Privacy policy

Privacy Policy

We are delighted that you are visiting our website https://peak.ag and that you are interested in our organisation.

Protecting your personal data—such as date of birth, name, telephone number, address, etc.—is important to us.

The purpose of this privacy policy is to inform you about the processing of your personal data that we collect when you visit our website. Our data protection practices comply with the legal provisions of the EU General Data Protection Regulation (GDPR). The following privacy policy serves to fulfil the information obligations arising from the GDPR, e.g. those set out in Articles 13 and 14 et seq. GDPR.

1. Controller
The controller within the meaning of Article 4(7) GDPR is the person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

With regard to our website, the controller is:

Peak Performance Products S.A.
13c, Fausermillen, 6689 Mertert, Luxembourg
Email: office@peak.ag
Tel.: +352 425215
Fax: +352 421315

2. Provision of the website and creation of log files
Each time our website is accessed, our system automatically collects data and information from the device used to access it (e.g. computer, mobile phone, tablet, etc.).

2.1. What personal data are collected and to what extent are they processed?

(1) Information about the browser type and version used;
(2) The operating system of the accessing device;
(3) Host name of the accessing computer;
(4) The IP address of the accessing device;
(5) Date and time of access;
(6) Websites and resources (images, files, other page content) that were accessed on our website;
(7) Websites from which the user’s system reached our website (referrer tracking);
(8) Status of access (whether retrieval was successful);
(9) Amount of data transmitted

This data is stored in the log files of our system. This data is not stored together with personal data of a specific user, so that individual visitors to the site cannot be identified.

2.2. Legal basis for processing personal data
Article 6(1)(f) GDPR (legitimate interests). Our legitimate interest is to ensure the achievement of the purpose described below.

2.3. Purpose of data processing
The data are anonymised immediately after collection with regard to the IP address, so that no inference can be made about an individual person based on the IP address. By analysing the anonymised data, we can observe and improve the stability and availability of our website over a longer period.
Temporary (automated) storage of the data is necessary for the process of a website visit in order to enable delivery of the website. The storage and processing of personal data also serve to maintain the compatibility of our website for as many visitors as possible and to combat misuse and eliminate faults. For this purpose, it is necessary to log the technical data of the accessing computer so that we can respond as early as possible to display errors, attacks on our IT systems and/or functional faults on our website. In addition, the data help us to optimise the website and to ensure the general security of our information technology systems.

2.4. Storage duration
The aforementioned technical data are deleted as soon as they are no longer required to ensure the compatibility of the website for all visitors, but no later than 3 months after our website has been accessed.

2.5. Right to object and to erasure
You may object to the processing at any time pursuant to Article 21 GDPR and request the erasure of data pursuant to Article 17 GDPR. You can find which rights you have and how to exercise them in the lower section of this privacy policy.

3. Special functions of the website
Our site offers you various functions which, when used, result in us collecting, processing and storing personal data.

Below we explain what happens to these data:

3.1. Order form
(a) What personal data are collected and to what extent are they processed?
The data you enter in the form fields, such as address, surname, first name, etc., are processed by us for the purpose stated below.

(b) Legal basis for processing personal data
Article 6(1)(b) GDPR (performance of pre-contractual measures and fulfilment of a contract)

(c) Purpose of data processing
The purpose of the data processing is to handle your order so that we can process potential contractual relationships with you and/or carry out pre-contractual measures. If you would also like to create a customer account with your order (pre-selected tick box), you must additionally provide a password. We will then set up an account for you on our platform that is linked to your email address.

(d) Storage duration
The data are deleted as soon as they are no longer required for processing the order and no statutory retention obligations apply. This is usually after 10 years.

(e) Right to object and to erasure
You can find which rights you have and how to exercise them in the lower section of this privacy policy.

(f) Necessity of providing personal data
The details in the order form are not contractually or legally required, but they are necessary to conclude a contract. If you do not fill in the required fields, or do not do so completely, the order you request cannot be completed. You can also place an order without creating a customer account.

3.2. Review function
(a) Scope of processing personal data
The data you enter in the fields of our review form will be processed by us for the purpose stated below. In this regard, we work with Trusted Shops GmbH, Subbelrather Straße 15c, 50823 Cologne, Germany. Further information on the handling of transmitted data can be found in the provider’s privacy policy at https://www.trustedshops.de/impressumdatenschutz//. The reviews are loaded from Trusted Shops.

(b) Legal basis for processing personal data
Article 6(1)(a) GDPR (consent by a clear affirmative act or conduct)

(c) Purpose of data processing
Acceptance and publication of your review on our website—and, if you explicitly agree—also on the online platforms of our review service providers.

(d) Storage duration
Your review is stored and published for an unlimited period. We reserve the right to delete it without giving reasons and without prior or subsequent notice.

(e) Right to withdraw consent and to erasure
You can have your review deleted at any time. The options for withdrawal and erasure are governed by the general rules on the right to withdraw consent and the right to erasure under data protection law set out later in this privacy policy.

(f) Necessity of providing personal data
Providing information in the review function is voluntary and neither contractually nor legally required. The information is also not necessary for concluding a contract. If you do not fill in the required fields, or do not do so completely, the review you request cannot be published on our platform.

3.3. Review requests by email
In this regard, we work with Trusted Shops GmbH, Subbelrather Straße 15c, 50823 Cologne, Germany. Further information on the handling of transmitted data can be found in the provider’s privacy policy at https://www.trustedshops.de/impressum-datenschutz//. The reviews are loaded from Trusted Shops.

(a) What personal data are collected and to what extent are they processed?
Your surname, first name, email address, the products ordered, as well as the date and time of the order, are processed for the purpose stated below.

(b) Legal basis for processing personal data
Article 6(1)(a) GDPR (consent by a clear affirmative act or conduct) by consenting at the end of the ordering process.

(c) Purpose of data processing
The purpose of the data processing is to handle your order so that we can perform or initiate the contract concluded with you.

(d) Storage duration
We use your data for the purpose of sending a review request for a maximum of one week after the relevant order. Please note, however, that we must store the data from your order for a longer period for contractual purposes; information on this can be found above under “Order form” in this privacy policy. For the purpose of the review request, we will no longer process your data after the review request has been sent for the respective order. Information on whether you have objected to the processing of data for the purpose of review requests will be stored in connection with your email address for 12 months after your last order and then deleted, provided that no statutory retention obligations apply.

(e) Right to object and to erasure
You may object to receiving review requests at any time without incurring any costs other than the transmission costs at basic rates. Each review request contains information on how you can unsubscribe from further review requests. You can also send your objection to the contact details provided in this privacy policy or in the legal notice. After unsubscribing, we will no longer process your data for the purpose of sending review requests. You can find which further rights you have and how to exercise them in the lower section of this privacy policy.

(f) Necessity of providing personal data
Independent of the sending of a review request, you must fill in the fields marked as mandatory in the order form so that we can process your order (see “Order form” above in this privacy policy). However, providing data for the purpose of sending the review request itself is neither legally nor contractually required. If you object to this use, it will have no effect on your order. We will then not send you a request to review your order.

3.4. Contact form(s)
(a) What personal data are collected and to what extent are they processed?
The data you enter into our contact forms—the data you enter into the input fields of the contact form.

(b) Legal basis for processing personal data
Article 6(1)(a) GDPR (consent by a clear affirmative act or conduct)

(c) Purpose of data processing
The data recorded via our contact form(s) will be used solely to process the specific contact enquiry received via the contact form. Please note that, in order to fulfil your contact request, we may also send emails to the address you have provided. This is so that you can receive confirmation from us that your enquiry has been correctly forwarded to us. However, sending this confirmation email is not obligatory for us and serves only for your information.

(d) Storage duration
After your enquiry has been processed, the data collected will be deleted without delay, provided there are no statutory retention periods.

(e) Right to withdraw consent and to erasure
The options for withdrawal and erasure are governed by the general rules on the right to withdraw consent and the right to erasure under data protection law set out later in this privacy policy.

(f) Necessity of providing personal data
Using the contact forms is voluntary and neither contractually nor legally required. You are not obliged to contact us via the contact form; you may also use the other contact options provided on our site. If you wish to use our contact form, you must fill in the fields marked as mandatory. If you do not fill in the necessary fields of the contact form, you may either be unable to submit the enquiry or we may be unable to process your enquiry.

3.5. Login area / registration
(a) Scope of processing personal data and personal data collected
The registration and login data you enter with us or that are communicated to you.

(b) Legal basis for processing personal data
Article 6(1)(b) GDPR (performance of pre-contractual measures and fulfilment of a contract)

(c) Purpose of data processing
You have the option of using a separate login area on our website. In order for us to verify your authorisation to use the protected area and/or protected documents, you must enter your login data (email or username and password) in the relevant form. If required, we can, upon request, send your login data to you by email and/or provide the option to reset your password.

(d) Storage duration
The data collected are stored for as long as you maintain a user account with us.

(e) Right to object and to erasure
You may object to the processing at any time pursuant to Article 21 GDPR and request the erasure of data pursuant to Article 17 GDPR. You can find which rights you have and how to exercise them in the lower section of this privacy policy.

(f) Necessity of providing personal data
Using the login area on our site is contractually required to use the protected area. The content protected by the login area cannot be used without entering personal data. If you wish to use our login area, you must fill in the fields marked as mandatory (username and password). Entering the data presupposes the existence of a user account. Logging in is not possible if the data you enter are incorrect. If the data you enter are incorrect or not provided, the protected area cannot be used. The rest of the site can still be used without login.

3.6. Newsletter sign-up form
(a) What personal data are collected and to what extent are they processed?
By subscribing to the newsletter on our website, we receive the email address you enter in the sign-up field and, where applicable, other contact details if you provide them to us via the newsletter sign-up form.

(b) Legal basis for processing personal data
Article 6(1)(a) GDPR (consent by a clear affirmative act or conduct)

(c) Purpose of data processing
The data captured in the sign-up form for our newsletter will be used by us exclusively for sending our newsletter, in which we inform you about all our services and our news. After you sign up, we will send you a confirmation email containing a link that you must click to complete your subscription to our newsletter (double opt-in).

(d) Storage duration
Our newsletter can be unsubscribed from at any time by clicking the unsubscribe link included in every newsletter. Your data will be deleted by us without delay after you unsubscribe, provided there are no statutory retention obligations. Likewise, if a sign-up is not completed, your data will be deleted by us without delay. We reserve the right to delete data without giving reasons and without prior or subsequent notice.

(e) Right to withdraw consent and to erasure
The options for withdrawal and erasure are governed by the general rules on the right to withdraw consent and the right to erasure under data protection law set out later in this privacy policy.

(f) Necessity of providing personal data
If you wish to use our newsletter, you must fill in the fields marked as mandatory and confirm your email address by clicking the double opt-in link. Providing details for newsletter sign-up is neither necessary to enter into a contract with us nor legally obligatory. It serves solely for sending our newsletter. If you do not fill in the mandatory fields, we will unfortunately be unable to provide you with our newsletter service.

4. Automated credit check / scoring
If you wish to conclude a contract with us, we reserve the right to carry out processing of your personal data solely by automated means in order to check your creditworthiness. We are also entitled to make such an automated decision pursuant to Article 22(2)(a) GDPR. Whether or not the contract can be concluded depends on the result of the automated credit check. A credit check calculates statistical probabilities of payment default. The credit report may include probability values (score values) calculated on the basis of scientifically recognised mathematical–statistical procedures. Using a multitude of characteristics, such as income, address data, occupation, marital status and past payment behaviour, conclusions are drawn about the customer’s future risk of payment default. The result is expressed in the form of a payment value (the so-called score). The information obtained in this way forms the basis of our decision on the establishment, performance or termination of a contractual relationship. If you believe that you have been wrongly excluded from concluding a contract due to the credit check, you are welcome to explain your position to us by email. We will then review the automated decision in the individual case pursuant to Article 22(3) GDPR. In order to carry out the credit check, we may store and process your personal data pursuant to Article 6(1)(b) GDPR.
On the basis of the contract being initiated, we transmit your data in the cases listed below to the following provider(s):

4.1. Automatic identity and credit check when selecting the “PayPal” payment method
(a) What personal data are collected and to what extent are they processed?
If you have selected “PayPal” as the payment method, we forward the personal customer data collected by us in the course of the order to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (hereinafter “PayPal”) for the purpose of payment processing. Provided you give your consent, the following data are affected by the data transfer: first and last name, street, house number, postcode, city, date of birth, telephone number as well as the data associated with your order.

(b) Legal basis for processing personal data
Article 6(1)(b) GDPR (performance of pre-contractual measures and fulfilment of a contract)

(c) Purpose of data processing
When the “PayPal” payment method is selected, PayPal carries out a credit check. Mathematical–statistical procedures are used to calculate a rating regarding the probability of payment default (the calculation of a so-called scoring value). PayPal bases its decision on the provision of the respective payment methods on the calculated scoring value. The calculation of a scoring value is carried out using recognised scientific procedures. Reference is also made to PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

(d) Storage duration
We will store the relevant data for processing the payment for as long as is necessary to carry out the transaction. Where the data are subject to statutory retention obligations, deletion will take place after the retention period has expired. The duration of data storage by PayPal is set out in PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

(e) Right to object and to erasure
You may object to the processing at any time pursuant to Article 21 GDPR and request the erasure of the data pursuant to Article 17 GDPR. You can find which rights you have and how to exercise them in the lower section of this privacy policy.

4.2. Automatic identity and credit check when selecting Klarna payment methods
(a) What personal data are collected and to what extent are they processed?
If you choose the “purchase on account” payment method with Klarna Invoice Purchase or the “instalment purchase” payment method via Klarna Instalment Purchase or Klarna Sofort, you will be asked during the order process to consent to the transmission of the data required for payment processing and an identity and credit check to Klarna AB, Sveavägen 46, 11134 Stockholm, Sweden (hereinafter: Klarna). If you give your consent, Klarna will receive the following data from us: first name and surname, street, house number, postcode, town/city, date of birth, telephone number as well as the data associated with your order.

(b) Legal basis for processing personal data
Article 6(1)(b) GDPR (performance of pre-contractual measures and fulfilment of a contract)

(c) Purpose of data processing
For the purpose of identity and credit checks, Klarna transmits data to credit reference agencies and receives information from them as well as, where applicable, credit information based on mathematical–statistical procedures, in which address data, among other things, are included in the calculation (so-called score values). In this way, Klarna obtains information about the statistical probability of a payment default, which forms the basis for the decision on the establishment, performance or termination of the contractual relationship. However, the option to choose one of the payment methods offered prior to conclusion of the contract is not dependent on such information.

The credit reference agencies are the following companies:

• Bürgel Wirtschaftsinformationen GmbH & Co. KG, Postfach 5001 66, 22701 Hamburg
• Creditreform Boniversum GmbH, Hellersbergstraße 11 41460 Neuss
• Deltavista GmbH, Freisinger Landstr. 74, 80939 Munich
• Arvato Infoscore Consumer Data GmbH / Infoscore Consumer Data GmbH, Rheinstraße 99, 76532 Baden-Baden
• SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden

Detailed information can be found in Klarna’s data protection provisions (https://cdn.klarna.com/1.0/shared/content/policy/data/de_de/data_protection.pdf) and Klarna’s terms of use (https://klarna.com/de/AGB).

(d) Storage duration
We will store the relevant data for processing the payment for as long as is necessary to carry out the transaction. Where the data are subject to statutory retention obligations, deletion will take place after the retention period has expired. The duration of data storage by Klarna is set out in Klarna’s privacy policy: https://cdn.klarna.com/1.0/shared/content/policy/data/de_de/data_protection.pdf

(e) Right to object and to erasure
You may object to the processing at any time pursuant to Article 21 GDPR and request the erasure of the data pursuant to Article 17 GDPR. You can find which rights you have and how to exercise them in the lower section of this privacy policy.

5. Statistical analysis of visits to this website – web trackers
When this website or individual files on the website are accessed, we collect, process and store the following data: IP address, the web page from which the file was retrieved, name of the file, date and time of access, amount of data transferred and a message indicating whether the retrieval was successful (so-called web log). We use these access data solely in a non-personalised form for the continual improvement of our online offering and for statistical purposes. To analyse visits to this website, we also use the following web trackers:

5.1. Facebook Connect
We use on our site the Facebook Connect service provided by Facebook Ireland Limited, 4 Grand Canal Square, 2 Dublin, Ireland, email: impressum-support@support.facebook.com, website: http://www.facebook.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
Facebook Connect enables users to use their Facebook profile for simplified registration with other web services.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://www.facebook.com/about/privacy.
The provider also offers an opt-out option at https://www.facebook.com/about/privacy.

5.2. Facebook Custom Audience
We use on our site the Facebook Custom Audience service provided by Facebook Ireland Limited, 4 Grand Canal Square, 2 Dublin, Ireland, email: impressum-support@support.facebook.com, website: http://facebook.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
Facebook Custom Audience is an advertising tool from Facebook that enables targeted advertising campaigns to be directed at site visitors.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://www.facebook.com/about/privacy.
The provider also offers an opt-out option at https://www.facebook.com/about/privacy.

5.3. Google Tag Manager
(a) What personal data are collected and to what extent are they processed?
We use on our site the service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: Google Tag Manager). Google Tag Manager provides a technical platform to execute and centrally manage other web services and web tracking programmes by means of so-called “tags”. In this context, Google Tag Manager stores cookies on your computer and, insofar as web tracking tools are executed via Google Tag Manager, analyses your surfing behaviour (so-called “tracking”). The data sent by individual tags embedded in Google Tag Manager are consolidated, stored and processed by Google Tag Manager under a unified user interface. All embedded “tags” are listed separately again in this privacy policy. Further information on data protection for the tools embedded in Google Tag Manager can be found in the respective section of this privacy policy. When using our website with tags from Google Tag Manager activated, data—particularly your IP address and your user activities—are transmitted to servers of Google Ireland Limited. With regard to the web services embedded via Google Tag Manager, the provisions in the respective section of this privacy policy apply. The tracking tools used in Google Tag Manager ensure, through IP anonymisation in the source code, that the IP address is anonymised by Google Tag Manager before transmission. Google Tag Manager only enables the anonymised collection of IP addresses (so-called IP masking). Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.

(b) Legal basis for processing personal data
The legal basis for data processing is your consent in our cookie and web tracking notice pursuant to Article 6(1)(a) GDPR (consent by a clear affirmative act or conduct).

(c) Purpose of data processing
On our behalf, Google will use the information obtained via Google Tag Manager to evaluate your visit to this website, to compile reports on website activities and to provide us with further services associated with the use of the website and the internet.

(d) Storage duration
Google will store the data relevant to the functioning of Google Tag Manager for as long as is necessary to deliver the booked web service. Data collection and storage take place in anonymised form. Insofar as a personal reference should exist, the data will be deleted without delay, provided they are not subject to statutory retention obligations. In any case, deletion takes place after the retention period has expired.

(e) Right to object and to erasure
You can prevent the collection and forwarding of personal data to Google (in particular your IP address) as well as the processing of these data by Google by disabling the execution of script code in your browser, installing a script blocker in your browser or activating your browser’s “Do Not Track” setting. You can also prevent the collection of the data generated by the Google cookie and related to your use of the website (including your IP address) by Google as well as the processing of these data by Google by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de. Google’s security and privacy principles can be found at https://policies.google.com/privacy.

5.4. Google Analytics
(a) Scope of processing personal data
We use on our site the web tracking service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: Google Analytics). Within the framework of web tracking, Google Analytics uses cookies that are stored on your computer and that enable an analysis of the use of our website and your surfing behaviour (so-called tracking). We carry out this analysis on the basis of Google Analytics’ tracking service in order to constantly optimise our online offering and make it more widely available. When using our website, data—particularly your IP address and your user activities—are transmitted to servers of Google Ireland Limited. We carry out this analysis on the basis of Google’s tracking service in order to constantly optimise our online offering and make it more widely available. We also require web tracking for security reasons. Through web tracking, we can trace whether third parties are attacking our website. The information from the web tracker enables us to take effective countermeasures and protect the personal data we process from these cyber attacks. By activating IP anonymisation within the Google Analytics tracking code of this website, your IP address is anonymised by Google Analytics before transmission. This website uses a Google Analytics tracking code that has been extended by the operator gat._anonymizeIp(); to enable only anonymised collection of IP addresses (so-called IP masking). Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.

(b) Legal basis for processing personal data
The legal basis for data processing is your consent in our cookie and web tracking notice pursuant to Article 6(1)(a) GDPR (consent by a clear affirmative act or conduct).

(c) Purpose of data processing
On our behalf, Google will use this information to evaluate your visit to this website, to compile reports on website activities and to provide us with further services related to the use of the website and the internet. We also require web tracking for security reasons. Through web tracking, we can trace whether third parties are attacking our website. The information from the web tracker enables us to take effective countermeasures and protect the personal data we process from these cyber attacks.

(d) Storage duration
Google will store the data relevant to the provision of web tracking for as long as is necessary to deliver the booked web service. Data collection and storage take place in anonymised form. Insofar as a personal reference should exist, the data will be deleted without delay, provided they are not subject to statutory retention obligations. In any case, deletion takes place after the retention period has expired.

(e) Rights to object and to erasure
You can prevent the collection and forwarding of personal data to Google (in particular your IP address) as well as the processing of these data by Google by disabling the execution of script code in your browser or activating your browser’s “Do Not Track” setting. You can also prevent the collection of the data generated by the Google cookie and related to your use of the website (including your IP address) by Google as well as the processing of these data by Google by downloading and installing the browser plug-in available at the following link (http://tools.google.com/dlpage/gaoptout?hl=de). Google’s security and privacy principles can be found at https://policies.google.com/privacy?hl=de.

5.5. Microsoft Advertising
We use on our site the Microsoft Advertising service provided by Microsoft Corporation, One Microsoft Way, 98052 Redmond, United States, email: brendon.lynch@microsoft.com, website: https://www.microsoft.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
The Microsoft Advertising service, as part of Microsoft Advertising, is a service that enables pay-per-click advertising on both Bing and Yahoo! search engines and collects data on our site.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://privacy.microsoft.com/de-de/privacystatement.

5.6. Microsoft Clarity
We use on our site the Microsoft Clarity service provided by Microsoft Corporation, One Microsoft Way, WA 98052-6399 Redmond, United States. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
The service enables us to analyse user behaviour. This allows us to make our website more attractive and improve the user experience.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://privacy.microsoft.com/de-de/privacystatement.

6. Integration of external web services and processing of data outside the EU
We use active content from external providers (so-called web services) on our website. By accessing our website, these external providers may receive personal information about your visit to our website. In this context, data processing outside the EU may be possible. You can prevent this by installing a suitable browser plug-in or by disabling the execution of scripts in your browser. This may result in functional restrictions on websites you visit.
We use the following external web services:

6.1. Bing
We use on our site the Bing service provided by Microsoft Corporation, One Microsoft Way, 98052 Redmond, United States, email: brendon.lynch@microsoft.com, website: https://www.microsoft.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
The Bing service enables faster searches across our site and/or the internet and links search engine content with our website.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://privacy.microsoft.com/de-de/privacystatement.

6.2. Cloudflare
We use on our site the Cloudflare service provided by Cloudflare, Inc., 101 Townsend St, 94107 San Francisco, United States, email: support@cloudflare.com, website: https://www.cloudflare.com/de-de/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is our legitimate interest in processing pursuant to Article 6(1)(f) GDPR. Our legitimate interest lies in achieving the purpose described below.
Cloudflare is a so-called content delivery network which, in addition to distributing the website across multiple servers, also provides security functions. Cloudflare also functions as a reverse proxy for our website.
With regard to processing, you have the right to object as set out in Article 21. Further information can be found at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://www.cloudflare.com/privacypolicy/.

6.3. DoubleClick
We use on our site the DoubleClick service provided by Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States, email: support-de@google.com, website: http://www.google.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
DoubleClick is a service from Google through which digital advertising is offered and delivered on the internet. It enables us to display individualised advertising to our site visitors.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://policies.google.com/privacy.

6.4. Findologic
We use on our site the Findologic service provided by Findologic GmbH, Jakob-Haringer Straße 5a, A-5020 Salzburg, Austria. The transfer and processing of personal data take place exclusively on servers in the European Union.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
This service is a plugin that we require to display all the content of our website to you. The plugin makes our website more attractive and delivers a better experience for our site visitors.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://www.findologic.com/datenschutz/.

6.5. Google
We use on our site the Google service provided by Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States, email: support-de@google.com, website: http://www.google.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
We use Google to load additional Google services on the website.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://policies.google.com/privacy.

6.6. Google Fonts
We use on our site the Google Fonts service provided by Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States, email: support-de@google.com, website: http://www.google.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
Via the Google Fonts service, fonts are loaded on our site to display the page to you in a visually improved version.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://policies.google.com/privacy.

6.7. Google reCaptcha
We use on our site the Google reCaptcha service provided by Google LLC, 1600 Amphitheatre Parkway, 9403 Mountain View, United States, email: support-de@google.com, website: http://www.google.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
Using specific characteristics and an analysis of on-page behaviour, the service recognises whether the entries made are automated by a program (a so-called bot) or by a human. The service has three different levels. Either it automatically recognises that the entry is not automated by a bot, or it prompts the user to tick a captcha checkbox. A third option involves displaying small image, audio or text tasks that the site visitor must solve. Google reCaptcha is a captcha service used on our website for security reasons to ensure that bots (automated programs) cannot perform interactions on our website. On our behalf, Google reCaptcha verifies that only humans, and not bots, can use our website. In this way, we can protect the special features of our website (e.g. contact forms or other input options such as the login area) from abusive access.
For processing, the service and/or we collect the following data: user behaviour (e.g. mouse gestures or input behaviour), IP address, browser data, computer information.
If you wish to use the input options on our website protected by Google reCaptcha, you must allow the use of Google reCaptcha and, where applicable, solve the relevant captchas. If you do not complete the captcha or do not allow the use of Google reCaptcha, you cannot use the form protected by the captcha. Alternatively, you can use our other contact options at any time (e.g. post or email).
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://policies.google.com/privacy.

6.8. Gstatic
We use on our site the Gstatic service provided by Google LLC, 1600 Amphitheatre Parkway, 94043 Mountain View, United States, email: support-de@google.com, website: http://www.google.com/. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.
The legal basis for the transfer of personal data is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, Article 9(2)(a) GDPR, which you have given on our website.
Gstatic is a service used by Google to retrieve static content to reduce bandwidth usage and to pre-load required catalogue files.
You may withdraw your consent at any time. Further information on withdrawing your consent can be found either in the consent itself or at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s privacy policy at https://policies.google.com/privacy.

6.9. Trusted Shops
We use on our site the Trusted Shops service provided by Trusted Shops GmbH, Subbelrather Straße 15c, 50823 Cologne, Germany. The transfer and processing of personal data take place exclusively on servers in the European Union.
The legal basis for the transfer of personal data is our legitimate interest in processing pursuant to Article 6(1)(f) GDPR. Our legitimate interest lies in achieving the purpose described below.
Via Trusted Shops, reviews from other purchasers and/or the Trusted Shops seal are displayed on our site.
With regard to processing, you have the right to object as set out in Article 21. Further information can be found at the end of this privacy policy.
Further information on the handling of the transmitted data can be found in the provider’s legal notice/privacy page at https://www.trustedshops.de/impressum/.

6.10. Social plug-in – “Facebook”
(a) What personal data are collected and to what extent are they processed?
We have integrated on our website a social plug-in of the social network “Facebook”, which is operated by Facebook Ireland Limited, 4 Grand Canal Square, 2 Dublin, Ireland, email: impressum-support@support.facebook.com, website: http://www.facebook.com/ (“Facebook”). When you access a page that contains such a plug-in, your browser automatically establishes a background connection to Facebook’s servers. The content of the plug-in is transmitted by Facebook directly to your browser and merely embedded into our page. Through this integration, Facebook receives the information that your browser has loaded a specific page of our website. This applies even if you do not have a Facebook profile or are not currently logged in to Facebook. This information (including your IP address) is transmitted by your browser directly to a server of Facebook in Ireland and stored there. If you are logged in to Facebook, Facebook can directly assign the visit to our website to your Facebook profile. If you interact with the plug-ins, for example by clicking the “Like” button or leaving a comment, this information is also transmitted directly to a server of Facebook and stored there. The information is also published on your Facebook profile and displayed to your Facebook contacts whom you have enabled for this purpose. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.

(b) Legal basis for processing personal data
Article 6(1)(a) GDPR (insofar as you have registered with “Facebook”) and Article 6(1)(f) GDPR (if you have not registered with Facebook). Where processing is based on Article 6(1)(f) GDPR, the legitimate interest of the site operator lies in enabling users to interact with the site operator’s content on Facebook.

(c) Purpose of data processing
The primary purpose of data collection is to provide you with a Facebook-connected means of social interaction and thus make our online presence interactive. The scope of data collection and the further processing and use of the data you provide by Facebook, as well as your rights in this respect and setting options to protect your privacy, can be found in Facebook’s data protection information: https://www.facebook.com/about/privacy

(d) Storage duration
Facebook will store the data relevant to the provision of the web service for as long as is necessary. Where the data are subject to statutory retention obligations, deletion will take place after the retention period has expired.

(e) Right to object and to erasure
If you do not want the Facebook social plug-in to run, you can also prevent execution by installing a suitable add-on or script blocker. If you do not want Facebook to attribute the data collected via our website to your Facebook profile, you must log out of Facebook before visiting our website. The options for objection and removal are otherwise governed by the general rules on the right to object and the right to erasure under data protection law described later in this privacy policy.

6.11. Social plug-in – “Instagram”
(a) What personal data are collected and to what extent are they processed?
We have integrated on our website a social plug-in of the social network “Instagram”, which is operated by Facebook Ireland Limited, 4 Grand Canal Square, 2 Dublin, Ireland, email: impressum-support@support.facebook.com, website: http://facebook.com/ (“Instagram”). When you access a page that contains such a plug-in, your browser automatically establishes a background connection to Instagram’s servers. The content of the plug-in is transmitted by Instagram directly to your browser and merely embedded into our page. Through this integration, Instagram receives the information that your browser has loaded a specific page of our website. This applies even if you do not have an Instagram profile or are not currently logged in to Instagram. This information (including your IP address) is transmitted by your browser directly to a server of Instagram in Ireland and stored there. If you are logged in to Instagram, Instagram can directly assign the visit to our website to your Instagram profile. If you interact with the plug-ins, for example by clicking the “Like” button or leaving a comment, this information is also transmitted directly to a server of Instagram and stored there. The information is also published on your Instagram profile and displayed to your Instagram contacts whom you have enabled for this purpose. Processing also takes place in a third country for which there is no adequacy decision by the Commission. Therefore, the level of protection customary under the GDPR cannot be guaranteed for the transfer, since it cannot be ruled out that, for example, authorities in the third country may access the data collected.

(b) Legal basis for processing personal data
Article 6(1)(a) GDPR (insofar as you have registered with “Instagram”) and Article 6(1)(f) GDPR (if you have not registered with Instagram). Where processing is based on Article 6(1)(f) GDPR, the legitimate interest of the site operator lies in enabling users to interact with the site operator’s content on Instagram.

(c) Purpose of data processing
The primary purpose of data collection is to provide you with an Instagram-connected means of social interaction and thus make our online presence interactive. The scope of data collection and the further processing and use of the data you provide by Instagram, as well as your rights in this respect and setting options to protect your privacy, can be found in Instagram’s data protection information: https://www.facebook.com/about/privacy

(d) Storage duration
Instagram will store the data relevant to the provision of the web service for as long as is necessary. Where the data are subject to statutory retention obligations, deletion will take place after the retention period has expired.

(e) Right to object and to erasure
If you do not want the Instagram social plug-in to run, you can also prevent execution by installing a suitable add-on or script blocker. If you do not want Instagram to attribute the data collected via our website to your Instagram profile, you must log out of Instagram before visiting our website. The options for objection and removal are otherwise governed by the general rules on the right to object and the right to erasure under data protection law described later in this privacy policy.

7. Information on the use of cookies
(a) Scope of processing personal data
On various pages we integrate and use cookies to enable certain functions of our website and to integrate external web services. The so-called “cookies” are small text files that your browser can store on your access device. These text files contain a characteristic string that uniquely identifies the browser when you return to our website. The process of saving a cookie file is also referred to as “setting a cookie”. Cookies can be set both by the website itself and by external web services.
The cookies are set by our website and/or the external web services in order to maintain the full functionality of our website, to improve user-friendliness, or to pursue the purpose specified with your consent. Cookie technology also enables us to recognise individual visitors using pseudonyms, e.g. individual or random IDs, so that we can offer more individual services.
Details are set out in the following table.

(b) Legal basis for the processing of personal data
Art. 6 (1) (f) GDPR (legitimate interests) and/or Art. 6 (1) (a) and Art. 9 (2) (a) GDPR (consent). Where cookies are processed on the basis of consent pursuant to Art. 6 (1) (a) GDPR, this consent is also deemed consent within the meaning of Section 25 (1) TTDSG for German users for the placement of the cookie on the user’s device.
Where another legal basis under the GDPR is stated (e.g. for contract performance or to comply with legal obligations), storage or placement for German users is based on an exception pursuant to Section 25 (2) TTDSG.
This applies “where the sole purpose of the storage of information in the terminal equipment of the end user or the sole purpose of access to information already stored in the terminal equipment of the end user is to carry out the transmission of a message over a public telecommunications network” or “where the storage of information in the terminal equipment of the end user or the access to information already stored in the terminal equipment of the end user is strictly necessary in order for the provider of an information society service explicitly requested by the user to provide that service”. The applicable legal basis can be found in the cookie table set out later in this section.

(c) Purpose of data processing
The cookies are set by our website and/or the external web services in order to maintain the full functionality of our website, to improve user-friendliness, or to pursue the purpose specified with your consent.
Cookie technology also enables us to recognise individual visitors using pseudonyms, e.g. individual or random IDs, so that we can offer more tailored services.

(d) Storage period
The cookies listed below are stored in your browser until they are deleted or, in the case of a session cookie, until the session has expired. Details are set out in the following table:

(e) Right to object, withdrawal of consent and deletion
You can configure your browser to prevent cookies from being set altogether. You can then decide on a case-by-case basis whether to accept cookies or accept them in general. Cookies can be used for various purposes, e.g. to recognise that your device has already connected with our website (persistent cookies) or to store your most recently viewed offers (session cookies). If you have expressly permitted us to process your personal data, you may withdraw this consent at any time. Please note that the lawfulness of processing carried out on the basis of consent up to the time of withdrawal remains unaffected.

(f) Data security and data protection, communication by e-mail
Your personal data are protected during collection, storage and processing by technical and organisational measures in such a way that they are not accessible to third parties. In the case of unencrypted communication by e-mail, complete data security on the transmission path to our IT systems cannot be guaranteed by us, so for information requiring a high degree of confidentiality we recommend encrypted communication or postal correspondence.

7.1 Online marketing and the placement of advertising
Online advertising is used on our website. Online advertising enables us to reach our target audience as effectively as possible and to make our website attractive. Cookies are also used so that advertising can be displayed on the website. We work with the following advertising partners:

Affiliate marketing via the Belboon service
We promote our website using affiliate marketing. Affiliate marketing is an internet-based form of distribution in which a commercial provider (merchant or advertiser) offers partners (affiliates or publishers) remuneration for placing advertising on their website. The cookies used by Belboon for this purpose, including their duration and purpose, can be found in Belboon’s cookie table:

What personal data are collected and to what extent are they processed?
We publish advertising banners and advertising content via Belboon on various external pages. The distribution and control of the advertising measures are handled by the Belboon web service of belboon GmbH, Weinmeisterstr. 12 – 14, 10178 Berlin, Germany (hereinafter “Belboon”) via the affiliate network operated by Belboon. By clicking on the advertising content on external websites, site users are directed to our website. When using our website, data such as your IP address and your user activities are transmitted to the servers of Belboon. The delivery of the advertising and its integration into the website are carried out by Belboon. When users are redirected from external websites to our website, data are transmitted to determine the effectiveness and efficiency of the advertising measure. Cookies are also used on our website in order to assess the advertising effectiveness of site visitors through our advertising measures. The use of cookies by affiliate marketing is subject to continuous change.

Legal basis for the processing of personal data
The legal basis for data processing is your consent pursuant to Art. 6 (1) (a) GDPR given via our notice banner regarding the use of cookies and web tracking (consent by an unambiguous affirmative action or conduct).

Purpose of data processing
On our behalf, Belboon will process the data in order to place advertising and to account for the effectiveness of the advertising measure for the remuneration of the contractual arrangement with our affiliates.

Storage period
Belboon will store the data relevant for the provision of web tracking for as long as is necessary to perform the booked web service. Where a personal reference exists, the data will be deleted without delay unless statutory retention obligations apply. In any event, deletion takes place after expiry of the statutory retention period. The cookies are stored in your browser until they are deleted or, in the case of a session cookie, until the session has expired.
 
Right to object, withdrawal of consent and deletion
You can prevent the collection and forwarding of personal data to Belboon (in particular your IP address) as well as the processing of these data by Belboon by disabling the execution of script code in your browser, installing a script blocker in your browser or activating the “Do Not Track” setting of your browser. Belboon’s security and privacy principles can be found at https://belboon.com/dsgvo/. You can configure your browser according to your preferences so that the setting of cookies is generally prevented. You can then decide on a case-by-case basis whether to accept cookies or accept them in general. If you have expressly permitted us to process your personal data, you may withdraw this consent at any time. Please note that the lawfulness of processing carried out on the basis of consent up to the time of withdrawal remains unaffected.

8. Right of access and requests for rectification – erasure & restriction of data – withdrawal of consent – right to object
8.1. Right of access
You have the right to obtain confirmation as to whether we process personal data concerning you. If this is the case, you have the right of access to the information specified in Art. 15 (1) GDPR, insofar as the rights and freedoms of other persons are not adversely affected (see Art. 15 (4) GDPR). We will gladly also provide you with a copy of the data.

8.2. Right to rectification
Pursuant to Art. 16 GDPR, you have the right to have any personal data concerning you that may be incorrectly stored by us (such as address, name, etc.) corrected at any time. You may also request the completion of the data stored by us at any time. Such adjustments will be made without delay.

8.3. Right to erasure
Pursuant to Art. 17 (1) GDPR, you have the right to have the personal data concerning you that we have collected erased if

• the data are no longer required;
• the legal basis for the processing has ceased to apply without replacement due to the withdrawal of your consent;
• you have objected to the processing and there are no overriding legitimate grounds for the processing;
• your data are being processed unlawfully;
• a legal obligation requires this or collection took place pursuant to Art. 8 (1) GDPR.

The right does not exist pursuant to Art. 17 (3) GDPR if

• processing is necessary for exercising the right of freedom of expression and information;
• your data were collected on the basis of a legal obligation;
• processing is necessary for reasons of public interest;
• the data are necessary for the establishment, exercise or defence of legal claims.

8.4. Right to restriction of processing
Pursuant to Art. 18 (1) GDPR, you have the right in certain cases to request the restriction of processing of your personal data.
This is the case if

• you contest the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure;
• the data are no longer required for the processing purpose, but the data collected are required for the establishment, exercise or defence of legal claims;
• an objection to processing has been lodged pursuant to Art. 21 (1) GDPR and it is not yet clear which interests prevail.

8.5. Right to withdraw consent
If you have given us express consent to process your personal data (Art. 6 (1) (a) GDPR and/or Art. 9 (2) (a) GDPR), you may withdraw this consent at any time. Please note that the lawfulness of processing carried out on the basis of consent up to the time of withdrawal remains unaffected.

8.6. Right to object
Pursuant to Art. 21 GDPR, you have the right to object at any time to the processing of personal data concerning you that has been collected on the basis of Art. 6 (1) (f) (within the scope of a legitimate interest). This right only applies if special circumstances speak against the storage and processing.

8.7. How can you exercise your rights?

Peak Performance Products S.A.
13c, Fausermillen, 6689 Mertert, Luxembourg
E-mail: office@peak.ag
Tel.: +352 425215
Fax: +352 421315

9. Right to data portability
In accordance with Art. 20 GDPR, you have the right to receive the personal data concerning you. We will provide the data in a structured, commonly used and machine-readable format. The data can be sent either to you or, at your request, to another controller.
Upon request and in accordance with Art. 20 (1) GDPR, we will provide you with the following data:

• data collected on the basis of express consent pursuant to Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR;
• data that we have received from you under existing contracts pursuant to Art. 6 (1) (b) GDPR;

insofar as the data have been processed by automated means.
We will transfer the personal data directly to a controller specified by you where this is technically feasible. Please note that we may not transfer data that interfere with the freedoms and rights of other persons in accordance with Art. 20 (4) GDPR.

10. Right to lodge a complaint with a supervisory authority pursuant to Art. 77 (1) GDPR
If you suspect that your data are being processed unlawfully on our website, you may of course seek judicial clarification of the issue at any time. You also have any other legal remedy available to you. Regardless of this, you have the right under Art. 77 (1) GDPR to lodge a complaint with a supervisory authority. The right to lodge a complaint under Art. 77 GDPR is available to you in the EU Member State of your place of residence, your place of work and/or the place of the alleged infringement, i.e. you may choose the supervisory authority to which you address your complaint from the aforementioned places. The supervisory authority with which the complaint is lodged will then inform you of the status and the results of your submission, including the possibility of a judicial remedy under Art. 78 GDPR.