to object to such processing;
  6. the existence of a right of complaint to a supervisory authority;
  7. if the personal data are not collected from you, all available information about the origin of the data;
  8. the existence of automated decision-making, including profiling, pursuant to Article 22(1) and (4) of the GDPR and – at least in these cases – meaningful information about the logic involved, as well as the scope and the intended impact of such processing on you. Where personal data are transferred to a third country or an international organisation, you have the right to be informed about the appropriate safeguards pursuant to Article 46 of the GDPR relating to the transfer.

4.2 Right to rectification
You have the right to request that we correct, and where applicable, complete, the personal data relating to you.
In detail:
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.

4.3 Right to erasure
In a number of cases, we are obliged to delete personal data relating to you.

In detail:
You have the right under Article 17(1) of the GDPR to request that we erase personal data concerning you without undue delay, and we shall be obliged to erase personal data without undue delay where one of the following grounds applies:

  1. The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
  2. You withdraw your consent on which the processing was based according to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
  3. You object to the processing in accordance with Art. 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object to the processing in accordance with Art. 21(2) GDPR.
  4. The personal data was processed unlawfully.
  5. The erasure of personal data is necessary for compliance with a legal obligation to which we are subject under Union or Member State law.
  6. The personal data was collected in relation to information society services offered in accordance with Art. 8 para. 1 GDPR.
  7. If we have made personal data public and are obliged to erase it pursuant to Art. 17(1) GDPR, we shall take appropriate measures, including technical measures, having regard to the technology available and the cost of implementation, to inform other controllers, processing the personal data, that you have requested the erasure by them of any links to, or copy or replication of, these personal data.

4.4 Right to restrict processing
In a number of cases, you are entitled to request that we restrict the processing of your personal data.

In detail:
You have the right to request that we restrict the processing of your data if any of the following conditions are met:

  1. the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data,
  2. the processing is unlawful and you opposed the erasure of the personal data and requested instead the restriction of its use;
  3. we no longer require the personal data for the purposes of processing, however, you require the data for the establishment, exercise or defence of legal claims, or
  4. you have objected to the processing pursuant to Art. 21(1) GDPR, as long as it has not yet been established whether our company's legitimate grounds override yours.

4.5 Right to data portability
You have the right to receive your personal data in a machine-readable format, to transmit it, or to have us transmit it to another controller. Specifically: You have the right to receive the personal data you have provided to us, which concerns you, in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that

  1. processing based on consent pursuant to Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR and
  2. processed using automated procedures.
  3. When exercising your right to data portability under paragraph 1, you have the right to have personal data transmitted directly by us to another controller, where technically feasible.

4.6 Right of objection
You have the right to object to the lawful processing of your personal data by us if it is based on your particular situation and our interests in processing do not outweigh this.

In detail:
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions. We will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If we process personal data for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. You have the right to object, on grounds relating to your particular situation, to processing of personal data concerning you for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

4.7 Right of withdrawal of data protection consent
You have the right to withdraw consent for the processing of personal data at any time.

4.8 Right of complaint to a supervisory authority
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you believe that the processing of personal data concerning you is unlawful.

5. Data Security
We take the utmost care to ensure the security of your data within the scope of applicable data protection laws and technical capabilities. We use the SSL (Secure Socket Layer) coding system, but would point out that data transmission over the internet (e.g. when communicating by email) can have security vulnerabilities. Seamless protection of data from third-party access is not possible. To secure your data, we maintain technical and organisational security measures in accordance with Art. 32 GDPR, which we continually adapt to the state of the art. Furthermore, we do not guarantee that our service will be available at all times; faults, interruptions or failures cannot be ruled out. The servers we use are regularly backed up with great care.

6. Disclosure of data to third parties; no data transfer to non-EU countries
In principle, we only use your personal data within our company. If and to the extent that we involve third parties in the performance of contracts (e.g. logistics service providers), these will only receive personal data to the extent that transmission is necessary for the performance of the specific service. In cases where we outsource certain parts of data processing („order processing“), we contractually oblige the processors to use personal data only in accordance with the requirements of data protection laws and to ensure the protection of the data subject's rights. Data transfer to bodies or persons outside the EU, other than in the case mentioned in section 4 of this declaration, does not and is not planned to take place.