{"id":1186,"date":"2018-12-13T10:51:35","date_gmt":"2018-12-13T09:51:35","guid":{"rendered":"https:\/\/shop.iob-ev.com\/?page_id=1186"},"modified":"2026-07-31T08:17:56","modified_gmt":"2026-07-31T06:17:56","slug":"datenschutz","status":"publish","type":"page","link":"https:\/\/shop.iob-ev.com\/en\/datenschutz\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<style>\n:root{<br \/>--primary:#155b74;<br \/>--text:#24323a;<br \/>--muted:#66757d;<br \/>--border:#dbe5e8;<br \/>--light:#f5f9fb;<br \/>}<br \/>*{box-sizing:border-box}<br \/>body{<br \/>margin:0;<br \/>font-family:Arial,Helvetica,sans-serif;<br \/>font-size:16px;<br \/>line-height:1.7;<br \/>color:var(--text);<br \/>background:#fff;<br \/>}<br \/>main{<br \/>max-width:1050px;<br \/>margin:auto;<br \/>padding:40px 28px 70px;<br \/>}<br \/>h1,h2,h3{<br \/>color:var(--primary);<br \/>line-height:1.25;<br \/>}<br \/>h1{<br \/>border-bottom:3px solid var(--primary);<br \/>padding-bottom:12px;<br \/>}<br \/>h2{<br \/>margin-top:45px;<br \/>padding-bottom:8px;<br \/>border-bottom:1px solid var(--border);<br \/>}<br \/>nav{<br \/>background:var(--light);<br \/>padding:20px;<br \/>border:1px solid var(--border);<br \/>border-radius:8px;<br \/>margin:25px 0 35px;<br \/>}<br \/>nav ol{<br \/>columns:2;<br \/>column-gap:40px;<br \/>}<br \/>.card{<br \/>background:#fff;<br \/>border:1px solid var(--border);<br \/>border-radius:8px;<br \/>padding:18px;<br \/>margin:20px 0;<br \/>}<br \/>footer{<br \/>margin-top:50px;<br \/>padding-top:20px;<br \/>border-top:1px solid var(--border);<br \/>color:var(--muted);<br \/>font-size:14px;<br \/>}<br \/>@media(max-width:720px){<br \/>nav ol{columns:1;}<br \/>main{padding:24px 18px 50px;}<br \/>}<br \/><\/style>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<header>\n<h1>Privacy Policy<\/h1>\n<p><strong>for shop.iob-ev.com<\/strong><br \/>\nVersion: 31 July 2026<\/p>\n<p>This Privacy Policy explains how personal data is collected, processed and protected when you visit and use the online shop <strong>shop.iob-ev.com<\/strong>.<\/p>\n<p>Personal data means any information relating to an identified or identifiable natural person as defined in the General Data Protection Regulation (GDPR).<\/p>\n<\/header>\n<nav>\n<h2>Table of Contents<\/h2>\n<ol>\n<li>Joint Controllers<\/li>\n<li>Joint Controllership Agreement<\/li>\n<li>Legal Bases of Processing<\/li>\n<li>Hosting<\/li>\n<li>Server Log Files<\/li>\n<li>Data Security<\/li>\n<li>Cookies<\/li>\n<li>Consent Management<\/li>\n<li>Google Fonts<\/li>\n<li>WooCommerce Shop<\/li>\n<li>Ordering Process<\/li>\n<li>Digital Products<\/li>\n<li>Transactional Emails<\/li>\n<li>Payment Processing<\/li>\n<li>Stripe &amp; WooPayments<\/li>\n<li>PayPal<\/li>\n<li>Email Contact<\/li>\n<li>Recipients of Data<\/li>\n<li>International Data Transfers<\/li>\n<li>Retention Periods<\/li>\n<li>Your Rights<\/li>\n<li>Right to Object<\/li>\n<li>Complaints<\/li>\n<li>Mandatory Information<\/li>\n<li>Changes to this Policy<\/li>\n<\/ol>\n<\/nav>\n<h2>1. Joint Controllers pursuant to Article 26 GDPR<\/h2>\n<p>The processing of personal data relating to the operation of the online shop <strong>shop.iob-ev.com<\/strong><br \/>\nis carried out under joint controllership pursuant to Article 26 GDPR by the following organisations:<\/p>\n<div class=\"card\">\n<p>IOB Internationale Organisation f\u00fcr naturnahe Badegew\u00e4sser e.V.<\/p>\n<p>Registered Office<\/p>\n<p>\u00dcberseetor 14<\/p>\n<p>28217 Bremen<\/p>\n<p>Germany<\/p>\n<p>Telephone:<br \/>\n+49 421 178 76 279<\/p>\n<p>&nbsp;<\/p>\n<p>Email: <a href=\"mailto:office@iob-ev.com\">[office@iob-ev.com](mailto:office@iob-ev.com)<\/a><\/p>\n<p>&nbsp;<\/p>\n<p>VAT ID:<br \/>\nDE277173171<\/p>\n<\/div>\n<div class=\"card\">\n<p>Italian Association for Natural Bathing Waters<\/p>\n<p>Via Giorgio e Guido Paglia, 27<\/p>\n<p>&nbsp;<\/p>\n<p>24122 Bergamo (BG)<\/p>\n<p>&nbsp;<\/p>\n<p>Italy<\/p>\n<p>VAT Number:<br \/>\n04896870161<\/p>\n<p>&nbsp;<\/p>\n<p>Tax Number:<br \/>\n91089910334<\/p>\n<p>&nbsp;<\/p>\n<p>Website:<\/p>\n<p>[www.acquebalneabili.it](http:\/\/www.acquebalneabili.it)<\/p>\n<p>&nbsp;<\/p>\n<\/div>\n<p>Data subjects may exercise their rights against either of the Joint Controllers.<\/p>\n<p>The internal allocation of responsibilities does not affect your statutory rights under the GDPR.<\/p>\n<p>2. Joint Controllership Agreement<\/p>\n<p>The Joint Controllers have concluded an agreement pursuant to Article 26 GDPR determining their respective responsibilities regarding compliance with data protection obligations.<\/p>\n<p>In particular:<\/p>\n<ul>\n<li>IOB e.V. is responsible for technical operation of the website, hosting, website security, maintenance and system administration.<\/li>\n<li>The Italian Association is responsible for product management, commercial operations, digital content and customer-related business matters.<\/li>\n<li>Both organisations cooperate regarding order processing, payment handling, statutory record keeping and the handling of data subject requests.<\/li>\n<\/ul>\n<p>The essence of this agreement will be made available to data subjects upon request where legally required.<\/p>\n<p>3. Legal Basis for Processing<\/p>\n<p>Personal data is processed exclusively in accordance with the applicable provisions of the General Data Protection Regulation (GDPR).<\/p>\n<ul>\n<li>Article 6(1)(a) GDPR \u2014 consent.<\/li>\n<li>Article 6(1)(b) GDPR \u2014 performance of a contract or pre-contractual measures.<\/li>\n<li>Article 6(1)(c) GDPR \u2014 compliance with legal obligations.<\/li>\n<li>Article 6(1)(f) GDPR \u2014 legitimate interests, including secure operation of the website, fraud prevention and legal defence.<\/li>\n<\/ul>\n<p>Where information is stored on, or accessed from, a user&#8217;s terminal device, the provisions of the German Telecommunications Digital Services Data Protection Act (TDDDG) additionally apply.<\/p>\n<p>Technically necessary storage and access operations are carried out pursuant to Section 25(2) TDDDG.<\/p>\n<p>Any non-essential storage or access takes place only after the user&#8217;s consent in accordance with Section 25(1) TDDDG.<\/p>\n<p><!-- End of Part 1 --><br \/>\n<!-- ========================================================= --><\/p>\n<p><!-- PART 2 --><\/p>\n<p><!-- Hosting \u2022 Server Logs \u2022 Security \u2022 Cookies \u2022 Consent --><\/p>\n<p><!-- ========================================================= --><\/p>\n<h2>4. Hosting<\/h2>\n<p>This online shop is hosted by<\/p>\n<p><strong>Hetzner Online GmbH<\/strong>,<\/p>\n<p>Industriestra\u00dfe 25,<\/p>\n<p>91710 Gunzenhausen,<\/p>\n<p>Germany.<\/p>\n<p>Hetzner processes personal data to the extent necessary for the technical operation,<br \/>\nmaintenance, security and availability of this website.<\/p>\n<p>Where Hetzner processes personal data on our behalf,<br \/>\nprocessing is carried out pursuant to a Data Processing Agreement in accordance with<br \/>\nArticle 28 GDPR.<\/p>\n<p>The legal basis for this processing is<br \/>\nArticle 6(1)(f) GDPR.<\/p>\n<p>Our legitimate interest consists in providing a secure,<br \/>\nstable and efficient online service.<\/p>\n<h2>5. Server Log Files<\/h2>\n<p>Whenever this website is accessed,<br \/>\nour hosting provider automatically records technical information in server log files.<\/p>\n<p>This information may include:<\/p>\n<ul>\n<li>IP address<\/li>\n<li>Date and time of access<\/li>\n<li>Requested URL<\/li>\n<li>Referrer URL<\/li>\n<li>Browser type and browser version<\/li>\n<li>Operating system<\/li>\n<li>HTTP status code<\/li>\n<li>Transferred data volume<\/li>\n<li>Technical error messages<\/li>\n<\/ul>\n<p>The processing of these data is necessary to ensure the secure operation of the website,<br \/>\ndetect technical problems,<br \/>\nprevent misuse,<br \/>\ninvestigate security incidents<br \/>\nand maintain system stability.<\/p>\n<p>The legal basis is<br \/>\nArticle 6(1)(f) GDPR.<\/p>\n<p>Server log files are retained only for as long as required for technical and security purposes.<br \/>\nWhere necessary to investigate abuse or legal claims,<br \/>\nindividual log entries may be retained until the matter has been fully resolved.<\/p>\n<h2>6. SSL\/TLS Encryption and Data Security<\/h2>\n<p>This website uses SSL\/TLS encryption in order to protect confidential communications.<\/p>\n<p>Encrypted connections can be identified by the padlock symbol in your browser<br \/>\nand by the use of &#8220;https:\/\/&#8221; in the address bar.<\/p>\n<p>We implement appropriate technical and organisational measures in accordance with<br \/>\nArticle 32 GDPR<br \/>\nto protect personal data against accidental or unlawful destruction,<br \/>\nloss,<br \/>\nalteration,<br \/>\nunauthorised disclosure<br \/>\nor unauthorised access.<\/p>\n<p>These measures include, among others:<\/p>\n<ul>\n<li>SSL\/TLS encryption<\/li>\n<li>Access control systems<\/li>\n<li>Role-based permissions<\/li>\n<li>Regular software updates<\/li>\n<li>Security monitoring<\/li>\n<li>Technical backups where necessary<\/li>\n<\/ul>\n<h2>7. Cookies and Similar Technologies<\/h2>\n<p>Our website uses cookies and similar technologies where necessary for the operation<br \/>\nof the online shop.<\/p>\n<p>Essential cookies are used to provide functions such as:<\/p>\n<ul>\n<li>shopping cart functionality<\/li>\n<li>checkout process<\/li>\n<li>payment processing<\/li>\n<li>security functions<\/li>\n<li>storage of your privacy preferences<\/li>\n<\/ul>\n<p>Essential cookies are used pursuant to<br \/>\nSection 25(2) TDDDG.<\/p>\n<p>The associated processing of personal data is based on<br \/>\nArticle 6(1)(b) GDPR<br \/>\n(contract performance)<br \/>\nor<br \/>\nArticle 6(1)(f) GDPR<br \/>\n(legitimate interests).<\/p>\n<p>Any non-essential cookies or comparable technologies are activated only after your<br \/>\nprior consent pursuant to<br \/>\nSection 25(1) TDDDG<br \/>\nand<br \/>\nArticle 6(1)(a) GDPR.<\/p>\n<p>You may withdraw or modify your consent at any time via the cookie settings.<\/p>\n<h2>8. Consent Management (Complianz)<\/h2>\n<p>We use<\/p>\n<p><strong>Complianz GDPR\/CCPA Cookie Consent<\/strong><\/p>\n<p>to manage and document cookie consent.<\/p>\n<p>Complianz stores your consent preferences together with technical information,<br \/>\nsuch as:<\/p>\n<ul>\n<li>date and time of consent<\/li>\n<li>selected preferences<\/li>\n<li>consent identifier<\/li>\n<li>technical proof of consent<\/li>\n<\/ul>\n<p>These data are processed solely for the purpose of complying with legal obligations<br \/>\nand documenting valid consent.<\/p>\n<p>The legal basis is<\/p>\n<p>Article 6(1)(c) GDPR,<\/p>\n<p>Article 6(1)(f) GDPR,<\/p>\n<p>and<\/p>\n<p>Section 25(2) TDDDG.<\/p>\n<p>Consent records are retained only for as long as necessary to fulfil legal documentation requirements.<\/p>\n<h2>9. Google Fonts<\/h2>\n<p>This website uses<\/p>\n<p><strong>Google Fonts hosted locally on our own server<\/strong>.<\/p>\n<p>No connection to Google servers is established when you visit this website.<\/p>\n<p>Consequently,<\/p>\n<p><strong>no personal data, including your IP address, is transmitted to Google<\/strong><\/p>\n<p>for the purpose of displaying fonts.<\/p>\n<p>The local hosting of fonts ensures a consistent appearance of the website while<br \/>\nmaximising data protection.<\/p>\n<p>The legal basis for this processing is<\/p>\n<p>Article 6(1)(f) GDPR.<\/p>\n<p>Our legitimate interest is the secure,<br \/>\nprivacy-friendly<br \/>\nand technically reliable presentation of our online services.<\/p>\n<p><!-- End of Part 2 --><br \/>\n<!-- ========================================================= --><\/p>\n<p><!-- PART 3 --><\/p>\n<p><!-- WooCommerce \u2022 Orders \u2022 Digital Products \u2022 Email --><\/p>\n<p><!-- ========================================================= --><\/p>\n<h2>10. WooCommerce Online Shop<\/h2>\n<p>Our online shop is operated using <strong>WooCommerce<\/strong>,<br \/>\na WordPress-based e-commerce platform.<\/p>\n<p>WooCommerce is used exclusively for the technical processing of orders,<br \/>\ncontract management and the provision of digital products.<\/p>\n<p>Depending on the services you use,<br \/>\nthe following categories of personal data may be processed:<\/p>\n<ul>\n<li>First and last name<\/li>\n<li>Billing address<\/li>\n<li>Email address<\/li>\n<li>Country of residence<\/li>\n<li>VAT information, where applicable<\/li>\n<li>Ordered products or services<\/li>\n<li>Order number<\/li>\n<li>Order date and time<\/li>\n<li>Selected payment method<\/li>\n<li>Payment status<\/li>\n<li>Technical information, including IP address and browser information<\/li>\n<\/ul>\n<p>The processing of these data is necessary for the conclusion and performance of the purchase contract,<br \/>\nfor payment allocation,<br \/>\nfraud prevention,<br \/>\naccounting obligations<br \/>\nand the delivery of digital products.<\/p>\n<p>The legal basis is<br \/>\nArticle 6(1)(b),<br \/>\nArticle 6(1)(c)<br \/>\nand,<br \/>\nwhere applicable,<br \/>\nArticle 6(1)(f) GDPR.<\/p>\n<h2>11. Ordering Process<\/h2>\n<p>This online shop does not provide permanent customer accounts.<\/p>\n<p>Orders are processed solely on the basis of the information required for the individual purchase.<\/p>\n<p>No user profile is created beyond the information required for fulfilling the respective order.<\/p>\n<p>However,<br \/>\nstatutory accounting,<br \/>\ntax and documentation obligations require us to retain certain transaction data<br \/>\nfor the legally prescribed retention periods.<\/p>\n<h2>12. Digital Products<\/h2>\n<p>The online shop offers <strong>digital products and digital services only<\/strong>.<\/p>\n<p>No physical goods are shipped.<\/p>\n<p>Following successful payment,<br \/>\ncustomers receive access to the purchased digital products,<br \/>\nfor example through:<\/p>\n<ul>\n<li>download links<\/li>\n<li>electronic tickets<\/li>\n<li>booking confirmations<\/li>\n<li>digital access credentials<\/li>\n<li>other electronic delivery methods<\/li>\n<\/ul>\n<p>Personal data are processed only to the extent necessary for providing these digital products.<\/p>\n<p>The legal basis is<br \/>\nArticle 6(1)(b) GDPR.<\/p>\n<p>Technical access logs and download records may additionally be processed<br \/>\nfor fraud prevention,<br \/>\nsystem security<br \/>\nand legal defence.<\/p>\n<p>The legal basis for such processing is<br \/>\nArticle 6(1)(f) GDPR.<\/p>\n<h2>13. Transactional Emails<\/h2>\n<p>In connection with your order,<br \/>\nwe send transaction-related emails that are necessary for the performance of the contract.<\/p>\n<p>These emails may include:<\/p>\n<ul>\n<li>Order confirmations<\/li>\n<li>Payment confirmations<\/li>\n<li>Invoices<\/li>\n<li>Delivery information<\/li>\n<li>Download instructions<\/li>\n<li>Booking confirmations<\/li>\n<li>Support information regarding your purchase<\/li>\n<\/ul>\n<p>These emails are not newsletters<br \/>\nand are not used for marketing purposes.<\/p>\n<p>The legal basis is<br \/>\nArticle 6(1)(b)<br \/>\nand<br \/>\nArticle 6(1)(c) GDPR.<\/p>\n<h2>14. Email Communication<\/h2>\n<p>This website does not provide a contact form.<\/p>\n<p>If you contact us by email,<br \/>\nwe process the personal data contained in your message,<br \/>\nincluding your email address<br \/>\nand any additional information you voluntarily provide.<\/p>\n<p>Where your enquiry relates to an existing or intended contractual relationship,<br \/>\nprocessing is based on<br \/>\nArticle 6(1)(b) GDPR.<\/p>\n<p>For all other enquiries,<br \/>\nprocessing is based on<br \/>\nArticle 6(1)(f) GDPR,<br \/>\nour legitimate interest being the efficient handling of communications.<\/p>\n<p>Your correspondence will only be retained for as long as necessary to process your enquiry<br \/>\nor for as long as statutory retention obligations require.<\/p>\n<p><!-- End of Part 3 --><br \/>\n<!-- ========================================================= --><\/p>\n<p><!-- PART 4 --><\/p>\n<p><!-- Payment Processing \u2022 Recipients \u2022 International Transfers --><\/p>\n<p><!-- Retention Periods --><\/p>\n<p><!-- ========================================================= --><\/p>\n<h2>15. Payment Processing<\/h2>\n<p>To process payments for purchases made through our online shop, we use the payment<br \/>\nservices <strong>WooPayments<\/strong>, <strong>Stripe<\/strong> and <strong>PayPal<\/strong>.<\/p>\n<p>Depending on the payment method selected, personal data required to complete the<br \/>\ntransaction are transmitted to the respective payment service provider.<\/p>\n<p>Such data may include, in particular:<\/p>\n<ul>\n<li>First and last name<\/li>\n<li>Billing address<\/li>\n<li>Email address<\/li>\n<li>Order number<\/li>\n<li>Order value<\/li>\n<li>Currency<\/li>\n<li>Payment status<\/li>\n<li>IP address (where required for fraud prevention)<\/li>\n<\/ul>\n<p>The processing is necessary for the performance of the purchase contract and is<br \/>\nbased on <strong>Article 6(1)(b) GDPR<\/strong>.<\/p>\n<p>Payment service providers may also process personal data in their own capacity<br \/>\nto comply with legal obligations, prevent fraud, prevent money laundering and<br \/>\nensure the security of payment transactions.<\/p>\n<h2>16. WooPayments<\/h2>\n<p>Our shop uses <strong>WooPayments<\/strong> to provide various payment methods.<\/p>\n<p>WooPayments is a payment service integrated into WooCommerce and operated by<br \/>\nAutomattic Inc. Payment processing is technically carried out using the<br \/>\ninfrastructure of Stripe.<\/p>\n<p>WooPayments processes only the personal data necessary to execute payment<br \/>\ntransactions securely and efficiently.<\/p>\n<p>Further information is available in WooCommerce&#8217;s and WooPayments&#8217;<br \/>\nprivacy documentation.<\/p>\n<h2>17. Stripe<\/h2>\n<p>If you choose to pay by credit card or by another payment method offered through<br \/>\nStripe, payment processing is carried out by<\/p>\n<p><strong>Stripe Payments Europe, Limited<\/strong>,<br \/>\nIreland.<\/p>\n<p>Stripe may process personal data for the following purposes:<\/p>\n<ul>\n<li>payment processing<\/li>\n<li>identity verification<\/li>\n<li>fraud prevention<\/li>\n<li>risk analysis<\/li>\n<li>compliance with statutory obligations<\/li>\n<li>prevention of unauthorised payment transactions<\/li>\n<\/ul>\n<p>Depending on the payment method selected, Stripe may process payment data,<br \/>\ntechnical device information and transaction-related information.<\/p>\n<p>The legal basis is<br \/>\nArticle 6(1)(b) GDPR.<\/p>\n<p>Where Stripe carries out legally required verification procedures or fraud<br \/>\nprevention in its own responsibility, additional legal bases may apply under<br \/>\nArticles 6(1)(c) and 6(1)(f) GDPR.<\/p>\n<p>Further information is available at<\/p>\n<p>&nbsp;<\/p>\n<p>https:\/\/stripe.com\/privacy<\/p>\n<p>&nbsp;<\/p>\n<h2>18. PayPal<\/h2>\n<p>If PayPal is selected as the payment method, payment processing is carried out by<\/p>\n<p><strong>PayPal (Europe) S.\u00e0 r.l. et Cie, S.C.A.<\/strong><\/p>\n<p>22\u201324 Boulevard Royal,<\/p>\n<p>L-2449 Luxembourg.<\/p>\n<p>PayPal receives only the personal data necessary to process your payment.<\/p>\n<p>PayPal may perform identity verification, fraud prevention and creditworthiness<br \/>\nassessments where permitted by applicable law.<\/p>\n<p>The legal basis for the transfer of personal data is<br \/>\nArticle 6(1)(b) GDPR.<\/p>\n<p>Additional information is available in PayPal&#8217;s Privacy Statement.<\/p>\n<h2>19. Recipients of Personal Data<\/h2>\n<p>Personal data are disclosed only where necessary for the purposes described in<br \/>\nthis Privacy Policy.<\/p>\n<p>Recipients may include:<\/p>\n<ul>\n<li>the Joint Controllers<\/li>\n<li>hosting provider (Hetzner)<\/li>\n<li>WooCommerce and technically required service providers<\/li>\n<li>WooPayments<\/li>\n<li>Stripe<\/li>\n<li>PayPal<\/li>\n<li>IT service providers<\/li>\n<li>accountants and tax advisers where required by law<\/li>\n<li>public authorities where disclosure is legally required<\/li>\n<\/ul>\n<p>Where service providers process personal data exclusively on our behalf,<br \/>\nData Processing Agreements have been concluded in accordance with<br \/>\nArticle 28 GDPR whenever legally required.<\/p>\n<h2>20. International Data Transfers<\/h2>\n<p>Some of the service providers used by this website may process personal data<br \/>\noutside the European Union (EU) or the European Economic Area (EEA).<\/p>\n<p>Where such transfers occur,<br \/>\nthey are carried out only in accordance with<br \/>\nArticles 44\u201349 GDPR.<\/p>\n<p>Appropriate safeguards may include:<\/p>\n<ul>\n<li>an adequacy decision adopted by the European Commission;<\/li>\n<li>the EU\u2013US Data Privacy Framework, where applicable;<\/li>\n<li>Standard Contractual Clauses adopted by the European Commission;<\/li>\n<li>additional technical and organisational safeguards where required.<\/li>\n<\/ul>\n<p>Despite these safeguards,<br \/>\ndata protection laws in third countries may differ from those applicable within<br \/>\nthe European Union.<\/p>\n<h2>21. Retention Periods<\/h2>\n<p>We retain personal data only for as long as necessary to fulfil the purposes<br \/>\ndescribed in this Privacy Policy or as required by applicable statutory retention<br \/>\nobligations.<\/p>\n<table>\n<tbody>\n<tr>\n<th>Category of Data<\/th>\n<th>Retention Period<\/th>\n<\/tr>\n<tr>\n<td>Order and invoice data<\/td>\n<td>Generally up to 10 years in accordance with applicable commercial and tax legislation<\/td>\n<\/tr>\n<tr>\n<td>Payment information<\/td>\n<td>As required by applicable legal obligations and the respective payment provider<\/td>\n<\/tr>\n<tr>\n<td>Server log files<\/td>\n<td>Only as long as technically and operationally necessary<\/td>\n<\/tr>\n<tr>\n<td>Consent records<\/td>\n<td>As required to demonstrate valid consent and comply with legal obligations<\/td>\n<\/tr>\n<tr>\n<td>Email correspondence<\/td>\n<td>Until the enquiry has been fully processed or statutory retention obligations expire<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>After expiry of the applicable retention periods,<br \/>\npersonal data are deleted or anonymised unless further storage is legally required<br \/>\nor necessary for the establishment,<br \/>\nexercise or defence of legal claims.<\/p>\n<p><!-- End of Part 4 --><br \/>\n<!-- ========================================================= --><\/p>\n<p><!-- PART 5 --><\/p>\n<p><!-- Data Subject Rights \u2022 Complaints \u2022 Final Provisions --><\/p>\n<p><!-- ========================================================= --><\/p>\n<h2>22. Rights of Data Subjects<\/h2>\n<p>Under the General Data Protection Regulation (GDPR), you have the following rights,<br \/>\nprovided the respective legal requirements are met:<\/p>\n<ul>\n<li>Right of access (Article 15 GDPR)<\/li>\n<li>Right to rectification (Article 16 GDPR)<\/li>\n<li>Right to erasure (&#8220;right to be forgotten&#8221;) (Article 17 GDPR)<\/li>\n<li>Right to restriction of processing (Article 18 GDPR)<\/li>\n<li>Right to data portability (Article 20 GDPR)<\/li>\n<li>Right to object (Article 21 GDPR)<\/li>\n<li>Right to withdraw consent at any time (Article 7(3) GDPR)<\/li>\n<\/ul>\n<p>You may exercise these rights at any time by contacting either of the Joint Controllers.<br \/>\nTo prevent unauthorised disclosure of personal data, we may request appropriate proof of identity before processing your request.<\/p>\n<h2>23. Withdrawal of Consent<\/h2>\n<p>Where the processing of your personal data is based on your consent, you may withdraw that consent at any time with future effect.<\/p>\n<p>Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.<\/p>\n<h2>24. Right to Object<\/h2>\n<p>Where personal data are processed on the basis of <strong>Article 6(1)(f) GDPR<\/strong> (legitimate interests),<br \/>\nyou have the right to object at any time on grounds relating to your particular situation.<\/p>\n<p>If you object, we will cease processing the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing serves the establishment, exercise or defence of legal claims.<\/p>\n<p>We do not currently process personal data for direct marketing purposes.<\/p>\n<p>Should this change in the future, you will have the right to object to such processing at any time without giving reasons.<\/p>\n<h2>25. Right to Lodge a Complaint<\/h2>\n<p>If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority pursuant to<br \/>\nArticle 77 GDPR.<\/p>\n<p>You may contact the supervisory authority in:<\/p>\n<ul>\n<li>the Member State of your habitual residence;<\/li>\n<li>your place of work;<\/li>\n<li>or the place of the alleged infringement.<\/li>\n<\/ul>\n<p>Since this online shop is operated under joint controllership between organisations established in Germany and Italy, the competent supervisory authority will depend on the specific circumstances of the processing concerned.<\/p>\n<h2>26. Security of Processing<\/h2>\n<p>The Joint Controllers implement appropriate technical and organisational measures pursuant to<br \/>\nArticle 32 GDPR<br \/>\nto ensure a level of security appropriate to the risk.<\/p>\n<p>Such measures include, among others:<\/p>\n<ul>\n<li>SSL\/TLS encrypted communication<\/li>\n<li>restricted administrative access<\/li>\n<li>role-based access management<\/li>\n<li>regular software updates<\/li>\n<li>technical monitoring of systems<\/li>\n<li>backup procedures where appropriate<\/li>\n<li>protection against unauthorised access<\/li>\n<\/ul>\n<p>Security measures are regularly reviewed and adapted to technological developments where necessary.<\/p>\n<h2>27. Mandatory Provision of Personal Data<\/h2>\n<p>The provision of personal data required during the ordering process is necessary for the conclusion and performance of the purchase contract.<\/p>\n<p>Without these data we are unable to:<\/p>\n<ul>\n<li>process your order;<\/li>\n<li>allocate your payment;<\/li>\n<li>issue legally required invoices;<\/li>\n<li>provide purchased digital products or services.<\/li>\n<\/ul>\n<p>The provision of any additional information is voluntary unless expressly indicated otherwise.<\/p>\n<h2>28. Automated Decision-Making<\/h2>\n<p>The Joint Controllers do not carry out automated decision-making or profiling within the meaning of<br \/>\nArticle 22 GDPR.<\/p>\n<p>However, payment service providers may independently perform automated fraud prevention, risk analysis or identity verification where required by law or necessary for secure payment processing.<\/p>\n<h2>29. Changes to this Privacy Policy<\/h2>\n<p>We reserve the right to amend this Privacy Policy whenever necessary to reflect changes in legislation, regulatory requirements, technical developments or the services offered through this website.<\/p>\n<p>The version published on this website shall always be the current and applicable version.<\/p>\n<div class=\"note\">\n<p><strong>Version:<\/strong><\/p>\n<p>31 July 2026<\/p>\n<\/div>\n<footer>\u00a9 IOB Internationale Organisation f\u00fcr naturnahe Badegew\u00e4sser e.V.andItalian Association for Natural Bathing Waters<\/p>\n<\/footer>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>","protected":false},"excerpt":{"rendered":"<p>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Privacy Policy for shop.iob-ev.com Version: 31 July 2026 This Privacy Policy explains how personal data is collected, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-1186","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/shop.iob-ev.com\/en\/wp-json\/wp\/v2\/pages\/1186","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/shop.iob-ev.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/shop.iob-ev.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/shop.iob-ev.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/shop.iob-ev.com\/en\/wp-json\/wp\/v2\/comments?post=1186"}],"version-history":[{"count":20,"href":"https:\/\/shop.iob-ev.com\/en\/wp-json\/wp\/v2\/pages\/1186\/revisions"}],"predecessor-version":[{"id":5293,"href":"https:\/\/shop.iob-ev.com\/en\/wp-json\/wp\/v2\/pages\/1186\/revisions\/5293"}],"wp:attachment":[{"href":"https:\/\/shop.iob-ev.com\/en\/wp-json\/wp\/v2\/media?parent=1186"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}