Privacy Policy

1. Privacy at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified.

Data Collection on Our Website

• Who is responsible for data collection on this website?

  Data processing on this website is carried out by the website operator:

  Knobelholz Spielzeug Manufaktur GmbH. You can find our contact details in the site notice (Impressum) of this website or in Section 2 of this Privacy Policy.

• How do we collect your data?

  On the one hand, your data is collected when you provide it to us (e.g., by entering information into an order or contact form). Other data (e.g., technical data such as your internet browser, operating system, or time of page access) is collected automatically or after your consent when you visit the website via our IT systems.

• What do we use your data for?

  Part of the data is collected to ensure the error-free provision of the website. Other data can be used to fulfill contracts, process your inquiries, or analyze your user behavior.

2. General Notes and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (GDPR, BDSG) and this Privacy Policy.

Information on the Controller (Responsible Party)

The controller responsible for data processing on this website is:

Knobelholz Spielzeug Manufaktur GmbH

Managing Director: Jens-Uwe Buda

Brandenburger Str. 39

15754 Heidesee / OT Friedersdorf

Germany

Phone: +49 (0) 177 8199200

E-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.

Storage Duration

Unless a specific storage period has been specified within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial retention periods).

Statutory Rights of the Data Subject

You have extensive rights regarding the processing of your personal data (including access, rectification, erasure, and data portability). A detailed listing and explanation of these rights can be found in Section 9 of this Privacy Policy.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

3. Data Collection, Hosting, and Technology

External Hosting

Our website is hosted by an external service provider (hoster). Personal data collected on this website is stored on the hoster's servers.

• Service Provider: ALL-INKL.COM - Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany

• Purpose: Hosting serves the secure, fast, and efficient provision of our online offer by a professional provider.

• Legal Basis: Processing takes place in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in a correct and secure provision of our website. We have concluded a Data Processing Agreement (DPA) with the provider pursuant to Art. 28 GDPR.

Server Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and version as well as the operating system used

• Referrer URL (the previously visited page)

• Hostname of the accessing computer / IP address

• Time of the server request

Purpose of Processing: Technical delivery, stability, and security of the website.

Legal Basis: Art. 6(1)(f) GDPR (legitimate interest in an error-free and secure operation).

Cookies and Consent Management (Consent Banner)

Our website uses cookies. These are small text files that are stored on your end device.

• Technically Necessary Cookies: These are strictly necessary for the basic operation of the website (e.g., saving the shopping cart, assigning a session ID).

  Legal Basis: § 25(2) TDDDG in conjunction with Art. 6(1)(b) or (f) GDPR.

• Technically Non-Essential Cookies (Analytics & Marketing): These are only set after your explicit, active consent via our cookie consent banner.

  Legal Basis: § 25(1) TDDDG (consent for the end device) and Art. 6(1)(a) GDPR (consent for data processing). You can change your settings at any time with effect for the future via the consent banner.

4. Communication & Contacting Us

Contacting Us (Contact Form or E-Mail)

If you send us inquiries via contact form or e-mail, your details, including the contact details provided by you, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions.

• Legal Basis: The processing of this data is based on Art. 6(1)(b) GDPR if your request is related to the fulfillment of a contract or necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), provided it was requested.

• Storage Duration: The data sent by you via contact form or e-mail remains with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies. Mandatory statutory provisions – in particular retention periods – remain unaffected.

Use of AI-Driven Services and Chatbots

AI-supported systems and automated chatbots may be used on our website to answer your inquiries efficiently, assist our customer service, and provide interactive assistance.

• Scope of Processing: When using AI features or chatbots, the content data entered by you (e.g., questions, text prompts), technical metadata, and the chat history are processed to generate a suitable response.

  Security Note: Please do not enter sensitive personal data (such as banking details or passwords) into free-text fields of AI systems.

• Legal Basis: Processing is based on Art. 6(1)(b) GDPR (if the inquiry serves pre-contractual/contractual fulfillment) or on our legitimate interest pursuant to Art. 6(1)(f) GDPR in an efficient and 24/7 available customer service.

• Third-Party Providers & Data Processing: Where external AI providers are integrated, processing takes place within the framework of Data Processing Agreements (DPA) pursuant to Art. 28 GDPR. We ensure that your input data is not used for training public AI models by third-party providers.

5. Payment, Shipping, and Order Data

Customer Account and Contract Execution

When you order from us or create a customer account, we process the data you enter (name, address, e-mail address, phone number, order details). Password data is stored exclusively in hashed/encrypted form and is not visible to us.

Legal Basis: Art. 6(1)(b) GDPR (performance of a contract).

Disclosure to Shipping Service Providers

We pass on your data (name, address) to the commissioned transport service provider (e.g., DHL, UPS, GLS, Hermes) for the purpose of delivering the goods (Art. 6(1)(b) GDPR).

The disclosure of your e-mail address or phone number for delivery notifications or coordination only takes place if you have expressly consented to this during the ordering process (Art. 6(1)(a) GDPR). This consent can be revoked at any time.

Payment Service Providers

We integrate payment services from third-party companies on our website to offer you secure and convenient payment methods. When you make a payment, your payment data (e.g., IP address, credit card number, bank details) is transmitted to the respective provider.

Transmission takes place on the basis of Art. 6(1)(b) GDPR (contract performance) and partly on the basis of your consent (Art. 6(1)(a) GDPR). The following services are used on our website:

• Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Details: Klarna Privacy Policy.

• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Details: PayPal Privacy Policy.

• Visa: Visa Europe Services Inc., German Branch, Neue Mainzer Straße 52–58, 60311 Frankfurt am Main, Germany. Details: Visa Privacy Center.

• Mastercard: Mastercard Europe SA, Chaussée de Tervuren 198A, 1410 Waterloo, Belgium. Details: Mastercard Privacy Notice.

6. Marketing and Advertising

Newsletter

If you subscribe to our newsletter, we use the double opt-in procedure. Data processing takes place on the basis of your consent (Art. 6(1)(a) GDPR).

• Service Provider: We use the service provider CleverReach (CleverReach GmbH & Co. KG, CRASH Building, Schafjückenweg 2, 26180 Rastede, Germany) to send the newsletter. Data processing takes place under a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR on servers located within Germany.

• Revocation: You can unsubscribe at any time via the unsubscribe link at the end of each newsletter or by sending us an informal e-mail.

Direct Mail Advertising

The processing of name and postal address for sending offers by post takes place on the basis of our legitimate interest in direct marketing pursuant to Art. 6(1)(f) GDPR. You can object to this use at any time by sending an informal message to us.

7. Analytics Tools and Tracking

Google Analytics

We use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

• Consent Requirement: Use takes place exclusively after your active consent via the consent banner (Art. 6(1)(a) GDPR and § 25(1) TDDDG).

• IP Anonymization: We use Google Analytics only with activated IP anonymization. Your IP address is shortened by Google within member states of the EU or EWR prior to transmission.

• Third-Country Transfer: Insofar as data is transferred to Google LLC in the USA, we point out that Google is certified under the EU-US Data Privacy Framework (DPF).

• Revocation: You can revoke your consent at any time via the consent banner on our site or by using the browser add-on: https://tools.google.com/dlpage/gaoptout.

Google AdSense

This website uses Google AdSense to integrate advertisements. Provider is Google Ireland Limited. Cookies and web beacons are used to analyze visitor traffic.

Legal Basis: Art. 6(1)(a) GDPR (consent via the consent banner).

8. Social Media and Plugins

Social media plugins (e.g., Facebook, X) are integrated on our website. To protect your privacy, we use a privacy-friendly integration (e.g., Shariff solution or two-click solution).

To prevent data from flowing unnoticed to these networks as soon as the page is loaded, plugins are disabled by default. Only when you actively click the plugin (consent pursuant to Art. 6(1)(a) GDPR) will a direct connection to the servers of the respective operator be established.

9. Your Rights as a Data Subject

As a data subject affected by data processing, you have the following statutory rights under the GDPR:

• Right of Access (Art. 15 GDPR): You have the right to request information about your personal data processed by us.

• Right to Rectification (Art. 16 GDPR): You can request the immediate correction of incorrect data or the completion of your data stored with us.

• Right to Erasure (Art. 17 GDPR): You have the right to request the deletion of your data, provided that no statutory retention obligations prevent this.

• Right to Restriction of Processing (Art. 18 GDPR): You can request the restriction of processing under certain conditions.

• Right to Data Portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used, and machine-readable format.

• Right to Withdraw Consent (Art. 7(3) GDPR): You can withdraw consent previously granted to us at any time with future effect.

• Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority.

🚨 RIGHT TO OBJECT (Art. 21 GDPR)

Insofar as your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to processing at any time on grounds relating to your particular situation.

If your objection is directed against direct marketing (e.g., postal advertising), you have a general right to object, which will be implemented by us without stating a special situation.

For questions regarding data protection or to exercise your rights, please contact us directly using the contact details provided in Section 2.