Privacy policy

Translation for convenience; the German version is legally binding.

This page explains which personal data we process when you visit konzept-living.de or order from us, why we do so and which rights you have.

1. Who is responsible?

Konzept 11 GmbH
Waldweg 7
17321 Löcknitz
Germany
Managing director: Pavel Zalatukhin
Phone: +49 39744 873600
E-mail: info@konzept-living.de

We have not appointed a data protection officer because we are not legally required to. For any data protection question you can reach us at the e-mail address above.

2. Legal bases at a glance

Contract (Art. 6(1)(b) GDPR): where we need data to process your order or enquiry.
Legal obligation (Art. 6(1)(c) GDPR): for example keeping invoices under commercial and tax law.
Legitimate interest (Art. 6(1)(f) GDPR): for example a secure and stable operation of the shop.
Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG): for example for statistics or the newsletter. You can withdraw consent at any time with effect for the future.

Without consent we store or read information on your device only where this is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG).

3. Hosting, e-mail delivery and server logs

The shop runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR). A service provider that maintains the shop on our behalf may access data for that purpose (Art. 28 GDPR).

We send all e-mails of the shop (order confirmations, newsletter, replies to forms, confirmations of receipt of a withdrawal) through the e-mail server of home.pl S.A., Szczecin, Poland; our mailbox, through which we receive your messages, is hosted there too. home.pl processes the content and addresses of these e-mails on our behalf (Art. 28 GDPR). It is based in the EU.

With every request the server stores technical details: IP address, date and time, the page requested, the amount of data transferred, the previously visited page, and browser and operating system. We need these details to deliver the shop, find errors and fend off attacks (Art. 6(1)(f) GDPR). The logs are not combined with other data and are deleted as soon as they are no longer needed for these purposes.

The shop is delivered exclusively encrypted via HTTPS.

4. Cookies and cookie settings

On your first visit a notice asks which cookies you agree to. You can change your choice at any time via the "Cookie settings" link at the bottom of every page.

Technically necessary, set without consent (§ 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR), in particular:

Session cookie (session-): keeps the cart and your login together, deleted when you close the browser.
timezone: your time zone, so that dates and times are shown correctly, 30 days.
cookie-preference and cookie-config-hash: store your choice in the cookie notice, 30 days.
kz-consent-id: a random identifier under which we can prove your choice in the cookie notice, 365 days.
paypal-cookie-key: required for paying with PayPal.
sw-states and sw-cache-hash: make sure that with a cart or a login you see your own pages and not cached ones, for the duration of the session.
sw-currency: the currency you selected.
In your browser's local storage we keep the layout of the cart so that it loads faster, and entries in contact and enquiry forms so that they are not lost when the page reloads.

Comfort, only with your consent: wishlist-enabled lets your device remember the wishlist without a customer account, 30 days.

Statistics, only with your consent: google-analytics-enabled allows Google Analytics (see section 11), 30 days. Google Analytics then sets the cookies _swag_ga_ga and _swag_ga_ga_M24J7Y5TZL, up to 2 years.

With your consent to statistics or marketing our shop also stores in your browser's local storage: kz-ga-cart (the cart last seen, with items and quantities, so that adding and removing are reported correctly) and kz-ga-sent-orders (the last reported order numbers, up to 20, so that an order is counted only once). Session storage holds kz-ga-cart-intent and kz-ga-step-…, which disappear when you close the tab. If you arrive through a Google ad, we store the click identifier (gclid) from the address in local storage, only with your consent to statistics; it is deleted when you withdraw.

Marketing, only with your consent, selectable individually:

kz-meta-enabled: allows the Meta Pixel (see section 12), 30 days.
kz-tiktok-enabled: allows the TikTok Pixel (see section 13), 30 days.
google-ads-enabled: allows Google's advertising features (see section 11), 30 days.

These services set cookies of their own: _fbp and _fbc (Meta, up to 90 days), _ttp, _tt_enable_cookie and ttcsid (TikTok, according to TikTok up to 13 months) and advertising cookies from Google.

Proof of your choice: because we must be able to prove that consent was given (Art. 7(1) GDPR), with every answer in the cookie notice we store the identifier from kz-consent-id, your choice per category, the version of the notice, the language and the time (Art. 6(1)(c) GDPR). We do not store your IP address or customer account with it. The entries are deleted after three years.

5. Customer account and guest orders

You can create a customer account or order as a guest. For the account we store name, salutation, e-mail address, password (encrypted), addresses and your orders, so that you can order faster and see your orders (Art. 6(1)(b) GDPR). We delete your account on request; data we are required to keep is blocked until the retention period ends.

Businesses apply for a trade account through a separate registration form. For this we also collect the company and VAT ID; we activate the account after checking the details (Art. 6(1)(b) GDPR).

6. Orders and contract processing

For an order we process name, billing and delivery address, e-mail address, phone number where given, the goods ordered, payment method and payment status (Art. 6(1)(b) GDPR). We keep invoices and accounting records for as long as commercial and tax law requires, up to ten years depending on the record (Art. 6(1)(c) GDPR).

Involved in processing your order are:

Shipping: the carrier commissioned with delivery receives your name and delivery address.
Order and stock management: orders are managed in BaseLinker, a service of BaseLinker sp. z o.o., Plac Solny 15, 50-062 Wrocław, Poland, acting on our behalf (Art. 28 GDPR). Invoices are also created there.
Payment: see section 7.

6a. Withdrawal via the online form

With the "Withdraw from contract" form (button at the bottom of every page) you can declare your withdrawal online. We process your name, e-mail address, the order number, your message where given, and the date and time of receipt. You immediately receive a confirmation of receipt by e-mail, and a further e-mail with the same details goes to us. The shop does not store the declaration itself; it exists only in these e-mails.

The purpose is to handle your withdrawal. The legal bases are our legal obligation to confirm receipt (§ 356a German Civil Code, Art. 6(1)(c) GDPR) and performance of the contract (Art. 6(1)(b) GDPR). We keep the details for as long as withdrawal and warranty claims can be asserted and, where they form part of accounting and invoice records, for as long as commercial and tax law require, up to ten years.

7. Payment

Payments by PayPal, credit or debit card, SEPA direct debit and Pay Later are processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal receives your order and payment data for this and, for direct debit and Pay Later, may decide on the payment method after its own credit check, for which PayPal itself is responsible.

If you use the PayPal button on the product page, in the cart or at login, PayPal sends us your name, e-mail address, delivery address and, where available, your phone number; we use them to create a guest account for the order (Art. 6(1)(b) GDPR).

So that the payment buttons are ready, our pages load program code from PayPal shortly after they open. PayPal thereby receives technical data such as your IP address. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in offering secure and common payment methods (Art. 6(1)(f) GDPR). PayPal may also transfer data to countries outside the EU. More in PayPal's privacy statement: paypal.com.

With a bank transfer (prepayment) you pay directly into our bank account; our bank receives the details of your transfer.

8. Newsletter

For the newsletter we only need your e-mail address. After signing up you receive an e-mail with a confirmation link; you are subscribed only once you click it (double opt-in). We store the time of sign-up and confirmation as proof of your consent (Art. 6(1)(a) GDPR).

After confirmation you receive a personal voucher code for 10 % off your first order, valid for 30 days. We store the code together with your e-mail address so that only you can redeem it.

The newsletter is sent from our shop, without an external newsletter service; the e-mails go through the e-mail server of home.pl (see section 3). You can unsubscribe at any time via the link in every issue or by e-mail to us. After unsubscribing you receive no further newsletters; your address stays stored with a note of the unsubscription so that we can respect and prove your objection (Art. 6(1)(c) and (f) GDPR). On request we delete it completely.

9. Contact and wholesale enquiries

If you write to us via the contact form or by e-mail, or call us, we process your details to answer your request (Art. 6(1)(b) GDPR for questions about an order, otherwise Art. 6(1)(f) GDPR). We delete them once your request has been dealt with, unless we are required to keep them.

Businesses request trade terms via the form on the wholesale page. For this we store company, VAT ID where given, name, e-mail address, phone number where given and your message in our shop system in order to make you an offer (Art. 6(1)(b) GDPR). We also keep an internal processing status and a note on your enquiry. If no business relationship results, we delete the enquiry as soon as we no longer need it, or earlier on request.

Our mailbox is operated on our behalf by home.pl S.A., Szczecin, Poland (Art. 28 GDPR, see section 3). Technical logs of our shop system that may contain a copy of a form message are deleted or overwritten regularly.

10. Reviews and wishlist

With a customer account you can review products. We publish the stars, title, text, the photos or videos you upload and your first name with the initial of your surname. If you bought the product from us, the review is marked as a verified purchase. We check every review before publishing it. The legal basis is the consent you give by submitting the review (Art. 6(1)(a) GDPR); on request we delete your review including photos and videos.

We store the wishlist in your customer account. Without an account your device remembers the list if you have agreed to comfort cookies.

11. Google Analytics

Only if you agree to statistics in the cookie notice do we load the Google tag (gtag.js) or Google Tag Manager and, through it, Google Analytics 4 of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics shows us how the shop is used, for example which pages are viewed and which products are added to the cart or bought. Google processes details about your device and your visit and a pseudonymous identifier; according to Google, the IP address is not stored. Data may be transferred to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Google Analytics keeps event and user data for 14 months and then deletes it.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via "Cookie settings". More: policies.google.com/privacy.

Google Signals and advertising features: If you also agree to "Google advertising" in the cookie notice, we activate Google Signals and ad personalisation. Google then links visit data with the Google accounts of signed-in users who have allowed ad personalisation and uses it for cross-device reports and audiences. Google sets advertising cookies for this. We pass on your consent choices through Google Consent Mode; without your consent these features stay off. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via "Cookie settings"; you can also switch off ad personalisation in your Google account at adssettings.google.com.

12. Meta Pixel and Conversions API

Only if you agree to marketing for Meta in the cookie notice do we load the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"), and additionally send the same events from our server to Meta (Conversions API). Events are page and product views, adding to the cart, starting the checkout, the order itself (product numbers, order value), searches (the search term) and contact and newsletter enquiries.

In doing so we and Meta process your IP address, browser details and the cookie identifiers _fbp and _fbc. For orders we also send the e-mail address, an internal customer identifier and, where given, the phone number, and for logged-in customers the e-mail address and customer identifier with the other events too, each hashed beforehand with SHA-256. We use this to measure the success of our advertising, improve ads and build audiences.

We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR). In essence: we obtain your consent and inform you; Meta fulfils data subject rights for the processing carried out by Meta. The agreement is available at facebook.com/legal/controller_addendum. Meta alone is responsible for any further processing by Meta: facebook.com/privacy/policy. Data is transferred to Meta Platforms, Inc. in the USA; Meta is certified under the EU-US Data Privacy Framework.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via "Cookie settings".

13. TikTok Pixel and Events API

Only if you agree to marketing for TikTok in the cookie notice do we load the TikTok Pixel of TikTok Technology Limited, The Sorting Office, Ropemaker Place, Dublin 2, D02 HD23, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom (together "TikTok"), and additionally send the same events from our server to TikTok (Events API). Section 12 lists these events.

In doing so we and TikTok process your IP address, browser details and the cookie identifier _ttp. For orders we also send the e-mail address, an internal customer identifier and, where given, the phone number, and for logged-in customers the e-mail address and customer identifier with the other events too, each hashed beforehand with SHA-256. The purpose is to measure the success of our advertising, improve ads and build audiences.

We are jointly responsible with TikTok for collecting and transmitting this data to TikTok and for the measurement and reporting based on it (Art. 26 GDPR). In essence: we obtain your consent and inform you; TikTok enables you to exercise your rights under Art. 15 to 20 GDPR for the data TikTok stores after the transmission. Please address such requests to TikTok via tiktok.com/legal/report/privacy. TikTok alone is responsible for any further processing, such as building audiences and delivering and optimising ads: tiktok.com/legal/page/global/partner-privacy-policy/en. TikTok matches hashed e-mail addresses and phone numbers as our processor.

According to TikTok, bodies outside the EU may also access data, including in China and the United Kingdom; TikTok states that it uses standard contractual clauses for this. More: tiktok.com/legal/page/eea/privacy-policy/en.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via "Cookie settings".

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time for the future (Art. 7(3) GDPR). A short e-mail to us is enough.

Right to object (Art. 21 GDPR): where we process data on the basis of a legitimate interest, you can object at any time on grounds relating to your particular situation. You can object to the use of your data for direct marketing at any time without giving reasons.

You can lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Mecklenburg-Vorpommern, datenschutz-mv.de.

15. Other information

We mark the details required for an order, an account or an enquiry as mandatory fields; without them we cannot conclude the contract or deal with the enquiry. We do not use automated decision-making under Art. 22 GDPR.

Last updated: October 2026

Language & currency