Privacy Policy

This English version is a translation provided for your convenience. In case of doubt, the German version shall prevail.

Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This only applies insofar as no other information is given for the processing operations below.

“Personal data” is any information relating to an identified or identifiable natural person.

Server log files

You can visit our websites without providing any personal information.

Each time our website is accessed, usage data is transmitted by your internet browser to us or our web host / IT service provider and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred and the requesting provider.

The processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in ensuring the trouble-free operation of our website and in improving our offer.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the EU Commission exists for Canada. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission's standard contractual clauses.

Contact

Controller / data protection officer

Contact us if you wish. The controller responsible for data processing is: Axel Schickling, Wöstendöllen 95-96, 49429 Visbek, Germany, +49 4445 988144, info@towflexx.de

You can reach our data protection officer directly at: Axel Schickling

Customer-initiated contact by e-mail

If you contact us on your own initiative by e-mail, we collect your personal data (name, e-mail address, message text) only to the extent you provide it. The data processing serves to handle and respond to your enquiry.

If the contact serves the implementation of pre-contractual measures (e.g. advice in the event of interest in a purchase, preparation of a quotation) or concerns a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) (b) GDPR.

If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in handling and responding to your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6 (1) (f) GDPR.

We only use your e-mail address to process your enquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form

When you use the contact form, we collect your personal data (name, e-mail address, message text) only to the extent you provide it. The data processing serves the purpose of making contact.

We only use your e-mail address to process your enquiry. Your data will then be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Use of Google Maps API address validation

On our website we use the address validation of the provider Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, “Google”).

The data processing serves the purpose of checking your entries in our address forms in real time for input and spelling errors and, where applicable, adding missing data. If data has been entered incorrectly, alternative suggestions for correcting the data are displayed. For this purpose, the address data you enter is transmitted to the provider, stored and evaluated there.

Among other things, the following information may be transmitted to and processed by Google: postal addresses (country, city, postcode, street, house number), e-mail address, telephone number.

Your data may also be transferred to the USA. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has thereby undertaken to comply with European data protection principles.

Your personal data is processed on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in a correct data basis for fulfilling our contractual obligations. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

The data is processed separately by the provider and is not combined with other data. It is deleted by the provider as soon as the status of the entered data has been determined, but no later than after 30 days.

Further information on Google's terms of use and data protection can be found at: https://cloud.google.com/maps-platform/terms and https://www.google.de/policies/privacy/.

Collection and processing when using the application form

When you use the application form, we collect your personal data only to the extent you provide it. This includes your contact details (e.g. name, e-mail address, telephone number), information on your professional qualifications and education, information on further professional training and performance-related certificates.

The data processing serves the purpose of making contact and deciding on the establishment of an employment relationship with you. The provision of the data is necessary to carry out the application process. Your personal data is processed on the basis of Art. 6 (1) (b) GDPR in conjunction with § 26 (1) BDSG (German Federal Data Protection Act) for the implementation of pre-contractual measures (going through the application process as the initiation of an employment contract).

If you have given us consent to process personal data for inclusion in our applicant pool, e.g. by ticking a checkbox, the processing is carried out on the basis of Art. 6 (1) (a) GDPR. You can withdraw your consent from us at any time without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal.

If special categories of personal data within the meaning of Art. 9 (1) GDPR are requested from applicants in the course of the application process, such as information on the degree of severe disability, this is done on the basis of Art. 9 (2) (b) GDPR so that we can exercise the rights arising from labour law and social security and social protection law and fulfil our obligations in this regard.

We store your personal data for as long as is necessary to decide on your application. Your data will then be deleted no later than after six months, unless you have consented to further processing and use. If the application process is followed by an employment relationship, the data provided will be further processed on the basis of Art. 6 (1) (b) GDPR in conjunction with § 26 (1) BDSG for the purposes of carrying out the employment relationship and then transferred to the personnel file.

Customer account, orders

Customer account

When you open a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal. Your customer account will then be deleted.

Collection, processing and disclosure of personal data for orders

When you place an order, we only collect and process your personal data insofar as this is necessary to fulfil and process your order and to handle your enquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded. The processing is carried out on the basis of Art. 6 (1) (b) GDPR and is necessary for the performance of a contract with you.

Your data is disclosed, for example, to shipping companies, dropshipping or fulfilment providers, payment service providers, service providers for order processing and IT service providers. In all cases, we strictly observe the legal requirements. The scope of the data transfer is limited to a minimum.

Reviews

Review reminder

After your order, we would like to ask you to rate your purchase with us.

For this purpose, we use your personal data (name, e-mail address, order information) independently of the contract processing to send you a review reminder by e-mail after an order has been placed, provided you have expressly consented to this.

The processing is carried out on the basis of Art. 6 (1) (a) GDPR with your consent. You can withdraw your consent at any time using the corresponding link in the e-mail or by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal.

Inventory management

Use of an external inventory management system

We use an inventory management system for contract processing as part of commissioned processing. For this purpose, your personal data collected in the course of the order is transmitted to

Demand Software Solutions GmbH, Am Tannenkamp 27, 49439 Steinfeld, Germany.

The processing of your personal data serves the purpose of fulfilling the contract concluded with you and is carried out on the basis of Art. 6 (1) (b) GDPR.

Payment service providers

Use of Klarna payment options

On our website we use the payment service of Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; “Klarna”). When you select and use payment via Klarna, the data required for payment processing is transmitted to Klarna in order to be able to fulfil the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) (b) GDPR.

Cookies may be stored in the process that enable your browser to be recognised. The resulting data processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in a customer-oriented offer of different payment methods. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

“Pay Later” (invoice), “Pay Now” (payment by direct debit, credit card, instant bank transfer), “Financing” (instalment purchase)

For individual payment methods such as “Pay Later” (invoice), “Pay Now” (payment by direct debit, credit card, instant bank transfer), “Financing” (instalment purchase), Klarna reserves the right to obtain a credit report, where applicable, on the basis of mathematical-statistical methods using credit agencies.

For this purpose, Klarna transmits the personal data required for a credit check, such as first and last name, address, gender, e-mail address, IP address and data related to the order, to a credit agency for the purpose of identity and credit checks and uses the information received about the statistical probability of a payment default for a balanced decision on the establishment, performance or termination of the contractual relationship. The credit report may contain probability values (score values) that are calculated on the basis of scientifically recognised mathematical-statistical methods and in whose calculation, among other things, address data is included. Your legitimate interests are taken into account in accordance with the statutory provisions. The data processing serves the purpose of a credit check for the initiation of a contract. The processing is carried out on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in protection against payment default if Klarna makes an advance payment. You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6 (1) (f) GDPR by notifying Klarna. The provision of the data is necessary for the conclusion of the contract with the payment method you have chosen. Failure to provide it means that the contract cannot be concluded with the payment method you have chosen.

Further information, in particular to which credit agencies Klarna passes on your personal data, can be found at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies.

General information on Klarna can be found at: https://www.klarna.com/de/. Your personal information is handled by Klarna in accordance with the applicable data protection regulations and as set out in Klarna's privacy policy at https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy.

Use of PayPal

When you pay via PayPal, we pass on your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”) as part of payment processing. In particular, name, address, e-mail address, order data and invoice amount are transmitted. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract). PayPal reserves the right to carry out a credit check where applicable. Further information on data protection at PayPal can be found at https://www.paypal.com/de/legalhub/paypal/privacy-full.

Use of Shopify Payments and Shop Pay

We process payments by credit card, Apple Pay and Google Pay via Shopify Payments. In the process, your payment and order data is transmitted to Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, and the integrated payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. The legal basis is Art. 6 (1) (b) GDPR.

If you actively select the option “Save my information for faster checkout” (Shop Pay) at checkout, your contact, delivery and payment data will be stored by Shopify in order to prefill it for future purchases in shops using Shop Pay. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR, which you can withdraw at any time with effect for the future. A transfer to third countries (in particular Canada and the USA) is possible; it takes place on the basis of the safeguards described above under “Server log files”. Further information: https://www.shopify.com/legal/privacy/app-users.

Cookies

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on a user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting appropriate technical settings in your internet browser, you can be notified before cookies are set, decide individually whether to accept them, and prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. However, please note that you may then not be able to use all the functions of this website to their full extent.

The links below explain how you can manage (and, among other things, deactivate) cookies in the most important browsers:

Chrome: https://support.google.com/accounts/answer/61416?hl=en

Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

Mozilla Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop

Safari: https://support.apple.com/en-gb/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Technically necessary cookies

Unless otherwise stated in the privacy policy below, we only use these technically necessary cookies for the purpose of making our offer more user-friendly, effective and secure. Cookies also enable our systems to recognise your browser even after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

The use of cookies or comparable technologies is based on § 25 (2) TDDDG (German Telecommunications Digital Services Data Protection Act). Your personal data is processed on the basis of Art. 6 (1) (f) GDPR on the basis of our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our offer.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you.

Use of the Shopify consent tool (Shopify Privacy & Compliance)

On our website we use the consent tool “Shopify Privacy & Compliance” of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”). Shopify is an affiliate of Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The tool enables you to give consent to data processing via the website, in particular the setting of cookies, and to exercise your right to withdraw consent already given. The data processing serves the purpose of obtaining and documenting required consents to data processing and thus complying with legal obligations. Cookies may be used for this purpose. User information, including your IP address, is collected and transmitted to Shopify.

The data processing is carried out to fulfil a legal obligation on the basis of Art. 6 (1) (c) GDPR.

Further information on data protection at Shopify can be found at https://www.shopify.com/legal/privacy.

Analytics, advertising tracking, AI tools

Use of Shopify analytics

On our website we use the statistics and analysis functions of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”) as part of commissioned processing. Shopify is an affiliate of Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The data processing serves the purpose of analysing this website and its visitors. For this purpose, data is stored for marketing and optimisation purposes and made available in reports, analyses and statistics. Among other things, the following device information is collected and processed: information about the web browser, the IP address, the time zone and some of the cookies installed on your device. When you navigate the website, information about the web pages or products viewed, the referrer URL (website from which you accessed our website) and information about how you interact with the website is also recorded. Technologies such as cookies as well as web beacons, tags and pixels (electronic files for recording information about how you navigate the website) are used for this purpose.

The use of cookies or comparable technologies is based on your consent pursuant to § 25 (1) sentence 1 TDDDG in conjunction with Art. 6 (1) (a) GDPR. Your personal data is processed with your consent on the basis of Art. 6 (1) (a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal.

Further information on data protection at Shopify can be found at https://www.shopify.com/legal/privacy, information on the data processing agreement at https://www.shopify.com/legal/dpa and information on the cookies used at https://www.shopify.com/legal/cookies.

Use of Google Ads conversion tracking

On our website we use the online advertising programme “Google Ads” and, in this context, conversion tracking. Google conversion tracking is an analysis service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; Google).

When you click on an ad placed by Google, a cookie for conversion tracking is stored on your computer. These cookies have limited validity, do not contain any personal data and are therefore not used for personal identification. If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognise that you clicked on the ad and were redirected to this page. Each Google Ads customer receives a different cookie. It is therefore not possible for cookies to be tracked across the websites of Ads customers.

The information obtained with the help of the conversion cookie serves the purpose of creating conversion statistics. This tells us the total number of users who clicked on one of our ads and were redirected to a page with a conversion tracking tag. However, we do not receive any information with which users can be personally identified.

Your data may be transferred to the servers of Google LLC in the USA. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has thereby undertaken to comply with European data protection principles.

Further information and Google's privacy policy can be found at: https://www.google.de/policies/privacy/

Use of Google AdSense

On our website we use the AdSense function of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). The data processing serves the purpose of renting out advertising space on the website and addressing visitors to the website with interest-based advertising. By means of this function, personalised, interest-based advertisements from the Google Display Network are shown to visitors to the provider's website. Google uses cookies that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has thereby undertaken to comply with European data protection principles. Google may transfer this information to third parties if required to do so by law or insofar as third parties process this data on behalf of Google. Under no circumstances will Google associate your IP address with other Google data.

Further information and Google's privacy policy can be found at: https://www.google.com/policies/technologies/ads/ and https://www.google.de/policies/privacy/

Use of “Shopify Network Intelligence”

In our online shop we use the security and analysis function “Shopify Network Intelligence” of Shopify Inc., Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify Network Intelligence is an automated system based on artificial intelligence. This system serves network security, fraud detection and the optimisation of shop performance.

For this purpose, Shopify Network Intelligence monitors network access and user behaviour in order to detect and prevent fraudulent activities (e.g. credit card misuse, bot attacks) at an early stage. Data is also used for technical stability and performance analysis.

We use Shopify Network Intelligence to ensure IT security and fraud prevention, the availability of the online shop, and the analysis and optimisation of shop performance.

Cookies are used for this purpose. The cookies enable the internet browser to be recognised. Your data may be transferred to Canada. For Canada, an adequacy decision of the EU Commission exists that covers data processing by companies subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Shopify, headquartered in Canada, is subject to PIPEDA and is obliged to comply with the data protection principles under PIPEDA.

The use of cookies or comparable technologies is based on your consent pursuant to § 25 (1) sentence 1 TTDSG in conjunction with Art. 6 (1) (a) GDPR. Your personal data is processed with your consent on the basis of Art. 6 (1) (a) GDPR. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent until its withdrawal.

Further information on data processing can be found in Shopify's privacy policy at https://www.shopify.com/legal/privacy

Use of the AI chat assistant “Chatty”

Our online shop uses the chat assistant “Chatty” provided by AVADA GROUP COMPANY LIMITED, 102 Tran Phu, Ha Dong, Hanoi, Vietnam (“Chatty”). In the chat window you can ask questions about our products, orders and deliveries. The answers are generated by an automated AI system; on request, the assistant hands the conversation over to our team.

Notice under Art. 50 of the EU AI Act: You are interacting with an AI system, not a human. The answers generated may contain errors or be incomplete. Binding information (e.g. on prices, delivery times, compatibility or your rights) is provided by our team. Please do not enter sensitive data (e.g. payment or health data) in the chat.

Data processed: the content of your chat messages; your name, e-mail address and order number if you provide them; IP address, device and browser information, approximate location, pages visited and cart contents in the shop, and time of use. To provide the chat, Chatty stores a session identifier in a cookie and in your browser’s local storage.

Purposes and legal bases: answering your enquiries and handling order matters (Art. 6(1)(b) GDPR where your enquiry concerns a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in fast and efficient customer communication). Information that is strictly necessary for the chat is stored on and read from your device under Section 25(2) No. 2 TDDDG. Functions going beyond this (e.g. proactive chat prompts and product recommendations based on the pages visited and the cart) are based on your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time with effect for the future.

Recipients and transfers to third countries: Chatty processes the data on our behalf as a processor (Art. 28 GDPR). The data is stored on servers in the USA; Chatty staff in Vietnam access it for operations and support. To generate answers, Chatty uses sub-processors, in particular Google LLC (hosting, AI model Gemini), OpenAI, L.L.C. and Anthropic PBC (AI models) as well as Amazon Web Services, Inc. and Cloudflare, Inc. (storage and delivery), each based in the USA. Transfers to the USA and Vietnam are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). According to Chatty, chat content is not used to train AI models.

Storage period: We store chat histories for as long as necessary to handle your request and delete them afterwards unless statutory retention obligations apply. Conversations deleted by us are permanently removed by Chatty after three months at the latest.

Further information: https://chatty.net/privacy-policy

Plug-ins and other

Use of YouTube

On our website we use the function for embedding YouTube videos of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”). YouTube is an affiliate of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).

The function displays videos stored on YouTube in an iFrame on the website. The “privacy-enhanced mode” option is activated. As a result, YouTube does not store any information about visitors to the website. Information is only transmitted to and stored by YouTube when you watch a video. Your data may be transferred to the USA. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). YouTube is certified under the TADPF and has thereby undertaken to comply with European data protection principles.

Further information on the collection and use of data by YouTube and Google, on your rights in this regard and on options for protecting your privacy can be found in YouTube's privacy notice at https://www.youtube.com/t/privacy.

Use of Google Translate

On our website we use, via an API integration, the translation service of

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

The data processing serves the purpose of displaying the information provided on the website in other languages. In order for the translation to be displayed automatically according to your choice of language, the browser you are using connects to Google's servers. Cookies may be used in the process. Among other things, the following information may be collected and processed: IP address, URL of the page visited, date and time.

Your data may be transferred to the USA. For the USA, an adequacy decision of the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Google is certified under the TADPF and has thereby undertaken to comply with European data protection principles.

Further information on the collection and use of your data by Google can be found at: https://www.google.com/policies/privacy/.

Data subject rights and storage period

Storage period

After complete processing of the contract, the data is initially stored for the duration of the warranty period, then taking into account statutory retention periods, in particular under tax and commercial law, and then deleted after the period has expired, unless you have consented to further processing and use.

Rights of the data subject

If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: right of access, rectification, erasure, restriction of processing and data portability.

In addition, under Art. 21 (1) GDPR you have the right to object to processing based on Art. 6 (1) (f) GDPR and to processing for direct marketing purposes.

Right to lodge a complaint with the supervisory authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.

You can lodge a complaint, among others, with the supervisory authority responsible for us, which can be contacted as follows:

Landesbeauftragte für den Datenschutz Niedersachsen

Prinzenstraße 5

30159 Hannover, Germany

Phone: +49 511 1204500

Fax: +49 511 1204599

E-mail: poststelle@lfd.niedersachsen.de

Right to object

If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time with effect for the future on grounds relating to your particular situation.

After an objection has been made, the processing of the data concerned will be stopped unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

Last updated: 2 November 2026