Data Protection Notice

Contents

1. We are responsible for your data
2. How secure is your data?
3. Our Data Protection Officer
4. What are compulsory details or mandatory fields?
5. What is your data processed for?
6. Right to object and withdraw consent at any time
7. What are cookies and what are they used for?
8. Web tracking and retargeting (anonymised/pseudonymised)
9. What happens with embedded YouTube videos?
10. Logging
11. How can you exercise your data protection rights?
12. Changes

1. We are responsible for your data

The protection and security of your personal data are of utmost importance to us. To ensure that you can feel secure in respect of data protection, we process your personal data in strict compliance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Personal data is data by which you can be identified or are identifiable. We only process your personal data in cases in which a legal provision permits this or you have granted prior consent.

We, namely Erwin Müller Versandhaus GmbH, Buttstraße 2, D-86647 Buttenwiesen, and our service providers, process your data on our behalf for the purposes stated below (hereinafter: Erwin Müller, we).

Our service providers include, for example, printers, lettershops, call centres, address service providers, internet service providers, data centres and payment service providers. Our service providers are prohibited from processing your data without your consent for purposes other than ours or for their own purposes.

In addition to the postal address stated above, you can also contact us by e-mail at service@erwinmueller.de.

Important note:

Please use the dedicated e-mail address datenschutz@erwinmueller.de for your online data protection enquiries and to exercise your data protection rights. This helps us process and respond to your request promptly. If you use another e-mail address, the additional effort this causes may result in considerable delays in processing your enquiry or request.

It is important to us that the following information enables you at all times to find out which personal data is collected during your visit to our website and when you use our services and offers, and how we subsequently process it.

2. How secure is your data?

We take technical and organisational security measures to protect your personal data against manipulation, loss, destruction or access by unauthorised persons, and to ensure the protection of your rights and compliance with applicable data protection provisions of the EU and the Federal Republic of Germany (Article 32 GDPR).

The measures taken are intended to ensure the confidentiality and integrity of your data, as well as the ongoing availability and resilience of the systems and services used to process your data. They are also aimed at restoring the availability of and access to data rapidly in the event of a physical or technical incident.

Our security measures also include encryption of your data. When your data is transmitted to us, encryption using Secure Sockets Layer (SSL, Chart 256 RSA certificate) is applied, except for the advisor chat.

All information you enter online is technically encrypted before it is transmitted. This means that this information cannot be viewed by unauthorised third parties at any time.

Our data processing and security measures are continuously improved in line with technological developments.

Our employees are, of course, bound in writing to confidentiality and compliance with the data protection requirements of the GDPR.

3. Our Data Protection Officer

If you have a question about data protection or data security, you can contact our Data Protection Officer by e-mail at datenschutz@erwinmueller.de or by post at Erwin Müller Versandhaus GmbH, Datenschutzbeauftragter, Buttstraße 2, D-86647 Buttenwiesen.

4. What are compulsory details or mandatory fields?

If certain data fields are designated as mandatory details or compulsory fields and/or marked with an asterisk (*) when data is collected, providing this data is either required by law or contract, or we need this data to conclude the contract, provide the requested service or fulfil the stated purpose. Data is naturally provided at your discretion, including for compulsory details. Failure to provide it may mean that we cannot execute the contract, provide the requested service or achieve the stated purpose.

5. What is your data processed for?

• a. Enquiries

  We process the information you provide in order to respond to your enquiries (Article 6 (1 b), Letter f GDPR). The provision of address and telecommunications data marked as mandatory is necessary for us to process and answer your request. Voluntarily providing further data makes it easier for us to process your enquiry or enables us to provide more precise information.

  After answering your enquiry, we generally store it together with the information you provided as a business letter for 6 years (Section 257 (4) HGB (German Commercial Code), Section 147 (3) AO (German Tax Code), Article 6 (1) Letter c GDPR).

• b. Personal customer account

  We process the registration data required to set up and use your customer account (Article 6 (1) Letter b GDPR). Access to your customer account is only possible after entering your personal password. Please keep your access data confidential. Voluntarily providing your telephone number enables us to make any necessary enquiries regarding your customer account.

  We store the data until you close your account, unless statutory retention or documentation obligations exist due to your orders (see c.).

• c. Orders and catalogue requests

  We initially process your personal data from your orders or catalogue requests in order to process the order or catalogue request and issue invoices (Article 6 (1) Letter b GDPR).

  We store the data relevant to your order or catalogue request and the associated documents (e.g. business letters, invoices) in accordance with legal requirements after completion of the order or catalogue request, pursuant to statutory provisions, for six years (Section 257 (4) HGB) or ten years (Section 147 (3) AO). We also process the information from your orders or catalogue requests for postal advertising and customer analyses (see g. below).

• d. Credit assessment

  For the purpose of deciding on the establishment, performance or termination of a contractual relationship, where we assume a risk of payment default, we may obtain and use probability values concerning your ability and willingness to pay, also determined from address data, from CRIF GmbH, Freisinger Landstraße 74, D-80939 Munich, infoscore Consumer Data GmbH, Rheinstraße 99, D-76532 Baden-Baden, Bürgel Wirtschaftsinformationen GmbH & Co. KG, Gasstraße 18, D-22761 Hamburg, CEG Creditreform Consumer GmbH, Hellersbergstraße 11, D-41460 Neuss and SCHUFA Holding AG, Kormoranweg 5, D-65201 Wiesbaden, using your data (name, address, customer number, date of birth, order value, order date) (Article 6 (1) Letter f GDPR, Section 31 (1) and (2) BDSG).

  We may transmit personal data concerning due, unpaid and undisputed receivables to credit agencies four weeks after receipt of the first of a total of two written reminders, in which we inform you that credit agencies may take the receivables data into account. Where there is a legitimate interest, these agencies may also make this data available to other companies for credit assessments (Article 6 (1) Letter f GDPR, Section 31 (2) No. 4 BDSG).

• e. Refer-a-friend promotion

  If you take part in our refer-a-friend promotion, we initially process the personal data of the referred new customer (address data, communication data, purchase data) to process the order and issue the invoice (Article 6 (1) Letter b GDPR). We process the existing customer's data to check whether the requirements for receiving the promotional reward (gift) are met and to send it (Article 6 (1) Letter b GDPR).

  The statutory retention obligations apply (see c. above).

• f. Voucher offers from Sovendus GmbH

  To select a voucher offer that is currently of interest to you, we transmit the hash value of your e-mail address and your IP address to Sovendus GmbH, Hermann-Veit-Str. 6, 76135 Karlsruhe (Sovendus) in pseudonymised and encrypted form (Article 6 (1) Letter f GDPR). The pseudonymised hash value of the e-mail address is used to take account of any objection to advertising made to Sovendus (Article 21 (3), Article 6 (1) Letter c GDPR). Sovendus uses the IP address exclusively for data security purposes and generally anonymises it after seven days (Article 6 (1) Letter f GDPR). We also transmit the order number, order value with currency, session ID, coupon code and timestamp to Sovendus in pseudonymised form for billing purposes (Article 6 (1) Letter f GDPR). If you are interested in a Sovendus voucher offer, there is no objection to advertising associated with your e-mail address, and you click the voucher banner displayed only in this case, we transmit your salutation, name, postcode, country and e-mail address to Sovendus in encrypted form to prepare the voucher (Article 6 (1) Letters b, f, GDPR).

  For further information about how Sovendus processes your data, please refer to the online data protection information at www.sovendus.de/datenschutz .

• g. Reviews and comments

  When you review or comment on our products, we only require your first name and at most the first letter of your surname, not your full name. You may also publish your contributions under a pseudonym. If you provide your name, you may be found by internet search engines (Article 6 (1) Letter f GDPR).

  We store the information from your comments and reviews for as long as the related products are published on our website. In the case of unlawful comments or reviews, we reserve the right, in accordance with statutory provisions, to store the comment or review for longer or to delete it.

• h. Advertising

  Email advertising/newsletter distribution

  With your consent, which you may revoke at any time, we send you our newsletter by e-mail with our offers and information for the whole family relating to sleeping, bathroom, living, clothing and personalised gift items (Manutextur) (Section 7 (2) No. 3 German Unfair Competition Act, UWG, Article 6 (1) Letter a GDPR).

  We process the mandatory information you provide when giving your consent so that we can address you personally in the newsletter.

  For purchasing customers, we also ask about their satisfaction with the products purchased by e-mail. You may, of course, object to this at any time at basic rates (Section 7 (3) UWG).

  Postal advertising and customer analyses

  We process your data from enquiries, orders and catalogue requests to the extent legally permitted for postal advertising, also in the interests of partner companies in the mail-order sector to which data may be transmitted for their own postal advertising, and for our customer analyses (Article 6 (1) Letter f GDPR).

  Our analyses are regularly pseudonymised on the basis of a customer number.

  Documentation of consents

  To obtain your consent to e-mail advertising, we use the so-called double opt-in procedure online to prevent our e-mail advertising from being sent to the e-mail addresses of persons who have not requested it. In accordance with the requirements of data protection supervisory authorities, your IP address is also recorded and stored for documentation purposes.

  If you send us consent by post, we also store it as a scan or in the original for documentation purposes (Article 7 (1), Article 6 (1) c GDPR).

  Retention period for advertising

  We store the data collected for advertising purposes until we receive a revocation of your consent or your objection to processing your data for advertising purposes (see 7. below).

  Change of purpose

  Should we change the purposes of processing over time, we will inform you in advance by updating this Data Protection Notice.

• i. Online applications

  If you apply for a position at Erwin Müller, we process your address, telecommunications and application data in order to process your application (Section 26 (1) BDSG). Providing the address and telecommunications data marked as mandatory fields is necessary to enable us to assign the application to you and contact you regarding your application. Providing the application data marked as mandatory fields is necessary to assess the prospects of success of your application.

  If the application process ends without employment, your data will be stored for a further six months for documentation purposes and then deleted.

• j. Extended retention periods

  The stated retention periods may be extended accordingly if, in an individual case, particularly if the data is processed for different purposes, a longer statutory or contractual retention period applies.

6. Right to object and withdraw consent at any time

You have the right, at any time and where the legal requirements are met, to object to the processing of your data on grounds relating to your particular situation (Article 21 (1) GDPR).

If you wish to object to the processing of your data for advertising purposes or withdraw consent already given (Article 21 (2) GDPR), a brief message at any time to our Data Protection Officer by e-mail at datenschutz@erwinmueller.de or by post to Erwin Müller Versandhaus GmbH, Datenschutz, Buttstraße 2, D86647 Buttenwiesen is sufficient. Please provide your customer number and your full address. Your data shall then no longer be processed for the advertising purposes covered by the objection or withdrawal of consent.

This does not affect the lawfulness of processing carried out before the objection or withdrawal.

After you object to the processing of your personal data for advertising purposes or withdraw your consent, under Article 21 (3) GDPR we are required by data protection law to add the data required for this purpose (name, address, e-mail address) to our internal advertising suppression list and to store it permanently (block it), solely for this purpose, and use it to compare against our future advertising files (Article 6 (1) Letters c, f, GDPR). This makes it possible to permanently ensure compliance with your objection to advertising or withdrawal of consent.

7. What are cookies and what are they used for?

• a. Cookies

  "Cookies" are small files that are transmitted to your computer's hard drive by your web browser or other programs. They are stored locally on your computer's hard drive and retained for later retrieval. Erwin Müller manages cookies

• b. Use of cookies

  Cookies are used on this website,

  • to enable and ensure the necessary technical functions (Article 6 (1) Letters b, f, GDPR)

  • to analyse visits to our website anonymously and pseudonymously for the purpose of optimising our website (web tracking) (Article 6 (1) Letter f GDPR),

  • to observe the rejection of cookies and/or the withdrawal of your consent to the use of cookies (“Do not track or retarget” cookies). With your consent, cookies are used for the pseudonymised processing of data

  • to make our website user-friendly and optimally tailored to your needs (Article 6 (1) Letter a GDPR) and,

  • to display offers that are as interesting as possible to you on our website and also on websites in affiliated advertising networks (tracking and retargeting) (Article 6 (1) Letter a GDPR) and

  under certain conditions, third party cookies are also set (e.g. for retargeting) to enable third-party functions and technologies (Article 6 (1) Letter a GDPR).

  Session cookies are used only for the respective session. These cookies are deleted after the session ends, i.e. after you leave our website or close the browser window.

  Other cookies remain on your device for a longer period and enable us to recognise your browser the next time you visit.

• c. Deactivating cookies

  You can configure your web browser to notify you when cookies are set or to reject all or at least certain cookies (e.g. only third party cookies) in order to generally prohibit web tracking and retargeting. However, if you deactivate cookies using your browser, various functions on our website will no longer be available to you.

  You can find information about this option for the most commonly used browsers at the following links:

  Microsoft Browser:	https://support.microsoft.com/en-us/help/4027947/microsoft-edge-delete-cookies
  Firefox:	https://support.mozilla.com/en-US/kb/Cookies
  Google Chrome:	https://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95647
  Safari:	https://support.apple.com/guide/safari/sfri11471
  Opera:	https://www.opera.com/help/tutorials/security/privacy/

• d. Our cookies

  An overview of all cookies set by Erwin Müller. If you require further details or would like to adjust your cookie settings, click here .

8. Web tracking and retargeting (anonymised/pseudonymised)

• a. Retargeting

  With your consent, we also use the web tracking and retargeting service of Criteo GmbH, Gewürzmühlstr. 11, D-80538 Munich (Criteo) (Article 6 (1) Letter a GDPR). A cookie is installed on our website and activated when you give your consent. The cookie then sends pseudonymised information about the products you have viewed and purchased to Criteo, so that we can also display our offers and information for the whole family relating to sleeping, bathroom, living, clothing and personalised gift items (Manutextur) to you on websites in Criteo's advertising network.

  If you no longer wish Criteo to collect data or would like to withdraw your consent, you can also deactivate retargeting here .

  usemax advertisement is a service of Emego GmbH, Werdener Str. 36, D-46047 Oberhausen, Germany. When the Erwin Müller website is accessed, a cookie is set for the user via the usemax ad server, which contains a reference to their browsing behaviour. The information obtained through it is used to address the user individually and personally via the website or advertising placements on third-party websites associated with usemax.

  If you no longer wish usemax advertisement to collect data or would like to withdraw your consent, you can also deactivate retargeting here .

  This link causes the browser to set an opt-out cookie. If you erase the opt-out cookie, data collection will start again on your next visit. The objection therefore applies only to the device and web browser on which the opt-out cookie is stored.

  TRG is a service of The Reach Group GmbH, Am Karlsbad 16, D-10785 Berlin, Germany. When the Erwin Müller website is accessed, a cookie is set for the user via the TRG ad server, which contains a reference to their browsing behaviour. The information obtained through it is used to address the user individually and personally via the website or advertising placements on third-party websites associated with The Reach Group.

  If you no longer wish TRG to collect data or would like to withdraw your consent, you can also deactivate retargeting here .

  This link causes the browser to set an opt-out cookie. If you delete the opt-out cookie, data collection will start again on your next visit. The objection therefore applies only to the device and web browser on which the opt-out cookie is stored.

  targeting360GmbH is a service provider in the, Gredinger Str. 28, D-90453 Nuremberg, Germany. When the Erwin Müller website is accessed, a cookie is set for the user via the targeting360 ad server, which contains a reference to their browsing behaviour. The information obtained through it is used to address the user individually and personally via the website or advertising placements on third-party websites associated with targeting360.

  If you no longer wish targeting360 to collect data or would like to withdraw your consent, you can also deactivate retargeting here .

  This link causes the browser to set an opt-out cookie. If you delete the opt-out cookie, data collection will start again on your next visit. The objection therefore applies only to the device and web browser on which the opt-out cookie is stored.

• b. Matomo

  Our website uses Matomo, an open-source software used to collect data for optimising website usage and statistically evaluating website visits. Pseudonymous usage profiles are also created. Cookies are used for this purpose, which are stored on your computer and enable a pseudonymous analysis of your use of our website. (Article 6 (1) Letter f GDPR) The IP address is anonymised immediately after collection and before it is stored.

• c. Emarsys

  We use the Webextend service of our service provider emarsys to create product recommendations from our range that are tailored to you and your interests. To do so, we use existing information, such as confirmations of the receipt and reading of emails, information about computers and internet connection, operating system and platform, your service history, the date and time of the homepage visit, and products you have ordered or viewed. We use this information only in pseudonymised form. We send you offers that match your areas of interest. For example, we also compare which of our advertising emails you open to avoid sending you unnecessary emails. If you do not wish to receive personalised advertising, you may object at any time. A notification sent to our stated contact details is sufficient for this purpose. Alternatively, you can unsubscribe using the unsubscribe link at the end of each advertising e-mail.

• d. AWIN

  We use components from the company AWIN on our website. The operating company of AWIN is AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany.
  AWIN is a German affiliate network that serves as an interface between merchants and sales partners (affiliates).

  Affiliate marketing is an internet-based form of distribution that allows commercial operators of websites, known as merchants or advertisers, to display advertising, which is usually compensated through click or sale commissions, on third-party websites, i.e., at sales partners who are also called affiliates or publishers. The merchant provides an advertising medium, such as an advertising banner or other suitable means of internet advertising, via the affiliate network, which is then integrated by an affiliate on their own websites or promoted via other channels, such as keyword advertising or email marketing.

  AWIN places a cookie on the information technology system of the affected person. What cookies are has already been explained above. The tracking cookie from AWIN stores no personal data. Only the identification number of the affiliate, i.e., the partner mediating the potential customer, as well as the order number of the visitor to a website and the clicked advertising medium are stored. The purpose of storing this data is the processing of commission payments between a merchant and an affiliate, which are handled via the affiliate network, i.e., AWIN.

  The applicable data protection provisions of AWIN can be accessed at AWIN's privacy policy.

  The storage of and access to information in the end user's terminal equipment is carried out in accordance with § 25 para. 1 TTDSG. The legal basis for further data processing is your consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent until the revocation.

9. What happens if integrated YouTube videos are activated and played?

We have integrated YouTube videos on our website, which are stored with YouTube (responsible: Google Inc., Amphitheater Parkway, Mountain View, CA 94043, USA), but can be played directly on our website.

To protect your privacy you must first activate the videos on our site.

If you activate videos, cookies of YouTube or DoubleClick may be stored on your end device and/or be read out, and you will transmit data concerning your use of this website to YouTube / Google (USA), e.g. your IP-address and cookie-ID, the specific address of the site you have visited, system date and time of access, browser-ID (Art. 6 par. 1 f GDPR). You will find information about the purposes and the scope of data collection and data processing by YouTube / Google and about your rights at: https://www.google.de/intl/de/policies/privacy/.

If you do not want YouTube or DoubleClick to obtain data about you by your using our website, you must not activate videos.

When videos are activated, the data will be transmitted, independent of whether you have a user account with YouTube or Google or not. If you are logged in to this account, these data can be directly related to your account. If you do not want this, you should log out of your account prior to activating videos.

10. Logging

Every time a visitor accesses this website, the following data are temporarily stored in a log file (server log files) and processed (Art. 6 par. 1 b, c, f GDPR):

• a description of the type and the version of the used web browser
• the used operating system
• the referrer URL category
• the host name of the accessing end device
• date and time of the server inquiry
• IP-address

These so-called server log data need to be processed to technically provide the service for billing purposes and subsequently to ensure system security and for documentation purposes (Art. 6 par. 1 b, f GDPR). Those data processed for technical purposes and to ensure system security will be anonymised after seven days at the latest by shortening the IP-address, unless the IP-address must be stored for documentation purposes (Art. 6 par. 1 c, Art. 5 par. 2, Art. 7 par. 1 GDPR). The data are further processed in anonymised form for statistical purposes.

11. How can you exercise your data protection rights?

If you have questions concerning the processing of your personal data by us, we will of course be pleased to provide information about the data relating to you (Art. 15 GDPR).

Moreover you have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR), as well as the right to object (Art. 21 GDPR) and the right to data portability (Art. 20 GDPR), provided that the legal requirements of the GDPR are met.

Please contact in all these cases our Data Protection Officer (see above 3.) at the communication addresses given there.

Finally you have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR, Sect. 19 BDSG).

12. Changes and update

It will from time to time be necessary to update this Data Protection Notice. We therefore reserve the right to change its contents at any time. We will publish the updated version of this Data Protection Notice on this site. When you visit our website the next time, you should once again read the Data Protection Notice.

As of: Septembre 2026