1. Data protection at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit this website or place an order in our shop. Personal data is any data that can be used to identify you personally. Detailed information can be found in the privacy policy below.
Data collection on this website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find the operator’s contact details in the section “Information about the controller” in this privacy policy.
How do we collect your data?
Some of your data is collected when you provide it to us — e. g. data that you enter when placing an order, in your customer account, in the contact form or when subscribing to the newsletter. Other data is collected automatically or with your consent by our IT systems when you visit the website (primarily technical data such as your browser, operating system or the time at which the page was accessed).
What do we use your data for?
Some of the data is collected to ensure that the website is provided without errors and that your orders are processed. Other data may — insofar as you have given your consent — be used to analyse your user behaviour and for advertising.
What rights do you have regarding your data?
You have the right of access at any time, free of charge, to information about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data, to withdraw consent that you have given at any time and, under certain circumstances, to request restriction of processing. You also have the right to lodge a complaint with the competent supervisory authority. You may contact us at any time regarding this or any other questions.
2. Information about the controller
The controller responsible for data processing on this website is:
Michael Ludwigs Agentur
Ludenbergerstr. 11
40629 Düsseldorf
Email: [email protected]
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
3. Hosting and delivery
This website is hosted by an external service provider. The personal data collected on this website is processed on the host’s servers. This may primarily include IP addresses, contact enquiries, metadata and communication data, contract data, contact details, names, website access data and other data generated via a website. Hosting is carried out for the purpose of fulfilling contracts with our customers (Art. 6(1)(b) GDPR) and in the interest of providing our online offering securely, quickly and efficiently (Art. 6(1)(f) GDPR). We have concluded a data processing agreement (DPA) with our host.
We also use network and security services (content delivery network and bot protection) to secure and deliver the website quickly. Connection data (in particular IP addresses) is processed to prevent attacks and automated misuse. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stability and security).
4. General information and mandatory information
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data as confidential and in accordance with statutory data protection regulations and this privacy policy.
Retention period
Unless a more specific retention period has been specified in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you assert a legitimate request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing it (e. g. retention periods under tax or commercial law); in the latter case, the data will be erased once these grounds no longer apply.
Legal bases
Where you have given your consent, we process your data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR; in the event that information on your terminal device is accessed, the processing is additionally based on Section 25(1) TDDDG. Consent may be withdrawn at any time. To perform a contract, we process your data on the basis of Art. 6(1)(b) GDPR, to comply with legal obligations on the basis of Art. 6(1)(c) GDPR and on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR.
Data transfers to the USA and other third countries
Among other things, we use tools provided by companies based in the USA or in other third countries that are not considered secure under data protection law. When these tools are active, your personal data may be transferred to and processed in those countries. We would like to point out that a level of data protection comparable to that in the EU cannot be guaranteed in these countries. Insofar as the respective providers are certified under the EU-US Data Privacy Framework or EU Commission standard contractual clauses are in place, we rely on these safeguards for the transfer; details can be found in the sections concerning the individual services.
Withdrawal of your consent to data processing
Many data processing operations are possible only with your express consent. You may withdraw consent that you have already given at any time — for example, via this website’s cookie settings. The lawfulness of data processing carried out prior to the withdrawal remains unaffected by the withdrawal.
Right to object (Art. 21 GDPR)
IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA. IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING FOR THIS PURPOSE; THIS ALSO APPLIES TO ANY PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT MARKETING.
Right to lodge a complaint with the competent supervisory authority
In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).
Right to data portability
You have the right to have data that we process by automated means on the basis of your consent or in performance of a contract provided to you or to a third party in a commonly used, machine-readable format.
Right of access, rectification and erasure
Within the framework of the applicable statutory provisions, you have the right of access at any time, free of charge, to your stored personal data, its origin and recipients and the purpose of the data processing, as well as, where applicable, a right to rectification or erasure of this data.
Right to restriction of processing
You have the right to request restriction of the processing of your personal data if the statutory requirements for this are met.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the “https://” in your browser’s address bar and by the padlock symbol.
5. Data collection on this website
Cookies and consent management (CookieYes)
Our websites use cookies and comparable technologies. Technically necessary cookies (e. g. for the shopping cart) are set on the basis of Section 25(2) TDDDG and Art. 6(1)(f) or (b) GDPR; all other cookies are set only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
We use the consent manager CookieYes to obtain and manage your consent. CookieYes stores your consent choices so that they can be taken into account during subsequent visits and documented. You can change or withdraw your choices at any time using the cookie icon on the website.
Server log files
The provider of the pages automatically collects and stores information in server log files, which your browser automatically transmits to us (browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, IP address). This data is not combined with other data sources. The data is collected on the basis of Art. 6(1)(f) GDPR (technically error-free display and optimisation of the website).
Contact form and withdrawal form
If you send us enquiries using the contact form (or the online withdrawal form), the information you provide in the form, including the contact details you enter there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. Processing is carried out on the basis of Art. 6(1)(b) GDPR insofar as your enquiry is related to a contract, and otherwise on the basis of our legitimate interest (Art. 6(1)(f) GDPR) or your consent.
Enquiry by email
If you contact us by email, your enquiry, including all personal data arising from it, will be stored and processed by us for the purpose of dealing with your request; the legal bases are the same as for the contact form.
Google reCAPTCHA
We use “Google reCAPTCHA” on this website to verify whether data entered into our forms is entered by a human or by an automated program. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For this purpose, reCAPTCHA analyses the behaviour of the website visitor on the basis of various characteristics (e. g. IP address, time spent on the site, mouse movements). The analyses run in the background; the legal basis is Art. 6(1)(f) GDPR (protection against abusive data harvesting and spam) or your consent. Google is certified under the EU-US Data Privacy Framework.
Wordfence (website security)
We use the security plugin Wordfence to protect this website from attacks and unauthorised access. The provider is Defiant Inc., 800 5th Ave., Ste. 4100, Seattle, WA 98104, USA. For this purpose, Wordfence processes IP addresses and access data in particular in order to detect and block malicious access. The legal basis is Art. 6(1)(f) GDPR (protection of the website). The transfer to the USA is based on the provider’s certification under the EU-US Data Privacy Framework or on standard contractual clauses.
6. Analytics tools and advertising
Google Tag Manager
We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tool that allows us to integrate tracking or statistics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies or carry out independent analyses. It is used on the basis of Art. 6(1)(f) GDPR or — insofar as terminal devices are accessed — your consent.
Google Analytics 4
This website uses — only with your consent via the cookie banner — functions of the Google Analytics 4 web analytics service. The provider is Google Ireland Limited. Google Analytics enables us to analyse the behaviour of website visitors (e. g. pages accessed, time spent on the site, devices used, origin of visitors and e-commerce events such as shopping cart activity and purchases). With Google Analytics 4, IP addresses are shortened by default before being processed and are not stored. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); we also use Google Consent Mode so that no analytics data is transmitted without consent. Data transfers to the USA are based on the EU-US Data Privacy Framework. You can withdraw your consent at any time via the cookie settings.
Microsoft Clarity
With your consent via the cookie banner (category “Analytics”), we use Microsoft Clarity, which is integrated via Google Tag Manager. The provider for our shop is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland.
Clarity shows us how our website is used – for example where people click, how far they scroll and where something does not work as intended – in the form of heatmaps and session recordings. We use this to improve our shop.
Clarity records mouse movements, clicks, scrolling and the pages visited, as well as technical information about your device and browser (e. g. screen size, browser type, approximate location derived from your IP address) and identifiers that link the page views of a session. Page text and anything you type into form fields is made unrecognisable before it is transmitted. The shopping cart, checkout, customer account and order confirmation pages are not recorded.
Clarity is only loaded after you have consented; only then are Clarity cookies set. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future via the cookie icon; the lawfulness of the processing carried out until the withdrawal remains unaffected. From the next page view onwards, Clarity is then no longer loaded. Clarity is not linked to any advertising account.
Microsoft keeps session recordings for 30 days; recordings we mark, a random sample of recordings and click and heatmap data for up to 9 months. Microsoft also processes the data for its own purposes (e. g. to improve and secure its services) under its own responsibility. The data may also be processed by Microsoft Corporation in the USA; Microsoft is certified under the EU-US Data Privacy Framework, and Microsoft Ireland and Microsoft Corporation have also concluded EU standard contractual clauses. More information: privacy.microsoft.com/privacystatement and learn.microsoft.com/clarity/faq.
Google Ads conversion tracking
We use — only with your consent — Google Ads conversion tracking to measure the success of our advertisements. The provider is Google Ireland Limited. If you reach our website via a Google ad and complete a purchase, this is recorded in order to evaluate ad performance. The legal basis is Art. 6(1)(a) GDPR; transfers to the USA are based on the EU-US Data Privacy Framework.
Order attribution (WooCommerce)
When an order is placed, our shop system records the source of the visit (e. g. search engine, direct access or referring website) in order to understand the channels through which our customers find us. This information is assigned to the order and evaluated exclusively for internal purposes. The legal basis is Art. 6(1)(f) GDPR (analysis and improvement of our offering).
7. Newsletter
Newsletter data and delivery via Mailchimp
If you subscribe to our newsletter, we require an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you agree to receive the newsletter (double opt-in). The newsletter is sent via Mailchimp, a service of Intuit Inc., 2700 Coast Ave, Mountain View, CA 94043, USA. Your data stored for the purpose of receiving the newsletter is processed on Mailchimp’s servers in the USA; the transfer is based on the EU-US Data Privacy Framework. Mailchimp can be used to evaluate whether newsletters are opened and links are clicked. The legal basis is your consent (Art. 6(1)(a) GDPR); you can unsubscribe from the newsletter at any time using the unsubscribe link.
Reminder of incomplete orders
If you have provided your email address during the ordering process and have given your consent, we may send you a reminder about items remaining in your shopping cart. The legal basis is your consent (Art. 6(1)(a) GDPR); consent may be withdrawn at any time.
8. Plugins and embedded content
YouTube
Videos from the provider YouTube are embedded on this website. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you play a video, a connection to YouTube’s servers is established; cookies may be set and usage data processed in the process. If you are logged into your YouTube account, you enable YouTube to associate your browsing behaviour directly with your personal profile. The legal basis is your consent or our legitimate interest in presenting our content in an appealing manner (Art. 6(1)(a)/(f) GDPR).
Google reviews (Trustindex)
We display reviews from our Google Business Profile on our website using a widget provided by Trustindex.io. When the widget loads, connection data is transferred to the provider’s servers. The legal basis is our legitimate interest in displaying authentic customer reviews (Art. 6(1)(f) GDPR) or your consent, insofar as the consent manager controls the widget accordingly.
Jetpack
The Jetpack plugin provided by Automattic Inc.,
60 29th Street #343, San Francisco, CA 94110, USA, is active on this website. Jetpack provides
functions for statistics, security and image delivery.
In the process, connection data — in particular your IP address, pages accessed
and information about your browser — may be transferred to Automattic servers, including those in the
USA, and processed there. The legal basis is our
legitimate interest in a secure and quickly delivered
website (Art. 6(1)(f) GDPR); insofar as
consent is requested, processing is carried out on the basis of
Art. 6(1)(a) GDPR. Automattic is certified under the
EU-US Data Privacy Framework.
Shopping cart functions
We use the FunnelKit Cart plugin to display and manage the shopping cart.
It processes the contents of your shopping cart on our
own server and stores a cookie in your browser for this purpose. No
data is transferred to third parties in the process. The legal basis is
Art. 6(1)(b) GDPR.
9. E-commerce, payment and shipping service providers
Processing of customer and contract data
We collect, process and use personal customer data (e. g. name, address, email address, order data) to establish, define and execute our contractual relationships (Art. 6(1)(b) GDPR). If you create a customer account, we store your data until you delete the account; statutory retention periods remain unaffected.
Disclosure to shipping service providers
To deliver your order, we pass on your name, delivery address and — insofar as required for delivery — your email address or telephone number to the shipping company commissioned with the delivery: DHL within Germany, and UPS or FedEx internationally. We create shipping orders and shipping labels via the service shipcloud (shipcloud GmbH, Hamburg), which acts as a processor for us and transfers the data to the respective carrier. The legal basis is Art. 6(1)(b) GDPR.
Payment services
We integrate payment services from third-party companies into our website. If you make a purchase from us, your payment data will be processed by the respective payment service provider for the purpose of processing the payment. The respective providers’ contractual terms and privacy policies also apply. The services are used on the basis of Art. 6(1)(b) GDPR (performance of a contract).
PayPal: The provider is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
Stripe (credit and debit card, Bancontact, Link): The provider for customers within the EU is Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Details: Stripe privacy policy.
Bank transfer: If you pay in advance/by bank transfer, we process your payment data exclusively for the purpose of processing the payment.
Michael45 is operated by:
Michael Ludwigs Agentur, sole proprietor Michael Ludwigs
Street: Ludenbergerstr. 11
City: Düsseldorf
State/Region: North Rhine-Westphalia
Country: Germany
Zip Code: 40629
VAT ID: DE234270742
Email: [email protected]
Phone: +49 171 6556088
