Privacy policy

1. Controller

For questions about how we process your personal data, contact us at the email address above.

2. Account and orders

You can order as a guest without an account. We use your email address to process your order, not to sign you up for advertising. Personal, time-limited access links let you see your own order and released documents. We create an account only if you expressly request one and activate it after you confirm your email address.

We keep incomplete guest forms for 24 hours so you can continue. During daily cleanup after a further 24-hour waiting period, we remove temporary contact details and any prepared password. Unresolved payments and pending order confirmations are exceptions. Actual order and receipt data are retained as required by law. Access links are valid for seven days, can be used once, and are stored only as hashes. An order view opened through a link remains available for one hour.

To set up an account and process an order, we process your contact details, billing and delivery address, and order and payment information. Passwords are stored as non-reversible hashes. Article 6(1)(b) GDPR is the legal basis for preparing and fulfilling the contract. Where statutory retention applies, the basis is Article 6(1)(c) GDPR. Deleting an account does not remove records that must be kept by law.

3. Technical operation and security

The shop uses essential session cookies for sign-in, the basket and protection from unauthorised requests. Technical logs and limits on sign-in attempts protect the service from misuse. The platform is hosted by Hetzner Online GmbH in Germany. Hetzner processes the technical data needed for hosting, connections and backups as our processor.

4. Shipping and payment

Carriers receive the recipient and address data needed for delivery. DHL handles consumer deliveries within Germany and to the available EU destinations.

For consumers, we use PayPal to process payments. PayPal's payment choices load on the checkout page, so PayPal may receive technical connection data such as your IP address and browser details. We send the order number, amount and currency to PayPal and receive payment and transaction status. The legal basis is Article 6(1)(b) GDPR. See PayPal's privacy statement for its processing and possible transfers outside the European Economic Area.

5. Contact, reviews and marketing

We process messages to customer service to handle your enquiry.

Product reviews

You can review a product with or without an account. We do not verify purchases, so these are not verified-buyer reviews. A comment is optional. The public sees your paw rating, date and any text you write, not your contact details. Positive and negative experiences are welcome. We may remove unlawful content, personal data or spam; a negative rating alone is not a reason to remove it. Internal test ratings do not count towards the public rating.

If you review without an account, we store a random identifier in the essential kaumaster_product_reviewer cookie for 90 days. It is used only to find and change your review, not for ads or analytics. With an account, we associate the review with your account. We process this data to provide the feature and prevent misuse under Article 6(1)(f) GDPR. You can withdraw a review using “Withdraw review” or contact us. Do not publish private contact or payment details.

We send newsletters only after separate consent and confirmation. You can withdraw that consent at any time. An account does not require you to subscribe.

Welcome discount

After breaking the bone, you can request a personal welcome discount. The code becomes active after you enter your email address and is sent by email. We store the address, language, request source and time, code, expiry, delivery attempts and any redemption with its order. Validity starts with the request and does not restart when you reopen it. Your shop session may select the code for your basket. Requesting a discount does not subscribe you to our newsletter. The unsubscribe link stops future offer messages to this address. Existing codes keep their conditions. Our private contact list matches addresses with current customer accounts; registration does not change newsletter consent. You may request deletion of unused discount data through our contact address. Statutory retention applies to order records.

Newsletter signup is optional and separate from the discount request. Guests can subscribe without an account. We store the email address, language, signup source, request time, confirmation status and confirmation delivery history. The address becomes eligible for newsletters only after you confirm the emailed link. Every newsletter includes an unsubscribe link. Opting out stops future newsletters but does not stop order and invoice messages. These emails contain no open-tracking pixels.

Basket reminders

Registered customers with a confirmed email address may receive reminders about a saved basket after roughly 3 and 24 hours without an order, then once a week. For this, we process the email address, basket items, last change time, sending status, visits through the basket link and any later associated order. We do not use open-tracking pixels. Guest contacts and merely viewed products do not trigger these reminders.

You can unsubscribe from basket reminders in your account or through the link in each reminder. Order and invoice emails are unaffected. Weekly reminders continue while the basket is filled. An order, an empty basket or an unsubscribe ends the reminders. We remove item copies from completed reminders after 90 days. The association needed to honour an unsubscribe remains so the unsubscribe link continues to work.

The website and shop on this domain share one privacy choice. Statistics (Google Analytics), usage analysis (Microsoft Clarity) and ad measurement (Google Ads) are separate and off by default. “Essential only” rejects all optional purposes. The choice, date and version are stored locally for 180 days under kaumaster.cookie-consent.v6. An essential kaumaster_consent_denied cookie can prevent stale consent from taking effect if browser storage fails.

With separate consent for usage analysis, Microsoft Clarity measures catalogue, product, basket and checkout visits, and product views, basket changes, checkout steps and confirmed PayPal purchases as events without personal details. Contact and address areas, forms and payment content are masked. Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, processes interactions, device and connection data and pseudonymous identifiers. Clarity records page visits using _clck and _clsk cookies. We do not grant it advertising consent. It is not loaded before consent, even in a cookieless mode. Account, order documents, sign-in and admin pages are excluded.

With statistics consent, Google Analytics 4 measures page visits, product and basket views, basket changes, checkout steps and confirmed PayPal purchases. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We send pseudonymous identifiers, device and connection data, products, pack sizes, quantities, product values excluding VAT and shipping, payment method as a category, separate tax and shipping values, and an order ID to prevent duplicate purchase reports. We do not send names, addresses, email addresses, form contents or payment details. Sign-in, account and admin pages are excluded. Our _ga and _ga_* cookies last up to 180 days.

Reported order IDs remain in session storage under kaumaster.analytics-purchases.v1 until the tab closes. Withdrawing statistics consent removes them.

Google Ads is limited to public information pages. You can withdraw optional consent at any time in “Cookie settings” in the footer. We then reload the page to stop already-loaded measurement services and delete accessible measurement cookies. Sign-in, basket and wish list remain. The legal bases for optional services are Article 6(1)(a) GDPR and section 25(1) TDDDG.

Microsoft stores Clarity data in the US. According to its retention information, regular recordings are kept for 30 days, and click data and marked recordings for nine months. Read the Microsoft privacy statement for transfers and your rights. The providers, purposes, cookie periods and further details are explained in Cookie settings and our website privacy policy.

Our own shop statistics

With statistics consent, we also collect our own daily totals on our Hetzner servers in Germany. These cover shop visits, product views, bone offers, basket and checkout. The statistics contain only the date, event, optional product and count, with no IP addresses, names, contact details or visitor IDs. To avoid duplicate counts, the existing shop session remembers the steps counted for the current day. This association ends with the session and is replaced on the next counted day. Without consent, no events are sent to this statistics service. Order, payment and refund records from contract fulfilment are used separately for operational reporting.

6. Your rights

Under the applicable legal requirements, you have rights of access, correction, deletion, restriction and portability. You may object to processing based on legitimate interests for reasons related to your particular situation. You may object to direct marketing at any time.

You can withdraw consent with effect for the future and complain to a data protection supervisory authority, particularly where you normally live or where the alleged infringement occurred.

7. Privacy on our website

For information about data processing on kaumaster.de, read our website privacy policy.

Anonymous page requests

We also count successful requests for public HTML pages on our website and shop directly on our Hetzner server in Germany. We store only an hour bucket, a fixed area such as guides or product pages, and a broad source category such as Google Search or direct access. The source category is derived from permitted campaign hints or the referring domain. Full destination URLs, query parameters, click identifiers and referrer URLs are not stored in these statistics. Neither are IP addresses, browser details, cookies or visitor identifiers.

This counter sets no analytics cookies and does not access browser storage. It does not identify people, returning visitors or personal browsing profiles. Repeated requests by the same person can count more than once. Private account, sign-in, basket, checkout and admin pages are excluded.

The anonymous count log uses a daily or size-based rotation policy; only the current and previous files are retained. The active report contains daily totals for at most 90 days. We do not link these data to customer accounts, orders or Google Analytics and Clarity data. Optional measurement services still require your separate consent.