Privacy policy

UNBINDING CONVENIENCE AUTOMATED ENGLISH TRANSLATION:

We take data protection seriously. The protection and security of your personal data, i.e. all data relating to you (hereinafter referred to as "personal data"), is our top priority.

Therefore, we handle all the data you entrust to us with the utmost care and in accordance with the applicable data protection regulations, i.e. the General Data Protection Regulation (hereinafter referred to as "GDPR") and the applicable national data protection law, i.e. the Act on the Implementation of the General Data Protection Regulation (OG 42/18, hereinafter referred to as "AIGDPR").

Below you can find out what data we collect about you, how we collect it and on what legal basis, for what purpose we use it, how we protect it and what rights you have in relation to its processing.

I. DATA CONTROLLER

The controller of your personal data when you visit our website on www.westwing.hr or our app, including the sale of goods and the provision of services we offer, as well as our Westwing accounts on the social media platforms "Facebook", "Instagram", "TikTok" and "Pinterest", among others, within the meaning of the GDPR, is:

Westwing GmbH, Moosacher Straße 88, 80809 Munich, Germany service@westwing.hr (hereinafter referred to as "Westwing" or "we").

Westwing GmbH and Westwing Group SE, with its registered office at Moosacher Straße 88, 80809 Munich, are also jointly responsible for the processing in some cases. In this context, Westwing and Westwing Group SE have defined in a contract in accordance with Article 26 of the GDPR which data protection obligations they assume from them.

II. DATA PROTECTION OFFICER

You can also contact our Data Protection Officer at any time if you have any questions about the processing of your personal data or the exercise of your rights. You can contact him via the following contact details:

Mr Christian Volkmer Projekt 29 GmbH & Co. KG

Ostengasse 14

93047 Regensburg

E-mail: anfrage@projekt29.de

Website: www.projekt29.de

III. CATEGORIES OF YOUR PERSONAL DATA PROCESSED

Personal data collected when you visit our website, our app or our social media accounts can be classified into the following categories:

Information collected when you browse our website or app, depending on which of our cookies you have consented to (e.g. login data, i.e. the date and time you logged in to our website, language settings, products in your shopping cart or information about your preferences, e.g. in relation to product categories),
Data collected when creating a user account (e.g. your name, address, email address, preferred title (if provided), your telephone number (if provided), your encrypted password for your account),
Data processed in connection with your order (e.g. about the products you have purchased or services you have used and the payment data you have provided to us),
Your data that is collected when you contact us (e.g. your name, your email address, your phone number, your customer, order and item number, as well as any other information you provide to us ),
Information about you that we transfer to our third-party service providers in certain cases in order to communicate with you on our website or in our app and to personalize the communication (e.g. your name, your email address, or products of interest to you based on your surfing behavior),
Information that is collected when you agree to receive newsletters, customer satisfaction surveys, product reminders, and your behavior in relation to the content of our promotional emails (e.g. opening the newsletter or clicking on a link in the newsletter),
Information about you that we receive from our cooperation partners in certain cases (e.g. credit agencies, technical service providers, debt collection service providers or payment service providers),
Data we process to participate in competitions (e.g. your name and e-mail address),
statistical or aggregated information about your usage behavior on our social media accounts,
Information about you that we receive from a friend or other contact who would like to invite you to use our website or our app (e.g. your email address).

IV. PURPOSES FOR WHICH WE PROCESS YOUR PERSONAL DATA

We use your personal data for various purposes, such as:

for the purpose of providing certain technical functions on our website and in our app (e.g. to store your goods in the shopping cart) and to protect our website and our app,
for the purpose of analysing your behaviour on our website in order to optimise our offer and our contributions for you and make them more interesting,
In order to create a user account,
to fulfill and process orders for goods and services sent to us (e.g. for the dispatch of goods),
to contact you (e.g. In order to answer all your questions, send you order confirmations and order notices, or inform you of changes that are important to you, e.g. applicable General Terms and Conditions or this Privacy Policy),
for advertising and marketing purposes (e.g. to send you our newsletter, to notify you of vouchers or special promotions, to remind you of your shopping cart history, to send you product ratings and opinion polls or for other similar advertising activities),
to process payments by us or our affiliate partners, to verify fraud by us or our affiliate partners, and to collect claims by our affiliate partners;
for participation in competitions,
for statistical analysis of your behavior on our social media accounts in order to optimize our offer and our contributions to you,
for the purpose of inviting a friend or other contact to use our website or our app.

At no time do we process special categories of personal data in accordance with Art. 9 GDPR (e.g. health data or data relating to your religion), unless you provide us with relevant information without being asked when communicating with our customer service.

If we want to collect and process further personal data from you, we will inform you separately in advance and, if necessary, obtain your consent.

V. LEGAL BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA

Your data will only be processed on one of the legal bases provided, i.e. if you have given your consent (Art. 6 (1) (a) GDPR), we have a legitimate interest in the processing (Art. 6 (1) (f) GDPR), we need your data for the performance or performance of a contract with you (Art. 6 (1) (b) GDPR) or it is necessary for compliance with a legal obligation (Art. 6 (1) (c) GDPR).

VI. RECIPIENTS OF YOUR PERSONAL DATA

Westwing remains responsible at all times for the processing of your personal data collected through our website or our app.

Your data will only be passed on to third parties in the following cases on the basis of the legal provisions listed in each case:

if the disclosure of your data is necessary for the fulfilment or performance of your contract (Article 6(1)(b) of the GDPR); this includes, for example, the communication of data to payment and logistics service providers, carriers and suppliers if they deliver directly to you); or
if it is necessary to comply with a legal obligation (Article 6(1)(c) of the GDPR; this includes, for example, the disclosure of data to government agencies and law enforcement authorities in order to comply with our legal obligations to provide information and disclose data or seek remedies), or
on the basis of our legitimate interest (Article 6(1)(f) of the GDPR); this includes, for example, the communication of data in the context of a transfer of claims or in the context of administrative purposes within a group of companies);
if we use external service providers, so-called processors, when processing your personal data, who are obliged to handle your data carefully and who act exclusively on our behalf and in accordance with our instructions (Article 28 GDPR; this includes, for example, processors in the areas of IT, logistics, telecommunications, sales and marketing).

In addition, we will only pass on your personal data to third parties if you have given us your consent to the communication of the data in question (Art. 6 (1) (a) GDPR), whereby any consent given can be revoked at any time with effect for the future.

VII. TRANSFER OF DATA TO THIRD COUNTRIES

When transferring your personal data to third countries, i.e. external bodies outside the European Union ("EU") and the European Economic Area ("EEA"), we ensure that the relevant external bodies treat your personal data with the same care as we do.

In addition, we only transfer your personal data to third countries for which an adequate level of protection has been confirmed by the European Commission or if a level of data protection comparable to that in the EU or the EEA can be guaranteed by contractual agreements or other appropriate guarantees (Art. 45 et seq.). GDPR).

VIII. DELETION OF YOUR PERSONAL DATA

Provided that there are no statutory retention periods (e.g. under commercial and tax law) to the contrary, we only store your personal data for as long as is necessary for the respective purpose of the processing or until you inform us that your personal data needs to be deleted.

Such retention periods under tax or commercial law apply, for example, to data relating to your orders, such as invoices. The latter, for example, are stored for ten years.

Accounts of customers who have not actively used their account for more than six years will be deleted.

So-called. The log files we collect when you surf our website or use our app for online security and abuse prevention purposes are generally stored for 20 days and only in individual cases, if longer storage is required to investigate possible cyberattacks, fraud or abuse, 180 days. Your data will then be deleted or anonymised in such a way that it can no longer be linked to you as a person.

IX. DETAILS OF THE PROCESSING OF YOUR DATA ON OUR WEBSITE

1. DATA PROCESSING WHEN VISITING OUR WEBSITE

When you visit our website, the following information is automatically collected and stored in so-called "server log files". Your browser automatically transmits this information to us so that our website can be displayed in your browser and that you can use our website:

The IP address of your Internet service provider,
the website from which you visit us and the websites you visit from our website,
date and time of access and crash data,
information about the browser and operating system used,
if applicable, the email address you use to register on our website,
identification numbers that are stored in so-called cookies or eTags on your end device and with which we can recognize your end device on the website,
location data,
visits or clicks on pages and products.

The processing or storage of your above-mentioned access data or your IP address is necessary for technical reasons in order to ensure and ensure the security of the system on our website.

In addition, we use the log files of your server exclusively for the design and optimization of our online offer according to requirements, whereby we assign you an individual user ID when you visit our website, which we merge or combine with your e-mail address only if an error occurs on the website.

If you visit our website to find out more about or use our range of products and services, the basis for the temporary storage and processing of access data is Article 6 (1) (b) of the GDPR, according to which the processing of personal data is permitted for the performance of a contract or for the implementation of pre-contractual measures.

In addition, the processing or temporary storage of your technical access data is based on the satisfaction of our legitimate interest in accordance with Article 6 (1) (f) GDPR. In particular, it is our legitimate interest to provide you with a technically functional, simple and secure website.

The access data collected when you visit our website is only stored for as long as necessary to fulfill the above purposes. Server log files are stored for a maximum of 180 days and then deleted.

2. DATA PROCESSING WHEN REGISTERING OR CREATING A USER ACCOUNT

To register and create your account, we need your email address and password of your choice. We also collect and process your contact information, i.e. your name, address, email address, the form of contact you want us to contact you with (if you provide one) and your telephone number (if you provide one). The email address serves as an access code to your user account. After successful registration, you will automatically receive a confirmation email. You can also store your personal information in your user account and use it to make convenient purchases on our website, while billing and shipping address information will be automatically stored in your account as described in section 3 below. Your information may be updated at any time in the personal area of your user account ("My Account"). We use this information to process orders, offer payment options, and process payments and possible returns, among other things.

We would like to make your visit to our website as pleasant as possible by using the "stay logged in" function. This function allows you to use our services without having to log in every time. Technically, the cookie is stored on your device so that you do not have to log in again on subsequent visits to our website. This function is not available to you if you have deactivated this cookie through your cookie settings or if you have deleted it in your browser settings after logging out of our website.

The legal basis for the related data processing is Article 6(1)(b) of the GDPR, according to which the processing of personal data is permitted for the performance of a contract or for the implementation of pre-contractual measures.

Your data collected when creating or registering a user account will only be stored for as long as this data is necessary to achieve the above purposes or as long as there is an active user account with Westwing.

3. DATA PROCESSING TO PROCESS YOUR ORDER

When you place an order with us, your data is processed for the conclusion and fulfilment of the contract and for the processing of your order, including payment and delivery. We store the billing information and (possibly different) shipping addresses you provide in your customer account so that you do not have to re-enter them the next time you make a purchase. You can change this information at any time for the future.

We delete your personal data processed as part of orders no later than after the expiry of the legal obligations of tax and accounting retention.

3.1. CHOOSING A PAYMENT METHOD

Depending on the payment method you choose, you will be asked for the information required to use the respective payment service provider. This payment data is transmitted directly to the relevant payment service provider and is not stored by us. The relevant payment service provider is responsible for your payment details. Information on this can be found on the website of the relevant payment service provider.

If you do not agree with the payment methods offered, you can inform us in writing by sending an e-mail to service@westwing.hr. We will then reconsider our decision taking into account your point of view.

3.1.1. PAYMENT BY CREDIT CARD

When you pay by credit card, we receive a so-called payment ID and the last four digits of your credit card number from our payment service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Doc, Dublin, D02 H210, Ireland.

This data is used to authenticate and assign your order and is therefore transmitted for your security. The personal data required for payment processing is collected directly by the payment service provider mentioned above.

The legal basis for the above-mentioned data processing is Article 6 (1) (b) of the GDPR, according to which the processing is permitted for the performance of a contract.

You can find more information about Stripe Payments Europe Ltd's data protection on their website: https://stripe.com/en-de/privacy.

3.1.2. APPLE PAY

If you choose the Apple Pay payment method to pay for purchases directly through your bank account, we will receive the relevant account information from our payment provider Stripe Payments Europe, 1 Grand Canal Street Lower, Grand Canal Doc, Dublin, D02 H210, Ireland. The personal data required for payment processing is collected directly by the payment service provider mentioned above.

The legal basis for the above-mentioned data processing is Article 6 (1) (b) of the GDPR, according to which the processing is permitted for the performance of a contract.

You can find more information about data protection in Apple Pay on the Apple Pay website: https://www.apple.com/es/legal/privacy/data/es/apple-pay/.

3.1.3. GOOGLE PAY

If you choose the Google Pay payment method to pay for purchases directly through your bank account, we will receive relevant account information from our payment service provider Stripe Payments Europe, 1 Grand Canal Street Lower, Grand Canal Doc, Dublin, D02 H210, Ireland. The personal data required for the processing and processing of payments is collected directly by the above-mentioned payment service provider.

The legal basis for the above-mentioned data processing is Article 6 (1) (b) of the GDPR, according to which the processing is permitted for the performance of a contract.

You can find more information about data protection in Google Pay on the Google Pay website: https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=buyertos&ldr=ES.

3.1.4. PayPal

If you choose the PayPal payment method, your personal data (i.e. your first and last name, shipping address, email address, phone number, amount to be paid and IP address) will be transferred to PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, so that you can authorise us to pay via PayPal. For this, you will need a PayPal account.

The legal basis for the above-mentioned data processing is Article 6(1)(b) of the GDPR, according to which the processing of personal data is permitted for the performance of a contract or for the implementation of pre-contractual measures.

More information on data protection at PayPal can be found on the website PayPal: https://www.paypal.com/es/webapps/mpp/ua/privacy-full.

4. FRAUD PREVENTION

To prevent fraud and non-payment, we check for frequent fraud patterns and anomalies. For this purpose, order and payment data (e.g. address, item, payment method) and device data (e.g. device, browser) are processed. The legal basis is Article 6 (1) (f) GDPR on the basis of our legitimate interest in protection against misuse.

You can find more information about the payment methods offered in our General Terms and Conditions (GTC).

5. DATA PROCESSING WHEN YOU CONTACT US

5.1. CHANNELS FOR CONTACTING US

You have several options to contact us. You can contact our customer service through the following communication channels:

Phone
by fax,
Mail
E-mail,
We can use the contact form.

In order to process your request, we collect your name, email address, phone number, customer, order and item number, as well as any other information you provide to us, depending on the communication channel you use to contact us.

The legal basis for this is Article 6 (1) (b) GDPR, according to which the processing of data is necessary for the performance of a contract, while for the processing of inquiries from visitors to our website is Article 6 (1) (f) GDPR, based on our legitimate interest in processing inquiries from visitors to our website.

5.2. OUR ZENDESK CUSTOMER SUPPORT SYSTEM

We use the Zendesk customer support system to process your contact inquiries. The provider is Zendesk, Inc, 1019 Market Street in San Francisco, CA 94103 USA.

We use Zendesk to process your queries quickly and efficiently. As a reminder, you can also submit your queries by simply entering your email address rather than your name.

We have concluded an order processing contract with Zendeska. This is a contract that ensures that your personal data will only be processed in accordance with our instructions and in accordance with the GDPR and other applicable laws.

Your data may be transferred to Zendesk servers in the USA and stored there. The legal basis for this is an adequacy decision of the European Commission of 10 July 2023 (so-called Data Privacy Framework) in accordance with Article 45 of the GDPR and your consent.

The legal basis for data processing by Zendesk is our legitimate interest in accordance with Article 6 (1) (f) GDPR. If you do not agree with Zendesk's processing of your inquiry, you can contact us by email or phone.

For more information, see Zendesk's privacy policy: https://www.zendesk.es/company/agreements-and-terms/privacy-notice/?_ga=2.49674086.1594119184.1724952410-1359339100.1724952409

6. PROCESSING OF DATA FOR ADVERTISING PURPOSES

6.1. SENDING ADVERTISING E-MAILS

If you have consented to this, Westwing will regularly send you the Westwing newsletter by email to keep you informed about the latest trends in the Home & Living area, must-have Home & Living styles, prominent features of Westwing online and retail stores, as well as special offers or "Sales of the Day" and "Sales of the Week" ("Newsletter"). Details of this can be found in Section 6.1.1.

Subject to your consent, you will also receive email notifications from us about personal benefits – such as vouchers or special promotions – reminders about the products in your shopping cart, reviews of Westwing products you have purchased, and surveys about Westwing or Westwing services ("Notifications"). Details on this can also be found in section 6.1.1.

If you have already purchased a product or service from us and have not objected to receiving it, you will also receive promotional emails from us about similar products and/or services by email. Details of this can be found in Section 6.1.2.

6.1.1. SENDING ADVERTISING E-MAILS BASED ON YOUR CONSENT

If you have given your consent on our website by ticking the checkbox, we will send you newsletters and/or email notifications.

Please note, however, that we will only send you newsletters and/or email notifications if you have previously expressly confirmed to us by clicking on the button that you wish to receive relevant emails. We will send you a corresponding button in the notification email upon receipt of your consent to the email address you have provided (the so-called "double opt-in process"). This serves to prevent misuse by third parties who might use your email address to register you for the Westwing newsletter or Westwing notifications without your consent. The legal basis for the double inclusion procedure is Article 6 (1) (f) GDPR, as we have an overriding legitimate interest in preventing such abuse and documenting your consent.

The relevant legal basis under data protection law for the processing of your personal data in connection with the sending of the above-mentioned advertising emails is your consent in accordance with Article 6 (1) (a) GDPR.

You can withdraw your consent at any time with effect for the future as follows:

Click on the unsubscribe link at the end of our promotional emails to be redirected (depending on whether you wish to unsubscribe from newsletters or email notifications) to the newsletter or notification management section of your user account (collectively, "Manage Promotional Emails"). There you can easily uncheck the boxes with newsletters or notifications that you no longer want to receive.
Optionally, you can also log in to your user account and then click on the "My Newsletters" or "My Notifications" tab (depending on the type of email you wish to unsubscribe from), and then unsubscribe from relevant newsletters or notifications that you no longer wish to receive in the above newsletter management or notification management by unchecking the appropriate checkmark.
You may also withdraw your consent to receive newsletters and/or notifications and unsubscribe from receiving relevant promotional emails by sending an email to service@westwing.hr.

With the help of our above-mentioned advertising email administration, we allow you to declare and revoke your consent to receive our newsletters and/or notifications in a variety of ways. By checking or unchecking the box, you can decide individually whether and when or how often you want to receive a newsletter or email notification, depending on which newsletter you are interested in or which notification you find useful and how often you want to receive the newsletter or notifications in question.

Please note that we use standard market technologies in our advertising emails to measure the opening of emails and/or links that you click on. We use this data for general statistical evaluations and to optimize and further develop our content and customer communications. This is done with the help of small graphics that are embedded in the newsletter (so-called pixels). The legal basis for this is our legitimate interest in optimizing and further developing our content and customer communications (Art. 6 (1) (f) GDPR). If you do not want this analysis of your usage behavior, you can unsubscribe from receiving advertising emails at any time or deactivate graphics in your email program by default.

Our newsletters and notifications are sent via the postal service provider Mapp Digital Germany GmbH, Dachauer Straße 63, 80335 Munich, Germany ("Mapp"). An order processing agreement has been concluded with Mapp for the processing of personal data in accordance with Article 28 of the GDPR. Further information can be found in Mapp's privacy policy. https://mapp.com/de/privacy/.

6.1.2. SENDING EMAILS WITH ADVERTISEMENTS FOR PRODUCTS AND SERVICES THAT MAY BE OF INTEREST TO YOU BASED ON YOUR PREVIOUS PURCHASING BEHAVIOR

If you have provided your email address when purchasing a product or service in our online store, we will send you offers and information about products and services from our range that may be of interest to you, as you have already purchased similar products and services from Westwing. In addition, we will send you product evaluation and feedback surveys to ask you about your satisfaction with the products you have purchased or the services you have used (e.g., our customer service). However, such advertising emails will only be sent if you have not objected to receiving them - despite our corresponding notice below the buy button.

The relevant legal basis under data protection law for the processing of your personal data is our legitimate interest in accordance with Article 6 (1) (f) of the GDPR in conjunction with the National Electronic Communications Act.

You can also object to receiving relevant advertising emails at any time by simply clicking on the unsubscribe link at the end of our promotional emails. If you wish, you can log in to your user account and unsubscribe through the advertising email administration (see section 6.1.1). You can also subsequently object to receiving relevant advertising emails by sending an email to service@westwing.hr.

6.2. SENDING NEWSLETTERS VIA WHATSAPP

We also allow you to receive our newsletter via the "WhatsApp" message. We use the WhatsApp Business app to send newsletters via WhatsApp.

For this purpose , we cooperate with our processors charles GmbH, Gartenstraße 86-87, 10115 Berlin, Germany and Braze, Inc., 318 West 39th Street, 5th Floor, New York, New York 10018, USA, ("Braze").

With regard to the use of WhatsApp, the data protection provisions of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland apply. They determine, among other things, that each WhatsApp message is end-to-end encrypted and therefore protected from access by third parties.

The legal basis for the processing of your data by Westwing is Art. 6 (1) a) GDPR, because you have consented to our website and confirmed via your WhatsApp message that you wish to receive newsletters via this channel, i.e. news about new products and interior trends. You can revoke your consent at any time with effect for the future by sending a "Stop" message.

Westwing is committed to complying with WhatsApp Business's privacy policy, which can be found here: https://business.whatsapp.com/privacy-protections.

7. PROCESSING OF DATA TO COMMUNICATE WITH YOU ON OUR WEBSITE AND THROUGH OUR APP

We also use the service provider Braze to communicate with you on our website and in our app. For this purpose, we show you the so-called "layers" with the option to interact, for example.

Braze is also used to send push notifications in our app.

Braze processes, among other things, the following personal data for this purpose: your IP address, device-related data such as device type, model, operating system, browser type and version, usage information such as time of use, name, email hash, data on interaction with the Braze SDK and messages, installation ID, device ID.

The legal basis for the processing of your personal data is Article 6(1)(a) of the GDPR. You can revoke your consent at any time with effect for the future. The easiest way to withdraw your consent is through our Cookie Consent Manager.

More information on Braze's data protection compliance can be found here: https:www.braze.com/privacy/.

8. PROCESSING OF DATA FOR PARTICIPATION IN COMPETITIONS

If you participate in competitions, we only process the data that is necessary for the organization of the competition (Article 6 (1) (b) GDPR). Please note the data protection information in the terms and conditions of the relevant tender.

9. DATA PROCESSING IN THE EVENT OF LEGAL PROCEEDINGS

In addition, we process your personal data in individual cases in order to exercise our legal claims of any nature or to defend ourselves against legal claims, or if it is necessary for the defence or prosecution of criminal offences.

The legal basis for this is the protection of our legitimate interests in accordance with Article 6(1)(f) of the GDPR.

10. DATA PROCESSING WHEN USING FAN PAGES ON SOCIAL NETWORKS

Westwing is active and present on social networks and social platforms to communicate with interested parties and users and inform them about other offers from Westwing. Below we provide you with an overview of the processing and use of your personal data by us or your use of the social media platforms listed below:

10.1. FACEBOOK IN INSTAGRAM

We operate the social media "fan pages" on Facebook and Instagram jointly with Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta"), in order to communicate with our fans (such as our customers and stakeholders) and inform them about our products, competitions and other promotions.

You can see the contract with Meta here: https:www.facebook.com/legal/terms/page_controller_addendum

With the help of Meta statistics about the use of our fan pages (e.g., number, name, interactions such as "likes" and comments, as well as aggregated demographics and other information or statistics; "Insight Data"), we receive information about how our fan page is used, what visitors to our fan pages are interested in, and which topics and content are particularly popular, so that we can optimize the content of our fan page and tailor it to our users. Insights data contains only statistical and depersonalized data about visitors to a fan page and therefore cannot be assigned to a specific person. You can find more information about the type and scope of these statistics in the Facebook Page statistics information. You can find more information about the respective responsibilities and the processing of your data by Facebook in the so-called "Information Supplement on Facebook Pages" at: https:www.facebook.com/legal/terms/information_about_page_insights_data

Please note that we have no control over the data processing that Meta carries out at its own risk in accordance with Meta's Terms of Use. However, we would like to point out that when you visit "Fanpages", data about your usage behavior is transmitted from Facebook and "Fanpages" to Facebook. Facebook processes your personal data itself in order to compile the above statistics and for its own market research and advertising purposes. We don't have access to that data.

To the extent that we receive your personal information when operating fan pages, you have the rights set out in this privacy policy. If you wish to assert your rights against Facebook beyond this, you can contact Facebook directly. We will be happy to assist you in exercising your rights to the extent possible and will direct your inquiries to Facebook.

The legal basis for this data processing is Article 6 (1) (f) GDPR on the basis of our above-mentioned legitimate interest in being able to offer you our Facebook fan pages for marketing and advertising purposes.

You can find more information about this in Meta's Data Policy at: https://es-es.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0

10.2. YOUTUBE

On YouTube.com platform, we use so-called "plugins" to embed our own videos and make them available to the public. YouTube is a service provided by a third party that is not affiliated with us, namely YouTube LLC operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; ("Google").

As soon as you access our YouTube channel, your browser establishes a connection to YouTube and transmits information. The integration of YouTube content only takes place in the so-called "extended data protection mode". This is provided by YouTube itself and, according to its own information, ensures that YouTube user data (e.g. cookies) is only stored on your device when the video is played. When you access the videos in question, your IP address, unique identifiers, browser type and settings, device type and settings, operating system, mobile network information such as mobile provider name and phone number, and app version number are transmitted to YouTube. YouTube also collects data about how its apps, browsers, and devices interact with its own services. The transfer of data to YouTube's partners is not necessarily excluded by the extended data protection mode. YouTube establishes a connection to the Google DoubleClick network, whether you're watching the video or not. The data transmitted includes the IP address, crash reports, system activity, and the date, time, and referral URL of your request. In addition, YouTube collects information about your activities (e.g., the terms you search for, the videos you watch, etc.). All data collected about you through our YouTube channel is processed by YouTube. According to YouTube, this information is used to compile video statistics, improve ease of use, and prevent abuse, among other things. YouTube also uses cookies to collect information about user behavior. The storage of these cookies can be prevented by appropriate settings and browser extensions. If you're signed in to your YouTube account, you allow YouTube to map your browsing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account before activating the play button.

In addition, we occasionally integrate videos stored on YouTube directly into our website using so-called "plug-ins". With this integration, the content of the YouTube website is displayed in parts of the browser window. However, YouTube videos can only be accessed by clicking on them separately. This technique is also known as "framing". If you access a (sub)page of our website on which YouTube videos are embedded in this way, a connection to YouTube's servers is established and the content is displayed on the website by notifying your browser. We have no influence on the scope and content of the data that is transmitted to YouTube and possibly other YouTube partners by activating the plug-in. Among other things, the YouTube server is informed which of our pages you have visited.

You can find more information about what information YouTube receives and how it is used in the YouTube Privacy Policy at: https:policies.google.com/privacy.

10.3. TIKTOK

We publish short video clips on the TikTok platform and the TikTok app to promote our products and sales. If you visit the TikTok website or app, TikTok Inc, 10100 Venice Blvd, Culver City, CA 90232, USA ("TikTok") collects and processes your personal data.

TikTok makes a certain amount of this data available to TikTok profile holders in anonymized and aggregated form. It is the number of new followers, demographic information such as gender and country, without reference to identifiable individuals. Therefore, Westwing is unable to identify any TikTok profile visitors. As the owner of this profile, Westwing receives anonymized statistical data (so-called "Insights data") from TikTok. This information cannot be used to draw conclusions about the visitor in question. We use the data contained in the statistics exclusively to analyze user behavior so that we can better adapt our TikTok profile and our offer to the needs and interests of visitors.

The use of your data transmitted to us by TikTok is based on our legitimate interest in accordance with Article 6 (1) (f) GDPR to carry out data analyses and statistically record the use of our TikTok profile, to optimize our offer for you, to advertise our publications and videos on our website, and to continuously improve and manage our offer and our products.

Further information on data processing by TikTok can be found in TikTok's privacy policy at: https:www.tiktok.com/legal/page/eea/privacy-policy/es.

10.4. PINTEREST

We operate a Westwing account on Pinterest and the Pinterest app, where we post home and living inspiration and advertise our products. Pinterest Inc., 808 Brannan Street, San Francisco, CA 94103, USA ("Pinterest") is responsible for Pinterest.

When you sign up for an account, Pinterest processes the information you provide, such as your name, email address, phone number, photos, pins and comments. In addition, Pinterest collects and processes your IP address, which is used to approximate your location if you choose to share your exact location, as well as other online and web activity (including the "pins" you click, the "boards" you create, and the text you add in your comment or description).

The legal basis for this data processing is Article 6 (1) (f) GDPR on the basis of our legitimate interest in being able to offer you our Pinterest platform for marketing and advertising purposes.

More information can be found at https://policy.pinterest.com/es/privacy-policy.

11. DATA PROCESSING BY SHOPIFY

To provide our online store and process your payments, we work with the service provider Shopify International Limited, Victoria Buildings 1-2, Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify allows us to manage our online store through Shopify's cloud computing infrastructure, and it also processes your payments for us.

Your data may be transferred to Shopify servers in the USA and stored there. The legal basis for this is an adequacy decision of the European Commission of 10 July 2023 (so-called Data Privacy Framework) in accordance with Article 45 of the GDPR together with the so-called EU Standard Contractual Clauses.

Shopify is used to provide our online store and process your payments. The legal basis is therefore our legitimate interest within the meaning of Article 6(1)(f) of the GDPR or the performance of your contract within the meaning of Article 6(1)(b) of the GDPR.

Shopify acts as our data processor or data controller, depending on the processing activity.

Further information on data processing and data protection notices by Shopify can be found at https://www.shopify.com/legal/privacy.

X. COOKIES AND SIMILAR TECHNOLOGIES

We use so-called "cookies" and similar technologies (such as so-called "web beacons", "pixels", "tags") on our website. Web beacons are small GIF files that can be hidden in other graphics, emails, or the like. Web beacons can identify your computer and evaluate your user behavior, for example your reactions to advertising campaigns. The information collected by web beacons cannot be used to identify you. Cookies are small text files that are transferred from an internet server to your browser and stored on your hard drive. There are so-called "session cookies", which are deleted as soon as you close your browser, and so-called "persistent cookies", which are stored on your end device for a longer period of time or indefinitely. The cookie contains a characteristic string of characters that allows your browser to be uniquely identified when you return to the website. This helps us to personalise our offer, make it easier to use, more efficient and secure, and enable the provision of certain functions.

Under the "Cookie settings" button, you can specify which cookies you want to allow at any time. Necessary cookies, which ensure essential functions of the website, cannot be switched off.

There are basically four different categories of cookies:

1. ABSOLUTELY NECESSARY COOKIES

These cookies enable basic functions and are essential for the website to function properly. They are used, for example, to process orders or to enable you, as a registered user, to remain logged in at any time when you access various subpages of our website. In addition, thanks to these cookies, you do not have to re-enter your login details every time you access a new page.

The legal basis for the use of strictly necessary cookies on our website is the satisfaction of our legitimate interest in the technically flawless and simple provision of our website (Article 6 (1) (f) GDPR). The use of strictly necessary cookies is possible and legally permitted without your prior consent.

2. FUNCTIONAL COOKIES

These cookies allow us to store information that you have already entered (such as your registered name) and provide you with enhanced and more personalized features.

The data processing is carried out on the basis of your consent in accordance with Article 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future, the easiest way is through the Cookie Consent Manager.

You can also refuse the use of cookies by changing your browser settings to "Reject cookies" if, for example, you do not want your computer to be recognized on your next visit. Instructions on how to do this can be found in your browser's user manual.

With the appropriate browser settings, you will be informed about the installation of cookies and you can only allow cookies in individual cases or exclude the acceptance of cookies in certain cases or in general. It is also possible to activate the automatic deletion of cookies when you close your browser. If you refuse the use of certain cookies, the use of certain areas of our website may be restricted.

3. PERFORMANCE COOKIES

These cookies allow us to count visits and traffic sources so that we can measure and improve the performance of our website. The information collected by cookies allows us, among other things, to understand which pages are the most popular, which are the least used and how visitors move around our website. All data collected by these cookies is aggregated and cannot be easily attributed to you.

4. COOKIES AND MARKETING PIXELS

These cookies and similar technologies (e.g. pixels) allow us to show you personalized and therefore relevant advertising content and to measure the effectiveness of our advertising measures. Therefore, it is not possible to draw direct conclusions about an individual. These cookies are not only set on our website, but also on other (advertising) partner sites ("third-party cookies"). So-called "retargeting" is used to place relevant advertising on other websites and to analyze the relevant target groups for the products.

5. DETAILS OF THE COOKIES WE USE

5.1. NECESSARY COOKIES

5.1.1. GOOGLE RECAPTCHA

We use the reCAPTCHA service offered to persons in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

With the help of this service, we can distinguish whether the entry was made by a natural person or maliciously by machine and automated processing.

By using the service, your IP address and any other data required by Google for the reCAPTCHA service will be transmitted to Google.

This data is processed on the basis of our legitimate interest in exercising personal liability online and preventing misuse and spam (Article 6 (1) (f) GDPR). Storing information and accessing information on your end device is absolutely essential.

The data in question may be transferred to Google servers in the USA and stored there. The legal basis for this is the European Commission's adequacy decision of 10 July 2023 (so-called Data Protection Framework) in accordance with Article 45 of the GDPR.

More information about Google reCAPTCHA and Google's privacy policy can be found at: https://www.google.com/intl/es/policies/privacy/ .

5.1.2. ONE TRUST

We work with the service provider OneTrust, LLC, 1350 Spring St NW, Atlanta, GA 30309 ("OneTrust") to obtain and manage your consent. This is done by means of our "cookie banner", which appears on your first visit to our website or in our app and which informs you about the processing of data or, in particular, about cookies and other technologies on our website and allows you to refuse or accept the setting of individual cookies and other technologies. However, you can re-apply for the cookie banner and change your selection. In addition, a cookie banner will appear when you visit our website if you have deactivated cookie storage or if OneTrust has deleted cookies or they have expired.

In particular, your consents or revocations, your IP address, data about your browser and your end device at the time of your visit are transmitted to OneTrust and the data is stored on your end device.

The relevant legal basis is Article 6 (1) (f) GDPR, as we have a legitimate interest in complying with the legally required documentation on your cookie consents and the management of cookies.

The data in question can be transferred to OneTrust servers in the USA and stored there. The legal basis for this is the European Commission's adequacy decision of 10 July 2023 (so-called Data Protection Framework) in accordance with Article 45 of the GDPR.

5.2. FUNCTIONAL COOKIES

5.2.1. VIMEO PLUGINS

For video integration, we use, among other things, Vimeo LLC, 555 West 18th Street, New York 10011, USA ("Vimeo").

For this purpose, it uses so-called add-ons. When you access websites with such a plugin, a connection to the Vimeo servers is established and information about which of our websites you have visited is transmitted. If you are logged in to Vimeo, Vimeo assigns this data to your personal user account. When you use the plugin, for example by clicking on the button to start a video, this information is also assigned to your user account.

Relevant data may be transferred to Vimeo's servers in the USA and stored there. The legal basis for this is an adequacy decision of the European Commission of 10 July 2023 (so-called Data Protection Framework) in accordance with Article 45 of the GDPR

Further information on data processing and data protection notices by Vimeo can be found at https://vimeo.com/privacy.

5.2.2 ALLOGLIO

We use the service Algolia SAS, 55 Rue d'Amsterdam, 75008 Paris, France ("Algolia") to search and index the content on our website and in our app. To do this, your IP address and search queries are transmitted to the Algolia server.

Algolia also creates reports for us with corresponding evaluations and analyses of search queries.

In this sense, Algolia helps us to improve the searchability of our offers, as well as the search experience and the satisfaction of our customers.

More information can be found in Algolia's privacy policy: https:www.algolia.com/policies/privacy.

5.3. PERFORMANCE COOKIES

5.3.1. GOOGLE ANALYTICS WITH CONVERSION TRACKING

We use Google Analytics, a web analytics service provided by Google that, among other things, installs pixels and performance cookies to store data on your end device.

This allows us to assign data, sessions and cross-device interactions to a pseudonymous user ID and thus analyse your usage behaviour across devices and improve our website and make it more interesting for you. For this purpose, we also receive statistics from Google about your use of our website.

Google Analytics 4 also uses artificial intelligence to automatically analyze and enrich data. This is primarily used to make predictions about the future behavior of website visitors based on structured event data (e.g., sales forecast, purchase probability, and cancellation probability). These forecast values can also be used to predict target groups. More information at: https:support.google.com/analytics/answer/9846734?hl=es

Google Analytics 4 also models conversions if there isn't enough data available to optimize the data analysis. More information about this can be found at: https:support.google.com/analytics/answer/10710245?hl=es.

Google Analytics 4 does not record or store individual IP addresses. However, Google Analytics 4 provides approximate geolocation data by deriving the following metadata from IP addresses: city (and derived latitude and longitude of the city), continent, country, region, subcontinent (and ID-based duplicates). For traffic in the EU, IP address data is only used to obtain geolocation data before it is immediately deleted. It is not recorded, not available, and not used for any other purpose.

The data in question may be transferred to Google servers in the USA and stored there. The legal basis for this is an adequacy decision of the European Commission of 10 July 2023 (so-called Data Privacy Framework) in accordance with Article 45 of the GDPR. Due to the activation of IP anonymization on this website, your IP address will be shortened before transmission to the USA or EU member states or EEA contracting states. Only in exceptional cases will your full IP address be transferred to a Google server in the USA and abbreviated there. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

The legal basis for the processing of your data is your consent, Article 6 (1) sentence 1 (a) General Data Protection Regulation. This means that we do not use this service unless you have given your consent to use Google Analytics with conversion tracking. You can withdraw your consent at any time with effect for the future, most easily through our Cookie Consent Manager.

You can also prevent the collection of your data (including your IP address) and the processing of this data by Google by downloading and installing the browser add-on available at the following link: http:tools.google.com/dlpage/gaoptout?hl=es. An opt-out cookie will be set to prevent future collection of your information when you visit this website. The opt-out cookie is only valid in this browser and only for our website and is stored on your device. If you delete cookies from this browser, you will need to reinstall the opt-out cookie.

Further information on the processing of data by Google Analytics with conversion tracking can be found at: http:www.google.com/analytics/terms/es.html, http://www.google.com/intl/es/analytics/learn/privacy.html, http://www.google.es/intl/de/policies/privacy.

5.4. COOKIES AND MARKETING PIXELS

5.4.1. FACEBOOK CUSTOM AUDIENCE / META PIXEL

On our website, we use Facebook Custom Audiences with a so-called pixel function ("Meta Pixel") and a server-side conversion API, which is operated for visitors outside the USA and Canada by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Grand Canal Harbour, Dublin 2, Ireland ("Meta").

This allows us to show you interest-based advertising when you visit Facebook, Instagram or other Meta apps and websites, and to track the effectiveness of our advertising. Through the metapixels embedded in our website, your browser automatically establishes a connection to Meta's servers for enhanced synchronization of the embedded metapixel. This provides Meta with information, for example, that you have clicked on a particular ad or product on our website, which in turn allows us to show you interest-based ads on our website or on other websites.

If you are registered with the Meta Service, Meta may assign a visit to the website to your account, as we transmit your personal data in the form of an email and IP address to Meta in a hashed form via pixels and partially enriched with existing tracking data. The country you are in is also transmitted. Even if you are not registered with Facebook or Instagram or are not logged in, Meta may learn your personal information above and use it to create a profile.

The data in question may be transferred to Meta's servers in the USA and stored there. The legal basis for this is an adequacy decision of the European Commission of 10 July 2023 (so-called Data Privacy Framework) in accordance with Article 45 of the GDPR.

The legal basis for the processing of your data is your consent, Article 6 (1) sentence 1 (a) General Data Protection Regulation. This means that we do not use these services unless you have given your consent to the use of personalized audiences or the Facebook pixel. You can withdraw your consent at any time with effect for the future, in the simplest way through our consent manager. In addition, if you are logged into your Facebook account, you can also object to the processing of your data via the following link: https:www.facebook.com/adpreferences/ad_settings/?entry_product=account_settings_menu

Further information, in particular on our and Meta's joint responsibility and on the purpose and scope of data processing by Meta, as well as on the setting options for protecting your privacy, can be found in Meta's privacy policy: https:www.facebook.com/about/privacy/.

5.4.2. PINTEREST TAG

In order to further optimize our Pinterest campaigns and measure their success, we use the "Pinterest Tag" service of the social network, which is offered to visitors in the European Economic Area by Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest").

We use the "Pinterest tag" in combination with the server-side conversion API to show our Pinterest ads only to those Pinterest users who have shown interest in our offer. At the same time, this ensures that the content of our advertisements is very likely to correspond to the interests of the user concerned. We may also track the behavior of Pinterest users who click on one of our ads. To do this, Pinterest processes data collected by the Service through cookies, web beacons and comparable storage technologies on our websites.

When using the service, the following data is processed: device data (e.g. type, brand), operating system used (e.g. iOS 11), IP address of the device used, time of access to our offer, type and content of the campaign and reaction to the corresponding campaign (e.g. button click), as well as device identifiers consisting of the individual characteristics of your end device. We may also use these device identifiers to identify your device on the website. The data collected in this way is anonymized for us and does not allow conclusions to be drawn about your identity. If you log in to your Pinterest account after visiting our website, or if you visit our website while logged in, Pinterest may store and process this information, of which we would like to inform you. It is possible that Pinterest associates this information with your Pinterest account and uses it for its own advertising purposes.

The relevant data may be transferred to Pinterest's servers in the USA and stored there. The legal basis for this is an adequacy decision of the European Commission of 10 July 2023 (so-called Data Privacy Framework) in accordance with Article 45 of the GDPR.

You can find more information about the purpose and scope of data processing and your settings options to protect your privacy in Pinterest's privacy policy, which you can access via the following link: https:policy.pinterest.com/de/privacy-policy.

5.4.3. MICROSOFT BING ADS

On our website, we use Bing conversion tracking from Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft Bing Ads places a cookie on your computer if you have come to our website via Microsoft Bing ads. This allows us to recognize that you have clicked on an ad and that you have been redirected to our website. This helps us understand the effectiveness of a particular ad. However, we only receive information about the total number of users who clicked on a Bing ad and were redirected to our website. No information about the identity of the user is communicated.

The data in question may be transferred to Microsoft servers in the USA and stored there. The legal basis for this is an adequacy decision of the European Commission of 10 July 2023 (so-called Data Privacy Framework) in accordance with Article 45 of the GDPR.

Further information about the data processing and cookies used by Bing Ads can be found at: https:privacy.microsoft.com/es-es/privacystatement.

5.4.4. GOOGLE ADS (FORMERLY ADWORDS) AND CONVERSION TRACKING

We use Google Adwords and Google Conversion Tracking, which is provided to persons in the European Economic Area and Switzerland by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

This allows us to place Google Adwords ads, taking into account your interests and location.

When you click on a Google ad, a cookie is temporarily placed on your computer that allows us to recognize that you have clicked on the ad and that you have been redirected to this page.

With the help of conversion statistics created from this, we know the total number of people who clicked on your ad and were redirected to the page with the conversion tracking tag. However, we do not receive any personal information about users.

If you use a Google Account, Google may associate your web and app browsing history with your Google Account and use information from your Google Account to personalize ads based on the settings stored in your Google Account. If you do not want this association with your Google account, you should log out of Google before visiting our website. You can also prevent the installation of appropriate cookies by changing the settings in your browser software or on Google's website.

More information about Google Ads and conversion tracking, as well as Google's privacy policy, can be found at: https:www.google.com/privacy/ads and https://policies.google.com/privacy.

5.4.5. GOOGLE DYNAMIC REMARKETING

We also use the remarketing function of Google Ads. This service is used to display interest-based ads on other websites after you have visited our website. The ads are based on the products and services you clicked on during your last visit to our website. To do this, Google sets cookies that are temporarily stored in your browser. The data obtained is not used to identify a person. Google only stores data such as your web query, IP address, browser type, browser language, date and time of your query.

You can find more information about Google dynamic retargeting and Google's privacy policy at: https:www.google.com/privacy/ads and https://policies.google.com/privacy.

5.4.6. GOOGLE AD MANAGER (FORMERLY DOUBLECLICK)

We also use Google Ad Manager (formerly Doubleclick). This service uses cookies, pixels, and other technologies to serve ads based on your interests and your past visits to our website or other websites. It also allows us to track the success of our advertising campaigns. Google also processes data to optimize its own products and services.

If you use a Google Account, Google may associate your web and app browsing history with your Google Account and use the information in your Google Account to personalize ads based on the settings stored in your Google Account. If you do not want this association with your Google account, you must log out of Google before visiting our website. You can also prevent the installation of appropriate cookies by changing the settings in your browser software or on Google's website.

You can find more information about Google Ad Manager and Google's privacy policy at: https:www.google.com/privacy/ads and https://policies.google.com/privacy.

5.4.7. YOUTUBE IN EXTENDED DATA PROTECTION MODE

We use the service provider YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA ("YouTube"), among others, to embed videos on our website. When you visit our website with embedded YouTube videos, your browser establishes a direct connection to YouTube's servers to show you the content. The content you access can be recorded by your browser. If you are logged into your YouTube account, YouTube may assign your usage behavior to your personal profile. You can prevent this by logging out of your YouTube account before visiting our website.

The relevant data may be transferred to YouTube servers in the USA and stored there. The legal basis for this is an adequacy decision of the European Commission of 10 July 2023 (so-called Data Protection Framework) in accordance with Article 45 of the GDPR

Further information on data processing by YouTube can be found in YouTube's privacy policy at: https:policies.google.com/privacy?hl=es&gl=es.

5.4.8. SEGMENT

We also use a segment service provided by Segment Inc, 101 15th St San Francisco, CA 94103, USA ("Segment").

The segment collects and stores information about you from which usage profiles can be created using pseudonyms. These usage profiles are used to analyse your usage behaviour and are evaluated in order to improve our offering to you. Cookies may be used for this purpose, which allow us to recognize you when you visit our website again. Pseudonymised user profiles are not merged with the personal data of the holder of the pseudonym.

The relevant data may be transferred to Segment's servers in the USA and stored there. The legal basis for this is the European Commission's adequacy decision of 10 July 2023 (so-called Data Protection Framework) in accordance with Article 45 of the GDPR.

Further information can be found in Segment's Privacy Policy: https:segment.com/docs/legal/privacy/.

5.4.9. HOTJAR

We use the Hotjar web analytics service provided by Hotjahr Limited, Dragonara Road, Paceville St. Julian's STJ 3141, Malta ("Hotjar").

Hotjar uses cookies and other technologies to analyze and evaluate your user behavior and interactions with our website. This helps us optimize your user experience on our website by providing us with a better understanding of our users' experiences on our website (e.g., clicks, scrolling, mouse movements).

Your IP address is truncated before the usage statistics are analysed, so that no direct conclusions can be drawn about your identity.

More information can be found in the "about Hotjar" section of the https://help.hotjar.com/hc/es/sections/115003204947.

5.4.10. BRAZE

We use the web analytics service Braze, Inc., 318 West 39th Street, 5th Floor, New York, New York 10018, USA, ("Braze") to communicate with you on our website and understand how our mobile content works and is used on your device. For example, we display pop-ups with the interaction option. Braze is also used to send push notifications in our app. We also use Braze to send you personalized promotions and information about our products. We also use Braze to notify you of items that you have forgotten in your cart.

The data in question may be transferred to Braze's servers in the USA and stored there. The legal basis for this is the European Commission's adequacy decision of 10 July 2023 (so-called Data Protection Framework) in accordance with Article 45 of the GDPR or

More information on Braze's data protection compliance can be found here: https:www.braze.com/privacy/.

5.4.11. CRITERIA

We also use the remarketing tool of Criteo, SA, 32 Rue Blanche, 75009 Paris, France, on our website and in our app to show you personalized ads on partner websites and in product apps that interest you based on the products you have clicked on on our website or in our app. To do this, Criteo links the above data about your past browsing behavior to a unique identifier, such as an ID cookie or other similar technology (e.g. mobile advertising ID and non-cookie-based technologies).

Criteo and Westwing act as joint controllers within the meaning of Article 26 of the GDPR.

The legal basis under data protection law is your consent in accordance with Article 6 (1) (a) General Data Protection Regulation. You can revoke this consent at any time with effect for the future - the easiest way is through our Cookie Consent Manager or at the following link https://www.criteo.com/es/privacy/disable-criteo-services-on-internet-browsers/ - withdraw your consent.

If Criteo transfers personal data to countries outside the EU or outside the EEA, Criteo will do so on the basis of an adequacy decision by the European Commission in accordance with Article 45 of the GDPR or on the basis of appropriate data protection safeguards in accordance with Article 46 of the GDPR, for example by concluding EU Standard Contractual Clauses. Your data will be deleted as soon as it is no longer required for the stated purposes of processing.

More information about the processing of your data by Crite can be found here: http:www.criteo.com/es/privacy.

5.4.12. KLEAR

We use the influencer marketing service Klear from Meltwater Deutschland GmbH, Jannowitz Centre, Brückenstrasse 6, 10179 Berlin. This allows us to set up influencer marketing programs and measure and analyze influencer campaigns. Klear uses cookies to track the success of campaigns on our website. These analyses help us, among other things, to search for social media influencers by region, language, sector, hashtag and previous collaborations, and to make data-driven decisions about our influencer marketing strategy.

Further information on data protection compliance can be found here: https:klear.com/legal/cookies; https://klear.com/legal/privacy-notice-for-influencers.

5.4.13. GOOGLE CUSTOMER MATCH

We also use Google's Google Customer Match service, which allows us to display interest-based ads to visitors to our website based on their previous browsing behavior on our website and on third-party websites, apps, and emails.

The legal basis for the processing of your data is your consent, Article 6 (1) sentence 1 (a) General Data Protection Regulation. This means that we will not use this service unless you have consented to its use. You can withdraw your consent at any time with effect for the future, most easily through our Cookie Consent Manager. If you don't want to receive interest-based ads from Google Customer Match, you can also opt out of the following sites: http:www.networkadvertising.org/choices/; http://www.youronlinechoices.com/

You can find more information about Google's data protection compliance here: https://support.google.com/google-ads/answer/6334160?sjid=2821624592503930728-EU

5.4.14. MAJOR FORENSICS

This website also uses Lead Forensics, a B2B sales and marketing tool from Lead Forensics, headquartered in the UK, Communication House, 26 York Street, London, W1U 6PZ, United Kingdom.

Lead Forensics uses a tracking code to identify companies that visit our websites based on their commercial IP addresses. These are not cookies. The Lead Forensics tracking code provides only publicly available information. It cannot and will not provide any personal or sensitive information about who has visited our website. The data will not be used to personally identify an individual visitor under any circumstances. If IP addresses are collected, they are anonymized immediately after storage.

Lead Forensics does not provide us with IP addresses. It only provides us with information about which companies have visited our website, the date and duration of the visit, and the websites they have visited. This information allows us to analyze the use of our website and possibly contact these companies.

The information generated by the Lead Forensics tracking code is transmitted to Lead Forensics' servers in the United Kingdom, where it is processed and stored. The legal basis for this is the European Commission's adequacy decision of 28 June 2021 in relation to transfers to the United Kingdom, in accordance with Article 45 of the GDPR.

The legal basis for the processing of your data is your consent, Article 6(1)(a) of the GDPR. This means that we will not use this service unless you have consented to its use. You can withdraw your consent at any time with effect for the future, most easily through our Cookie Consent Manager. To unsubscribe from tracking, you can also use the following link: https:optout.leadforensics.com/?clientID=786109

5.4.15. TiKTOK ADS

We use the TikTok Ads service provided by TikTok Inc, 10100 Venice Blvd, Culver City, CA 90232, USA ("TikTok"), which allows us to display interest-based ads to visitors to our website based on their previous browsing behavior on our website and on third-party websites, apps and emails.

When you visit our website, a connection to TikTok's servers is established by installing pixels and data such as your IP address, pages visited and interactions can be recorded.

The corresponding data can also be transferred to TikTok servers in the USA and stored there. The legal basis for this is the European Commission's adequacy decision of 10 July 2023 (so-called Data Protection Framework) in accordance with Article 45 of the GDPR.

You can find more information about TikTok's data protection compliance here: https:ads.tiktok.com/help/article/app-retargeting?lang=es or here: https:www.tiktok.com/legal/page/eea/privacy-policy/es.

XI. TECHNICAL AND ORGANISATIONAL MEASURES FOR DATA SECURITY

We have taken technical and organizational security measures and measures to protect your personal information from loss, destruction, manipulation, and unauthorized access by third parties, and to ensure an adequate level of protection and protect your personal rights.

In particular, we encrypt personal data, including sensitive content such as your contact queries, before transmitting it. All our employees, as well as service providers and processors working for us, are obliged to comply with applicable regulations and data protection laws.

We regularly check whether our security measures are adequate and state-of-the-art.

XII. YOUR RIGHTS AS A DATA SUBJECT

In accordance with the statutory provisions on data protection, you have the following rights in relation to your personal data at any time:

1. RIGHT OF ACCESS

You have the right to request and receive information about the data we process about you: the purposes of the processing, the categories of personal data, the recipients or categories of data recipients to whom the personal data have been or will be disclosed, the envisaged data retention periods or the criteria for determining the relevant periods, the rights relating to the protection of the data you have, the existence of automated decision-making, including profiling (if applicable); information on appropriate safeguards for the transfer of data to third countries. You also have the right to obtain a copy of this information.

2. RIGHT TO RECTIFICATION

You have the right to request the rectification of inaccurate data and, taking into account the purposes of the processing, the completion of incomplete data.

3. RIGHT TO ERASURE ("RIGHT TO BE FORGOTTEN")

You have the right to request the deletion of your data for the following reasons:

The storage of the data is no longer necessary for the purposes for which it was collected or otherwise processed,
withdraw the consent on which the processing was based and there is no other legal basis for the processing,
You object to the processing and there are no compelling legitimate grounds for the processing,
that the personal data in question have been unlawfully processed,
or the erasure of personal data is necessary for compliance with a legal obligation under Union or Member State law.

Please note that there may be reasons that prevent immediate deletion, e.g. in the case of legal retention obligations. Regardless of the exercise of your right to erasure, we will delete your data immediately and completely, provided that the storage is no longer necessary for the respective purpose of the processing and that there are no statutory or statutory retention obligations to the contrary.

4. RIGHT TO RESTRICTION OF PROCESSING

You have the right to request the restriction of the processing of your data, provided that

you contest the accuracy of your personal data, for a period that allows us to verify the accuracy of your personal data,
the processing is unlawful and you object to the erasure of your personal data and instead request the restriction of the use of your personal data;
we no longer need the personal data for the purpose of processing, but you need it for the establishment, exercise or defence of rights in legal proceedings, or
you have objected to the processing in accordance with Article 21 (1) of the GDPR until it has been verified whether our legitimate reasons are stronger than yours.

5. RIGHT TO DATA PORTABILITY

If the legal requirements are met, you have the right to receive the data provided in a structured, commonly used and machine-readable format and to transmit this data to another data controller or, if technically feasible, to request its transfer by Westwing.

6. RIGHT TO LODGE A COMPLAINT WITH THE COMPETENT DATA PROTECTION AUTHORITY

You also have the right to lodge a complaint with the competent data protection supervisory authority. To confirm this right, please contact:

Personal Data Protection Agency

Ulica grada Vukovara 54

HR – 10 000 Zagreb

E-pošta: azop@azop.hr

Tel.: 00385 (0)1 4609-000

Fax: 00385 (0)1 4609-099

Website: www.azop.hr

7. RIGHT TO OBJECT

If the processing of personal data is based on our legitimate interest in accordance with Article 6 (1) sentence f) GDPR, you also have the right to object to the processing of your personal data on the basis of your particular situation, e.g. by e-mail to: service@westwing.hr. In this case, we will no longer process personal data for these purposes, unless our legitimate interest prevails in individual cases.

8. RIGHT TO WITHDRAW CONSENT

If the processing of your personal data is based on your consent in accordance with Article 6 (1) (a) of the GDPR, you have the right to withdraw your consent at any time with effect for the future, e.g. by sending an email to: service@westwing.hr.

If you wish to exercise any of these rights against us, please contact our Data Protection Officer by email at: anfrage@projekt29.de.

XIII. CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this privacy policy if necessary, for example, due to the use of new technologies.

If fundamental changes are made to this privacy policy, we will post them on our website. We will also check whether there is an obligation to provide further notice in the event of changes to this privacy policy in individual cases and, if necessary, we will comply with this obligation accordingly.

Status: April 2025