Privacy policy
Privacy Policy
1) Introduction and Contact Details of the Controller
1.1
We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about the handling of your personal data when using our website. Personal data means any information by which you can be personally identified.
1.2
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Rene Hartmuth
Quergartenweg 19
63456 Hanau
Germany
Phone: +49 152 34564933
Email: info@vooro.de
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.
2) Data Collection When Visiting Our Website
2.1
When you use our website purely for informational purposes, meaning that you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server ("server log files").
When you access our website, we collect the following data, which is technically necessary for us to display the website:
- The website visited
- Date and time of access
- Amount of data transferred (in bytes)
- Source/reference from which you reached the page
- Browser used
- Operating system used
- IP address used (if applicable, in anonymized form)
Processing is carried out in accordance with Article 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.
The data will not be disclosed or otherwise used. However, we reserve the right to subsequently review server log files if there are concrete indications of unlawful use.
2.2
For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries submitted to the controller), this website uses SSL or TLS encryption.
You can recognize an encrypted connection by the "https://" prefix and the lock symbol displayed in your browser’s address bar.
3) Hosting & Content Delivery Network
Shopify
For hosting our website and displaying website content, we use the services of:
Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland
Data may also be transferred to:
Shopify Inc.
150 Elgin Street
Ottawa, ON K2P 1L4
Canada
All data collected on our website is processed on the provider’s servers.
We have concluded a Data Processing Agreement (DPA) with the provider to ensure the protection of our website visitors' data and to prohibit unauthorized disclosure to third parties.
For data transfers to Canada, an adequate level of data protection is ensured through an adequacy decision of the European Commission.
4) Cookies
To make visiting our website attractive and to enable the use of certain functions, we use cookies, which are small text files stored on your device.
Some of these cookies are automatically deleted after you close your browser ("session cookies"), while others remain on your device for a longer period and enable the storage of website preferences ("persistent cookies").
In the latter case, the storage duration can be found in your browser’s cookie settings overview.
If personal data is processed through individual cookies used by us, processing is carried out:
- pursuant to Article 6(1)(b) GDPR for the performance of a contract,
- pursuant to Article 6(1)(a) GDPR where consent has been given, or
- pursuant to Article 6(1)(f) GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website and a user-friendly, effective browsing experience.
You can configure your browser to inform you about the setting of cookies and decide individually whether to accept them, or to exclude the acceptance of cookies for specific cases or generally.
Please note that if cookies are not accepted, the functionality of our website may be restricted.
5) Contacting Us
5.1 Judge.me
For review reminders, we use the services of:
Judge.me Ltd.
c/o Buckworths
2nd Floor, 1–3 Worship Street
London EC2A 2AB
United Kingdom
Only on the basis of your explicit consent pursuant to Article 6(1)(a) GDPR do we transmit your email address and, where applicable, additional customer data to the provider so that it can contact you by email with a review reminder.
You may revoke your consent at any time with effect for the future, either by contacting us or the provider directly.
We have concluded a Data Processing Agreement with the provider to ensure the protection of our website visitors' data and to prohibit unauthorized disclosure to third parties.
For transfers of data to the provider's location, an adequate level of data protection is ensured through an adequacy decision of the European Commission.
5.2 General Contact Inquiries
When you contact us (e.g., via contact form or email), personal data is processed exclusively for the purpose of handling and responding to your request and only to the extent necessary for that purpose.
The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) GDPR.
If your inquiry is aimed at concluding a contract, the additional legal basis is Article 6(1)(b) GDPR.
Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively resolved and provided that no statutory retention obligations prevent deletion.
6) Comment Function
When using the comment function on this website, in addition to your comment, information regarding the time the comment was created and the username chosen by you will be stored and published on this website.
Furthermore, your IP address will be logged and stored.
This storage serves security purposes and protects us in the event that a user infringes the rights of third parties or posts unlawful content through a comment.
We require your email address in order to contact you if a third party objects to your published content as being unlawful.
The legal basis for storing your data is Article 6(1)(b) and Article 6(1)(f) GDPR.
We reserve the right to delete comments if they are objected to by third parties as unlawful.
7) Data Processing When Opening a Customer Account
Pursuant to Article 6(1)(b) GDPR, personal data is collected and processed to the extent necessary when you provide such data while opening a customer account.
The data required for account registration can be found in the respective input form on our website.
You may delete your customer account at any time by sending a message to the controller at the contact details provided above.
After deletion of your customer account, your data will be erased provided that:
- all contracts concluded through the account have been fully performed,
- no statutory retention periods prevent deletion, and
- we have no legitimate interest in further storage.
8) Use of Customer Data for Direct Marketing
8.1 Subscription to Our Email Newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers.
The only mandatory information required for sending the newsletter is your email address.
Providing additional data is voluntary and is used to address you personally.
For newsletter registration, we use the double opt-in procedure. This means that you will only receive newsletters after explicitly confirming your consent by activating a verification link sent to your email address.
By activating the confirmation link, you grant us consent to use your personal data pursuant to Article 6(1)(a) GDPR.
In this context, we store:
- the IP address recorded by your Internet Service Provider (ISP),
- the date and time of registration,
in order to trace any potential misuse of your email address at a later time.
The data collected during newsletter registration is used strictly for the intended purpose.
You may unsubscribe from the newsletter at any time via the unsubscribe link included in every newsletter or by contacting the controller listed above.
After unsubscribing, your email address will be removed from our newsletter distribution list without delay unless:
- you have expressly consented to further use of your data, or
- we reserve the right to use data in a manner permitted by law and explained in this Privacy Policy.
8.2 Shopping Cart Reminder Emails
If you abandon a purchase before completing your order, you have the option of receiving a one-time reminder email regarding the contents of your virtual shopping cart.
The only mandatory information required for this reminder service is your email address.
Providing additional data is voluntary and may be used to address you personally.
For reminder emails, we also use the double opt-in procedure, ensuring that notifications are only sent after you explicitly confirm your consent through a verification link sent to your email address.
By activating the confirmation link, you grant consent pursuant to Article 6(1)(a) GDPR for the use of your personal data for shopping cart reminder emails.
We store:
- the IP address assigned by your ISP,
- the date and time of registration,
in order to document possible misuse of your email address.
The data collected for this email notification service is used strictly for the intended purpose.
You may unsubscribe from shopping cart reminders at any time by contacting the controller specified above.
After unsubscribing, your email address will be immediately removed from the corresponding distribution list unless:
- you have expressly consented to further processing, or
- we are legally entitled to continue processing the data as described in this Privacy Policy.
9) Data Processing for Order Fulfillment
9.1 General Order Processing
To the extent necessary for contract fulfillment for delivery and payment purposes, the personal data we collect will be passed on to the commissioned shipping company and the commissioned financial institution in accordance with Article 6(1)(b) GDPR.
If, under a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact data you provided when placing your order in order to personally inform you about such updates within the framework of our legal information obligations pursuant to Article 6(1)(c) GDPR.
Your contact data will be used exclusively for communications concerning updates that we are legally required to provide and will only be processed to the extent necessary for that purpose.
For the processing of your order, we also cooperate with the service providers listed below, who support us wholly or partially in the performance of concluded contracts. Certain personal data is transferred to these service providers in accordance with the information below.
9.2 Shipping Service Providers
To fulfill our contractual obligations toward customers, we work with external shipping partners.
We transmit your name, delivery address, and—where necessary for delivery—your telephone number exclusively for the purpose of delivering goods pursuant to Article 6(1)(b) GDPR to the shipping partner selected by us.
9.3 Use of Payment Service Providers
Apple Pay
If you choose Apple Pay as your payment method, payment processing is carried out via the Apple Pay functionality of your iOS, watchOS, or macOS device through a payment card stored in Apple Pay.
Apple Pay uses security features integrated into your device’s hardware and software to protect transactions.
To authorize a payment, you must enter a code previously defined by you and verify your identity using Face ID or Touch ID.
For payment processing, the information provided during the ordering process together with information about your order is transmitted to Apple in encrypted form.
Apple then re-encrypts this data using a developer-specific key before forwarding it to the payment service provider associated with the payment card stored in Apple Pay.
The encryption ensures that only the website through which the purchase was made can access the payment data.
After payment has been completed, Apple transmits your device account number and a transaction-specific dynamic security code to the website for confirmation of successful payment.
Where personal data is processed, processing is carried out solely for payment processing purposes pursuant to Article 6(1)(b) GDPR.
Apple retains anonymized transaction data, including:
- Approximate purchase amount
- Approximate date and time of purchase
- Whether the transaction was successfully completed
This anonymization prevents any personal identification.
Apple uses anonymized data to improve Apple Pay and other Apple products and services.
Additional information on Apple Pay privacy practices can be found on Apple's website.
Google Pay
If you select Google Pay, payment processing is carried out through the Google Pay application on an NFC-enabled mobile device running at least Android 4.4 ("KitKat").
Google Pay processes payments via a payment card or payment method verified within Google Pay.
For payments exceeding EUR 25.00, prior unlocking of the mobile device through facial recognition, fingerprint, password, or another verification method is required.
For payment processing, the information submitted during checkout, together with order information, is transmitted to Google.
Google then forwards a one-time transaction number to the website to verify the payment.
This transaction number does not contain actual payment details but serves solely as a unique token.
Google acts only as an intermediary in payment processing.
The actual transaction is executed between the user and the website through the payment method stored in Google Pay.
Where personal data is processed, processing takes place exclusively for payment processing purposes pursuant to Article 6(1)(b) GDPR.
Google may collect, store, and evaluate transaction-related information, including:
- Date and time of transaction
- Transaction amount
- Merchant location and description
- Description of purchased goods or services
- Photos attached to transactions
- Names and email addresses of buyers and sellers
- Payment method used
- Description of transaction purpose
- Promotional offers connected to the transaction
According to Google, such processing is based on Article 6(1)(f) GDPR and Google's legitimate interests in accounting, transaction verification, optimization, and maintenance of Google Pay.
Google may also combine transaction data with information collected through other Google services.
Further details are available in Google's terms and privacy notices.
PayPal
This website offers one or more online payment methods provided by:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
When selecting a payment method requiring advance payment, the payment data you provide during checkout—including:
- Name
- Address
- Bank account details
- Credit card details
- Currency
- Transaction number
as well as information regarding your order, will be transmitted to PayPal pursuant to Article 6(1)(b) GDPR.
The transfer takes place solely for payment processing purposes and only to the extent necessary.
If a payment method involves us extending payment terms, you may be asked to provide additional personal information such as:
- First and last name
- Street and house number
- Postal code and city
- Date of birth
- Email address
- Telephone number
To protect our legitimate interest in assessing your creditworthiness, this information may be transmitted to PayPal for credit assessment pursuant to Article 6(1)(f) GDPR.
PayPal may use statistical probability values (score values) based on scientifically recognized mathematical and statistical methods.
Address data may be included in such assessments.
You may object to this processing at any time, although PayPal may continue processing where necessary for contractual payment processing.
PayPal Checkout
This website uses PayPal Checkout, an online payment solution that combines PayPal's own payment methods with local payment methods offered by third parties.
When paying via:
- PayPal
- Credit Card via PayPal
- Direct Debit via PayPal
- Pay Later via PayPal (where available)
your payment data is transmitted to PayPal for payment processing pursuant to Article 6(1)(b) GDPR.
PayPal reserves the right to perform credit checks for certain payment methods.
Where applicable, payment data may be transmitted to credit agencies pursuant to Article 6(1)(f) GDPR for assessing creditworthiness.
The results may include score values calculated using recognized statistical methods.
You may object to such processing by contacting PayPal, although PayPal may continue processing where necessary for payment execution.
For the PayPal payment method "Purchase on Invoice", payment data is initially transferred to PayPal and subsequently to:
Ratepay GmbH
Franklinstraße 28–29
10587 Berlin
Germany
Ratepay performs identity and creditworthiness checks in its own name and may transfer data to credit agencies pursuant to Article 6(1)(f) GDPR.
PayPal Checkout may also support local payment providers such as:
- Apple Pay
- Google Pay
- iDEAL
- Bancontact
- BLIK
- EPS
- MyBank
- Przelewy24
Where such payment methods are selected, payment data is transferred to the respective provider for processing pursuant to Article 6(1)(b) GDPR.
Additional information is available in PayPal's Privacy Statement.
Shopify Payments
This website offers payment methods through:
Shopify International Limited
Victoria Buildings
1–2 Haddington Road
Dublin 4
D04 XN32
Ireland
When selecting a Shopify Payments method involving advance payment, payment data and order information are transferred to Shopify pursuant to Article 6(1)(b) GDPR exclusively for payment processing purposes.
9.4 Electronic Cancellation Option for Ongoing Consumer Contracts
Consumers who have entered into paid continuing obligations (such as subscription agreements) through this website may terminate such agreements electronically using a dedicated cancellation button in accordance with applicable legal notice periods.
The cancellation process may require the consumer to:
- Provide identifying information
- Clearly identify themselves
- Submit the cancellation electronically
Personal data collected for this purpose is processed pursuant to Article 6(1)(b) GDPR and only to the extent necessary for handling the cancellation.
The data is also used to confirm receipt and timing of the cancellation electronically.
An additional legal basis is Article 6(1)(c) GDPR, as we are legally obligated to provide an electronic cancellation option for such contracts.
9.5 Electronic Withdrawal Function for Distance Contracts
Consumers who conclude contracts through this website and are entitled to a statutory right of withdrawal may exercise that right electronically through a dedicated withdrawal function.
To provide this function, we use a solution from:
EU Withdrawal Button
When using the withdrawal function, consumers may be required to provide:
- Contract identification details
- First and last name
- Email address
The provider initially processes this information based on our legitimate interest in offering a user-friendly, reliable, and efficient withdrawal process pursuant to Article 6(1)(f) GDPR.
The information is then used to confirm receipt of the withdrawal declaration on our behalf and subsequently forwarded to us.
We process the transmitted information pursuant to:
- Article 6(1)(b) GDPR
- Article 6(1)(c) GDPR
for the proper handling of the withdrawal request and to comply with our legal obligations.
Information collected by the provider is routinely deleted after the withdrawal process has been completed, provided no statutory retention obligations apply.
We have concluded a Data Processing Agreement with the provider to ensure the protection of processed data and prevent unauthorized disclosure.
10) Website Functionalities
10.1 Facebook Plugins
This website uses plugins from the social network operated by:
Meta Platforms Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland
These plugins enable direct interaction with content on the social network.
To enhance the protection of your data when visiting our website, the plugins are initially deactivated and integrated into the website using a so-called "2-click" or "Shariff" solution.
This integration ensures that when you visit a page containing such plugins, no connection to the provider's servers is established automatically.
Only when you actively enable the plugin and thereby grant your consent pursuant to Article 6(1)(a) GDPR will your browser establish a direct connection with the provider's servers.
In this process, information about:
- your device,
- your IP address,
- your browser,
- and your browsing history
may be transmitted to the provider and further processed, regardless of whether you are logged into an existing user account.
If you are logged into an account on the social network, information about your interactions through the plugin may also be published there and displayed to your contacts.
You may revoke your consent at any time by deactivating the plugin again. Such revocation does not affect data already transferred prior to revocation.
Data may also be transferred to:
Meta Platforms Inc., USA
We have concluded a Data Processing Agreement with the provider.
For transfers to the United States, the provider participates in the EU–US Data Privacy Framework, which ensures an adequate level of protection based on a European Commission adequacy decision.
10.2 Instagram Plugins
This website uses plugins from:
Meta Platforms Ireland Ltd.
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland
The operation of Instagram plugins follows the same principles described above for Facebook plugins.
The plugins are initially deactivated through a 2-click or Shariff solution and become active only after your consent pursuant to Article 6(1)(a) GDPR.
Once activated, information about your device, browser, IP address, and browsing history may be transmitted to Meta and processed there.
Data may also be transferred to:
Meta Platforms Inc., USA
Meta participates in the EU–US Data Privacy Framework.
10.3 Pinterest Plugins
This website uses plugins from:
Pinterest Europe Ltd.
Palmerston House
2nd Floor, Fenian Street
Dublin 2
Ireland
These plugins allow direct interaction with Pinterest content.
To protect your privacy, the plugins are initially disabled via a 2-click or Shariff solution.
Only after activation and your consent pursuant to Article 6(1)(a) GDPR will a connection to Pinterest's servers be established.
Information regarding your device, browser, IP address, and browsing history may then be transferred and processed.
If you are logged into Pinterest, interactions performed through the plugin may also be associated with your Pinterest account and displayed to your contacts.
Data may also be transferred to:
Pinterest Inc., USA
Pinterest relies on the European Commission’s Standard Contractual Clauses for international data transfers.
10.4 ShopSync for Shopify
This website uses the Shopify application:
ShopSync LLC
PO Box 252
Jefferson City, TN 37760
USA
ShopSync synchronizes the email marketing service Mailchimp with our Shopify account.
This enables:
- Updates in Mailchimp email lists (e.g., newsletter unsubscribes) to be automatically reflected in Shopify.
- Newly generated customer data from Shopify purchases to be automatically transferred to Mailchimp mailing lists.
Synchronization of Existing Marketing Data
Processing takes place pursuant to Article 6(1)(f) GDPR based on our legitimate interest in maintaining accurate and legally compliant marketing records across systems.
Transfer of New Customer Data
Following a purchase on Shopify and only on the basis of your explicit consent pursuant to Article 6(1)(a) GDPR, the following information may be transferred via ShopSync to Mailchimp:
- First name
- Last name
- Postal address
- Email address
- Transaction-related information
- Purchase amount
- Date and time of purchase
ShopSync does not permanently store this information after synchronization.
All synchronized information is transferred via SSL encryption.
The synchronization process requires transmission through secure servers hosted by Amazon Web Services in the United States.
11) Tools and Miscellaneous Services
11.1 Accountable
For bookkeeping purposes we use the cloud-based accounting software provided by:
Accountable SA
22 drève des Weigélias
1170 Brussels
Belgium
The provider processes incoming and outgoing invoices and, where applicable, banking transactions in order to:
- automatically capture invoices,
- match invoices with transactions,
- and generate accounting records through a partially automated process.
Where personal data is processed, such processing is based on our legitimate interest in the efficient organization and documentation of business processes pursuant to Article 6(1)(f) GDPR.
11.2 sevDesk
For bookkeeping purposes we also use:
sevDesk GmbH
Hauptstraße 115
77652 Offenburg
Germany
The provider processes invoices and financial transactions to facilitate automated accounting.
We have concluded a Data Processing Agreement with the provider.
Where personal data is processed, processing is based on our legal obligation to maintain proper accounting records pursuant to Article 6(1)(c) GDPR.
11.3 Cookie Consent Tool
This website uses a Cookie Consent Tool to obtain legally valid user consent for cookies and cookie-based applications requiring consent.
The tool is presented to users in the form of an interactive interface through which consent can be granted for specific cookies or services.
Only after a user has provided the relevant consent will the corresponding cookies and services be activated.
This ensures that such cookies are only placed on a user's device when consent has been granted.
The tool sets technically necessary cookies in order to save your cookie preferences.
As a rule, no personal data is processed.
If, in individual cases, personal data (such as an IP address) is processed for the purpose of storing, assigning, or documenting consent preferences, processing is based on:
- Article 6(1)(f) GDPR (legitimate interest in legally compliant consent management), and
- Article 6(1)(c) GDPR (legal obligation to document user consent).
Where necessary, we have concluded a Data Processing Agreement with the provider.
Further information can be found directly within the consent tool interface on our website.
12) Rights of the Data Subject
12.1 Your Rights Under Data Protection Law
Under applicable data protection law, you have the following rights regarding the processing of your personal data:
- Right of access (Article 15 GDPR)
- Right to rectification (Article 16 GDPR)
- Right to erasure ("right to be forgotten") (Article 17 GDPR)
- Right to restriction of processing (Article 18 GDPR)
- Right to notification (Article 19 GDPR)
- Right to data portability (Article 20 GDPR)
- Right to withdraw consent (Article 7(3) GDPR)
- Right to lodge a complaint with a supervisory authority (Article 77 GDPR)
12.2 Right to Object
Objection Based on Particular Circumstances
Where we process your personal data on the basis of our legitimate interests following a balancing of interests, you have the right to object at any time to such processing on grounds relating to your particular situation.
If you exercise your right to object, we will cease processing the affected personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms or unless the processing serves the establishment, exercise, or defense of legal claims.
Objection to Direct Marketing
Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes.
If you exercise your right to object, we will stop processing your personal data for direct marketing purposes.
13) Retention Period for Personal Data
The duration for which personal data is stored depends on:
- the applicable legal basis,
- the purpose of processing,
- and, where relevant, statutory retention obligations (e.g., commercial and tax law retention periods).
Processing Based on Consent
Where personal data is processed on the basis of consent pursuant to Article 6(1)(a) GDPR, the data will be stored until you withdraw your consent.
Processing Based on Contractual Obligations
Where legal retention periods apply to data processed pursuant to Article 6(1)(b) GDPR, such data will be routinely deleted after expiration of the retention period, provided it is no longer required for contract fulfillment or contract initiation and no legitimate interest in continued storage remains.
Processing Based on Legitimate Interests
Where processing is based on Article 6(1)(f) GDPR, personal data will be retained until you exercise your right to object under Article 21(1) GDPR, unless compelling legitimate grounds for continued processing exist.
Direct Marketing
Where personal data is processed for direct marketing purposes pursuant to Article 6(1)(f) GDPR, the data will be retained until you exercise your right to object under Article 21(2) GDPR.
General Rule
Unless otherwise specified in this Privacy Policy, stored personal data will be deleted once it is no longer necessary for the purposes for which it was collected or otherwise processed.
Status: June 19, 2026
