PRIVACY POLICY

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data refers to all data with which you can be personally identified.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" and the padlock symbol in your browser bar.

2) Data Collection When Visiting Our Website

When you use our website for purely informational purposes, i.e. if you do not register or otherwise provide us with information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

• Our visited website
• Date and time at the time of access
• Amount of data sent in bytes
• Source/referral from which you reached the page
• Browser used
• Operating system used
• IP address used (where applicable: in anonymised form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to subsequently review the server log files should there be concrete indications of unlawful use.

3) Hosting & Content Delivery Network

Hosting by Shopify
We use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify") for the purpose of hosting and displaying the online shop on the basis of processing on our behalf. All data collected on our website is processed on Shopify's servers. In the context of the aforementioned services provided by Shopify, data may also be transferred for further processing on our behalf to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. or Shopify (USA) Inc. In the event of data being transferred to Shopify Inc. in Canada, an adequate level of data protection is ensured by the European Commission's adequacy decision. Further information on data protection at Shopify can be found at the following website: https://www.shopify.de/legal/datenschutz
Further processing on servers other than those of Shopify mentioned above only takes place within the framework communicated below.

4) Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after the browser is closed (so-called "session cookies"), while others remain on your device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the storage duration in the overview of your web browser's cookie settings.
If personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6(1)(b) GDPR either for the performance of the contract, in accordance with Art. 6(1)(a) GDPR in the case of consent given, or in accordance with Art. 6(1)(f) GDPR to protect our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit.
You can set your browser to inform you about the placing of cookies and to decide individually whether to accept them, or to exclude the acceptance of cookies for certain cases or in general.
Please note that the functionality of our website may be restricted if cookies are not accepted.

5) Contact

5.1 Review reminder by Loox
If you have given us your express consent to do so during or after your order in accordance with Art. 6(1)(a) GDPR, we will transmit your email address and, if applicable, other customer data previously collected to the review tool Loox, a service of Loox Online Ltd., Rehov Har Sinai 2, 6581602 Tel Aviv-Yafo, Israel ("Loox"), so that it can send you a review reminder by email. You can revoke your consent at any time by sending a message to the controller responsible for data processing or to the review platform.
For the transfer of data to Loox in Israel, an adequate level of data protection is ensured by the European Commission's adequacy decision.
We have concluded a data processing agreement with Loox, by which we oblige Loox to protect the data of our customers and not to pass it on to third parties. This agreement can be viewed here: https://loox.io/legal/data_processing_addendum.pdf
More information on data protection at Loox can be found at https://loox.io/legal/privacy_policy_merchants.pdf

5.2 When contacting us (e.g. via contact form or email), personal data is processed exclusively for the purpose of handling and responding to your enquiry and only to the extent necessary for this purpose. The legal basis for the processing of this data is our legitimate interest in responding to your enquiry in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted when it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided there are no statutory retention obligations to the contrary.

6) Data Processing When Opening a Customer Account

In accordance with Art. 6(1)(b) GDPR, personal data will continue to be collected and processed to the extent necessary when you provide it to us when opening a customer account. The data required for opening an account can be found in the input form of the corresponding form on our website. Deletion of your customer account is possible at any time and can be carried out by sending a message to the above-mentioned address of the controller. After deletion of your customer account, your data will be deleted provided all contracts concluded through it have been fully processed, there are no statutory retention periods to the contrary, and no legitimate interest on our part in continued storage persists.

7) Use of Customer Data for Direct Marketing

Registration for our email newsletter

If you sign up for our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address. The provision of further data is voluntary and will be used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter once you have expressly confirmed your consent to receiving the newsletter by clicking on a verification link sent to the specified email address.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6(1)(a) GDPR. We store the IP address registered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later point in time. The data we collect when you register for the newsletter is used strictly for the stated purpose. You can unsubscribe from the newsletter at any time via the designated link in the newsletter or by sending a corresponding message to the controller named at the beginning. After unsubscribing, your email address will be immediately deleted from our newsletter mailing list, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond that, which is permitted by law and about which we inform you in this statement.

Would you like to be removed from our mailing list?

HHC-VAPES sends you as an existing customer special offers and promotions by post, email, SMS and RCS. New customers also receive these, provided they have consented or have not expressly objected. If you do not wish to receive offers and promotions by email, you can unsubscribe here or use the link included in all marketing communications. We will endeavour to remove you as quickly as possible, however it may take a while before you are completely removed from our email mailing list, so you may still receive one or two emails. If you do not wish to receive offers and promotions by post, SMS or RCS, please let us know at info@hhc-vapes.com. Our postal marketing materials are printed in advance, so the process may take some time, and it is possible that you may receive one further communication.

If your data is held on a recognised "opt-out" list in your country, HHC-VAPES will make every effort to ensure that you do not receive marketing materials from us, unless you have expressly requested otherwise.

8) Data Processing for Order Fulfilment

8.1 To the extent necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a corresponding contract, we will process the contact data (name, address, email address) you provided during the order in order to inform you personally about upcoming updates within the legally prescribed period via a suitable communication channel (e.g. by post or email), in fulfilment of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data will be used strictly for the purpose of communications about updates owed by us and will only be processed by us to the extent necessary for the respective communication.

For the processing of your order, we also work with the following service provider(s), who support us in whole or in part in the execution of concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

8.2 Use of payment service providers (payment services)

- Apple Pay
If you choose the payment method "Apple Pay" from Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment will be processed via the "Apple Pay" function of your device running iOS, watchOS or macOS by charging a payment card stored in "Apple Pay". Apple Pay uses security features integrated into the hardware and software of your device to protect your transactions. To authorise a payment, you must enter a code previously set by you and verify using the "Face ID" or "Touch ID" function of your device.
For the purpose of payment processing, the information you provided during the ordering process, together with the information about your order, is transmitted to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before the data is transmitted to the payment service provider of the payment card stored in Apple Pay to process the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number and a transaction-specific, dynamic security code to the originating website to confirm the success of the payment.
If personal data is processed during the transmissions described, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6(1)(b) GDPR.
Apple retains anonymised transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was completed successfully. Anonymisation completely excludes any personal reference. Apple uses the anonymised data to improve "Apple Pay" and other Apple products and services.
When you use Apple Pay on iPhone or Apple Watch to complete a purchase made via Safari on Mac, the Mac and the authorisation device communicate via an encrypted channel on Apple's servers. Apple does not process or store any of this information in a format that can be used to identify you. You can disable the ability to use Apple Pay on your Mac in your iPhone settings. Go to "Wallet & Apple Pay" and disable "Allow Payments on Mac".
Further information on data protection for Apple Pay can be found at the following internet address: https://support.apple.com/de-de/HT203027

9) Web Analytics Services

Google Analytics 4
This website uses Google Analytics 4, a service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which can be used to analyse the use of websites.
When using Google Analytics 4, so-called "cookies" are used by default. Cookies are text files that are stored on your device and enable an analysis of your use of a website. The information collected by cookies about your use of the website (including the IP address transmitted by your device, truncated by the last digits, see below) is generally transmitted to a Google server and stored and processed there. This may also result in information being transmitted to the servers of Google LLC, based in the USA, and further processing of the information taking place there.
When using Google Analytics 4, the IP address transmitted by your device when you use the website is always collected and processed in anonymised form only, as a standard and automatic process, so that a direct personal reference to the collected information is excluded. This automatic anonymisation is achieved by Google truncating the IP address transmitted by your device by the last digits within member states of the European Union (EU) or other contracting states of the Agreement on the European Economic Area (EEA).
On our behalf, Google uses this and other information to evaluate your use of the website, to compile reports (reports) on your website activities and usage behaviour, and to provide us with further services related to your use of the website and the internet. The truncated IP address transmitted by your device in the context of Google Analytics 4 will not be merged with other data from Google. The data collected in the context of the use of Google Analytics 4 is retained for 2 months and then deleted.
Google Analytics 4 also enables, via a special function called "demographic characteristics", the creation of statistics with statements about the age, gender and interests of website users on the basis of an evaluation of interest-based advertising and with the inclusion of third-party information. This makes it possible to determine and distinguish user groups of the website for the purpose of target-group-optimised alignment of marketing measures. However, data collected via the "demographic characteristics" function cannot be attributed to a specific person and therefore not to you personally. This data collected via the "demographic characteristics" function is retained for two months and then deleted.
All the processing described above, in particular the setting of Google Analytics cookies for the storage and reading of information on the device you use to access the website, will only take place if you have given us your express consent to do so in accordance with Art. 6(1)(a) GDPR. Without your consent, Google Analytics 4 will not be used during your use of the website. You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website.
We have concluded a so-called data processing agreement with Google for our use of Google Analytics 4, by which Google is obliged to protect the data of our website users and not to pass it on to third parties.
To ensure compliance with the European level of data protection, also in the event of a possible transfer of data from the EU or EEA to the USA and possible further processing there, Google relies on the so-called standard contractual clauses of the European Commission, which we have contractually agreed with Google.
Further legal information on Google Analytics 4, including a copy of the aforementioned standard contractual clauses, can be found at https://policies.google.com/privacy?hl=de&gl=de and at https://policies.google.com/technologies/partner-sites

10) Page Functionalities

10.1 - Google Web Fonts
This page uses so-called web fonts provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") for the uniform display of fonts. When you call up a page, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.
For this purpose, the browser you are using must connect to Google's servers. This may also result in the transmission of personal data to the servers of Google LLC. in the USA. In this way, Google becomes aware that our website was accessed via your IP address. The processing of personal data in the course of establishing a connection with the provider of the fonts will only be carried out if you have given us your express consent to do so in accordance with Art. 6(1)(a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website. If your browser does not support web fonts, a default font from your computer will be used.
Further information on Google Web Fonts can be found at https://developers.google.com/fonts/faq and in Google's privacy policy: https://www.google.com/policies/privacy/

10.2 Google reCAPTCHA
On this website we use the reCAPTCHA function from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). This function is primarily used to distinguish whether input is made by a natural person or abusively by machine and automated processing. The service involves sending the IP address and, if applicable, other data required by Google for the reCAPTCHA service to Google, and is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in determining individual personal responsibility on the internet and preventing abuse and spam. In the context of using Google reCAPTCHA, personal data may also be transferred to the servers of Google LLC. in the USA.
Further information on Google reCAPTCHA and Google's privacy policy can be viewed at: https://www.google.com/intl/de/policies/privacy/
To the extent legally required, we have obtained your consent pursuant to Art. 6(1)(a) GDPR for the processing of your data described above. You can revoke your consent at any time with effect for the future. To exercise your revocation, please follow the option for lodging an objection described above.
For the transfer of data from the EU to the USA, Google relies on so-called standard data protection clauses of the European Commission, which are intended to ensure compliance with the European level of data protection in the USA.

11) Tools and Miscellaneous

11.1 - Lexoffice
For handling our accounting, we use the service of the cloud-based accounting software "lexoffice" from Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg.
Lexoffice processes incoming and outgoing invoices and, if applicable, the bank transactions of our company, in order to automatically capture invoices, match them to transactions and create the financial accounting from this in a partially automated process.
If personal data is also processed in this context, the processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions.
More detailed information on lexoffice, the automated processing of data and the data protection provisions can be found at https://www.lexoffice.de/datenschutz/

11.2 Cookie Consent Tool

This website uses a so-called "Cookie Consent Tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The "Cookie Consent Tool" is displayed to users when they visit the page in the form of an interactive user interface, in which consent for certain cookies and/or cookie-based applications can be granted by ticking a checkbox. By using the tool, all cookies/services requiring consent are only loaded if the respective user has given corresponding consent by ticking a checkbox. This ensures that such cookies are only placed on the user's respective device if consent has been given.
The tool sets technically necessary cookies to save your cookie preferences. Personal user data is generally not processed in this context.
If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning or logging cookie settings, this processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and therefore in a legally compliant design of our website.
A further legal basis for the processing is also Art. 6(1)(c) GDPR. As the controller, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user's consent.
Further information on the operator and the setting options of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.

12) Rights of the Data Subject

12.1 The applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the stated legal basis for the respective conditions of exercise:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to notification pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent given pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

12.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF A BALANCING OF INTERESTS DUE TO OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING REMAINS RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU CAN EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13) Duration of Storage of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and – where applicable – additionally by the respective statutory retention period (e.g. commercial and tax law retention periods).

When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, such data is stored until the data subject withdraws their consent.

If statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, such data will be routinely deleted after the expiry of the retention periods, provided it is no longer necessary for the performance or initiation of the contract and/or no legitimate interest on our part in continued storage persists.

When processing personal data on the basis of Art. 6(1)(f) GDPR, such data is stored until the data subject exercises their right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, such data is stored until the data subject exercises their right to object pursuant to Art. 21(2) GDPR.

Unless otherwise indicated by the other information in this statement regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.