Privacy Policy
1. Controller
The controller responsible for processing personal data on this website is: gum and fun süd GmbH & Co. KG Industriestraße 5 95502 Himmelkron Germany Phone: +49 9227 940886 Email: shop@gumandfun.info Authorised representative: gum-and-fun süd Verwaltungs-GmbH, represented by Managing Director Alexander Höfner.
2. General Information on Data Processing
We process personal data exclusively to the extent necessary for the provision of this online shop, for the establishment, execution or termination of contractual relationships, and for compliance with legal obligations. Processing is only carried out on the basis of legal permission – particularly Article 6 (1) (a), (b), (c) and (f) GDPR – or your consent. Our offering is exclusively aimed at businesses (B2B). Nevertheless, we process personal data, for example, from contact persons and employees of our customers.
3. Hosting and Storage Location
This shop operates on the Lovable Cloud platform. The database and application data are stored with Supabase on Amazon Web Services (AWS) servers in the eu-west-1 region (Ireland). Therefore, processing takes place entirely within the European Union. Data processing agreements in accordance with Article 28 GDPR are in place with the service providers used. These service providers process data exclusively according to our instructions and not for their own purposes.
4. Access Data and Server Log Files
When you visit the pages, the hosting service provider automatically processes technical access data: IP address, date and time of access, requested URL, amount of data transferred, browser type, and operating system. This processing is technically necessary to deliver the website, ensure system security, and analyse errors (Article 6 (1) (f) GDPR). Log data is only stored temporarily by the hosting service provider; we do not analyse it, store it permanently, or combine it with other data.
5. Order Processing and Contract Fulfilment
When placing an order or making an enquiry, we process your company name, contact person, billing and shipping address, email address, telephone number, and order and payment details. The legal basis is the performance of a contract and the implementation of pre-contractual measures (Article 6 (1) (b) GDPR). We use this data for order confirmation, delivery, invoicing, picking, shipping processing, and, if applicable, for processing returns and credit notes.
6. Customer Account
If we set up a customer account for you, we store your orders, invoices, delivery notes, and payment statuses so that you can view them at any time. The legal basis is Article 6 (1) (b) GDPR. Upon request, we will delete the customer account, provided there are no legal retention obligations preventing this.
7. Payment Processing
Depending on the chosen payment method, we pass on the data required for payment processing to the respective payment service providers: – Bank Transfer (Vorkasse / Überweisung) and Purchase on Account: Processed via our main bank; no data is transmitted to external payment service providers. – SEPA Direct Debit: Transmission of bank details (IBAN) to the credit institution, provided the direct debit is authorised. – Credit Card and other payment methods via Stripe: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes payment data as an independent controller within the scope of its privacy policy. – PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. PayPal processes payment data as an independent controller. We only receive payment confirmations or rejections and technical transaction identifiers from payment service providers. The legal basis is Article 6 (1) (b) GDPR.
8. Email Communication
We send order confirmations, invoices, delivery notes, and enquiries by email via our email service provider. The legal basis is Article 6 (1) (b) GDPR. Your email address will only be used for promotional purposes with your consent or within the legally permissible framework for existing customers (§ 7 Abs. 3 UWG); you can object to promotional use at any time.
9. Cookies and Local Storage
The shop exclusively uses technically necessary storage mechanisms (e.g., for the shopping cart and session). No tracking, analytics, or marketing cookies are set. The legal basis is § 25 (2) TDDDG.
10. Recipients and Processors
We only share personal data to the extent necessary for contract fulfilment: – Shipping and forwarding service providers for delivery, – Payment service providers and banks for payment processing, – Our tax advisor and accounting service providers within the legal framework, – Hosting, platform, and email service providers as processors according to Article 28 GDPR. No further transfer or sale of data takes place.
11. Transfer to Third Countries
We do not transfer personal data to countries outside the European Union or the European Economic Area. Hosting and the database are located within the EU (Ireland).
12. Storage Duration
We store personal data only for as long as necessary for the respective purposes. Contract, order, and invoice data are subject to legal retention periods under commercial and tax law (§ 147 AO, § 257 HGB) and are retained for up to ten years. Enquiries without a contract conclusion are deleted as soon as communication is complete and no retention obligations exist.
13. Data Security
The transmission between your browser and our shop is protected by TLS encryption. We secure our systems with technical and organisational measures against loss, destruction, unauthorised access, and alteration.
14. Your Rights
You have the following rights regarding your personal data: – Right to information (Article 15 GDPR), – Right to rectification (Article 16 GDPR), – Right to erasure (Article 17 GDPR), – Right to restriction of processing (Article 18 GDPR), – Right to data portability (Article 20 GDPR), – Right to object to processing (Article 21 GDPR), – Right to withdraw consent with future effect (Article 7 (3) GDPR). To exercise your rights, a simple message to shop@gumandfun.info or +49 9227 940886 is sufficient.
15. Right to Complain to the Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is, in particular: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Promenade 18 91522 Ansbach Germany https://www.lda.bayern.de
16. Current Status of this Privacy Policy
This privacy policy is valid as of 30.08.2026. We will update it as soon as changes to the shop, the service providers used, or the legal situation require it. The version available on this page at any given time applies.