Privacy Notice

You can find the previous version here.

1 SCOPE AND LEGAL BASIS

(1) This Privacy Notice explains how we process your personal data when you use our online store https://pocketbook.de/ (“online store”).

(2) This Notice does NOT apply to:

personal data that we process about you if you interact with other websites, our branded social media pages, and other websites not operated by us, or in other ways in which you may interact with us as a user of our products and services. In such cases, the relevant privacy notice of each product or service you interact with will apply;

the processing of personal data in connection with the PocketBook Cloud service, which is provided by PocketBook International SA and governed by the separate PocketBook Cloud Privacy Notice;

personal data that we process about you if you are an employee of, or business contractor with, us.

(3) For the purposes of data protection laws, PocketBook Readers GmbH and PocketBook International SA are joint controllers under Article 26 GDPR for the processing of your personal data described in this Privacy Notice. This means that both companies together decide why and how your personal data is processed, and that we are jointly responsible to you under the GDPR. In essence, PocketBook Readers GmbH is responsible for the commercial operation of the online store, and PocketBook International SA is responsible for the underlying platform, database and data governance.

JOINT CONTROLLERS

PocketBook Readers GmbH	PocketBook International SA
Richard-Wagner-Str. 11, 01445 Radebeul, Germany	Crocicchio Cortogna 6, 6900 Lugano, Switzerland
Email: privacy@pocketbook.de	Email: privacy@pocketbook-int.com

For any questions, comments or complaints about how we handle your personal data, or to exercise any of your rights under the GDPR, please use our dedicated data protection channel: privacy@pocketbook.de.

(4) You may exercise your rights in respect of your personal data against either controller. Regardless of which controller you contact, your request will be handled and, where necessary, forwarded to the other controller. Our contact point for data protection matters is privacy@pocketbook.de

(5) Our online store is intended for adults and is not directed at children. We do not knowingly collect or process personal data of children under the age of 16 without the consent of the holder of parental responsibility. If we become aware that we have processed such data without the required consent, we will delete it without undue delay.

2. THE DATA WE COLLECT ABOUT YOU

(1) Depending on how you use our online store, we process the following categories of personal data:

Inventory data (e.g. names and addresses of customers)

Contact details (e.g. email address, telephone number)

Contract data (e.g. services used or products purchased, contract content, contractual communication and payment information)

Usage data (e.g. access times and the websites of our online offering visited, data gathered from cookie files)

Content data (e.g. information on forms or in emails)

Technical data (e.g. device and connection information).

Affiliate marketing data (e.g. online and cookie identifiers, referral information, transaction and order identifiers, purchase values, transaction status and related technical data).

Trustmark, review and buyer protection data (e.g. technical access data, order references and values, hashed email addresses and review-related information, where applicable).

3. HOW WE USE YOUR DATA AND LEGAL GROUNDS WE RELY ON

(1) We process your personal data in particular for the following purposes:

providing the online store, its content and functions;

performing our contractual services and the services available in the online store (including processing orders, delivery of products and digital content, and operating your customer account);

customer service and after-sales services;

responding to requests by which you exercise your data protection rights, and communicating with you;

marketing and analytics;

operating affiliate marketing programmes, tracking referrals and conversions, validating transactions, preventing invalid or fraudulent transactions, measuring campaign performance and administering affiliate commissions;

displaying trustmarks and customer reviews, offering buyer protection and facilitating customer feedback;

ensuring the security and functionality of the online store.

(2) We rely on the following legal grounds for these purposes:

performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR) for providing the online store and its contractual services, processing and delivering orders, operating your account, and customer/after-sales service;

compliance with a legal obligation (Article 6(1)(c) GDPR) for tax, accounting and retention obligations, and for responding to requests by which you exercise your rights;

your consent (Article 6(1)(a) GDPR) for marketing communications, analytics and personalisation, and non-essential cookies and similar tracking technologies, including affiliate referral and conversion tracking , and for accessing and transmitting order information to enable automatic recognition of customers already registered for buyer protection services; you may withdraw your consent at any time with effect for the future;

our legitimate interests (Article 6(1)(f) GDPR) for ensuring the security, stability and functionality of the online store, preventing misuse and fraud, improving our products and services, displaying trustmarks and customer reviews, administering affiliate marketing programmes, validating transactions attributed to affiliate partners, preventing invalid or fraudulent transactions and calculating affiliate commissions based on lawfully collected transaction data and for direct marketing of our own similar products and services to our existing customers by e-mail in accordance with Section 7(3) of the German Act Against Unfair Competition (UWG); you may object to such direct marketing at any time and free of charge.

(3) Where we rely on our legitimate interests, we have weighed those interests against your interests, rights and freedoms. You may object to such processing on grounds relating to your particular situation, and you may object to direct marketing at any time (see § 9).

(4) Providing your data is not a legal obligation and your consent is voluntary; however, if you do not provide data necessary for a purpose above, we may be unable to provide the corresponding function or service.

(5) Access data and log files. Based on our legitimate interests (Article 6(1)(f) GDPR), we collect data about each access to the server on which the online store is hosted (server log files). This data is technically necessary to display the website to you and to ensure its stability and security. It includes, in particular, the name of the page and file accessed, the date and time of access, the amount of data transferred, notification of successful access, browser type and version, your operating system, the previously visited page, and the IP address. Log file data is stored for security purposes (for example, to investigate misuse or fraud) for a maximum of ninety days and then deleted; data whose further storage is necessary for evidentiary purposes is retained until the relevant incident has been finally resolved.

(6) Registration and customer account. Using our products and services, in particular buying our e-readers and digital content (e-books and audiobooks), requires you to register a customer account in our online store. During registration we collect the mandatory data you provide (name, e-mail address and password); when you log in, we collect your e-mail address and password; and for security purposes we store the date, time and IP address of each registration and login (Article 6(1)(f) GDPR). When you place an order, we collect your address and payment information (see § 6) and, where you provide them, further data such as a telephone number or additional delivery addresses. In your customer account you can view and manage your orders, the devices you use, your wish list and your personal data. We process this data to perform the contract and operate your account (Article 6(1)(b) GDPR). You may close your account at any time by notifying us, for example by e-mail.

(7) When you first purchase digital content, a PocketBook Cloud account is created for you so that the purchased content can be made available through PocketBook Cloud. PocketBook Cloud is operated by PocketBook International SA, and its processing of personal data is governed by the separate PocketBook Cloud Privacy Notice. You may also use the "Send-to-PocketBook" service on our e-readers, using your online store login details, to send digital content stored on the device by e-mail.

4. WHAT COOKIES DO WE USE

(1) When you use our online store, we use cookies and similar technologies. Some are strictly necessary to provide the online store and are used without your consent, as permitted under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Others are not strictly necessary and are used only with your consent (Section 25(1) TDDDG and, where personal data is processed on the basis of consent, Article 6(1)(a) GDPR).

(2) You can give, refuse or withdraw your consent at any time, with effect for the future, through our cookie consent management tool.

(3) Detailed information about the cookies and similar technologies we use, their purpose, duration and providers, and how to manage them, is set out in our separate Cookies Declaration, which forms part of this Privacy Notice.

5. MARKETING AND COMMUNICATIONS

(1) Newsletter and e-mail marketing. We send our newsletter and promotional e-mails either with your consent (Article 6(1)(a) GDPR), obtained through a double opt-in procedure, or, in the case of our existing customers, on the basis of our legitimate interest in direct marketing of our own similar products and services (Article 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition (UWG)). You may unsubscribe or object at any time, free of charge, using the link in each message or in your customer account.

(2) Reminders about an uncompleted order. Where you are our customer and have not completed an order, we may send you a reminder by e-mail on the basis of our legitimate interest (Article 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act Against Unfair Competition (UWG). You may object at any time, free of charge.

(3) Push notifications. Where you have enabled them, we may send push notifications about our offers (Article 6(1)(a) GDPR). You can disable them at any time in your device or application settings.

(4) Online advertising. We display advertising and measure its effectiveness using cookies and similar technologies, where you have consented (Article 6(1)(a) GDPR). We also operate affiliate marketing programmes to track referrals from partner websites, attribute resulting purchases and other conversions, validate transactions, prevent invalid or fraudulent transactions, measure campaign performance and administer affiliate commissions.

Affiliate tracking cookies and similar technologies are used only with your consent. Details of the technologies used are available in our Cookie Declaration, while information about the relevant providers and their roles is provided in our List of Processors and Data Recipients.

(5) Trustmarks, customer reviews and buyer protection.

We display trustmarks and customer reviews on our online store and offer buyer protection services. When trustmarks or review widgets are displayed, technical access data, including your IP address, date and time of access and request information, may be processed. IP addresses are anonymised immediately after collection. This processing is based on our legitimate interests in promoting a trustworthy shopping environment (Article 6(1)(f) GDPR).

With your prior consent (Article 6(1)(a) GDPR), the Trustbadge may access order information stored on your device after a purchase, including the order number, order value and your email address. Your email address is hashed before being transmitted to the service provider together with the relevant order information. This allows the provider to determine whether you are already registered for buyer protection or related services.

If you do not consent to automatic recognition, you may still choose to register for or activate buyer protection separately through the Trustcard. Further processing of personal data in connection with services you choose to use is governed by your agreement with the service provider.

Further information about the provider, the categories of data processed and the respective responsibilities is available in our List of Processors and Data Recipients.

(6) To honour your objections and unsubscribe requests, we keep a record of the contacts that have opted out, so that we do not contact them again (Article 6(1)(f) GDPR). The names of the providers we use for these communications are listed on our List of Processors and Data Recipients page (see § 6).

(7) This section concerns promotional communications only. Messages necessary to perform your order (such as order confirmations) are not marketing and are covered by § 3.

6. RECIPIENTS AND PROCESSORS

(1) We share your personal data only where necessary and lawful. Depending on the processing activity, we may disclose your data to the following categories of recipients:

payment service providers;

communications and marketing providers (for example, for e-mail newsletters, reminders and push notifications);

analytics and personalisation providers;

advertising partners and affiliate marketing network providers;

search and merchandising providers;

customer support providers;

IT, hosting and infrastructure providers;

other companies within the PocketBook group;

trustmark, buyer protection, rating and review providers;

courts, authorities and other public bodies, where we are legally required to disclose data.

(2) Most of these recipients act as our processors under Article 28 GDPR and process your data only on our instructions and under a data processing agreement. With certain advertising and review partners we act as joint controllers under Article 26 GDPR. In that case, you may exercise your rights against either joint controller.

(3) Payments. We use a payment service providers to process payments (Article 6(1)(b) GDPR). Depending on the selected payment method, the relevant provider processes the information necessary to authorise and complete the transaction. We receive payment confirmation, transaction identifiers and other information necessary to process your order. If you choose to save a card for future purchases, it is stored in pseudonymised (hashed) form by the provider on our behalf; you may remove it at any time in the "Payment Details" section of your account. The provider may transmit data to credit agencies to verify identity and creditworthiness.

(4) Joint controllers. For certain advertising, affiliate marketing, trustmark, buyer protection and review services, we and the respective provider are joint controllers under Article 26 GDPR for the collection and transmission of the relevant data. In essence, each party is responsible for the processing it carries out. You may exercise your rights against either party, and a request made to us will, where necessary, be forwarded. Further details are available from the respective provider and on our List of Processors and Data Recipients page.

(5) A current and specific list of the processors and other recipients we use, including their identity, the service they provide and the applicable safeguards, is available on our List of Processors and Data Recipients, which forms part of this Privacy Notice. We keep that list up to date, so that changes to individual providers do not require amending this Privacy Notice.

(6) Information about transfers of personal data outside the EEA is set out in § 7.

7. INTERNATIONAL TRANSFERS

(1) In most cases, your personal data is processed within the European Economic Area (EEA). Where we transfer personal data to a third country (outside the EU/EEA), we do so only if the requirements of Articles 44 et seq. GDPR are met.

(2) Such transfers take place on the basis of an adequacy decision of the European Commission for the country concerned or, in the absence of an adequacy decision, on the basis of appropriate safeguards, in particular the European Commission's Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions).

(3) Within our group, personal data may be transferred to PocketBook International SA in Switzerland. Switzerland is recognized by the European Commission as providing an adequate level of data protection, so this transfer does not require additional safeguards.

(4) The recipients located outside the EEA and the safeguards applicable to each are identified on our List of Processors and Data Recipients.

8. HOW LONG WE RETAIN YOUR DATA

(1) We keep your personal data only for as long as necessary for the purposes for which it was collected, or for as long as required by law. Where data is no longer needed, we delete or anonymise it.

(2) The main retention periods are:

Contract and order data: for the duration of the contract and thereafter until the expiry of the applicable statutory periods for defect liability and limitation of claims (as a rule, up to three years; the statutory period for defect liability in goods is 24 months);

Tax and accounting records: for the statutory retention periods under German tax law, as a rule eight years for accounting documents such as invoices and order records, and ten years for books, inventories and annual financial statements (Article 6(1)(c) GDPR);

Customer account data: until you close your account, unless we are legally required to retain it;

Marketing data: for as long as your consent is valid or until you object; we may keep a record of unsubscribed contacts in order to honour your objection;

Server log files: a maximum of ninety days (see § 3);

Data from the handling of your data protection requests: up to five years;

Cookie and analytics data: for the storage periods indicated in our Cookies Declaration.

Affiliate marketing and conversion data: for as long as necessary to attribute and validate transactions, administer affiliate commissions, prevent fraud and resolve related disputes, subject to applicable legal retention requirements. The storage periods of affiliate tracking cookies and similar technologies are specified in our Cookies Declaration and cookie consent management tool.

(3) Where data must be retained for legal reasons but no longer actively processed, we restrict its processing accordingly until deletion is permitted.

9. WHAT RIGHTS DO YOU HAVE

(1) Under the GDPR, you have the following rights in relation to the personal data we hold about you:

Right of access (Article 15 GDPR). You can ask us to confirm whether we process your personal data and, if so, to provide you with a copy of that data together with information about how and why we use it, who we share it with, and how long we keep it. For example, you can ask for an overview of the data held in your customer account and your order history.

Right to rectification (Article 16 GDPR). You can ask us to correct any inaccurate data and to complete any incomplete data we hold about you, for example, an outdated delivery address or a misspelled name. You can also update most of this data yourself in your customer account.

Right to erasure (Article 17 GDPR). You can ask us to delete your personal data where it is no longer needed for the purposes for which it was collected, where you withdraw your consent, or where you successfully object to processing. This right does not apply where we are legally required to keep the data, for example for tax and accounting purposes.

Right to restriction of processing (Article 18 GDPR). You can ask us to temporarily limit the processing of your data, for example while we verify its accuracy after you have contested it, or while we assess an objection you have raised.

Right to data portability (Article 20 GDPR). Where we process your data by automated means on the basis of your consent or a contract, you can ask to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another provider where technically feasible.

Right to object (Article 21(1) GDPR). You can object, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop that processing unless we have compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.

(2) Objection to direct marketing (Article 21(2) GDPR). You can object to the use of your data for direct marketing at any time, without giving any reason and free of charge. If you do, we will stop using your data for that purpose, including any related profiling. You can also unsubscribe directly using the link in each marketing message or the settings in your customer account.

(3) Withdrawal of consent (Article 7(3) GDPR). Where we process your data based on your consent, you can withdraw that consent at any time with effect for the future. Withdrawing consent does not affect the lawfulness of any processing we carried out before you withdrew it.

(4) How to exercise your rights. To exercise any of your rights, or if you would like more information about these rights or the rights that may apply in your country, please contact us:

PocketBook Readers GmbH	PocketBook International SA
Richard-Wagner-Str. 11, 01445 Radebeul, Germany	Crocicchio Cortogna 6, 6900 Lugano, Switzerland
Email: privacy@pocketbook.de	Email: privacy@pocketbook-int.com

or use our dedicated data protection channel: privacy@pocketbook.de. We may need to request specific information from you to confirm your identity before we act on your request. Responding to your request is free of charge, unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act. We will respond within the time limits set by the GDPR.

(5) Right to lodge a complaint (Article 77 GDPR). If you believe we process your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority. You may do so in particular with:

the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Maternistraße 17, 01067 Dresden, Germany, www.datenschutz.sachsen.de, which is the competent authority for PocketBook Readers GmbH (established in Radebeul, Saxony); and

the Swiss Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch, as one of the joint controllers (PocketBook International SA) is established in Switzerland.