Privacy policy

Privacy Policy

1. Information on the Collection of Personal Data and Contact Details of the Controller

1.1 General Information

Thank you for visiting our website and for your interest in our products. The following information explains how we process personal data when you use our online shop.

Personal data means any information relating to an identified or identifiable natural person.

1.2 Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Luventas Medical OHG

Gewerbegebiet Limbach 11
96178 Pommersfelden
Germany

Commercial Register No.: HRA13197

Telephone: +49 (0)9548 980 66 23

Email: info@luventasmedical.de

Website: www.luventasmedical.de

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

1.3 SSL/TLS Encryption

To protect the transmission of personal data and other confidential content, such as orders or enquiries, this website uses SSL/TLS encryption.

You can recognise an encrypted connection by the “https://” in the address bar of your browser and the padlock symbol.

2. Data Collection When Visiting Our Website

If you use our website for informational purposes only, without registering or otherwise providing us with information, we generally collect only the data transmitted to our server by your browser.

This may include, in particular:

  • pages visited,

  • date and time of access,

  • amount of data transferred,

  • source or website from which you accessed our website,

  • browser used,

  • operating system used,

  • IP address.

The processing is carried out for the technical provision, stability and security of our website and, insofar as the statutory requirements are met, is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in particular in ensuring the secure and uninterrupted operation of our online shop.

3. Hosting and Shopify

Shopify provides the technical infrastructure for our online shop. In the course of operating our online shop, personal data may be processed. This may include, in particular, customer and contact details, order and contractual data, payment and shipping information, as well as technical data and information concerning the use of our online shop.

Shopify may transfer personal data to affiliated companies and carefully selected technical service providers as part of the provision of its services. This may also involve the processing of personal data outside the European Economic Area (EEA).

According to its own information, Shopify uses the transfer mechanisms required under applicable data protection law for international data transfers. These include, in particular, European Commission adequacy decisions and, where required, Standard Contractual Clauses and other appropriate safeguards.

Further information on the processing of personal data by Shopify and on international data transfers can be found in Shopify's privacy policy and data protection information:

https://www.shopify.com/de/legal/datenschutz

4. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files or pieces of information that may be stored on or accessed from your device.

Some cookies and similar technologies are technically necessary to ensure that our online shop functions properly. For example, they enable shopping cart contents, language settings or other information necessary for the operation of the shop to be stored.

Other cookies and similar technologies may be used to analyse the use of our online shop or for marketing purposes.

Where consent is required for the setting, storage or access of information on your device or for the subsequent processing of personal data, this will only take place with your consent. The processing of personal data based on consent is carried out in accordance with Art. 6(1)(a) GDPR.

Cookie Consent Management via Shopify

To obtain and manage your consent for cookies and similar technologies that are not technically necessary, we use the cookie consent functionality provided by Shopify.

When you first access our website, you will be presented with a corresponding selection option. You can decide there whether to consent to or reject the use of certain cookies and similar technologies.

Your selection is stored technically so that your consent decision can be taken into account during subsequent visits to our website. In this context, information concerning your consent decision and technically necessary information for storing and assigning that decision may be processed.

The processing and documentation of your consent decision, insofar as this is necessary to fulfil legal obligations, is based on Art. 6(1)(c) GDPR. Where processing is based on our legitimate interest in ensuring legally compliant and technically proper consent management, it is based on Art. 6(1)(f) GDPR.

You may change or withdraw your consent at any time with effect for the future. To do so, you can access the cookie settings again via the corresponding function on our website and adjust your selection. The lawfulness of processing carried out on the basis of your consent before its withdrawal remains unaffected.

The information stored in connection with consent management will only be retained for as long as necessary to manage your consent and, in particular, to demonstrate that valid consent was properly obtained.

The cookie consent functionality is part of the Shopify shop technology we use. Further information on the processing of personal data by Shopify can be found in the sections of this Privacy Policy concerning the hosting and operation of our online shop.

Please note that disabling certain technically necessary cookies may result in individual functions of our online shop not functioning or functioning only to a limited extent.

5. Contacting Us

If you contact us, for example via a contact form, by email or through other means of communication, we process the personal data you provide to us.

The data collected depends on the information you provide when contacting us.

The data is processed exclusively for the purpose of handling and responding to your enquiry and, where applicable, for technical administration.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to properly process and respond to your enquiry.

If your contact with us is aimed at entering into or performing a contract, Art. 6(1)(b) GDPR shall additionally constitute the legal basis.

After your enquiry has been conclusively processed, the data will be deleted unless statutory retention obligations prevent this.

6. Contact via WhatsApp Business

You have the option of contacting us via the WhatsApp Business messaging service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If you contact us via WhatsApp in connection with an existing, upcoming or potential business transaction, we process and store the personal data you provide. This may include, in particular, the telephone number you use for WhatsApp, your first and last name, address, the messages you send and, where applicable, other information you provide.

Where the contact relates to the initiation, performance or processing of a specific business transaction, such as an order, quotation or other business enquiry, the processing is carried out pursuant to Art. 6(1)(b) GDPR, insofar as it is necessary for the performance of pre-contractual measures or the fulfilment of a contract.

The data collected as part of business communications may also be stored and used beyond the specific enquiry insofar as this is necessary for maintaining and managing the business relationship, processing further or existing business transactions, or communicating regarding potential future business relationships. To this extent, the processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR. Our legitimate interest lies in particular in the efficient management and maintenance of business relationships, the processing of business enquiries and communication with existing and potential business partners and customers.

In order to assign an enquiry or communication to a specific business or customer transaction, we may ask you to provide additional information, such as an order number, customer number, address or email address.

Data received via WhatsApp will only be stored for as long as necessary for the purposes stated above or as required by statutory retention obligations. Data will only be stored for longer periods if there is an appropriate legal basis for doing so.

Please note that WhatsApp processes personal data in accordance with its own privacy policies. When using WhatsApp, data may be transferred to WhatsApp Ireland Limited, companies affiliated with WhatsApp or Meta, and service providers engaged by them, and may also be processed outside the European Economic Area. We do not have complete control over the nature, scope and purposes of such processing by WhatsApp.

Further information on the processing of personal data by WhatsApp and on your rights and privacy settings can be found in WhatsApp's privacy policy:

WhatsApp Privacy Policy: https://www.whatsapp.com/legal/

When using WhatsApp Business, personal data may be transferred to third countries, in particular the United States. The applicable data protection transfer mechanisms are used for such transfers. Where a transfer is based on the EU-U.S. Data Privacy Framework, it is based on the corresponding adequacy decision of the European Commission. Where required, appropriate safeguards, in particular the European Commission's Standard Contractual Clauses, may be used for further transfers.

8. Opening a Customer Account and Contract Processing

If you create a customer account in our online shop or place an order, we process the personal data you provide for the purpose of setting up your customer account and performing the contract.

This may include, in particular:

  • first and last name,

  • billing and delivery address,

  • email address,

  • telephone number,

  • order information,

  • information concerning the products ordered,

  • payment and shipping information.

The legal basis is Art. 6(1)(b) GDPR.

As a general rule, we use the data you provide to process the respective contract and to fulfil our contractual and statutory obligations.

You may request deletion of your customer account at any time by contacting us using the contact details provided above. Following complete fulfilment of the contract or deletion of the customer account, the data will be blocked or deleted unless statutory retention obligations or other legal grounds require further storage.

In particular, documents relevant under commercial and tax law are stored in accordance with the applicable statutory retention periods.

9. Use of Shopify Apps and Third-Party Providers for Order Processing

To extend and provide technical support for our Shopify online shop, we use various apps and external service providers. Personal data may be processed in connection with these services insofar as this is necessary for the respective functions.

9.1 StatusPro

We use the Shopify app “StatusPro” to manage and communicate order status information.

The provider of the application is Indie SaaS Ltd., United Kingdom.

When using StatusPro, order information, order status information and associated customer information may be processed in particular.

The processing serves in particular to manage order statuses, inform customers of changes to their order status and, where applicable, provide an option for checking the status of an order.

Depending on the use of the functions, the following data may be processed in particular:

  • name,

  • email address,

  • order information,

  • order status,

  • delivery or shipment information,

  • where applicable, other information associated with the order.

StatusPro states that it stores order and status data in accordance with a retention period that can be configured by the merchant. Once this period has expired, the relevant data is intended to be automatically and permanently deleted.

StatusPro may use additional technical service providers, such as hosting, storage or IT service providers, to provide its services. According to the provider, where personal data is transferred to third countries, appropriate safeguards, in particular the European Commission's Standard Contractual Clauses, are used where required.

The legal basis for processing is Art. 6(1)(b) GDPR insofar as the processing is necessary for the performance and processing of an order or related communication. Where processing is necessary for the technical provision and optimisation of our business processes, it may be based on Art. 6(1)(f) GDPR.

Further information can be found in StatusPro's privacy policy:

https://orderstatuspro.com/privacy

9.2 Post & DHL Shipping

We use the Shopify app “Post & DHL Shipping” to process our shipping operations.

The application is used in particular to create and manage shipping labels and to transmit the data required to carry out the shipment to DHL.

The following data may in particular be processed or transmitted to DHL as part of shipping processing:

  • recipient's name,

  • delivery address,

  • where applicable, email address and telephone number,

  • order information,

  • shipping information,

  • shipment and tracking information.

Data is transmitted only to the extent necessary to carry out the respective shipment and, where applicable, any additional DHL services selected.

Our shipments are generally made within the European Union.

When using certain DHL services, such as parcel notifications, additional contact details may be processed. An email address will only be disclosed for corresponding notification services where this is necessary and the applicable data protection requirements are met.

The processing is carried out for the performance of the contract concluded with you pursuant to Art. 6(1)(b) GDPR.

Further information on the processing of personal data by Deutsche Post and DHL can be found in their respective privacy information:

https://www.deutschepost.de/de/f/footer/datenschutz.html

10. Data Processing for Order Fulfilment

10.1 Disclosure to Transport Companies

For delivery of your order, we transmit the personal data required for this purpose to the transport company commissioned for the delivery.

In the case of shipment via DHL, this may include, in particular, the recipient's name, email address and delivery address.

If additional DHL services are used, further data, in particular contact details, may be required.

The processing is generally carried out pursuant to Art. 6(1)(b) GDPR for the performance of the contract.

10.2 Payment Service Providers

Depending on the payment method you select, the data required for payment processing is transmitted to the respective payment service provider.

PayPal

The service provider for payments via PayPal is:

PayPal (Europe) S.à r.l. et Cie, S.C.A.

22–24 Boulevard Royal

L-2449 Luxembourg

When payment is made via PayPal, the data required for payment processing is transmitted to PayPal.

The legal basis is Art. 6(1)(b) GDPR.

Further information can be found in PayPal's privacy policy:

https://www.paypal.com/de/legalhub/paypal/privacy-full

Klarna

If you select a Klarna payment method, payment processing is carried out by:

Klarna Bank AB (publ.)

Sveavägen 46

111 34 Stockholm

Sweden

As part of payment processing, personal data and order information may be transmitted to Klarna. Depending on the payment method selected, Klarna may carry out an identity and creditworthiness check.

The processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR and, insofar as consent is required, on the basis of Art. 6(1)(a) GDPR.

Further information can be found in Klarna's privacy information:

https://www.klarna.com/de/datenschutz/

Credit and Debit Card Payments via Shopify Payments

We use the Shopify Payments payment service, provided by Shopify, to process credit and debit card payments.

Shopify Payments can be used to process payments via Visa, Mastercard and Maestro, among others. As part of the payment process, the personal data required for payment processing is processed. This may include, in particular, name, billing and delivery address, order information, as well as payment and transaction data.

The entry and processing of complete card details takes place via the payment systems provided for this purpose by Shopify Payments. We do not store complete credit card details ourselves, such as card numbers or security codes.

The processing is carried out to process the payment method you have selected, authorise and record the payment, and fulfil the order. The legal basis for this is Art. 6(1)(b) GDPR. Where processing is necessary to comply with statutory obligations, in particular obligations under payment and financial law, it is carried out on the basis of Art. 6(1)(c) GDPR.

As part of payment processing, data may also be processed for fraud prevention, verification and securing payment transactions.

For merchants in the European Economic Area, personal data is initially processed by Shopify International Limited, Ireland. Shopify may transmit personal data to affiliated companies, payment service providers, financial service providers and other technical service providers for the provision of payment services. Processing or transfer may also take place outside the European Economic Area, in particular in Canada and the United States. Shopify uses the appropriate safeguards required under applicable data protection laws for this purpose.

Depending on the respective technical and operational requirements, Shopify may process and store personal data in different regions. Therefore, storage or processing of personal data exclusively within the European Union cannot be guaranteed.

Further information on the processing of personal data by Shopify can be found in Shopify's privacy policy:

https://www.shopify.com/de/legal/datenschutz

11. Analytics and Marketing Services

11.1 Google Analytics

Where you have given your consent, we use Google Analytics to analyse the use of our online shop.

The provider is Google Ireland Limited. When using the service, information concerning page views, duration of use, visitor origin, devices and browsers used, as well as other usage data, may be processed.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future via our consent management tool.

Personal data may also be processed by Google outside the European Economic Area. Where a transfer to a third country takes place, it is carried out on the basis of the applicable data protection safeguards.

Further information can be found in Google's privacy policy:

https://policies.google.com/privacy

11.2 Google Ads, Remarketing and Conversion Tracking

We may in future use Google Ads services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) for the placement, measurement and optimisation of our online advertising.

The use of the Google Ads functions described below will only take place if you have previously given your consent via our consent management tool. The processing of personal data is based on your consent pursuant to Art. 6(1)(a) GDPR.

Depending on the technical configuration, Google Ads, remarketing or personalised advertising, conversion tracking, the creation and use of audiences, Customer Match and Enhanced Conversions may be used.

Remarketing and personalised advertising

As part of Google Ads, we may use remarketing or retargeting functions. This may involve assigning visitors to our website to certain audiences in order to subsequently display relevant advertising or advertising related to their previous visit to our online shop on Google services and on websites and in apps of Google's advertising partners.

For this purpose, information about visits to our website, pages and products viewed, actions taken and interactions with our advertisements may be processed. Depending on the technical implementation, cookies, similar technologies and online identifiers may be used for this purpose.

Google may combine the information collected with other information available to Google, provided this is permitted under Google's respective settings and requirements. This may include creating interest-based audiences and personalising advertising across different devices or Google services.

Conversion tracking

We may use Google Ads conversion tracking to measure the effectiveness of our advertisements and advertising campaigns.

In this context, Google may determine whether a user carried out certain actions on our website after clicking on an advertisement served by Google. Such actions may include, for example, visiting certain pages, submitting a form or completing an order.

The information processed may include, in particular, information concerning interactions with our advertisements, visits to our website, pages viewed, actions taken, as well as technical information concerning the device and browser used.

The information obtained is used in particular to create conversion statistics, measure the success of our advertising campaigns and optimise our online advertising.

Consent Mode and measurement without cookies

Where technically implemented, we may use the Consent Mode offered by Google. This enables the use of certain Google services and the processing of data to be adapted to the consent decisions you make in our consent management tool.

If you do not consent to the corresponding storage or use of data, certain Google functions may be restricted or may only be performed in a manner that does not store the relevant advertising or analytics cookies on your device.

Depending on the technical configuration, technical information or so-called signals (“pings”) may, for example, be transmitted to Google in this case. Google may use these for modelling and statistical evaluation of conversions, among other purposes.

Even where processing takes place without setting the relevant cookies, processing of information that may be related to an individual cannot be completely excluded. The specific processing depends on the Google technology used in each case and the settings we have selected.

Google Customer Match

Where used by us, we may use Google Customer Match to create and use audiences within Google Ads.

For this purpose, we may transmit certain customer data, in particular email addresses, telephone numbers or other data suitable for the respective matching process, to Google in a format provided by Google. Google may use this data to compare it with existing Google accounts and assign it to corresponding audiences.

Customer data will only be transmitted for Customer Match if the applicable data protection requirements are met and the corresponding consent has been obtained.

The customer data used by us for this purpose is processed only to the extent necessary. Where Google processes the data using a hashing procedure before or during transmission, the matching is performed on the basis of the data processed accordingly. This does not alter the fact that Google's processing may involve personal data.

Customer Match may be used to display relevant or personalised advertising to existing customers or other permitted audiences within Google services or to create audiences for advertising campaigns.

Google Ads Enhanced Conversions

Where used by us, we may use Google Ads Enhanced Conversions to improve the accuracy of our conversion measurement.

For this purpose, data provided by users in connection with a conversion, such as an email address, telephone number, name or certain address details, may be processed and transmitted to Google in the technically prescribed format.

The relevant data may be processed using a hashing procedure before transmission. Google may use the processed data to compare it with existing information in order to assign conversions more reliably and improve measurement of the effectiveness of our advertising campaigns.

Such processing only takes place where the applicable data protection requirements are met and the corresponding consent has been obtained via our consent management tool.

Data processed and purposes of processing

Depending on the Google Ads functions actually used by us, the following data may in particular be processed:

  • information concerning visits to our website,

  • pages and products viewed,

  • actions taken and orders,

  • information concerning interactions with advertisements,

  • information concerning the source of a website visit,

  • cookie and online identifiers,

  • IP address or information derived from it,

  • information concerning the browser, operating system and device used,

  • information concerning advertising audiences and target groups created or used,

  • in the case of Customer Match or Enhanced Conversions, customer data such as email address, telephone number, name or certain address details.

The processing serves in particular to display personalised or interest-based advertising, create and use audiences, measure and statistically evaluate advertising campaigns, attribute and measure conversions, and optimise our online advertising.

The data processed in each individual case depends on the Google services actually used, the settings selected by us and the technical implementation.

International data transfers

As part of the use of Google Ads, personal data may be transferred to Google companies and service providers engaged by Google outside the European Economic Area, in particular to the United States, and processed there.

For transfers to the United States, Google may, where the relevant requirements are met, rely on the EU-U.S. Data Privacy Framework. For other international data transfers, Standard Contractual Clauses or other appropriate safeguards may be used in accordance with the applicable data protection requirements.

Withdrawal of consent

You may withdraw your consent to the use of Google Ads and the associated functions at any time with effect for the future via our consent management tool or change the settings you have made there.

The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Further information on the processing of personal data by Google can be found in Google's privacy policy and in Google's information on technologies and services for websites and apps:

https://policies.google.com/privacy

13. Your Rights as a Data Subject

Subject to the applicable statutory requirements, you have the following rights:

  • right of access pursuant to Art. 15 GDPR,

  • right to rectification pursuant to Art. 16 GDPR,

  • right to erasure pursuant to Art. 17 GDPR,

  • right to restriction of processing pursuant to Art. 18 GDPR,

  • right to data portability pursuant to Art. 20 GDPR,

  • right to object to certain processing pursuant to Art. 21 GDPR,

  • right to withdraw consent pursuant to Art. 7(3) GDPR,

  • right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.

Withdrawal of Consent

You may withdraw consent that you have already given at any time with effect for the future.

Withdrawal may be effected, in particular, via the settings of our consent management tool or by contacting us.

The lawfulness of processing carried out before withdrawal remains unaffected by the withdrawal.

14. Data Retention

As a general rule, we store personal data only for as long as necessary for the respective purpose of processing.

In addition, statutory retention obligations may apply. In particular, commercial and tax law retention obligations may require certain data to be stored for longer periods.

Once the respective retention period has expired, the data will be deleted unless another legal basis permits further storage.

15. Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy where this is necessary due to technical developments, changes to our services, changes to the service providers we use, or due to statutory or regulatory requirements.

The current version of this Privacy Policy published on our website shall apply in each case.

Version: September 2026