Skip to main content Skip to search Skip to navigation

Privacy

Privacy Policy

Thank you for your interest in our online shop. Protecting your personal data is important to us. Below we explain which data we process when you use our website and place an order, for what purposes and on what legal basis this is done, and what rights you have.

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

EASTSIDE IMPEX Handelsgesellschaft mbH
Prenzlauer Promenade 190
13189 Berlin, Germany
Represented by its managing director Denis Sauermann
Phone: +49 30 95601530
E-mail: datenschutz@heimgart.com

2. Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

  • Access to the data we process (Art. 15 GDPR),
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR),
  • Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
  • Data portability (Art. 20 GDPR),
  • Objection to certain processing (Art. 21 GDPR, see below),
  • Withdrawal of consent with effect for the future (Art. 7 (3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

You can change or withdraw your consent to non-essential cookies and similar technologies at any time via the settings of our consent banner.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) (f) GDPR. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing purposes, you have the right to object at any time without giving reasons; this also applies to any profiling related to such direct marketing. After such an objection we will no longer process your data for these purposes.

No particular form is required for the objection; preferably send it to widerspruch@heimgart.com or to our postal address stated above.

3. Accessing our website and server log files

If you use our website purely for information purposes, we only collect the data that your browser transmits to our server and that is technically necessary to display the website to you and to ensure its stability and security:

  • IP address
  • date and time of the request and time zone difference to GMT
  • page or file accessed
  • access status / HTTP status code and amount of data transferred
  • referrer URL
  • browser type, browser version, operating system and language

Purpose: delivery of the website, ensuring IT security, detecting and defending against attempted misuse and attacks.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure and functional website).
Storage period: log files are deleted after seven days at the latest. Data whose retention is required for evidentiary purposes is excluded from deletion until the respective incident has been finally resolved.

4. Cookies and consent management

We use cookies and similar technologies on our website. Cookies are small text files that are stored on your device.

Essential cookies are required to operate the shop — for example for the shopping cart, logging in to your customer account and storing your consent decision. The legal basis is Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6 (1) (b) and (f) GDPR.

All other cookies and services — in particular for audience measurement, advertising and embedded content — are used only with your consent. The legal basis is Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR.

You give and manage your consent via the consent banner of our shop system (the JTL-Shop consent manager). We operate the banner ourselves; no external consent service provider is involved. Your decision is logged so that we can demonstrate consent (Art. 7 (1) GDPR). You can change your selection at any time via the banner.

Independently of this, you can delete cookies or restrict their storage via your browser settings. Disabling essential cookies may cause parts of the shop to stop working.

5. Customer account and order processing

When you place an order, we process the data you provide, in particular title, name, billing and delivery address, e-mail address, telephone number and company details where applicable, payment details, time of order, items ordered and IP address.

Purpose: performance of the purchase contract including shipping, payment, invoicing, returns and customer service.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract and pre-contractual measures); for retention under commercial and tax law, Art. 6 (1) (c) GDPR.

You can optionally create a customer account in which you can view your orders and manage your data. If you delete your customer account, we delete the data stored there unless statutory retention obligations prevent this. Please back up your data yourself before deletion.

Logistics and shipping: storage, picking and shipping of our goods is handled on our behalf by acut fulfillment GmbH, Alboinplatz 19, 12105 Berlin, Germany, as a processor under Art. 28 GDPR. For delivery, we or our fulfilment provider pass on your name, delivery address and, where required for delivery, your e-mail address or telephone number to the carrier engaged in each case (DHL Paket GmbH, DPD Deutschland GmbH or UPS Deutschland Inc. & Co. OHG). The legal basis is Art. 6 (1) (b) GDPR.

6. Payment processing

Depending on the payment method chosen, we pass on the payment data required for processing to the respective payment service provider. In some cases the payment service providers also collect this data themselves and process it under their own responsibility.

PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. If you choose PayPal, you are redirected to the PayPal website and log in there with your credentials. PayPal's privacy policy applies in this respect: paypal.com/uk/legalhub/privacy-full.

Credit card and prepayment. For payment by prepayment we only process the information required to allocate your incoming payment. For credit card payments, the card details are transmitted to the processing payment service provider; we do not store complete card details.

Legal basis: Art. 6 (1) (b) GDPR.

7. Contacting us

If you contact us by e-mail, via a form or by telephone, we process the information you provide in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR insofar as the enquiry relates to a contract or its initiation, and otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries). We delete the data once your enquiry has been fully dealt with and no statutory retention obligations apply.

System used: to handle customer enquiries and manage our customer contacts, we use the Brevo platform of Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany, the German company of Brevo S.A.S., Paris, France. Processing takes place in Germany and France. We have concluded a data processing agreement with Brevo under Art. 28 GDPR. Brevo's privacy policy: brevo.com/legal/privacypolicy.

8. Newsletter

If you subscribe to our newsletter, we process your e-mail address and the log data of your registration in order to send you information about our products, offers and promotions.

Double opt-in: after you register, we send you an e-mail asking you to confirm. You will only receive the newsletter after your confirmation. We log the time of registration and confirmation and the IP address used so that we can demonstrate consent.

Mailing service provider: the newsletter is sent via Brevo. The provider is Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany, the German company of Brevo S.A.S., Paris, France. Processing takes place in Germany and France. We have concluded a data processing agreement with Brevo under Art. 28 GDPR. Brevo's privacy policy: brevo.com/legal/privacypolicy.

Performance measurement: our newsletters contain a tracking pixel that lets us see whether and when a message was opened and which links were clicked. We use this analysis to align our content with the interests of our readers. It forms part of the consent you give when registering.

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 7 (2) no. 2 of the German Act Against Unfair Competition (UWG); for logging the registration, Art. 6 (1) (f) GDPR. For mailings to existing customers, Section 7 (3) UWG may apply.

Unsubscribing: you can unsubscribe from the newsletter at any time. You will find an unsubscribe link at the end of every message. After unsubscribing, we delete your data unless it is required to demonstrate the consent previously given.

9. Protecting our forms against misuse (Google reCAPTCHA)

To protect our forms — in particular the contact form and the online withdrawal form — against automated input, we use reCAPTCHA. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Your IP address and further technical details and interaction data are transmitted to Google and analysed there to distinguish human input from automated input. Transfer to Google LLC in the USA is possible.

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG (consent via our banner).
Privacy policy: policies.google.com/privacy.

10. Audience measurement

Google Analytics 4. We use the web analytics service Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The service uses cookies and similar technologies to analyse the use of our website. The data collected includes truncated IP addresses, pages visited, time spent, origin of the visit, approximate location (country, region), device type and browser, and triggered events such as cart and purchase actions. Pseudonymous usage profiles are created from this data. We use the analyses to improve our offering.
Retention period in our property: 14 months.

Google Tag Manager. To manage the scripts we use, we use Google Tag Manager from the same provider. The Tag Manager itself does not store personal data in cookies, but records your IP address when loading and controls the execution of the other services in accordance with your consent.

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG. Transfer to Google LLC in the USA is possible; see section 13.
Privacy policy: policies.google.com/privacy.

11. Advertising, retargeting and partner programmes

We use the following services only with your consent. The legal basis in each case is Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG.

Google Ads — conversion tracking, enhanced conversions and remarketing. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Ads for three purposes:

  • Conversion tracking. If you reach us via one of our ads, a cookie is set that allows us to evaluate whether an ad click led to an order. The order number, the value of the goods and the currency are transmitted in the process.
  • Enhanced conversions. When you complete an order, we additionally transmit your e-mail address as well as your name and address to Google in encrypted form (SHA-256 hash). Google matches this information against the data of signed-in Google accounts in order to attribute an ad click to an order even where no cookie is present. Your details leave our shop only in encrypted form; they nevertheless constitute personal data.
  • Remarketing. Google stores an identifier for your visit and assigns you to audience lists so that we can show you ads again in the Google advertising network — for example in Google Search, on YouTube and on partner sites.

Privacy policy: policies.google.com/privacy. Transfer to Google LLC in the USA is possible; see section 13.

Google Customer Reviews. Provider: Google Ireland Limited. After an order we may ask you whether you would like to take part in a review of our shop. If you take part, we transmit your e-mail address and the order number to Google so that the review request can be sent to you.

Meta Pixel (Facebook Pixel). Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel records your visit and your interactions on our website so that we can show you interest-based advertising in the Meta network and measure the effectiveness of our ads. If you are logged in to a Meta service, Meta can attribute the visit to your account. For the collection and transmission of the data, we and Meta are joint controllers within the meaning of Art. 26 GDPR; Meta alone is responsible for the further processing.

Meta Conversions API. Provider as above. In addition to the pixel in your browser, we transmit the same events — such as page view, product view, add to cart and purchase — server-side directly from our shop system to Meta. For matching purposes, your e-mail address, name, address and, where provided, telephone number are transmitted in encrypted form (SHA-256 hash), together with your IP address and your browser identifier. Browser and server events carry the same event ID so that a transaction is not counted twice. This transmission also takes place only after your consent; if you withdraw it, the transmission stops. Privacy policy: facebook.com/privacy/policy.

releva.nz retargeting. Provider: releva GmbH, Feilnerstraße 10, 10969 Berlin, Germany. Using cookies, the service analyses your previous usage behaviour in our shop and collects pseudonymised data about your interests in order to show you relevant advertising on other websites. The information is not used to identify you personally. Opt-out and privacy policy: releva.nz/datenschutz.

Pinterest Tag. Provider: Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland. The tag records your visit and your interactions on our website so that we can measure the effectiveness of our ads on Pinterest and show you interest-based advertising there. Privacy policy: policy.pinterest.com/en/privacy-policy.

Awin partner programme. Provider: AWIN AG, Otto-Ostrowski-Straße 1A, 10249 Berlin, Germany. We take part in an affiliate network. If you reach us via a sales partner's link, a cookie is set so that any resulting order can be attributed to the partner and commissioned. Privacy policy: awin.com/gb/privacy.

12. Embedded content

We embed videos on our website. These are only loaded after you have given your consent. When loading, the respective provider receives your IP address and further technical details; without this transmission the content could not be displayed. Providers may set cookies and carry out analyses.

  • YouTube — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: policies.google.com/privacy.
  • Vimeo — Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, NY 10001, USA. Transfer to the USA is possible; see section 13. Privacy policy: vimeo.com/privacy.

Legal basis: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG.

13. Transfers to third countries

Some of the services mentioned may transfer personal data to recipients in the United States of America. For these transfers we rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, provided the respective recipient is certified under it. If a recipient is not certified, the transfer is based on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) together with supplementary safeguards.

Where you have consented to the use of a service, your consent also covers the associated transfer to a third country (Art. 49 (1) (a) GDPR). Please note that a level of data protection fully equivalent to European law cannot be guaranteed in the USA and, in particular, access by US authorities cannot be ruled out.

14. Storage period

We process and store your personal data for as long as is necessary for the respective purpose. In addition, statutory retention obligations apply, in particular under the German Commercial Code (HGB) and the German Fiscal Code (AO), with periods generally of six to ten years. The statutory limitation periods are also relevant for assessing the storage period; the standard limitation period under Sections 195 et seq. of the German Civil Code (BGB) is three years.

15. Job applications

If you apply to us, we process the data you submit — in particular your cover letter, CV and references — in order to assess your suitability for the advertised or another open position and to carry out the application procedure.

Legal basis: Section 26 (1) of the German Federal Data Protection Act (BDSG) in conjunction with Art. 88 GDPR. If further processing after the end of the procedure is necessary to assert or defend claims, we base it on Art. 6 (1) (f) GDPR. Where you have given us your consent, Art. 6 (1) (a) GDPR applies.

Recipients: your documents are first reviewed by those responsible for HR and then forwarded to the persons responsible for the position. Only persons involved in the application procedure have access.

Applicant management system: we use the JOIN platform of JOIN Solutions AG, Eichenstrasse 2, 8808 Pfäffikon SZ, Switzerland, to advertise positions and manage applications. JOIN processes your data on our behalf on the basis of a data processing agreement under Art. 28 GDPR. Switzerland is covered by an adequacy decision of the European Commission. JOIN's privacy policy: join.com/privacy.

Storage period: in the event of a rejection, we delete your data six months after the end of the procedure. If you have consented to further storage, we add you to our talent pool; there we delete the data after one year or earlier if you withdraw your consent. If you are hired, we transfer your data to your personnel file.

Place of processing: processing takes place exclusively in data centres within the European Union.

16. No automated decision-making

No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place. Should we use such a procedure in the future, we will inform you separately where required by law.

17. Requirement to provide data

To merely use our website, you only need to provide the data that is technically necessary and required for IT security. For an order, we need the information required to perform the contract; without it we cannot process your order. For an enquiry, you only need to provide the data required to handle it.

18. Changes to this privacy policy

We adapt this privacy policy whenever our services or the legal framework change. The version published on this page applies in each case.

Last updated: 16 October 2026