Data Protection Policy

Welcome to our website www.eclatbmx.com. We thank you for your interest in our products and services. Effective data security and protection of your personal data is of the utmost importance to us as is safeguarding your privacy. Protecting your personal data for collection, storage or use in ac- cordance with legal regulations is something we take very seriously. That is why our company has put in place extensive technical and organisational measures to secure your personal data when you navigate our website as a customer. If you do not wish for your personal data to pass through our website, you have the option of placing your order by phone.

The collection, processing and use of your personal data, such as your name, address, E-Mail address or your phone number, will now follow in line with the EU’s General Data Protection Regulation orGDPR as well as country- specific regulations governing data protection applicable to our company. With this data protection policy, we would like to keep you informed of the kind of personal data we collect, process and use, the full extent of this data and its purpose as well as your legal rights in this regard.

You can essentially use this website without revealing any personal data. However, if you wish to make full use of our website’s services, it will be necessary for us to process personal data. If weneed to process personally identifiable information, we will ask for your consent at regular intervals, if there is no legal basis for doing so.

1. Data Controller for Data Protection

The following company is the data controller responsible for the collection, processing and use of your personal data pursuant to the GDPR and other applicable data protection laws in the member states of the European Union as well as other provisions related to data protection:

WE MAKE THINGS GmbH Richard-Byrd-Straße 12 D-50829 Köln, Germany

Telephone: +49(0)221-500057-20 E-Mail: mail@eclatbmx.com Website: www.eclatbmx.com

You can contact us at any time, free of charge, for information on your personal data, which we may have stored on our website. Should you object to the collection, processing or use of your personal data pursuant to this Data Protection Policy in full or in individual part, please do so in writing via e- mail, fax or letter to the above mentioned address.

2. Collection, Processing and Use of Personal Data

Personal data is defined as factual or personal information relating to an identified or identifiable living person. In particular, personal data is your name, your address as well as other data you are asked to share with us when registering and/or creating a customer account with us. Statistical data, which we collect while you visit our online shop, for example, and which cannot be directly associat- ed with you, is not considered to be personal data. Statistical data includes, in particular, information on which pages of our online shop are most popular or then how many visitors have visited certain pages of our online shop.

3. Cookies

Our company’s websites use cookies. Cookies are small files, which are stored on your data carrier. When you visit our store online they save certain preferences and data and then relay this infor- mation back to our system via your browser. Cookies are used by a great number of internet sites and servers. Many cookies contain a unique identifier called a cookie ID. This is a string of characters that websites and servers match with the internet browser on which the cookie has been stored. This enables us to recognise you as a user and adapt our pages and offers accordingly. It also makes it easier for you to use our website, for example, when certain personal details are saved so you do not have to re-enter them repeatedly. A cookie ID allows our website to recognise and identify a particu- lar internet browser.

By setting the browser options you can block cookies on your internet browser and also prevent new cookies from being installed. This also allows you to delete cookies that may have been stored al- ready by websites or other software programmes. The complete disabling of cookies, however, will prevent you from making full use of all the functions on our website.

4. Collection of General Information and Data

With each visit to our website, by you or an automated system, a range of general data and infor-mation is collected, which is stored in the server’s log files. This includes information on (a) browsertypes and versions, (b) the operating system accessing our website, (c) the website or page from which you or the system arrived at our website, (a so-called referrer), (d) subpages which directed you or a system to our website (e) the date and time of access to our website (f) an Internet-Protocol Address (IP-Address), (g) the internet service provider of the system accessing our website (h) other information and data of a similar nature, which is collected and stored so as to protect our website in case of an attack on our information technology systems.

We do not make any inferences with regard to your person with the use of general data or infor- mation. It is more specifically meant for the purpose of (a) a more accurate delivery of the content of our website, (b) optimisation of the contents of our webpage as well as the advertisements con- tained therein, (c) guaranteeing continued efficiency of our internet technology systems and the technology that supports our website (d) to provide the relevant law enforcement authorities with the necessary information in case of a cyber security attack. We will use this data and information only for statistical purposes and/or to maximise data protection and data security at our company as well as to protect personal data as best as we can. The data to be found on the server-log files is stored separately from personal data.

5. Newsletter

We give users of our website the opportunity to subscribe to our company’s newsletter so that we can keep you informed of special offers at regular intervals. You can subscribe to our newsletter only if you (a) have a valid email address (b) if you register for delivery of the newsletter. When you enter an email address to register for the newsletter, you will receive a double opt-in confirmation from us so that we can check if the owner of the email address account has indeed authorised the subscription and wants to be added to our mailing list.

When you register for our newsletter we save the IP Address – provided to us by the Internet-Service- Provider (ISP) – of the computer system being used at the time of registration as well as the date and the time of registration. We collect this data so as to trace possible misuse of your email address in the future and with this we also safeguard ourselves legally as a company against possible fraud.

Personally identifiable data will only be used for the purpose of newsletter delivery. We will not share personally identifiable data with a third party.

If you do not wish to receive a newsletter from us at some point in the future, you can cancel your subscription at any time. Please notify us in writing at the aforementioned address of my company, for example, via email, fax or letter if you wish to cancel your subscription. There is a link in each of our newsletters, which you can click on at any time if you wish to revoke your consent.

6. Newsletter-Tracking

Our company’s newsletters contain so-called tracking pixels. This is a miniature graphic, which is sent in HTML format to enable log data records and analysis. By means of these pixels we can recognise if and when an email was opened and which links in the email were clicked on. In this way, we can ac- quire data to statistically analyse the success of our online marketing campaign.

Your personally identifiable data is saved and interpreted by us so that we can improve our newslet- ter delivery and better adapt the contents of this newsletter to your interests. We will not share these personally identifiable data with a third party. You are entitled to revoke your consent at any time if you wish to do so. If you unsubscribe from our newsletter, we will treat this as revocation of consent. Once you have revoked your consent, we will completely delete your personally identifiable data from our system.

7. Contact

Based on legal requirements, our website allows for prompt contact with our company electronically or by direct contact, both of which require an e-mail address. When you contact us via e-mail or our contact form, your personal data will automatically be stored so that we can process whatever mat- ter you have raised with us or then contact you if we need to. Your personal data will not be shared with any third party.

8. Regular Deletion and Blocking of Personal Data

We process and store your personal data for only as long as it is necessary, in relation to the purpose for which it is being processed or for as long as it is allowed as per regulations laid down by the Euro- pean Data Protection Supervisory Authority or other legislative authority.

As soon as the purpose has been served or the time limit has expired, as laid out by the European Supervisory Authority or other competent legislative authority, your personal data will be blocked and deleted pursuant to the aforementioned legal regulations.

9. Your Rights as Subject of Data Processing

You have comprehensive rights that encompass data protection laws. If you wish to exercise these rights with respect to our company, we kindly ask you to refer your questions while clearly identify- ing yourself to the contact details as indicated in Art. 1 of this Data Protection Policy.

9.1 Right to Confirmation

You have the right to request a confirmation from us at any time if you think data personally identifi- able to you is being processed. You may contact an employee of our company for information at any time if you wish to exercise this right.

9.2 Right to Information

You have the right, as granted to you by the European Data Protection Supervisory Authority, to re- quest information from us on your personal data that we may have stored, together with a copy if needed. Furthermore, you are entitled to receive the following information:

1. i)  the purpose for which it is being processed
2. j)  the categories of personal data being processed;
3. k)  the recipient or categories of recipients that are or may become privy to your personal data, in particular recipients in non-EU countries or international organisations;
4. l)  where possible, the length of time for which your personal data is expected to be stored, or then at the very least, the criteria upon which this length of time is based;
5. m)  rectification or deletion of your personal data or restricting its processing or objection to its processing;
6. n)  if you can lodge a complaint at a competent supervisory authority;
7. o)  if your personal data does not originate from you, disclosure of all information possible on the source of your data;
8. p)  if you are the subject of automated decision-making, including profiling’ pursuant to Art. 22para. 1 and 4 of the GDPR and – in such cases – significant information on the logic, the scope and the implications of such automated processing for you.

If your personal data is transferred to a non-EU country or an international organisation, you have the right to be notified pursuant to the guarantees as laid out in Art. 46 of the GDPR.

9.3 Right to Rectification

In case personal data personal is inaccurate, you have the right to request immediate rectification from us. In addition, taking into consideration the purpose of processing, you have the right to com- pletion where personal data is incomplete – also by means of a supplementary statement.

9.4 Right to Deletion (Right to be Forgotten)

You have the right to request us to immediately delete your personal data and we are legally obligat- ed to delete such data for at least one of the following reasons:

1. g) your personal data is no longer needed for the purpose for which it was stored or in any way processed;
2. h)  you revoke your consent to processing pursuant to Art. 6 Para. 1 a) of the GDPR, alternative- ly, Article. 9 Para. 2 a) of the GDPR, and there is no other legal basis for further processing;
3. i)  you object to the processing pursuant to Art. 21 Para. 1 of the GDPR and there are no over- riding legitimate grounds for processing, or you object to processing pursuant to Art. 21 Para. 2. of the GDPR;
4. j)  your personal data is being processed unlawfully;
5. k)  the deletion of your personal data is for the purpose of fulfilling a legal obligation, as re- quired by EU law or the law of the member states to which we are subject;
6. l)  your personal data has been collected within the scope of services provided by the infor- mation society pursuant to Art. 8 Para. 1 of the GDPR. If we have made personal data public and are under obligation to delete such data as per the aforementioned regulations, we will take the necessary measures, including technical, while taking into consideration the techno- logical resources available to us and the costs involved in such undertaking such measures, to inform those persons or entities processing your personal data that you have requested the deletion of all links to this data or even copies or replicas of such data.

9.5 Right to Data Portability

You have the right, as granted to you by the European Data Protection Supervisory Authority, to re- ceive personal data that you have provided to us in a structured, commonly used and machine- readable format. You have the right to transfer your data to another controller without hindrance from us provided,

1. c) the processing is based on consent pursuant to Art. 6 Para. 1 a) of the GDPR or Art. 9 Para. 2 a) of the GDPR or a contract pursuant to Art. 6 Para. 1 b) of the GDPR and
2. d) the processing has been carried out by automated means.

In exercising your right to data portability, you have the right to request that your personal data transmitted directly to another controller pursuant to Art. 20 Para. 1 of the GDPR, as long as it is technically feasible and the fundamental rights and freedom of a third party are not compromised.

9.6 Right to Objection

You have the right to object at any time, for reasons that arise as a result of circumstances particular to you, to the processing of your personal data pursuant to Art. 6 Para. 1 e) or f) of the GDPR; this also applies to Profiling based on aforementioned provisions. We will halt with the processing of your personal data unless we are able to provide compelling legal grounds for doing so, such that they override your interests, fundamental rights and freedom or if the processing serves legitimate inter- ests which we may be pursuing or defending. If we are processing personal data for the purpose of direct advertising, you have the right to object to the processing of your personal data for such ad- vertising; this also applies to Profiling if it is directly connected to such advertising.

For reasons that arise as a result of circumstances particular to you, you have the right to object to the processing of your personal data for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 Para. 1 of the GDPR, unless it is necessary to fulfil a particular task in the public interest.

9.7 Automated Decision -Making Including Profiling

You have the right not to be the subject of a decision based solely on automated processing – includ- ing Profiling – which may impact your legal interests or compromise you in any way provided the decision (a) is not necessary to conclude or perform a contract between you and our company or (b) is admissible based on the legal regulations as laid out by the European Union or its member states and the measures taken within the scope of these legal provisions protect your rights and freedom as well your legitimate interests or (c) is made with your express consent.

If the decision is necessary to (a) conclude or perform a contract between you and our company and (b) is taken with your express consent, we will take the necessary measures to protect your funda- mental rights and freedom as well as your legitimate interests. At the same time we will also have tonominate an individual to represent the company’s viewpoint and interests or appeal a decision onbehalf of the company.

9.8 Right to Revoke Consent

You have the right to revoke your consent to the processing of your personal data at any time.

9.9 Right to Lodge a Complaint at a Competent Supervisory Authority

You have the right to lodge a complaint at a competent supervisory authority, in particular in the member state of which you are a resident, your workplace, or the place where you think the alleged breach has occurred, if you consider the processing of your personal data is unlawful.

10. Data Protection Provisions for the Operation and Use of Google Analytics (with Anonymisation Function)

We have integrated components of Google Analytics into our website (with anonymisation function). Google Analytics is a web analytics service for the collection and evaluation and analysis of web traf- fic, which provides an insight into user behaviour. A web analytics service gathers data on which website directed you to another website (a so-called referrer), which subpages you accessed from a particular website or how often you visited a subpage and which time you spent on it. We use web analytics to optimise our website and also for the purpose of cost-benefit analysis of internet advertising. Google-Analytics Components’ operating company is Google Inc., 1600 Amphitheatre Parkway,Mountain View, CA 94043-1351, US. We use a tracking code via Google Analytics known as „_gat._anonymizelp“, with which the IP- Address of your internet connection is shortened and anonymised by Google, when you access our website from an EU member state or any other state that is signatory to the European Economic Area Agreement. The purpose of Google Analytics Components is to analyse website traffic visiting our website. With the help of data and information derived from this analysis, Google evaluates the use of our website and compiles online reports identifying activities on our website and services offered therein. Google-Analytics stores a Cookie on your information technology system, with which Google can analyse the use of our website. When accessing a particular page on our website on which Google Analytics Components have been integrated, the internet browser on your information technology system will automatically transfer data via the Google Analytics Components for an online analysis to Google. In this way, Google is notified of your personal data such as, for example, your IP Address, which allows Google to identify where the visitor and the clicks originate from and to issue commis- sion invoices.

This cookie allows us to save your personal data, including information such as the time and place of access and the frequency of visits to our website. With each visit to our website, your personal data, including the IP Address of the internet connection you are using, is transferred to Google in the United States of America (USA). This personal data is saved by Google in the USA and can be for- warded to a third party, under certain circumstances.

You may choose to block the use of cookies by our website by means of the settings on your internet browser and thereby also prevent new cookies from being installed. This will also prevent Google from storing cookies on your information technology system in the future. You can also delete cook- ies that may already have been stored by Google Analytics or other software programmes via your internet browser at any time.

Furthermore, you have the right to object to or prevent the recording and compiling of data pro- duced by Google Analytics resulting from the use of this website as well as the processing of personal data by Google. To this end, you can download and install a browser add-on from the following link:

https://tools.google.com/dlpage/gaoptout

This will inform Google-Analytics via Javascript that you do not wish to have any data or information related to website visits transferred to Google Analytics. Google will treat the installation of this browser add-on as an objection. Should your information technology system have to be deleted, reformatted or reinstalled at some point in the future, you will have to reinstall the browser add-on so as to disable Google Analytics. You can reinstall or reactivate your browser add-on, as long as it has been uninstalled or deactivated.

You will find further information and relevant data protection laws on Google underhttps://www.google.de/intl/de/policies/privacy/ and underhttps://www.google.com/analytics/terms/de.html

Further information on Google-Analytics can be found under the following link:https://www.google.com/intl/de_de/analytics/.

11. Data Protection Provisions for the Operation and Use of Facebook Plugins

The components of the social networking website Facebook are integrated into our website.

A social networking website is a social meeting point operated in the internet, an online community which enables users to communicate with one another or to interact in a virtual space. A social net- working website can serve as a platform for the exchange of opinions and experiences and can be a source of personal or corporate information for the internet community. Facebook is designed to enable users of its social networking site to create personal profiles, upload photos and network with other users via friend requests.

The social networking service of Facebook is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, US. For those that live outside the USA and Canada, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, is the controller responsible for the processing of personal data.

When you display a page of our website, the Facebook components on your information technologysystem’s internet browser will automatically be prompted to download an image of Facebook com- ponents from Facebook. A complete overview of Facebook Plug-ins can be found under this linkhttps://developer.facebook.com/docs/plugins/?locale=de_DE. In this way, Facebook is informed of the pages of our website you have visited.

If you are logged into Facebook while you are visiting our website, it keeps track of your use and rec- ognises which of the subpages you have visited. This information is gathered by Facebook compo- nents and matched to your Facebook account. When you click on a Facebook button integrated into our website, for example the „Like“ button, or if you add a comment, Facebook matches this infor- mation to your personal Facebook User Account and saves this personal data.

Facebook is kept in the loop when you visit our website through the Facebook components as long as you are logged into Facebook at this time, irrespective of whether you click on the Facebook compo- nents or not. By logging out of Facebook before you log onto our web page, you can prevent any information from being shared with them.

Facebook data protection guidelines can be found under this link https://de- de.facebook.com/about/privacy/. This contains information on the storage, processing and use ofpersonal data by Facebook and explains how you can safeguard your privacy via Facebook’s privacysettings. There are a variety of applications that allow you to prevent data transfers to Facebook.

12. Data Protection Provisions for the Operation and Use of Instagram

Components of Instagram are integrated into our website.

Instagram is a social networking site, which allows its users to communicate and interact with each other in a virtual space. Instagram allows its users to share photos and videos, which can be shared to other social networking sites as well.

The social networking service Instagram is operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, US.

When you display a page on our website, this information is shared with Instagram via the „Insta“- Button on our website. This information is gathered by the Instagram components and matched to your Instagram User Account. If you are logged into Instagram when you visit our website, Instagram can match your visit to your Instagram User ID and connect the data obtained from both. By logging out of your Instagram User Account before you log into our website, you can prevent any infor- mation from being shared with them.

Data obtained from clicking on the ”Insta“ button is saved by Instagram. Further information on thepurpose and extent of data storage, its processing and use as well as your fundamental rights and applications that allow you to protect your privacy can be found in the Instagram data protection guidelines under this link: https://help.instagram.com/155833707900388.

13. Data Protection Provisions for the Operation and Use of YouTube with Enhanced Data Protec- tion Mode

We have integrated components of YouTube into this website.

YouTube is a video sharing website which allows you to create and upload videos free of charge. Other YouTube users can watch, rate and comment on these videos.

We use the ”enhanced data protection mode“ option available on the YouTube website. When youdisplay a page on our website that has an embedded video, a connection will be made to the You Tube server and the content will appear on our website via a communication to your browser. With enhanced data protection mode, only data related to the pages you have visited is transferred to the YouTube server, if you watch the video. If you are logged into YouTube at the same time, this infor- mation is matched to your YouTube User Account. You can prevent this information from being shared with them by logging out of your account before visiting our website.

YouTube’s operating company is YouTube LLC, 901 Cherry Avenue, 94066 San Bruno, California, US. It belongs to Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043-1351, US.

Further information on YouTube Data Protection guidelines can be found under the following link provided by Google: https://www.google.de/intl/de/policies/privacy/.

14. Data Protection Provisions on the Operation and Use of Twitter

Components of Twitter have been integrated into this website.

Twitter is a multilingual, publically accessible micro-blogging service, through which users can postand exchange short messages in the form of ‘tweets’. Registered users can post these messages ortweets but those that are not registered can only read them. If you have Twitter users that follow you on Twitter, your messages will show up on their timeline when they log onto Twitter. Twitter enables you to reach a wide audience through hash tags, links and re-tweets.

Twitter communication service is operated by Twitter, Inc., 1355 Market Street, Suite 900, San Fran- cisco, CA 94103, USA.

When you display a page on our website, your information technology system’s internet browser willautomatically be prompted by the Twitter components to download an image of these components from Twitter. You can find further information on the Twitter buttons under this link:https://about.twitter.com/de/resources/buttons. In this way, Twitter receives information on which subpages of our website you have visited. With the integration of Twitter components our users help us to propagate the contents of our website so that it gains recognition in the digital world and thereby increases the number of visitors to our website.

If you are logged into Twitter while you are visiting our website, it keeps track of your use and recog- nises which of the subpages of our website you have visited for the entire duration. This information is gathered by Twitter components and matched to your Twitter account. The data and information obtained is then matched to your Twitter User Account, is saved and processed by Twitter as soon as you click on a Twitter button integrated into our website.

Twitter is kept in the loop when you visit our website through the Twitter components as long as you are logged into Twitter at this time, irrespective of whether you have clicked on the Twitter compo- nents or not. By logging out of Twitter before you log into our website, you can prevent any infor- mation from being shared with them.

Twitter data protection guidelines can be found under this link https://twitter.com/privacy?lang=de.

15. Data Protection Provisions for the Operation and Use of Google Maps

This website uses Google Maps to display interactive cards and shows you directions by car, public transit or walking to your destination.

Google Maps is a web mapping service belonging to Google Inc., 1600 Amphitheatre Parkway, Moun- tain View, California 94043, US.

By using Google Maps, you could be transferring information related to the use of our website, in- cluding your IP address as well as the addresses entered into your route planner, to Google in the USA. When you display a page on our website containing Google maps, your browser builds an in-stant connection to Google’s servers. The contents of the card are transferred directly to yourbrowser by Google and from there they are embedded into the website. We have no control over the extent of the data that Google collects in this way. To our knowledge, they have access to this data, at the very least:

• Date and time of your visit to the website in question,
• Internet address or URL of the website you visited,
• IP address, in combination with the addresses entered into the route planner.

We have no control over the further processing and use of data by Google and can therefore not be held responsible for their actions. If you wish to prevent Google from storing, processing or using information related your internet use, you can disable Javascript in your browser settings. You will, however, not be able to use the interactive card in this case.

For more information on the purpose and extent of data storage, its processing and use by Google, as well your fundamental rights and applications to safeguard your privacy, you can read Google’sdata protection guidelines under the following link: https://policies.google.com/privacy?hl=de. With the use of our website, you agree to the processing of your data stored via Google Maps Route Plan- ner for the aforementioned purposes, as described above.

16. Data Protection Provisions for the Operations and Use of Google Webfonts

Licenced Google fonts („Google Webfonts“) are integrated into this website.

These licensed Google fonts are offered by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, US.

Google’s data protection guidelines can be found under the following link:https://www.google.com/policy/privacy.

You can disagree to the use of Google fonts at any time under this link:https://adssettings.google.com/authenticated If you do so, however, we cannot guarantee the opti- mal performance of our website.

17. Legal basis for Data Processing

The legal basis for actions in which we require your consent for data processing meant for certain purposes is Art. 6 I lit. a of the GDPR. The legal basis for actions in which we process your personal data for the purpose of concluding a contract with our company, such as for example, when deliver- ing items that you have ordered or providing other services, is Art. 6 I lit. b of the GDPR. The legal basis for actions in which we need to process data before your enter into a contract with us, such as for example, when answering your questions on products or services, is also Art. 6 I lit. b of the GDPR. The legal basis for actions in which we are legally obligated to process your personal data, such as for example, for tax purposes, is Art. 6 I lit. c of the GDPR. The legal basis for actions, in which we have to process personal data in order to protect vital interests of an individual, such as, for ex- ample, when they injure themselves during a visit to our operation, for which details as to their name, age, health insurance, or other such information must be communicated to a third party, is Art. 6 I lit. d of the GDPR. The legal basis for actions in which we have to process personal data to protect legitimate interests of our company or a third party, is Art. 6 I lit. f of the GDPR, provided your interests, fundamental rights and freedoms do not override these.

The European legislator has authorised data processing of this nature pursuant to Recital 47, Line 2 of the GDPR, if you are a customer of the controller processing the data and reasonable expectations must be taken into consideration based on this relationship with the controller.

18. Legitimate Interests in Processing Personal data

Our legitimate interest in the processing of personal data pursuant to Art. 6 Para. 1 f of the GDPR lies in the execution of our business activities for the welfare of our employees.

19. Time Limit for Data Storage

Your personal data will be stored depending on the time limit set by legal requirements according to the purpose for which it is being processed. Your personal data will be deleted at regular intervals, as soon as it is no longer required for the performance or initiation of a contract.

20. Rules on the Provision of Personal Data

We would like to clarify that you will have to provide us with personal data necessitated by statutory provisions (for example: tax purposes) or for contractual provisions (for example: details of your con- tractual partner). You are obligated to provide us with personal data if you want to enter into a con- tract with our company. You may contact one of our employees before you provide us with personal data, who will be able to clarify if the provision of this data is legally or contractually stipulated or if it is at all necessary to enter into a contract with us and what it would mean for you if you did wish to provide us with your personal data.

21. Automated Decision-Making

We do not make use of automated decision-making or Profiling.