Privacy Policy

We know that discretion and privacy really matters. Therefore, responsible handling of your data is very important to us.

 

In order to make it easier for you to protect your personal data, you will find all the information about its processing in this Privacy Policy.

 

Name and address of the person responsible

The responsible party within the meaning of the General Data Protection Regulation (GDPR) and the UK`s Data Protection Act 2018 (PDA), as well as other data protection regulations, is:

 

PTBC LTD trading as Playtime Boutique

Gemma House, 39 Lilestone Street, London, England, NW8 8SS.

Tel.: 0800 037 8094

E-mail: [email protected]

 

Our Principles:

Playtime Boutique  respects your right to privacy and is committed to the following key principles:

 

  • We protect your privacy and aim to provide you with a service that is tailored to your needs.
  • Personal data is collected for specific purposes based on your consent or a legitimate interest when you contact us.
  • You have the right to information and access to your personal data at any time and may request its correction or deletion.
  • We do not sell your personal data to third parties. However, if necessary and if explicitly mentioned afterwards or if you have consented, we may share your data with group companies, brand licensees, partners and other service providers. In this case, their own privacy policies may also apply.
  • We take all reasonable measures to ensure the security and protection of your data from misuse.

 

Automated decision-making

We do not use automated decision-making or profiling.

 

Accuracy

It is important that the data we hold about you is accurate and current, therefore please keep us informed of any changes to your personal data.

 

Children Data

Our website is not intended for children, and we do not knowingly collect data relating to children. If you become aware that your child has provided us with Personal Data, without parental consent, please contact us, and we take the necessary steps to remove that information from our server.

 

External Links

Our website contains links to the online offers of other providers. We hereby point out that we have no influence on the content of the linked online offers and the compliance with data protection regulations by their providers.

 

Scope of the processing of personal data

As a matter of principle, we collect and use the personal data of our users only insofar as this is necessary for the provision of a functional website as well as our contents and services. The collection and use of our users’ personal data regularly only takes place with the user’s consent. An exception applies in those cases in which it is not possible to obtain prior consent for actual reasons and the processing of the data is permitted by legal regulations.

 

Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6(1)(a) of the GDPR serves as the legal basis for the processing of personal data.

 

When processing personal data that is necessary for the performance of a contract to which the data subject is a party, Art.6 para. 1 lit. b GDPR serves as the legal basis. This also applies to processing operations that are necessary for the performance of pre-contractual measures.

 

Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which our company is subject, Art. 6 paras. 1 lit. c GDPR serves as the legal basis. In the event that vital interests of the data subject or another natural person make processing of personal data necessary, Art. 6 (1) (d) GDPR serves as the legal basis. If the processing is necessary to protect a legitimate interest of our company or a third-party and the interests, fundamental rights and freedoms of the data subject do not outweigh the first-mentioned interest, Art. 6 (1) lit. f GDPR serves as the legal basis for the processing.

 

Data deletion and storage period

The personal data of the data subject will be deleted or blocked as soon as the purpose of the storage no longer applies. Storage may also take place if this has been provided for by the European and national legislator in Union regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted if a storage period prescribed by the aforementioned norms expires unless there is a necessity for the continued storage of the data for the conclusion or fulfilment of a contract.

 

Provision of the website and creation of log files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

 

The following data is collected:

 

  • Information about the browser type and the version used.
  • The user’s operating system
  • The IP address of the user
  • Date and time of access
  • Websites from which the user’s system accesses our website.

 

This data is also stored in the log files of our system. This data is not stored together with other personal data of the user. The legal basis for the temporary storage of the data and the log files is Art. 6Abs. 1 lit. f GDPR.

 

The temporary storage of the IP address by the system is necessary to enable the delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimise the website and to ensure the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. These purposes are also our legitimate interest in data processing according to Art. 6 Para. 1 lit. f GDPR.

 

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

 

In the case of storage of data in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of the users are deleted or alienated, so that an assignment of the calling client is no longer possible.

 

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility for the user to object.

 

Use of cookies

Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. When a user calls up a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is called up again. We use cookies to make our website more user-friendly. Some elements of our website require that the calling browser can be identified even after a page change (e.g. carrying out an order). No data is stored in the cookie beyond the characteristic string used to identify the browser. For more information on cookies please visit www.allaboutcookies.org and for more details on the cookies we use please read our Cookie Policy. The legal basis for the processing of personal data using cookies is Art. 6 para. 1 lit. f GDPR.

 

Registration

On our website, we offer users the opportunity to register by providing personal data. The data is entered into an input mask and transmitted to us and stored. The data is not passed on to third parties. The following data is collected during the registration process:

 

  • E-mail address
  • Password
  • IP address

 

At the time of registration, the date and time are also stored on the data record. As part of the registration process, the user’s consent to the processing of this data is obtained. Furthermore, the user has the option of supplementing the registration data in further steps with data on the billing and delivery address in order to simplify the ordering process. The legal basis for the processing of data is Art. 6 (1) lit. a GDPR if the user has given his consent.

 

User registration is necessary for the provision of certain content and services on our website. This includes writing product reviews, maintaining a personal watch list of articles and the simplified ordering process by reusing the registration and address data in the online shop.

 

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. This is the case for the data collected during the registration process when the registration on our website is cancelled or modified.

 

As a user, you have the option of cancelling the registration at any time by following the instructions for deleting the customer account in your customer account under the menu item “Your data”. You can change the data stored about you at any time in your customer account. You can also contact our customer service

 

Contact form and e-mail contact

 

Our website contains a contact form that can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask is transmitted to us and stored. These data are:

 

  • First and last name
  • E-mail address

 

Your consent to the processing of your data will be obtained during the submission process and reference will be made to this privacy policy.

 

Alternatively, it is possible to contact us via the e-mail address provided. In this case, the user’s personal data transmitted with the e-mail will be stored.

 

In this context, the data will not be passed on to third parties. The data is used exclusively for processing the conversation.

 

The legal basis for the processing of the data is Art. 6 (1) lit. a GDPR if the user has given his consent. The legal basis for the processing of data transmitted in the course of sending an e-mail is Art. 6 para. 1 lit f GDPR. If the e-mail contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 para. 1 lit. b GDPR.

 

The processing of personal data from the input mask serves us solely to process the contact. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in processing the data. The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

 

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended.

 

The conversation is ended when the circumstances indicate that the matter in question has been conclusively clarified.

 

The additional personal data collected during the sending process will be deleted at the latest after a period of seven days.

 

The user has the possibility to revoke his consent to the processing of personal data at any time. If the user contacts us by e-mail, he can object to the storage of his personal data at any time. In such a case, the conversation cannot be continued.

 

Furthermore, the user has the possibility to revoke his consent by telephone, by e-mail or via the contact form. All personal data stored in the course of contacting us will be deleted in this case.

 

Online Orders

In our online shop, personal data is collected for the purpose of contract processing. This data is entered via an input mask and transmitted to us and stored. Data is only passed on to third parties in the context of order processing, for example for payment processing and for dispatch by a parcel service provider. The following data is collected during the ordering process:

 

  • Name
  • Billing and Shipping address
  • E-mail address

 

At the time of ordering in the online shop, the date and time are also stored on the data record. Users who have registered in the online shop can use the data collected with the registration to simplify the ordering process and do not have to enter it again.

 

When personal data is collected as part of the ordering process, the user’s consent to the processing of this data is obtained.

The legal basis for the processing of the data is Art. 6 (1) lit. a GDPR if the user has given his consent.

 

The data collection is necessary for the fulfilment of the contract with the user or for the implementation of pre-contractual measures.

 

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.

 

This is the case for the personal data collected in the ordering process of the online shop for the fulfilment of a contract or for the implementation of pre-contractual measures when the data is no longer required for the implementation of the contract. Even after the conclusion of the contract, it may be necessary to store the personal data of the contractual partner in order to fulfil contractual or statutory obligations.

 

The user has the option at any time to have the data collected during the ordering process deleted.

 

If the data is required for the fulfilment of a contract or for the implementation of pre-contractual measures, premature deletion of the data is only possible insofar as contractual or legal obligations do not prevent deletion.

 

Use of payment services and payment procedures

When processing orders in our online shop, the user can choose from various payment methods.

 

In this context, personal data, which the user has provided in the order process, may be transmitted to the corresponding provider of the payment method in order to process the payment process. The provider may process the data further, for example, to carry out an identity check or, depending on the selected payment method, to carry out a credit check.

 

For the payment method “credit card”, we work together with an established and PCI certified provider. The credit card data is recorded there and only an anonymised identifier (KEN) is transferred to us.

 

Sending information

We use your data for sending information ordered by you about our offer and other promotions from us to the e-mail address provided by you.

 

  1. a) Newsletter registration on our website

On our website, there is the possibility to subscribe to a free newsletter. When you register for the newsletter, the data from the input mask is transmitted to us, i.e. at least your e-mail address. The registration is carried out by means of the so-called double opt-in procedure.

 

After registration, you will receive an e-mail asking you to confirm your registration. This confirmation is necessary so that no one can register with other people’s e-mail addresses. For the processing of the data, your consent is obtained during the registration process and reference is made to this data protection notice. If you register for our newsletter, which informs you about our latest products and services, the personal data you provide in this context (such as name, address and e-mail address) will be processed by us for the purpose of sending you the newsletter.

 

  1. b) Dispatch due to the sale of goods

If you purchase goods or services on our website, we may send you information on our own similar goods to your specified e-mail address even without your consent. The legal basis for this data processing is Art. 6 para. 1 p. 1 lit. f GDPR, because advertising related products and services by way of direct advertising represents a legitimate interest for us as the provider of this website. You may object to the processing of your personal data for the purpose of direct advertising at any time. We will then refrain from further processing for such purposes. You can send us your objection as described below. In addition, you can object to the sending of such newsletters at any time in the future without giving reasons by unsubscribing via the unsubscribe link at the end of each newsletter or by contacting us in any other way.

 

We would like you to enjoy reading our e-mails. Therefore, we try to only include content that you are likely to be interested in. We, therefore, measure and store opening and click-through rates in your user profile, i.e. whether and when you open our emails, which content of the emails you click on and when, as well as whether and why our emails could possibly not be delivered. We also use this data for statistical purposes. In particular, this serves our legitimate interest to evaluate the performance of the individual newsletter campaigns and to define optimisation measures in order to make the newsletter as attractive and suitable as possible for you. The legal basis for the processing is therefore Art. 6 para. 1 lit. f GDPR.

 

Of course, you can unsubscribe from receiving our information at any time, i.e. revoke your consent with effect for the future or object to data processing. For this purpose, you will find a corresponding unsubscribe link in every mail or newsletter and can confirm the unsubscription on our website. You can also contact us for cancellation at any time.

 

Disclosure of personal data to third parties

Your personal data will only be passed on if there is a legal obligation to do so or to service providers and partner companies that have been carefully selected in advance and are contractually obliged to comply with the requirements of data protection law.

 

  1. a) Disclosure within affiliated companies pursuant to Art. 6 Para. 1 lit. b GDPR

We pass on your personal data for the conclusion and processing of contracts for offers on our website to affiliated companies. This is particularly necessary so that you can use all our offers. If you contact a store or our customer hotline with questions, complaints or returns as well as other complaints, they will also receive access to your order data in order to be able to process your request.

 

b)Disclosure to service providers according to Art. 6 para. 1 lit. b and f GDPR

For the operation and optimisation of our website and our services and for the processing of contracts, various service companies work for us, e.g. for central IT services or the hosting of our website, for the payment and delivery of products or for the dispatch of newsletters, to whom we pass on the data required for the fulfilment of the task (e.g. name, address).

 

Some of these companies act for us by way of commissioned processing and may therefore use the data provided exclusively in accordance with our instructions. In this case, we are legally responsible for appropriate data protection precautions at the companies we commission. We, therefore, agree on specific data security measures with these companies and monitor them regularly.

 

In contrast to order processing, in the following cases we transmit data to third parties for their own use in order to process the contract:

 

  • In the case of delivery of goods to logistics companies and the postal service provider specified when the order was placed.
  • In the case of payment for goods to the payment service provider specified when the order was placed.

 

We do not collect or store any payment transaction information such as credit card numbers or bank details during the payment process. You only provide this information directly to the respective payment service provider.

 

  1. c) Disclosure to other third parties pursuant to Art. 6 para. 1 lit. c and f GDPR

We will disclose your data to third parties or government agencies within the framework of existing data protection laws if we are legally obliged to do so, e.g. due to official or court orders, or if we are entitled to do so, e.g. because this is necessary for the prosecution of criminal offences or for the exercise and enforcement of our rights and claims.

 

Use of web analysis and other services

We use Google Analytics; Google Analytics mainly uses so-called cookies. The operator of the service is Google Inc, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA.

 

Google Analytics uses cookies, which are text files placed on the user’s computer, to help the website analyse how users use the site. The information generated about the use of the websites (including your IP address) is usually transmitted to a Google server in the USA and stored there.

 

On our websites, we use the extension “-anonymizeIp” for IP anonymisation, whereby your IP address is shortened beforehand by Google within the member states of the European Union and the UK or in other contracting states of the Agreement on the European Economic Area.

 

Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

 

Google will use the information generated on our behalf for the purpose of evaluating your use of our website, compiling reports on website activity for orion.de and providing us with other services relating to website activity and internet usage.

 

Under no circumstances will Google merge the IP address collected by Google Analytics with other Google data. Google may transfer the information collected by Google Analytics to third parties if Google is legally obliged to do so or if third parties process this data on behalf of Google.

 

For our Internet offering, we have implemented Google Analytics reports on performance by demographic characteristics and interests. We use data obtained by Google via interest-based advertising as well as visitor data from third-party providers (e.g. age, gender, interests) as part of Google Analytics.

 

As a user of our website, you can prevent the storage of these cookies by changing your browser settings.

 

We would like to point out that you may then not be able to use all the functions of our websites to their full extent.

 

Furthermore, you can object to the collection of the data generated by the cookie and related to your use of the website, including your IP address, by Google and prevent the processing of this data by Google by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout?hl=en.

 

We would like to point out that on our website Google Analytics has been extended by “gat._anonymizeIp()” to ensure an anonymised collection of IP addresses, so-called IP masking.

 

Further information on data protection at Google can be found at https://policies.google.com/

 

Your rights

Of course, you have rights with regard to the collection of your data, which we are pleased to inform you of herewith. If you would like to make use of one of the following free rights, a simple message to us will suffice. For your own protection, we reserve the right, in the case of an existing enquiry, to obtain further information necessary to confirm your identity and, if identification is not possible, to refuse to process the enquiry.

 

  1. a) Right to information

You have the right to request information and/or copies of the personal data stored about you.

 

  1. b) Right to rectification

You have the right to request that personal data relating to you be corrected and/or completed without delay.

 

  1. c) Right to object to processing

You have the right to request the restriction of the processing of your personal data, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defence of legal claims or you have lodged an objection to the processing.

 

  1. d) Right to deletion

You have the right to request the erasure of your personal data stored by us, unless the exercise of the right to freedom of expression and information, the processing is necessary for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defence of legal claims.

 

  1. e) Right to information

Where you have exercised the right to rectification, erasure or restriction of processing, we will notify all recipients to whom personal data relating to you has been disclosed of such rectification or erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort.

 

  1. f) Right to data portability

You have the right to have personal data that you have provided to us handed over to you or to a third party in a structured, common and machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done insofar as it is technically feasible.

 

  1. g) Right of objection

Insofar as your personal data are processed on the basis of legitimate interests pursuant to Article 6 (1) (f) of the GDPR, you have the right to object to the processing at any time pursuant to Article 21 (1) of the GDPR.

 

If we process your for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing in accordance with Art. 21 (2) GDPR; this also applies to profiling insofar as it is related to such direct marketing.

 

  1. h) Right to withdraw consent

You have the right to cancel your consent to the collection of data at any time with effect for the future. The data collected until the cancellation becomes legally effective will remain unaffected. Please understand that the implementation of your cancellation may take a little time for technical reasons and that you may still receive messages from us in the meantime.

 

  1. i) Right to complain to a supervisory authority

If the processing of your personal data violates data protection law or if your data protection rights have otherwise been violated in any way, you may complain to the supervisory authority.

 

You can also exercise your rights of rectification and deletion most quickly, easily and conveniently by logging into your customer account and directly editing or deleting your data stored there.

 

  1. j) Automated decision making including profiling

You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

 

SSL encryption

To protect the security of your data during transmission, we use state-of-the-art encryption procedures (e.g. SSL) via HTTPS.

 

Social Media

The data you enter on our social media pages, such as comments, videos, pictures, likes, public messages, etc. are published by the social media platform and are not used or processed by us for any other purpose at any time. We only reserve the right to delete content if this should be necessary. Where applicable, we share your content on our site if this is a function of the social media platform and communicate with you via the social media platform. The legal basis is our legitimate interest. The data processing is carried out in the interest of our public relations and communication.

 

If you wish to object to certain data processing over which we have an influence, please contact us. We will then examine your objection. If you send us a request on the social media platform, we may also refer you to other secure communication channels that guarantee confidentiality, depending on the response required. You always have the option of sending us confidential enquiries to our address stated in the imprint.

 

As already stated, where the social media platform provider gives us the opportunity, we take care to design our social media pages to be as data protection compliant as possible. With regard to statistics that the provider of the social media platform makes available to us, we can only influence these to a limited extent and cannot switch them off. However, we make sure that no additional optional statistics are made available to us.

 

Data processing by the operator of the social media platform

The operator of the social media platform uses web tracking methods. Web tracking can also take place regardless of whether you are logged in or registered with the social media platform. As already explained, we can unfortunately hardly influence the web tracking methods of the social media platform. We cannot, for example, switch this off.

 

Please be aware: It cannot be ruled out that the provider of the social media platform uses your profile and behavioural data, for example, to evaluate your habits, personal relationships, preferences, etc. We have no influence on this. In this respect, we have no influence on the processing of your data by the provider of the social media platform.

 

Content Delivery Network

Our website uses a so-called Content Delivery Network (CDN). A CDN is a network of powerful servers that cache content at various locations around the world. A CDN has two main tasks: to deliver content in the shortest possible time and to reduce the load on the web host by distributing traffic. CDNs transmit two types of content: Static and dynamic content. Static content is delivered to all website visitors in the same form, such as video content from streaming services or code frameworks (e.g. Javascript, jQuery). Dynamic content is first adapted to the user and only created at the moment of the request. This includes content that takes place via web applications, email or online shops and is personalised. In order to use the latter, information about the website visitor must first be transmitted to the CDN. The legal basis for the use of a CDN and the transmission of your data to it is our legitimate interest. The legitimate interest results from our need for a technically flawless and fast presentation of our website and the relief of our IT infrastructure. You can object to the processing of your data on the basis of our legitimate interest at any time. To do so, please use the contact details provided.

 

International transfers

We do not directly and for the purpose of processing transfer your personal data outside the European Economic Area (EEA) and the United Kingdom.

 

Changes to our privacy policy

We reserve the right to adapt this privacy policy so that it always complies with the current legal requirements or in order to implement changes to our services in the privacy policy, e.g. when introducing new services. The new privacy policy will then apply to your next visit.

 

Concerns and Contact

If you have any concerns about a possible compromise of your privacy or misuse of your personal data on our part, or any other questions or comments, you can contact us.

 

Version

This policy was last amended in November 2021.