Data protection

General Information

This privacy policy provides detailed information about what happens to your personal data when you visit our website. Personal data refers to any information that can be used to identify you personally. We strictly adhere to legal regulations, particularly the General Data Protection Regulation (GDPR), when processing your data and place great emphasis on ensuring that your visit to our website is absolutely secure.

Data Controller

The entity responsible for collecting and processing personal data on this website is:

- **Name:** tre_alpacas | Meidl Family
- **Street and Number:** Am Kirchplatz 1, 97244 Gützingen
- **Country:** Germany
- **Email:** tre.alpacas@gmail.com
- **Phone:** +49 (0) 172 276 86 38

Access Data (Server Log Files)

When you visit our website, we automatically collect and store access data in so-called server log files, which your browser automatically transmits to us. These include:

- Browser type and version used by your computer
- Hostname of the accessing computer
- Date and time of the server request
- The IP address currently used by your computer (possibly in anonymized form)

Typically, we cannot and do not intend to associate this data with any particular person. The processing of this data is carried out in accordance with Art. 6(1)(f) GDPR to protect our legitimate interest in improving the stability and functionality of our website.

Cookies

To make visiting our website more attractive and to enable the use of certain features, we use so-called cookies. These are small text files stored on your device. Cookies cannot run programs or transfer viruses to your computer system.

Cookies that are necessary for electronic communication or to provide specific features requested by you are stored based on Art. 6(1)(f) GDPR. We have a legitimate interest in storing cookies to ensure the error-free and optimized provision of our services. Any other cookies (e.g., cookies used for analyzing your browsing behavior) will be addressed separately in this privacy policy.

Most of the cookies we use are so-called "session cookies." They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser upon your next visit.

You can configure your browser to notify you about the placement of cookies and only allow cookies in individual cases, block cookies in certain cases or in general, and enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of this website.

§1 Web Analysis Tools and Advertising

Social Media

1.1 **Instagram Plugin**

Our website integrates features from the Instagram service provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA ("Instagram"). The plugins are marked with an Instagram logo, for example in the form of an "Instagram camera." An overview of Instagram plugins and their appearance can be found here: [Instagram Badges](http://blog.instagram.com/post/36222022872/introducing-instagram-badges).

To protect your data when visiting our website, the Instagram plugins are only integrated into the page using an HTML link (the so-called "Shariff" solution from c’t). This ensures that when you visit a page on our website that contains such plugins, no connection to Instagram's servers is established. Only when you click on the Instagram button will a new browser window open and Instagram's page be accessed.

For more information about the purpose and scope of data collection, further processing and use of the data by Instagram, as well as your rights and privacy protection options, please refer to Instagram's privacy policy at: [Instagram Privacy Policy](https://instagram.com/about/legal/privacy/).

Contact Form

If you contact us via email or a contact form, the data you provide, including your contact details, will be stored to process your request and for potential follow-up questions. We will not share this data without your consent.

The processing of data entered into the contact form is based solely on your consent (Art. 6(1)(a) GDPR). You can revoke your consent at any time by sending us an informal email. The legality of data processing carried out until the revocation remains unaffected.

Data submitted via the contact form will remain with us until you request its deletion, revoke your consent for its storage, or the purpose for data storage no longer applies. Mandatory statutory provisions, particularly retention periods, remain unaffected.

Duration of Comment Storage

Comments and associated data, such as IP addresses, are stored. The content remains on our website until it is fully deleted or needs to be removed for legal reasons.

Subscribing to Comments

As a user of our website, you can subscribe to comments after registering. We will send you a confirmation email to verify that you are the owner of the provided email address. You can unsubscribe from the comment subscription at any time via a link in the subscription email. The data entered to set up the subscription will be deleted upon unsubscription. If this data has been transferred to us for other purposes and in other locations, it will remain with us.

Comments are stored based on your consent (Art. 6(1)(a) GDPR). You can revoke your consent at any time. For this, an informal message via email is sufficient. The legality of data processing carried out until the revocation remains unaffected.

Customer Account

When you open a customer account, you consent to the storage of your basic data, such as name, address, email address, and bank details, as well as your usage data (username, password). This allows you to place orders with us using your email address and personal password.

Online Payments

If you order goods or services from our online shop, it is necessary for the fulfillment of the contract that you provide personal data required to process your order. The mandatory data necessary for contract processing is marked separately. Depending on the selected payment method, the data required for payment processing will be forwarded to the respective payment service providers. Your data will be processed based on Art. 6(1)(1)(b) GDPR.

PayPal

We use the PayPal online payment service on our website. The service provider is the American company PayPal Inc. For the European region, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg is responsible.

Data processing is mainly carried out by PayPal. This may result in data being processed and stored without anonymization. In addition, U.S. authorities may have access to individual data. It may also be possible that this data is linked to data from other PayPal services where you hold a user account.

You can learn more about the data processed by PayPal in their privacy policy: [PayPal Privacy Policy](https://www.paypal.com/de/webapps/mpp/ua/privacy-full).

Data Usage and Disclosure

The personal data you provide to us, for example, when placing an order or sending an email (e.g., your name, address, or email address), will not be sold or otherwise marketed to third parties. Your personal data will only be used for correspondence with you and only for the purpose for which you provided it to us. We will only share your payment data with the credit institution responsible for processing the payment.

The use of data collected automatically during your visit to our website is solely for the aforementioned purposes. The data will not be used for any other purpose.

We assure you that your personal data will not be disclosed to third parties unless we are legally obligated to do so or you have given us your prior consent.

SSL and TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator, our website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the lock symbol in your browser's address bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

§2 Retention Period

Personal data communicated to us via our website will only be stored for as long as necessary to fulfill the purpose for which it was entrusted to us. Business and tax retention periods may require certain data to be stored for up to 10 years.

§3 Rights of Data Subjects

As a data subject, you have the following rights with respect to the personal data concerning you that we process, based on statutory provisions:

3.1 Right of Withdrawal

Many data processing operations are only possible with your explicit consent. If the processing of your data is based on your consent, you have the right to withdraw consent for the processing of data at any time with future effect in accordance with Art. 7(3) GDPR. The lawfulness of data processing carried out based on consent until the revocation remains unaffected. Data storage for billing and accounting purposes remains unaffected by a revocation.

3.2 Right of Access

You have the right, pursuant to Art. 15 GDPR, to request confirmation from us whether we are processing personal data concerning you. If such processing is taking place, you have the right to information regarding your processed personal data, the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom your data has been disclosed or will be disclosed, the planned retention period or the criteria used to determine the retention period, the existence of the right to rectification, deletion, restriction of processing, objection to processing, the right to lodge a complaint with a supervisory authority, the source of your data if it was not collected by us, the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the logic involved, the scope, and the intended effects of such processing, as well as your right to be informed of the safeguards provided in Art. 46 GDPR when transferring your data to third countries.

3.3 Right to Rectification

You have the right, under Art. 16 GDPR, to request the immediate correction of inaccurate personal data concerning you and/or to have your incomplete data completed.

3.4 Right to Erasure

You have the right to request the deletion of your personal data in accordance with Art. 17 GDPR, provided one of the following reasons applies:

a) Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

b) You withdraw your consent on which the processing is based under Art. 6(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing;

c) You object to the processing under Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing under Art. 21(2) GDPR;

d) The personal data was processed unlawfully;

e) The deletion of personal data is required to fulfill a legal obligation under Union or Member State law to which we are subject;

f) The personal data was collected in relation to the provision of information society services pursuant to Art. 8(1) GDPR.

This right does not apply if the processing is necessary:

a) For the exercise of the right to freedom of expression and information;

b) To fulfill a legal obligation that requires processing under Union or Member State law to which we are subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;

c) For reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) and Art. 9(3) GDPR;

d) For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right is likely to render the achievement of the purposes of this processing impossible or seriously impair it; or

e) To assert, exercise, or defend legal claims.

If we have made your personal data public and are obligated to delete it according to the above, we will take reasonable measures, including technical measures, to inform those responsible for processing the data that you, as the data subject, have requested the deletion of all links to your personal data or of copies or replications of this personal data, taking into account the available technology and implementation costs.

3.5 Right to Restriction of Processing

You have the right to request the restriction (blocking) of the processing of your personal data under Art. 18 GDPR. You can contact us at any time using the address provided in the legal notice. The right to restrict processing applies in the following cases:

a) If you contest the accuracy of your personal data stored with us, we will typically need time to verify this. During the verification period, you have the right to request the restriction of the processing of your personal data.

b) If the processing of your personal data was or is unlawful, you may request the restriction of data processing instead of deletion.

c) If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to request the restriction of the processing of your personal data instead of deletion.

d) If you have objected under Art. 21(1) GDPR, we must balance your interests against ours. As long as it is not yet determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If the processing of your personal data has been restricted, these data may – apart from being stored – only be processed with your consent or for the assertion, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of significant public interest of the European Union or a Member State.

3.6 Right to Notification

If you have exercised your right to rectification, erasure, or restriction of processing against us, we are obligated to notify all recipients to whom your personal data has been disclosed of this rectification, erasure, or restriction of processing unless this proves impossible or involves a disproportionate effort. You have the right, under Art. 19 GDPR, to be informed about these recipients upon request.

3.7 Right Not to Be Subject to Automated Decision-Making – Including Profiling

You have the right, under Art. 22 GDPR, not to be subject to a decision based solely on automated processing – including profiling – that has legal effects concerning you or similarly significantly affects you.

This does not apply if the decision:

a) Is necessary for entering into, or the performance of, a contract between you and us,

b) Is authorized by Union or Member State law to which the controller is subject and these laws include suitable measures to safeguard your rights, freedoms, and legitimate interests, or

c) Is based on your explicit consent.

However, these decisions must not be based on special categories of personal data under Art. 9(1) GDPR unless Art. 9(2)(a) or (g) applies, and suitable measures have been taken to safeguard your rights and freedoms, as well as your legitimate interests.

In the cases referred to in (a) and (c), we will implement suitable measures to safeguard your rights and freedoms and legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express your point of view, and to contest the decision.

3.8 Right to Data Portability

Where processing is based on your consent under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract under Art. 6(1)(b) GDPR and the processing is carried out by automated means, you have the right, under Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller or have it transmitted to another controller, where technically feasible.

3.9 Right to Object

If we process your personal data based on the balancing of interests under Art. 6(1)(f) GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation; this also applies to profiling based on this provision. The respective legal basis on which processing is based can be found in this privacy policy. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defense of legal claims (objection under Art. 21(1) GDPR).

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes, including profiling to the extent it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes (objection under Art. 21(2) GDPR).

You may exercise your right to object in connection with the use of information society services – notwithstanding Directive 2002/58/EC – by automated means using technical specifications.

3.10 Right to Lodge a Complaint with the Supervisory Authority under Art. 77 GDPR

If there is a breach of the GDPR, the data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

The supervisory authority responsible for us is:
**Bavarian Data Protection Authority**
Promenade 18
91522 Ansbach
Postal address:
P.O. Box 1349, 91504 Ansbach
**Phone:** 0981/180093-0
**Email:** poststelle@lda.bayern.de
**Website:** [Bavarian Data Protection Authority] (https://www.lda.bayern.de)

Validity and Changes to This Privacy Policy

This privacy policy is effective as of September 7, 2022. We reserve the right to change this privacy policy at any time in compliance with applicable data protection regulations. This may be necessary, for example, to comply with new legal requirements or to reflect changes to our website or new services offered on our website. The version in effect at the time of your visit will apply.

If this privacy policy is amended, we intend to announce changes to it on this page so that you are fully informed about the personal data we collect, how we process it, and under what circumstances it may be shared.