of LUPO Operating OG, Mitterfladnitz 194, 8322 Eichkögl (as of October 2023)

In the following data protection information we inform you about the processing of personal information carried out by LUPO Operating OG, Mitterfladnitz 194, 8322 Eichkögl ( "LUPO Operating" and/or "we" and/or "controller" ) in accordance with the General Data Protection Regulation ( "GDPR" ). Our data protection information applies to all websites, applications and other services specified within its scope (hereinafter jointly referred to as "services" ) offered by LUPO Operating in Europe.

Please read our privacy policy carefully. If you have any questions or comments about our privacy policy, please contact us at office@lupo-operating.at.

1. Name and contact details of the controller

This privacy information applies to data processing by the

LUPO Operating OG
Mitterfladnitz 194
8322 Eichkögl
Email: office@lupo-operating.at
represented by: Stefan Luttenberger (Managing Director) and Elias Posch (Managing Director)
Website: www.bamboogroove.at

2. Purposes of data processing, legal bases and legitimate interests pursued by the controller or a third party as well as categories of recipients

2.1. Accessing our website

2.1.1. Log files

Every time you access services, information is sent to the server of our service through the respective Internet browser of your respective device and temporarily stored in log files. The data records stored in this way contain the following data, which is stored until it is automatically deleted: date and time of retrieval, name of the page accessed, IP address of the requesting device, referrer URL (origin URL from which you came to our service), the amount of data transferred, loading time, as well as product and version information of the browser used and the name of your access provider.
The legal basis for processing the IP address is Article 6 paragraph 1 letter f) GDPR. Our legitimate interest arises from the

• Ensuring a smooth connection setup,
• Ensuring comfortable use of our services,
• Evaluation of system security and stability.

It is not possible to draw any direct conclusions about your identity from the information and we will not do so. The information is stored and automatically deleted once the aforementioned purposes have been achieved. The standard deletion periods depend on the criterion of necessity.

2.1.2. Cookies, tracking, social media plugins

We use cookies or similar technologies on various pages to make visiting our services more attractive, to enable the use of certain functions and to statistically record the use of our services. Cookies are small text files that your browser automatically creates and that are stored on your respective device (laptop, tablet, smartphone, etc.) when you visit and/or use our services. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware. Information is stored in the cookie that is related to the specific device used. However, this does not mean that we thereby receive immediate knowledge of your identity and/or can draw conclusions about you. Most of the cookies used are deleted at the end of the browser session (so-called session cookies). This enables us, for example, to offer the cross-page shopping cart display in which you can see how many items are currently in your shopping cart and how high your current purchase value is. Other cookies remain on your device and enable us to recognize your device the next time you visit (so-called permanent or cross-session cookies). These cookies in particular serve to make our service more user-friendly, effective and secure. Thanks to these technologies, it is possible, for example, for you to see information in our services that is specifically tailored to your interests.

We use cookies and similar technologies on the one hand on the basis of Art. 6 Para. 1 f) GDPR (legitimate interest in optimizing our services). Certain cookies and similar technologies are used exclusively on the basis of your consent (Art. 6 Para. 1 a) GDPR). We divide cookies and similar technologies into three categories according to their purpose:

Necessary cookies and technologies

These cookies or similar technologies are necessary for our services to function. This applies, for example, to cookies or similar technologies that store login data after registration in our online shop so that the user remains logged in to our online shop even after switching to another page, or to cookies that ensure that a user-specific configuration of the service functions (selected language, etc.) is retained across sessions. In addition, these cookies or similar technologies contribute to the secure and proper use of our services. The legal basis for the use of these technologies is Article 6 (1) (f) GDPR.

Analysis & Functional Cookies and Technologies

These cookies enable us to provide enhanced functionality and personalization. They may be set by us or by third parties whose services we use in our services. If you do not allow these cookies, some or all of these services may not work properly. These cookies also enable us to count visits and traffic sources so we can measure and improve the performance of our services. They help us answer questions about which pages are most popular, which are least used, and how visitors move around our services. All information collected by these cookies is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you used/visited our services. The legal basis for the use of these technologies is Article 6 Paragraph 1 Letter a) GDPR.

marketing

These cookies or similar technologies can be set via our website by us or our partners in order to show you relevant content/advertising both on our website and on third-party websites. So-called profiles can be created based on your interests. Direct identification of a person is generally not possible using this information, as only pseudonymous browser and/or device information is used. If you do not allow these cookies or similar technologies, you will experience less relevant content/advertising tailored to your interests. The legal basis for the use of these technologies is Article 6 Paragraph 1 Letter a) of the GDPR.

If we use your information on the basis of your consent, you give this consent by clicking on the "Ok" button on the banner displayed when you visit our services - possibly after you have made certain settings:

By clicking "Ok" you agree to the use of cookies and other technologies to process your data, including transmission to our marketing partners (third parties). Our partners also use cookies and other technologies to personalize, measure and analyze advertising.

Notice of right of withdrawal

You can revoke your consent in whole or in part at any time with effect for the future by changing your settings in our preference center.

Browser settings

Of course, you can set up your browser so that it does not store cookies on your device. The help function in the menu bar of most web browsers explains how you can prevent your browser from accepting new cookies, how you can have your browser notify you when you receive a new cookie, or how you can delete all cookies you have already received and block all further cookies.

In Internet Explorer:

1. In the "Tools" menu, select "Internet Options".
2. Click on the "Privacy" tab.
3. Now you can make the security settings for the Internet zone. Here you can specify whether and which cookies should be accepted or rejected.
4. Click "OK" to confirm the setting.

In Firefox:

1. In the "Tools" menu, select Settings.
2. Click on "Privacy".
3. In the drop-down menu, select "Create using custom settings".
4. Now you can set whether cookies should be accepted, how long you want to keep these cookies and add exceptions for which websites you always or never want to allow to use cookies.
5. Click "OK" to confirm the setting.

In Google Chrome:

1. Click the Chrome menu in the browser toolbar.
2. Now select "Settings".
3. Click on "Show advanced settings".
4. Under "Privacy", click on "Content Settings".
5. Under "Cookies" you can make the following settings for cookies:
   • Delete cookies
   • Block cookies by default
   • Delete cookies and website data by default after closing the browser
   • Allow exceptions for cookies from specific websites or domains

However, we would like to point out that in this case you may not be able to use all functions of our services to their full extent.

2.2. Establishment, implementation and/or termination of a contract

2.2.1. Data processing upon conclusion of contract

If you register for one of our services and/or conclude another contract with us (e.g. buy a product from us), we process the data required to conclude, execute or terminate the contract. This includes:

• Salutation
• First name Last Name
• Billing and delivery address
• E-mail address
• Billing and payment data
• birth date
• Telephone number
• Shop settings

The legal basis for this is Article 6 Paragraph 1 Letter a) and b) GDPR, i.e. you provide us with the information on the basis of the respective contractual relationship (e.g. management of the customer/user account, processing of a purchase contract) between you and us. In order to process your email address in the event of a purchase via our websites/applications, we are also obliged to send an electronic order confirmation due to legal requirements (Article 6 Paragraph 1 Letter c) GDPR).

We store the data collected for contract processing - unless we use it for our own marketing purposes - for the duration of the respective contract and until the expiry of the respective statutory or possible contractual warranty and guarantee rights. After this period has expired, we store the information required by commercial and tax law for the contractual relationship for the legally specified periods. During this period, the data will only be processed again in the event of an audit by the tax authorities.

In order to process a purchase contract via our services, the following data processing is also required:

Payment data is passed on to payment service providers commissioned by us who process the payment(s). We pass on information about the delivery address to logistics companies and shipping partners commissioned by us so that the order can be delivered. To ensure that the goods are delivered according to your wishes, we may pass on your email address and, if applicable, telephone number to the logistics company and/or shipping partner commissioned by us who take over the delivery. They may contact you in advance of delivery to coordinate the details of the delivery with you. The respective data is transmitted solely for the respective purpose and, after delivery, is not used for any other purposes and is deleted again after existing commercial and tax retention periods have expired.

2.2.2. Use of data for fraud prevention purposes

The information you provide when placing an order can be used to check whether an atypical order process has occurred (e.g. ordering a large number of goods at the same time to the same address using different customer accounts). We generally have a legitimate interest in carrying out such a check. The legal basis for the processing is Art. 6 Paragraph 1 Letter f) GDPR.

2.2.3. Transmission of information to transport service providers/shipping partners

For the purpose of delivering ordered goods, we work with logistics service providers/transport companies and/or shipping partners: The following data may be transmitted to them for the purpose of delivering the ordered goods or for the purpose of notifying the shipment: first name, last name, postal address and, if applicable, the email address and, if applicable, the telephone number. The legal basis for the processing is Art. 6 paragraph 1 letter b) GDPR.

2.3. Data processing for advertising purposes

2.3.1. Postal advertising

We generally have a legitimate interest in using certain information for marketing purposes in order to be able to make you relevant offers. We process the following information for postal advertising for our own marketing purposes and for the marketing purposes of third parties: first name, last name, postal address, year of birth.

We are also entitled to store additional personal information about you, collected in compliance with legal requirements, for our own marketing purposes and for the marketing purposes of third parties. The aim is to send you advertising that is geared solely to your actual or perceived needs/interests and not to bother you with advertising that is not relevant to you.

The additionally stored data will not be transmitted to third parties.

Reference to the right of objection
You can object to the use of your personal information for the aforementioned marketing purposes at any time free of charge with effect for the future by sending an email to office@lupo-operating.at.

If you object, your data will be blocked for further advertising data processing. We would like to point out that in exceptional cases, advertising material may still be sent temporarily even after receipt of your objection. This is due to the technical lead time required for selection and does not mean that we have not implemented your objection.

2.3.2. Newsletter

As part of our services, we offer you the opportunity to sign up for our newsletter. To ensure that no errors have been made when entering the email address, we use the so-called double opt-in procedure (DOI procedure): After you have entered your email address in the registration field and given your consent to receive our newsletter, we will send you a confirmation link to the email address you provided. Only when you click on this confirmation link will your email address be added to our mailing list for sending our newsletter. The legal basis for this data processing is Article 6 paragraph 1 letter a) GDPR.

Notice of right of withdrawal
You can revoke your consent at any time with future effect by sending a message to office@lupo-operating.at or by using the unsubscribe option at the end of each newsletter.

2.3.3. Product recommendations by email

As an existing customer, you will regularly receive product recommendations from us by email. You will receive these product recommendations from us regardless of whether you have subscribed to a newsletter. We will use the email address you provided during the purchase to advertise our own goods and/or services that are similar to those you have purchased from us based on an order you have already placed. The legal basis for this data processing is Article 6 paragraph 1 letter f) GDPR.

Note on the right of objection
You can object to our product recommendations at any time free of charge with effect for the future by sending a message to office@lupo-operating.at or at the end of each product recommendation email.

2.4. Online presence and service optimization

2.4.1. Google Analytics

For the purpose of needs-based design and continuous optimization of our website, we use Google Analytics, a web analysis service of Google Inc. ("Google"), based on Article 6 Paragraph 1 Letter f) of the GDPR. Google Analytics uses so-called "cookies", text files that are stored on your computer and that enable an analysis of your use of the website. In this context, pseudonymized user profiles are created and cookies are used. The information generated by the cookie about your use of this website, such as

• Browser type/version,
• operating system used,
• Referrer URL (the previously visited page),
• Hostname of the accessing computer (IP address),
• Time of server request

On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide the website operator with other services relating to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. You can prevent cookies from being saved by setting your browser software accordingly; however, we would like to point out that in this case you may not be able to use all of the functions of this website to their full extent. In addition, you can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available under the following link: tools.google.com/dlpage/gaoptout?hl=de ..

2.5.2. Google Marketing Platform

This website uses the online marketing tool Google Marketing Platform operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("GMP").

GMP uses cookies to display ads that are relevant to users, to improve campaign performance reports, or to prevent a user from seeing the same ads multiple times. Google uses a cookie ID to record which ads are displayed in which browser and can prevent them from being displayed multiple times.

In addition, GMP can use cookie IDs to record conversions related to ad requests. This is the case, for example, when a user sees a GMP ad and later visits the advertiser's website using the same browser and purchases a product from that website. buys something. According to Google, GMP cookies do not contain any personal information.

Due to the marketing tools used, your browser automatically establishes a direct connection to the Google server. We have no influence on the scope and further use of the data collected through the use of this tool by Google and therefore provide the following information based on our level of knowledge: By integrating GMP, Google receives the information that you have accessed the corresponding part of our website or clicked on one of our advertisements. If you are registered with a Google service, Google can assign the visit to your account. Even if you are not registered with Google or are not logged in, there is a possibility that the provider will find out and save your IP address. When using GMP, personal data may also be transmitted to the servers of Google LLC in the USA.

You can find further information about GMP by Google’s privacy policy here: www.google.de/policies/privacy/ .

To the extent legally required, we have obtained your consent in accordance with Art. 6 (1) (a) GDPR for the processing of your data as described above. You can revoke your consent at any time in our preference center.

2.5.3. Google Ads Remarketing

Our website uses the functions of Google Ads Remarketing, with which we advertise our websites in Google search results and on third-party websites. The provider is Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). For this purpose, Google places a cookie in the browser of your device, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you visit.

Any further data processing will only take place if you have given Google your consent to link your internet and app browsing history to your Google account and to use information from your Google account to personalize ads that you view on the web. If you are logged in to Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. To do this, Google will temporarily link your personal data to Google Analytics data to create target groups. When using Google Ads Remarketing, personal data may also be transferred to Google LLC servers in the USA.

You can permanently deactivate the setting of cookies for advertising preferences by downloading and installing the browser plug-in available under the following link: https://www.google.com/settings/ads/onweb/ .

Further information and the data protection provisions regarding advertising and Google can be found here: https://www.google.com/policies/technologies/ads/ .

To the extent legally required, we have obtained your consent in accordance with Art. 6 (1) (a) GDPR for the processing of your data as described above. You can revoke your consent at any time in our preference center.

2.5.4. Google Conversion Tracking

We also use so-called conversion tracking when using the Google AdWords service. When you click on an ad placed by Google, a cookie for conversion tracking is stored on your computer/device. These cookies expire after 30 days, do not contain any personal data and are therefore not used for personal identification. The information obtained using the conversion cookie is used to create conversion statistics for AdWords customers who have opted for conversion tracking.

The legal basis for this data processing is Article 6 paragraph 1 letter a) GDPR.

You can prevent cookies from being saved by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of our services. You can also deactivate interest-based ads on Google and interest-based Google ads on the web (within the Google Display Network) in your browser by activating the “Off” button at www.google.de/settings/ads or by deactivating them at www.aboutads.info/choices/ . You can find more information about your settings options and Google’s privacy policy at www.google.de/intl/de/policies/privacy/?fg=1 . You can withdraw your consent at any time in our preference center.

2.5.5. Google AdSense

We use the online advertising service Google AdSense, which can present you with advertising tailored to your interests. Our aim is to show you advertising that may be of interest to you in order to make our services more interesting for you. For this purpose, statistical information about you is collected and processed by our advertising partners. These advertisements can be identified by the note "Google Ads" in the respective advertisement.

Google receives the information that you have visited our website. To do this, Google uses a web beacon to set a cookie on your computer. If you are logged in with your Google account, your data can be assigned directly to it. It is possible that this data will be passed on to Google's contractual partners, third parties and authorities. The legal basis for the processing of your data is Art. 6 Para. 1 Clause 1 Letter a) of GDPR.

Further information on the purpose and scope of data collection and processing as well as further information on your rights and setting options for protecting your privacy can be found here: https://www.google.de/intl/de/policies/technologies/ads .

2.5.6. Facebook retargeting and conversion

We use the pixel of Facebook Ireland Limited (Website Custom Audience Pixel). This pixel collects information about the use of this website (e.g. information about articles viewed) by LUPO Operating and Facebook Ireland Limited under joint responsibility and transmits it to Facebook Ireland Limited. This information can be assigned to you with the help of other information that Facebook Ireland Limited has stored about you, e.g. because you own an account on the social network “Facebook”. Based on the information collected via the pixel, interest-based advertisements can be displayed in your Facebook account (retargeting). The information collected via the pixel can also be aggregated by Facebook Ireland Limited and the aggregated information can be used by Facebook Ireland Limited for its own advertising purposes and for the advertising purposes of third parties. For example, Facebook Ireland Limited can infer certain interests from your surfing behavior on this website and also use this information to advertise third-party offers. Facebook Ireland Limited can also combine the information collected via the pixel with other information that Facebook Ireland Limited has collected about you via other websites and/or in connection with the use of the social network "Facebook", so that Facebook Ireland Limited can save a profile about you. This profile can be used for advertising purposes. Facebook Ireland Limited is solely responsible for the permanent storage and further processing of the tracking data collected via the website custom audience pixel used on this website.

As part of the Facebook pixel function, we have also activated automatic advanced matching ("Advanced Matching"). This pixel function enables us to send hashed emails, names, gender, city, state, zip code and date of birth or telephone number as additional information to Facebook, provided that you have provided us with this data and have given your consent. This activation enables us to tailor advertising campaigns on Facebook even more precisely to people who are interested in our services or products.

The legal basis for this data processing is Article 6 paragraph 1 letter a) GDPR.

You can find more information about data protection at Facebook Ireland Limited at https://www.facebook.com/policy.php . Here you will also find the option of asserting your rights as a data subject (e.g. right to deletion) vis-à-vis Facebook Ireland Limited. You can revoke your consent at any time in our preference center.

2.5.7. Other advertising networks & affiliates

When you use our app, our ad networks and affiliates can use so-called device identifiers to create an anonymized profile of your click behavior for mobile advertising. In our app, we work with various mobile advertising partners, including the following companies:

Apple Search Ads (US location)

These cookies and device identifiers may be used to show you personalized ads. A profile is also created based on similar information that Google, Facebook and other third-party ad networks receive from your visits to other websites or apps in your networks.

The legal basis for data processing is Art. 6 paragraph 1 letter a) GDPR. You can revoke your consent at any time in our preference center or you can follow the instructions below:

2.6. Fan pages

LUPO Operating maintains social media profiles on the social networks Facebook and Instagram ( "fan pages" ), services of Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ( "Facebook" ), on which we regularly publish and share content and offers. When YOU interact with our fan pages or other Facebook or Instagram websites, the operators of the social networks use cookies and similar technologies to record your usage behavior. LUPO Operating can view general statistics on the interests and demographic characteristics (e.g. age, gender, region) of users for its fan pages. When you use social networks, the type, scope and purposes of data processing in the social networks are primarily determined by the operators of the social networks. An exception applies to so-called page insights, for which we are jointly responsible with Facebook and which we explain below.

Processing of your data by Facebook

When you use fan pages, Facebook also processes your data for its own purposes, which are not reflected in this privacy policy and over which we have no influence. You can find further information on the respective social networks:

Facebook's privacy policy

Instagram privacy policy

Usage analysis (page insights)

When you interact with our fan pages, Facebook records your usage behavior using cookies and similar technologies. In this context, LUPO Operating receives "page insights" that contain statistical, depersonalized (anonymized) information about visitors. We are unable to assign this information to you personally. The selection and processing of page insights information is carried out exclusively by Facebook. Page insights help us to understand how our fan pages are used, what interests visitors have and which topics and content are particularly popular. We use this information to offer visitors to our fan pages relevant content and to be able to respond better to the interests and usage habits of our visitors.

LUPO Operating and Facebook are jointly responsible for processing your data for the provision of Page Insights (Art. 26 GDPR). There is an agreement between LUPO Operating and Facebook that specifies which company fulfills which data protection obligations in accordance with the GDPR with regard to the processing of Page Insights data.

If you have given Facebook your consent to the creation of page insights as described above, the legal basis is Article 6 paragraph 1 letter a) GDPR. Otherwise, the legal basis is Article 6 paragraph 1 letter f) GDPR, whereby our legitimate interest arises from the aforementioned purposes.

3. Social media plug-ins

Based on Article 6 Paragraph 1 Letter a) of the GDPR, we may use social plug-ins from the social networks Facebook and Twitter in our services to make our company better known. The responsibility for ensuring that the service complies with data protection regulations rests with the respective providers.

The purpose and scope of the data collection and the further processing and use of the data by the respective provider as well as your related rights and setting options for protecting your privacy can be found in the respective data protection information of the provider, which we link to below.

Facebook

On some websites we use plug-ins from the social network facebook.com, which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA ("Facebook"). You can find the link to Facebook's privacy policy here: Facebook 's privacy policy.

When plug-ins are activated, your web browser establishes a direct connection with the web servers of the respective social network and the content of the plug-in is transmitted directly from the social network to your web browser, which then integrates it into our website. By integrating the plug-ins, the social network receives the information that you have accessed the corresponding page of our website and can record device and access data. If you are logged in to the social network, it can also assign the visit to your account on the respective social network.

By logging out of social network pages beforehand and deleting cookies, you can prevent social networks from assigning the information collected about you to your user account on the respective social network during your visit to www.aboutyou.at. If you do not want social networks to assign the data collected via our website directly to your profile, you must log out of the relevant social networks before visiting our website. You can also completely prevent the loading of the plugins with add-ons for your browser, e.g. with the script blocker "NoScript", which can be found at: www.noscript.net .

3.1. Customer account / user account

In order to provide you with the greatest possible convenience, we offer you the permanent storage of your personal data in a password-protected customer account/user account.

Creating a customer account is generally voluntary. If you create a customer account, the data collected here will be processed on the basis of Article 6 Paragraph 1 Letter b) GDPR. Once a customer account has been set up, you do not need to enter any data again. You can also view and change the data stored about you in your customer account at any time.

Only if you wish to place orders via our website/application, it is mandatory to open a customer account in order to process the contract.

In addition to the data requested when placing an order, you must provide a password of your choice to set up a customer account. This is used together with your email address to access your customer account. Please treat your personal access data confidentially and in particular do not make it available to any unauthorized third parties. Please note that you will remain automatically logged in even after you leave our website unless you actively log out.

You have the option of deleting your customer account at any time. Please note, however, that this does not automatically delete the data visible in the customer account once you have ordered from us. Your data will be deleted automatically after the retention periods applicable to us under commercial and tax law have expired. The legal basis for this further data processing is Art. 6 Paragraph 1 Letter c) GDPR and Art. 6 Paragraph 1 Letter f) GDPR.

3.2. Contact

You have the option of contacting us in several ways. By email, by phone, by chat or by post. If you contact us, we will use the personal data that you voluntarily provide to us for the sole purpose of contacting you and processing your request.

The legal basis for this data processing is Art. 6 paragraph 1 letter a), Art. 6 paragraph 1 letter b), Art. 6 paragraph 1 letter c) GDPR and Art. 6 paragraph 1 letter f) GDPR.

3.3. Payments

We process your payment information for the purpose of payment processing, e.g. when you purchase or use a product and/or service via www.bamboogroove.at. Depending on the payment method, we will forward your payment information to third parties (e.g. to your credit card provider in the case of credit card payments).

The legal basis for this data processing is Art. 6 paragraph 1 letter a), Art. 6 paragraph 1 letter b), GDPR and Art. 6 paragraph 1 letter f) GDPR.

3.4. Paypal

When paying via PayPal, your payment data will be forwarded to PayPal (Europe) S.à rl et Cie, SCA, 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of the payment processing. PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or - if offered - "purchase on account" via PayPal. PayPal uses the result of the credit check in relation to the statistical probability of default for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values ​​(so-called score values). Insofar as score values ​​are included in the result of the credit report, these are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things, is included in the calculation of the score values. For further information on data protection, including on the credit agencies used, please refer to PayPal 's privacy policy.

3.5. Klarna payment methods

In cooperation with Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, we offer the following payment options. Payment is made to Klarna in each case:

• Invoice: The payment period is 30 days from dispatch of the goods/ticket/or, in the case of other services, from the provision of the service. The complete invoice terms for the countries in which this payment method is available can be found here .
• Sofortüberweisung: Available in Germany, Austria, Belgium, Italy, Spain, Poland and the Netherlands. Your account will be debited immediately after you place your order.

The use of the payment methods invoice and direct debit requires a positive credit check. In this respect, we forward your data to Klarna as part of the purchase initiation and processing of the purchase contract for the purpose of address and credit checks. Please understand that we can only offer you those payment methods that are permitted based on the results of the credit check. You can find further information and Klarna's terms of use here . You can find general information about Klarna here .

Your personal information will be treated by Klarna in accordance with applicable data protection laws and as set out in Klarna's privacy policy .

4. Storage period and data deletion

LUPO Operating only stores personal data for as long as it is necessary for the purposes stated in this privacy policy, in particular to fulfill our contractual and legal obligations. We may also store your personal data for other purposes if or as long as further storage for certain purposes is permitted by law.

If you close your customer account/user account, we will delete all stored personal information. If complete deletion is not possible or not required for legal reasons, we will block this information. Blocking occurs, for example, if commercial or tax law retention obligations apply, such as those under the German Commercial Code (HGB) and the Fiscal Code (AO). Here we are obliged to keep this information for tax audits and financial audits for up to ten years. Even if there is no statutory retention obligation, we can refrain from immediate deletion in certain legally permitted cases. This applies, for example, if the information in question may still be required for further contract processing or legal prosecution or legal defense (e.g. in the case of complaints). The decisive criterion for the duration of the blocking is then the respective statutory limitation periods, after which we then delete the information.

5. Recipients outside the EU

With the exception of the processing described, we do not pass on your data to recipients based outside the European Union or the European Economic Area. The processing mentioned involves data transmission to the servers of the providers of tracking or targeting technologies commissioned by us. These servers are located in the USA. The data transmission takes place on the basis of so-called standard contractual clauses of the EU.

6. Your rights

6.1. Overview

In addition to the right to revoke your consent given to us, you have the following additional rights if the respective legal requirements are met:

• the right to information about your personal data stored by us (Art. 15 GDPR), in particular you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the origin of your data, if it was not collected directly from you;
• the right to rectification of inaccurate data or to completion of correct data (Art. 16 GDPR),
• the right to delete your data stored by us (Art. 17 GDPR), provided that there are no statutory or contractual retention periods or other legal obligations or rights to further storage that we must comply with,
• the right to restrict the processing of your data (Art. 18 GDPR) if you dispute the accuracy of the data, the processing is unlawful but you refuse to delete it; the controller no longer needs the data but you need it to assert, exercise or defend legal claims or you have objected to the processing in accordance with Art. 21 GDPR,
• the right to data portability pursuant to Art. 20 GDPR, i.e. the right to have selected data stored about you transferred to us in a common, machine-readable format, or to request that it be transferred to another responsible party
• the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or work or of our company headquarters.

You can assert the aforementioned rights to which you are entitled at office@lupo-operating.at.

6.2. Right of objection

Under the conditions of Art. 21 Para. 1 GDPR, data processing can be objected to for reasons arising from the particular situation of the data subject.

The above general right of objection applies to all processing purposes described in this data protection declaration that are processed on the basis of Article 6 paragraph 1 letter f) GDPR. Unlike the special right of objection aimed at data processing for advertising purposes, under the GDPR we are only obliged to implement such a general objection if you give us reasons of overriding importance (e.g. a possible danger to life or health).

6.3. Right of withdrawal

If we process data based on consent you have given, you have the right to revoke your consent at any time. Revoking your consent does not invalidate any data processing carried out up to the time of revocation based on your consent.

6.4. Fan pages

For the processing of your Page Insights information together with Facebook, we have agreed with Facebook that Facebook is primarily responsible for providing you with information about the processing of your Page Insights information and for enabling you to exercise your data protection rights (e.g. right of objection). You can find more information about your data protection rights in connection with Page Insights and how you can assert them directly with Facebook here .