Privacy Policy

Privacy Policy

Thank you for your interest in how we process your data. Protecting your privacy is very important to us. Below you will find detailed information about how we handle your data.

1. General

The controller for processing within the meaning of data protection legislation is

Zippo GmbH
Groendahlscher Weg 87
46446 Emmerich am Rhein
Email: shop.de@zippo.com
Telephone: 028227134100

Data protection controller:

Trusted Shops SE
Subbelrather Str. 15c
50823 Cologne
Cologne, Germany
Email: dsgvo@trustedshops.de

This privacy policy applies to the processing of personal data of visitors to our website, business partners, applicants and newsletter subscribers.

In the context of the above activities, we make use of various group companies to support us in these activities, in particular Zippo Manufacturing Company, 33 Barbour Street, Bradford, Pennsylvania 16701, United States (“Zippo US”) and Zippo UK Limited, 5 Squire Patton Boggs (Uk) Llp (Ref: Csu) Rutland House, 148 Edmund Street, Birmingham, England, B3 2JR (“Zippo UK”). In principle, we only use our group companies as processors. However, Zippo US and Zippo UK act as joint controllers with us in accordance with Art. 26 para. 1 sentence 1 GDPR for some processing activities as described below. In these cases, we are available to you as a contact person. 

2. Information for visitors to our website

You can visit our website without providing any personal information. Every time a web page is requested, the web server automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data) and documents the access. This access data is analyzed exclusively to ensure the smooth operation of the site and to improve our offer. This serves to protect our legitimate interests, which prevail in the context of a balancing of interests, in the correct presentation of our offer in accordance with art. 6 Para. 1 S. 1 lit. f GDPR. All access data is deleted no later than seven days after the end of your visit to our website.

2.1 Hosting

We use the Shopify Plus service from Shopify Inc, 151 O'Connor Street Ground Floor Ottawa, Ontario K2P2L8, Canada (“Shopify”) to host our website.

Shopify acts as a processor here. Unless stated otherwise in this privacy policy, all access data and all data collected in the forms on this website are processed on its servers. If you have questions about Shopify and the basis of our relationship with them, use the contact details described in this privacy policy.

Shopify uses servers in Canada, for which the European Commission has determined an appropriate level of data protection by decision.

2.2 Cookies and other technologies

  • General information

To make the visit to our website attractive and to enable the use of certain functions, we use various technologies, including so-called cookies. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser (so-called “session cookies”). Other cookies remain on your end device and allow us to recognize your browser on your next visit (“persistent cookies”).

When using our online offer, we use absolutely necessary technologies to be able to provide the expressly requested telemedia service. We also use technologies that are absolutely necessary for the use of certain functions of our website (e.g. shopping cart function). These technologies are used for the collection and processing of the IP address, time of visit, device and browser information and information about your use of our website (e.g. information about the contents of the shopping cart).

For the storage of information on your end device or access to information that is already stored on your end device, no permission is required in this respect, but this is carried out on the basis of § 25 (2) no. 2 TTDSG.

We use, among others, the following technically necessary cookies:

The “PHPSESSID” cookie for security reasons. This cookie is a session cookie and is deleted as soon as you close your browser.
A cookie that gives the website administrators access to the backoffice information. This cookie has a lifespan of 480 hours.
A cookie with which our cookie banner can be hidden. This cookie has a lifespan of one year.
For all other functions that are not absolutely necessary, your permission is required for the storage of information on your end device or access to information that is already stored on your end device in accordance with article 25 (1) sentence 1 TTDSG. Every permission you have given remains in effect until you change or reset the relevant settings on your device. You can change your settings at any time by clicking on the fingerprint button at the bottom right or bottom left of the page. If you do not accept cookies, the functionality of our website may be limited.

You can also set the storage of cookies directly in your browser. You can find the cookie settings for your browser under the following links:  Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

We also use technologies to comply with the legal obligations we are subject to (e.g. to be able to prove consent for the processing of your personal data) and for web analysis and online marketing. More information about this, including the respective legal basis for data processing, can be found in the following sections of this privacy policy. More information about these technologies, including the respective legal basis for data processing, can be found on the Usercentrics platform. You can access this by clicking on the fingerprint button at the bottom right or bottom left of the page.

  • Use of the Usercentrics Consent Management Platform to manage permissions

On our website, we use the Usercentrics Consent Management Platform (“Usercentrics”) to inform you about the cookies and other technologies we use on our website and to obtain, manage and document your consent for the processing of your personal data by these technologies, insofar as this is required by law. This is necessary on the basis of Art. 6 para. 1 sentence 1 lit. c GDPR to comply with our legal obligation under Art. 7 para. 1 GDPR to be able to prove your consent for the processing of your personal data.

Usercentrics is a service of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, which processes your data on our behalf. When you visit our website, the Usersentrics web server stores a so-called server log file, which also contains your anonymized IP address, the date and time of your visit, device and browser information and information about your consent behavior. Your data is deleted after three years, unless you have expressly given permission for the further use of your data in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this statement.

  • Google Analytics

Our website uses Google Analytics, a web analysis service from Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies to analyze your use of the website. The information generated by the cookie about your use of this website is generally transferred to a Google server in the US and stored there. If IP anonymization is activated on this website, your IP address is first shortened by Google within the member states of the European Union or other states of the European Economic Area. Only in exceptional cases is the full IP address forwarded to a Google server in the US and shortened there. Google will use this information to analyze your use of the website, to compile reports on website activities for the website operator and to provide other services related to website and internet use for the website operator. The IP address that is passed on by your browser in the context of Google Analytics is not combined with other Google data. You can prevent the storage of cookies by configuring the settings of your browser software accordingly. However, we point out that you may not be able to fully use all functions of this website in that case. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing the browser plugin available via the following link: http://tools.google.com/dlpage/gaoptout?hl=de.

[We have activated “Google Signals” in Google Analytics for advertising purposes. This is an addition to the existing Google Analytics functions to obtain aggregated data about age, gender, location, search history and interests of website visitors, provided that they have allowed personalized ads in their Google account. By activating Google Signals, data is collected and linked to the Google account].

You can prevent Google Analytics from collecting data by clicking on the following link. This sets an opt-out cookie that prevents your data from being collected in the future when you visit this website: Disable Google Analytics. [You can disable the “Google Signals” function at any time via the settings in your Google account: https://adssettings.google.com]

More information about terms of use and data protection can be found on http://www.google.com/analytics/terms and https://policies.google.com/?hl=en. [Note that on this website Google Analytics is extended with the code “anonymizeIp” to ensure that IP addresses are collected anonymized (IP masking)].

  • Elevar

We use the Elevar web analysis service on our website or parts of our website to record the use of our website by visitors and to evaluate and optimize the effectiveness of our advertising and marketing measures. Elevar is a web analysis service provided by Elevar LLC in Charleston, US (“Elevar”). Elevar LLC acts as a processor for us on the basis of a data processing agreement in accordance with Art. 28 GDPR.

Elevar automatically collects data such as your IP address, the time of your visit, information about your device and browser and your use of our website. This data is used to create user profiles that are managed using pseudonyms. Cookies may also be used for these purposes. These pseudonymized profiles are not linked to personal data without your express permission.

3. Information for customers

You can order our products directly from us via our webshop. We need various data to process and fulfill your order. In the following sections of this privacy policy you will find information about the processing of your data, in particular about the transfer to our service providers for the processing of orders, payments and shipments.
In principle, your data is limited for further processing after the contract has been fully processed and deleted after the expiration of the retention periods according to tax and commercial legislation, unless you have expressly given permission for the further use of your data in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this statement.

3.1 Customer account

You have the option to open a customer account with us and store your data for future orders on our website. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b GDPR, i.e. that you provide us the data on the basis of the contractual relationship between you and Zippo. Deletion of your customer account is possible at any time and can be done by sending a message to the contact option described in this privacy policy or via a function provided for this purpose in the customer account. After deleting your customer account, your data will be deleted, unless you have expressly given permission for the further use of your data in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use data beyond this, which is legally permitted and about which we inform you in this statement.

3.2 Data processing for contract processing

For the purpose of contract processing (including questions about and processing of existing warranty and service claims and legal update obligations) in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR, we collect personal data when you voluntarily provide it to us as part of your order. Mandatory fields are marked as such, because we need the data in these cases to process the contract and we cannot send the order without this data. Which data is collected, you can see on the respective input forms.

More information about the processing of your data, in particular about the transfer to our service providers for the handling of orders, payments and shipments, you will find in the following chapters of this privacy policy. After completion of the contract, your data will be limited for further processing and deleted after the expiration of the tax and commercial law retention periods in accordance with Art. 6 para. 1 sentence 1 lit. c GDPR, unless you have expressly given permission for the further use of your data in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR or we reserve the right to use data beyond what is legally permitted and about which we inform you in this statement.

3.3 Data processing for shipping processing

To fulfill the contract in accordance with Art. 6 Para. 1 S. 1 lit. b GDPR, we pass your data to the shipping service provider that is responsible for the delivery, insofar as this is necessary for the delivery of the ordered goods.

If you have given us your express permission for this during or after your order, we pass your email address to the selected provider of the shipping service in accordance with Art. 6 par. 1 sentence 1 letter a GDPR, so that they can contact you before delivery to inform you about the delivery or coordinate it.
Permission can be revoked at any time by sending a message to the contact option described in this privacy policy or directly to the provider of the shipping service at the contact address listed below. After revocation, we delete your data that was provided for this purpose, unless you have expressly given permission for the further use of your data or we reserve the right to use data beyond what is legally permitted and about which we inform you in this statement.

General Logistics Systems Deutschland GmbH & Co. OHG
GLS Deutschland-Straße 1 - 7
DE-36286 Neuenstein
Germany

United Parcel Service Deutschland S.à.r.l. & Co. OHG
Görlitzer Straße 1
41460 Neuss
Germany

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Bonn, Germany

3.4 Data processing for payment processing

For the processing of payments in our online shop, we work together with the following partners: technical service providers, credit institutions, payment service providers.

  • Data processing for transaction processing

Depending on the payment method selected, we pass on the information required to process the payment transaction to our technical service providers, who work for us in the context of order processing, or to the commissioned credit institutions or to the selected payment service provider, insofar as this is necessary to process the payment. This is for the performance of the contract in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR. In some cases, the payment service providers themselves collect the information required to process the payment, for example on their own website or through a technical integration in the ordering process. In this context, the privacy policy of the payment service provider concerned applies.

If you have questions about our payment processing partners and the basis of our cooperation with them, please use the contact option described in this privacy policy.

  • Data processing for fraud prevention and optimization of our payment processes

If necessary, we pass on further information to our service providers in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR, which they process together with the information required to process the payment as our processors for the purpose of fraud prevention and optimizing our payment processes (e.g. invoicing, processing disputed payments, accounting support).

  • Purchase on installment

When selecting the payment method “purchase on installment” and providing the necessary data protection consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, personal data (first name, last name, address, email address, phone number, date of birth, IP address, gender) together with data required to process transactions (article, invoice amount, due dates, total amount, invoice number, taxes, currency, order date and time) is passed on to our partner PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2444 Luxembourg (“PayPal”) for the purpose of processing this payment method, 22-24 Boulevard Royal, L-2449 Luxembourg, Luxembourg (“PayPal”).


To check the identity or creditworthiness of the customer, our partner makes inquiries and retrieves information from publicly accessible databases and credit reporting agencies. The providers from whom information and, if applicable, creditworthiness information is obtained based on mathematical-statistical procedures, as well as further details about the processing of your data after transfer to our partner PayPal, can be found in their privacy policy, which you can find here: https://www.paypal.com/de/webapps/mpp/ua/privacy-full


Our partner PayPal uses the received information about the statistical probability of default to make a balanced decision about entering into, performing, or terminating the contractual relationship. You have the option to contact our partner PayPal to explain your position and dispute the decision. The consent given for data transfer during the ordering process can be revoked at any time, also without giving reasons, with future effect.

3.5 Contact us

In the context of customer communication, we collect personal data to process your questions in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR if you voluntarily provide us with this data when you contact us (e.g. via a contact form or email). Mandatory fields are marked as such, because we absolutely need the data in these cases to process your contact. You can see which data is collected on the relevant input forms. After your request has been fully processed, your data will be deleted, unless you have expressly given permission for further use of your data in accordance with Art. 6 para. 1 sentence 1 letter a GDPR or we reserve the right to use data further than legally permitted and about which we inform you in this statement.

4. Information for business partners

If you are a business partner of Zippo or want to become one, we must collect and use certain data about you and/or people within your organization to fulfill our contractual obligations or to communicate with you. Without this data, we will generally have to refuse to enter into the contract or execute the order or will no longer be able to perform an existing contract and will therefore have to terminate it.

If necessary, we collect the first and last name, any titles and academic degrees, the company name, the area of responsibility, the address, the telephone details, the email address, the gender and the language preference of our business partners.

We use the above-mentioned data to fulfill our contractual obligations and/or to communicate with you. The legal basis for the processing of your personal data is Art. 6 para. 1 letter b GDPR. We delete the personal data of our business partners ten (10) years after the last documented communication. This does not affect your rights as a data subject below, including the right to erasure.

5. Social Media

If you have given permission to the relevant social media operator in accordance with Art. 6 para. 1 sentence 1 letter a GDPR, your data is automatically collected and stored for market research and advertising purposes when you visit our online presence on the following social media, where user profiles are created using pseudonymous data. These can, for example, be used to place advertisements inside and outside the platforms that presumably correspond to your interests. For this purpose, cookies are generally used. For detailed information about the processing and use of data by the respective social media operator, as well as a contact option and your rights and setting options for the protection of your privacy, we refer you to the data protection notices of the providers linked below. If you need further help with this, you can contact us.

5.1 Facebook

Facebook is offered by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (“Meta Platforms Ireland”). The information automatically collected by Meta Platforms Ireland about your use of our online presence on Facebook is usually transferred to a server at Meta Platforms, Inc., 1 Hacker Way, Menlo Park, California 94025, USA and stored there. The data processing when visiting a Facebook fan page is based on an agreement between jointly responsible parties in accordance with Art. 26 GDPR. More information about Insights data can be found here.

5.2 X

X is offered by Twitter Unlimited International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland (“X”). The information automatically collected by X about your use of our online presence on Twitter is generally transferred to a server of X Corp, 1355 Market Street, Suite 900, San Francisco, CA 94103, USA and stored there.

5.3 Instagram

Instagram is a service of Meta Platforms Ireland. The information automatically collected by Meta Platforms Ireland about your use of our online presence on Instagram is usually transferred to a server of Meta Platforms, Inc, 1 Hacker Way, Menlo Park, California 94025, USA and stored there. Data processing in the context of a visit to an Instagram fan page is based on an agreement between jointly responsible parties in accordance with Art. 26 GDPR. More information about Insights data can be found here.

5.4 YouTube

YouTube is a service of Google. The information automatically collected by Google about your use of our online presence on YouTube is generally forwarded to a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA and stored there. 

    5.5 Pinterest

    Pinterest is a service offered by Pinterest Europe Ltd, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (“Pinterest”). The data automatically collected by Pinterest about your use of our online presence on Pinterest is usually transferred to a server of Pinterest, Inc, 505 Brannan St., San Francisco, CA 94107, USA and stored there. The data processing in the context of the visit to our presence on LinkedIn is based on an agreement between the jointly responsible parties in accordance with Art. 26 GDPR.

    5.6 LinkedIn

    LinkedIn is a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). The information automatically collected by LinkedIn about your use of our online presence on LinkedIn is generally forwarded to a server of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA and stored there. The data processing in the context of the visit to our presence on LinkedIn is based on an agreement between the jointly responsible parties in accordance with Art. 26 GDPR.

    5.7 TikTok:

    TikTok is a service offered by TikTok Technology Ltd, 10 Earlsfort Terrace, Dublin 2, Ireland (“TikTok”). The data collected during the use of users is stored in data centers in the United States, Malaysia and Singapore. The processing by TikTok is partly carried out as joint controllers on the basis of an agreement between joint controllers in accordance with Art. 26 GDPR and partly as order processing on the basis of an order processing agreement in accordance with Art. 28 GDPR.

    6. Information for applicants

    You can apply for the vacancies on our website by sending an email to bewerbung@zippo.com. Our application form is available on our website for this purpose. If you do not provide the required data, we may not be able to process your application.

    In this context, we collect your first and last name, any titles and academic degrees, address, date of birth, nationality, telephone details and email address, as well as all other data in your application documents and CV. Providing this personal data is voluntary. Your data is processed in accordance with Art. 6 para. 1 sentence 1 lit. b GDPR solely for the purpose of making a decision about entering into an employment relationship.

    If your application is successful, we store your data for the duration of the employment relationship. If your application is not successful, we generally delete your application data after six months, taking into account the limitation periods according to the law of evidence, unless you have given permission for further storage in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, for example to be considered for future positions.

    We use Join Solutions AG, Schönhauser Allee 36, 10435 Berlin (“Join Solutions”) as a contractor for applications.

    7. Information for newsletter subscribers:

    On our website, we offer you the option to subscribe to our newsletter so that we can keep you informed about Zippo news and events. We collect your email address, last name, first name and title.

    The newsletter is sent and the associated processing of your personal data takes place exclusively on the basis of your consent in accordance with Art. 6 para. 1 sentence 11 lit. a GDPR.

    We use technology from our service provider HubSpot, Inc. Two Canal Park, Cambridge, MA 02141 USA (“HubSpot”) to send the newsletter and analyze behavior. HubSpot analyzes deliveries, opens, clicks, country of origin and the medium used to open the newsletter on our behalf. HubSpot uses servers in the USA to deliver its services. In this respect, our cooperation with them is based on standard data protection clauses of the European Commission.

    You can withdraw your consent at any time. If you no longer want to receive the newsletter in the future, you can unsubscribe directly at any time via the shop.de@zippo.com unsubscribe. We delete your personal data after you have withdrawn your consent.

    8. Information about transfer to third countries (data transfer to third countries)

    We use technologies from service providers whose registered office and/or server locations may be in third countries outside the EU or the EEA. If there is no adequacy decision by the EU Commission for this country, we ensure an adequate level of data protection through other suitable guarantees.

    In general, we have agreed on the standard data protection clauses of the EU Commission with the technology providers we use and that process personal data in a third country for which no adequacy decision exists.  

    Nevertheless, it is possible that, despite all contractual and technical measures, the level of data protection in the third country does not correspond to that of the EU. In these cases, we will obtain your consent in accordance with Art. 49 para. 1 sentence 1 lit. a GDPR for the transfer of your personal data to a third country.

    In particular, there is a risk that local authorities in the third country do not have sufficiently limited access rights to your personal data from a European data protection perspective, that we as the data exporter or you as the data subject are not aware of this and/or that you do not have sufficient legal remedies to prevent this and/or take action against such access.  

    You can see which third countries we transfer data to in the data protection statements for the respective tool and/or service that we use for permission management/ Consent Manager Platform (CMP). 

    9. Your rights as a data subject

    As a data subject, you have the following rights:

    (i) in accordance with Article 15 GDPR, the right to request information about your personal data that is processed by us, insofar as specified;

    (ii) in accordance with Article 16 GDPR, the right to immediately request the correction of incorrect or incomplete personal data stored by us;

    (iii) in accordance with Article 17 GDPR, the right to request the erasure of your personal data stored by us, unless further processing is required

    • the exercise of the right to freedom of expression and information;
    • to comply with a legal obligation;
    • for reasons of public interest or
    • necessary to establish, exercise or defend legal claims;

    (iv) in accordance with Article 18 GDPR, the right to request the restriction of the processing of your personal data, insofar as

    (ii) in accordance with Article 20 GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request that it be transferred to another controller;

    (iii) in accordance with Article 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority in your usual place of residence or work or at our company headquarters.

    (iv) Insofar as we process personal data as explained above to protect our legitimate interests, which outweigh in the context of a balancing of interests, you can object to this processing with future effect. If the processing takes place for direct marketing purposes, you can exercise this right at any time as described above. If the processing takes place for other purposes, you only have the right to object if there are reasons arising from your specific situation.

    After exercising your right to object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defense of legal claims.

    This does not apply if the processing takes place for direct marketing purposes. We will then no longer process your personal data for this purpose.

     

    10. Contact

    If you have questions about the collection, processing, or use of your personal data, information, correction, restriction, or erasure of data, as well as the withdrawal of any consent or objection to a specific use of data, you can contact our customer service. company data protection officer.