Privacy Policy

As of: 04.09.2026

1. Information on data protection

We are pleased that you are visiting our website and thank you for your interest in our company and our products. Below we inform you about which personal data we process, when and for which purposes, as well as about your rights.

What is personal data?
Personal data is information by which a person is identified or identifiable (e.g. name, address, e-mail address, telephone number).

2. Controller

MANePED GmbH
Grünstraße 5
42697 Solingen
Germany

Tel.: +49 157 35472608
E-mail: info@nagelzange.de

Person responsible within the meaning of the GDPR: Muhammad Usman

(“we”, “us”)

A separate data protection officer has not been appointed. The contact point for data protection is the contact address stated above.

3. Data collection and use when visiting the website

(1) Technically necessary data

When our website is accessed, technically necessary data is processed. This is in particular:

  • IP address,
  • date and time of the request,
  • time zone difference to GMT,
  • content of the request (specific page/file),
  • access status/HTTP status code,
  • amount of data transferred,
  • website from which the request comes (referrer),
  • browser,
  • operating system and interface,
  • language and version of the browser software.

Purpose:
Ensuring the stability, security and provision of the website.

Legal basis:
Art. 6 (1) (f) GDPR (legitimate interest in the secure operation of the website).

Storage period:
Server log files are retained for 30 days.

(2) Non-essential cookies and tracking

If you consent to the setting of cookies that are not strictly necessary or to tracking technologies, we process pseudonymised usage data by means of the analysis and marketing tools employed.

Legal basis:
Art. 6 (1) (a) GDPR.

Withdrawal:
You may withdraw your consent at any time with effect for the future.

4. Processing in connection with registration, orders and customer accounts

In the case of orders or a registration, we process in particular the following data:

  • name,
  • billing and delivery address,
  • e-mail address,
  • telephone number,
  • payment and order information.

Purposes of processing:

  • performance of the contract,
  • customer service,
  • shipping processing,
  • invoicing,
  • reversal of transactions,
  • warranty,
  • fraud prevention and prevention of misuse,
  • with your consent: direct advertising, review requests and newsletter dispatch.

Legal bases:

  • Art. 6 (1) (b) GDPR (contract / pre-contractual measures),
  • Art. 6 (1) (c) GDPR (legal obligations, e.g. retention under tax and commercial law),
  • Art. 6 (1) (f) GDPR (legitimate interest, e.g. fraud prevention),
  • Art. 6 (1) (a) GDPR (consent for advertising, newsletter, review requests).

5. Duration of data storage

We retain contractual and business documents in accordance with the statutory requirements for up to 10 years (Sections 147 AO, 257 HGB). Otherwise, we delete personal data as soon as the purpose of the processing ceases to apply or you withdraw a consent you have given, provided that no statutory retention obligations conflict with this.

You can send us deletion requests at any time via the contact form or by e-mail.

6. Recipients / disclosure to third parties

We use – insofar as necessary – external service providers and transfer data to the following categories of recipients:

  • Payment service providers: PayPal, Klarna, Stripe, SOFORT, Shopify Payments, Apple Pay, Google Pay
  • Shipping / logistics: Excellent GmbH (fulfilment & shipping); where applicable, parcel service providers engaged on behalf of Excellent GmbH (e.g. DHL, GLS, DPD)
  • Invoicing: easybill GmbH (creation and management of invoices)
  • E-mail / marketing: Klaviyo
  • Reviews: Judge.me, Trustpilot, Google
  • Shop platform / hosting: Shopify
  • Communication: WhatsApp via Charles GmbH
  • Loyalty programme: LoyaltyLion
  • Hosting / e-mail / technical infrastructure: goneo Internet GmbH
  • Advertising and social media platforms: Meta Platforms Ireland Limited (Facebook, Instagram, Meta Pixel, remarketing/retargeting)
  • Advertising / conversion measurement: Microsoft Ireland Operations Limited (Microsoft Advertising, Universal Event Tracking)
  • Analytics / marketing measurement: Profitmetrics ApS

Legal bases:
Art. 6 (1) (b), (f) GDPR; in the case of marketing, review requests or similar optional functions, where applicable Art. 6 (1) (a) GDPR.

6.1 Receivables management / debt collection (paywise)

Should payments due not be settled despite a reminder, we reserve the right to hand over the enforcement of our claims to an external debt collection service provider.

Recipient:
paywise GmbH
Bahnhofstr. 95
82166 Gräfelfing
Germany
Tel.: +49 (0) 89 9545384 0
E-mail: kontakt@paywise.de

Data categories:
Personal data required for the enforcement of claims, in particular:

  • name,
  • address,
  • contact details,
  • contract, order and claim data,
  • invoice number,
  • amount,
  • due date,
  • reminder data,
  • payment and communication data.

Purpose:
Enforcement of our contractual payment claims as well as processing and collection of outstanding receivables.

Legal basis:
Art. 6 (1) (f) GDPR (legitimate interest in efficient receivables management and legal enforcement), where applicable additionally Art. 6 (1) (b) GDPR.

Note on responsibility:
paywise processes the transmitted data as an independent controller.

Storage period:
Only for as long as is necessary for the enforcement of the claim and for compliance with statutory retention obligations.

Credit agencies:
Insofar as the statutory requirements are met, data may be exchanged with credit agencies, e.g. for credit checks or for reporting undisputed, due and unpaid receivables.

Legal basis:
Art. 6 (1) (f) GDPR.

7. Hosting / platform (Shopify)

Our website and our online shop are operated via Shopify. The provider is Shopify International Limited, Ireland; further affiliated companies are involved, including Shopify Inc., Canada.

In this context, personal data is processed insofar as this is necessary for the provision of the shop functions.

Third country transfer:
Transfers may take place to countries outside the EEA, including to Canada or the USA. The transfers are carried out on the basis of appropriate safeguards, in particular standard contractual clauses. For Canada there is additionally an adequacy decision of the EU Commission.

Legal bases:
Art. 6 (1) (b) and (f) GDPR; for non-essential services Art. 6 (1) (a) GDPR.

7a. Data transfer to the USA and other third countries

Some of the service providers we use (including Google, Meta, Microsoft, Shopify, Klaviyo, TikTok, Stripe, PayPal) are based in the USA or process data there. Access to this data by US authorities cannot be completely ruled out.

Insofar as these recipients are certified under the EU-US Data Privacy Framework (DPF), the transfer takes place on the basis of the adequacy decision of the European Commission of 10 July 2023 (Art. 6 or Art. 45 GDPR). The USA thereby ensures an adequate level of data protection for certified companies. You can check whether a specific recipient is certified at https://www.dataprivacyframework.gov.

For recipients that are not certified under the DPF, we base the transfer on the standard contractual clauses of the EU Commission (Art. 46 (2) (c) GDPR) as well as supplementary protective measures. On request we will provide you with a copy of the agreed safeguards.

The EU-US Data Privacy Framework is the subject of ongoing legal review. Should the adequacy decision be annulled in the future, we will base the affected transfers on the standard contractual clauses mentioned.

8. Payment processing

Payments are processed – depending on the payment method chosen – via the respective selected providers. Their data protection provisions apply in addition.

Legal basis:
Art. 6 (1) (b) GDPR.

9. E-mail marketing (Klaviyo & Shopify)

We send newsletters as well as product and service information following prior registration using the double opt-in procedure. Registrations are logged with IP address and time stamp.

You can unsubscribe at any time via the link in every e-mail or by notifying us.

Legal basis:
Art. 6 (1) (a) GDPR.

10. Review reminders

Following a purchase, we may ask you to submit a review, for example via Judge.me, Trustpilot or Google.

Legal basis:
Art. 6 (1) (a) GDPR, insofar as consent has been given; in addition, the requirements of Section 7 UWG must be observed.

11. Analysis tools & tracking

We use – in each case only with your consent given via our consent management tool – analysis and marketing technologies in order to evaluate the use of our website, to improve the performance of our online shop and to measure the effectiveness of our advertising measures.

For this purpose, in particular the following services may be used:

  • Google Analytics
  • Meta Pixel / Meta Business Tools
  • TikTok Pixel
  • YouTube Analytics
  • Microsoft Advertising (Universal Event Tracking)
  • ProfitMetrics
  • further analysis and marketing services individually named in the consent tool

In this context, in particular pseudonymised usage data, technical device and browser information, pages accessed, times, referrer, interaction data and – depending on the service used – cookie IDs, event data or hashed identifiers may be processed.

Legal basis:
Art. 6 (1) (a) GDPR.

Withdrawal:
You may withdraw a consent you have given at any time with effect for the future via the cookie settings.

11a. Meta Pixel / Meta Business Tools

Insofar as you have consented, we use the Meta Pixel and, where applicable, further Meta Business Tools on our website.

Provider:
Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

The Meta Pixel is a piece of code with which the behaviour of visitors can be tracked after they have been directed to our website via an advertisement on Facebook or Instagram. This enables us to measure the effectiveness of our advertising, to build target audiences and to optimise our advertising measures.

In the course of use, in particular the following data may be processed:

  • pages and content accessed,
  • technical information on the browser, device and operating system,
  • referrer URL,
  • IP address,
  • times of the page view,
  • interaction and event data (e.g. page view, product view, shopping cart, purchase),
  • cookie IDs or similar identifiers,
  • where applicable, hashed customer data in the context of advanced matching, provided that this has been activated and you have consented to it.

The processing serves in particular:

  • the analysis of user behaviour,
  • the measurement of conversions,
  • the optimisation of our advertising campaigns,
  • the building of target audiences for personalised advertising on Facebook and Instagram.

Legal basis:
Art. 6 (1) (a) GDPR.

Withdrawal:
You may withdraw your consent at any time with effect for the future via the cookie settings.

Insofar as joint controllership exists in connection with Meta Business Tools, the contractual terms provided by Meta in this respect apply in addition.

Third country transfer:
A transfer of personal data to third countries, in particular to the USA, cannot be ruled out. Insofar as no adequacy decision applies, the transfer takes place on the basis of appropriate safeguards, in particular standard contractual clauses pursuant to Art. 46 GDPR.

Further information:
Supplementary information can be found in Meta's data protection provisions.

11b. ProfitMetrics

Insofar as you have consented, we use ProfitMetrics for the analysis and optimisation of the profitability of our online shop and our marketing measures.

Profitmetrics ApS, Hejreskov alle 2c 1th, 3050 Humlebæk, Denmark is a provider of analytics services. Further information on how your data is processed by this provider and the corresponding contact details can be found at:
https://knowledge.profitmetrics.io/profitmetrics-as-data-processor

Purposes of processing:
Analysis and optimisation of the profitability of our shop as well as of the performance of marketing measures.

Legal basis:
Art. 6 (1) (a) GDPR, provided that the service is used only with your consent given via the consent management tool.

Withdrawal:
You may withdraw your consent at any time with effect for the future via the cookie settings.

Further information:
Supplementary information on the data processing by ProfitMetrics can be found at the link stated above.

11c. Microsoft Advertising (Bing) – Universal Event Tracking (UET)

Insofar as you have consented, we use Universal Event Tracking (UET) from Microsoft Advertising on our website.

Provider:
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18, D18 P521
Ireland

The UET tag is a piece of code with which it can be tracked how visitors behave on our website after they have reached us via an advertisement in the Microsoft advertising network (e.g. Bing, MSN, Microsoft Edge or partner sites). This enables us to measure the effectiveness of our advertising, to evaluate conversions and to build target audiences for remarketing.

In the course of use, in particular the following data may be processed:

  • pages and content accessed,
  • technical information on browser, device and operating system,
  • referrer URL,
  • IP address,
  • times of the page view,
  • interaction and event data, in particular completed orders including order value, currency and order identifier,
  • cookie IDs and similar identifiers, in particular the cookies _uetsid and _uetvid,
  • the Microsoft click identifier (MSCLKID), if you have reached our website via an advertisement.

The processing serves in particular:

  • the measurement of conversions,
  • the analysis of user behaviour after an ad click,
  • the management and optimisation of our advertising campaigns,
  • the building of pseudonymous target audiences for remarketing in the Microsoft advertising network.

A transfer of hashed customer data in the context of enhanced conversions does not take place; this function is deactivated in our advertising account.

Legal basis:
Art. 6 (1) (a) GDPR.

Withdrawal:
You may withdraw your consent at any time with effect for the future via the cookie settings. The UET tag is loaded exclusively after you have given your consent to the “Marketing” category.

Third country transfer:
A transfer of personal data to the USA cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework; section “7a. Data transfer to the USA and other third countries” applies in addition.

Further information:
Microsoft's privacy statement at https://privacy.microsoft.com/de-de/privacystatement.

12. Google Fonts

Fonts are embedded locally or – following your consent – loaded from Google servers.

Legal basis:
Art. 6 (1) (a) GDPR.

12a. Google reCAPTCHA

To protect our forms (e.g. contact, registration, login) against abusive automated use and spam, we use the reCAPTCHA service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA analyses whether an entry is made by a human or in an automated manner. In this process, among other things your IP address, the time spent on the page and interactions on the page are transmitted to Google and evaluated; a transfer to the USA is possible (see section “7a. Data transfer to the USA and other third countries”; Google is certified under the EU-US Data Privacy Framework).

Legal basis:
Art. 6 (1) (f) GDPR (legitimate interest in the security of our website and in protection against misuse); insofar as consent is requested, Art. 6 (1) (a) GDPR.

Further information:
Google's privacy policy at https://policies.google.com/privacy and https://policies.google.com/terms.

13. Your rights

In accordance with the statutory provisions, you have the following rights:

  • right of access (Art. 15 GDPR),
  • right to rectification (Art. 16 GDPR),
  • right to erasure (Art. 17 GDPR),
  • right to restriction of processing (Art. 18 GDPR),
  • right to data portability (Art. 20 GDPR),
  • right to object (Art. 21 GDPR),
  • right to withdraw consent given, with effect for the future (Art. 7 (3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority, in particular with the authority responsible for us or the authority responsible at your place of residence.

By way of example, the competent authority is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf

14. Social media links, Facebook/Instagram sharing and embeds

14.1 Links to our social media presences

On our website we may link to our presences on Facebook, Instagram, YouTube or other social networks. If you click on such a link, you leave our website. The data protection provisions of the respective provider then apply.

In principle, data is only transferred to the respective provider once you actively click on the link.

Legal basis:
Art. 6 (1) (f) GDPR.

Our legitimate interest lies in a user-friendly external presentation of our company and in the provision of further information and communication channels.

14.2 Facebook and Instagram sharing functions

Insofar as we provide functions for sharing content on Facebook or Instagram on our website, their use takes place only in the context of your active action or – insofar as technically necessary – only after corresponding consent via our consent management tool.

When such functions are used, in particular the following data may be transmitted to Meta:

  • IP address,
  • information about the page accessed,
  • browser and device information,
  • date and time of use,
  • where applicable, further Meta-related identifiers.

The processing takes place for the purpose of enabling content of our website to be shared on social networks and of increasing the reach of our content.

Legal basis:

  • for purely external sharing links without automatic data transfer: Art. 6 (1) (f) GDPR,
  • for embedded social plugins or comparable active Meta functions: Art. 6 (1) (a) GDPR.

14.3 Integration of Instagram content / social media embeds

Insofar as we embed content from Instagram, Facebook or other social networks on our website, technical access data may be processed by the respective provider when the relevant page is accessed.

This may include in particular:

  • IP address,
  • browser data,
  • device information,
  • information about the specific subpage accessed,
  • usage and interaction data.

The integration takes place – insofar as the processing is not solely technically imperative – only with your consent.

Legal basis:
Art. 6 (1) (a) GDPR.

14.4 Joint controllership / third country transfer

Insofar as joint controllership is to be assumed in connection with social plugins, business tools or other functions of Meta, the agreements provided by Meta in this respect apply in addition.

A transfer to third countries, in particular to the USA, cannot be ruled out. Insofar as no adequacy decision exists, the transfer takes place on the basis of appropriate safeguards, in particular standard contractual clauses pursuant to Art. 46 GDPR.

Further information:
The data protection notices of the respective provider, in particular those of Meta, apply in addition.

15. Remarketing & retargeting

Insofar as you have consented, we use remarketing and retargeting technologies, in particular:

  • Meta Custom Audiences,
  • Lookalike Audiences,
  • Google Ads Remarketing,
  • Microsoft Advertising Remarketing,
  • as well as comparable functions of other providers.

This enables interest-based advertisements to be displayed to you on third-party platforms.

In this context, information about your usage behaviour on our website may be transmitted to the respective provider or matched with data already held by the provider. This may also include the building of pseudonymous target audiences.

Legal basis:
Art. 6 (1) (a) GDPR.

Withdrawal:
You may withdraw your consent at any time via the cookie settings.

16. App tracking (if an app exists)

If an app is offered and you use it, analysis or tracking services such as Firebase Analytics or Apple Store Analytics may – with your consent – be used.

Legal basis:
Art. 6 (1) (a) GDPR.

17. Newsletter tracking

Our newsletters may contain tracking pixels or web beacons in order to measure openings, clicks and reach.

You may object to this at any time; in addition, you may withdraw your consent to the newsletter as a whole at any time.

Legal basis:
Art. 6 (1) (a) GDPR.

18. WhatsApp communication

If you contact us via WhatsApp or if we – on the basis of your consent – communicate with you via WhatsApp, the processing takes place via Charles GmbH as service provider.

Legal basis:
Art. 6 (1) (a) GDPR (consent) or Art. 6 (1) (b) GDPR (contract / initiation of a contract), depending on the content of your enquiry.

19. Loyalty programme

We use LoyaltyLion to manage a loyalty or bonus programme.

In this context, in particular order and customer data may be processed insofar as this is necessary for operating the programme.

Legal bases:
Art. 6 (1) (b) GDPR as well as Art. 6 (1) (f) GDPR.

20. Google Tag Manager

We use Google Tag Manager to manage and deliver tags. Google Tag Manager itself does not set any cookies and in principle does not store any personal data. However, it provides for the technical integration of other services, which for their part may process data.

The processing of such data by the respective integrated services is governed by the provisions stated there.

21. Data security

We take appropriate technical and organisational measures to protect your data against loss, destruction, manipulation and unauthorised access. These include in particular:

  • TLS/SSL encryption,
  • access restrictions,
  • authorisation concepts,
  • regular technical and organisational reviews.

22. Changes to this privacy policy

We reserve the right to adapt this privacy policy as required so that it always complies with the current legal requirements, or in order to implement changes to our services in the privacy policy.

The respective current version is available on our website at any time.

23. Cookie consent management & Global Privacy Control (GPC)

To obtain and manage your consent, we use the consent banner of the Shopify platform (Shopify Customer Privacy / Consent Management). On your first visit to our website you can use the banner to consent to non-essential cookies and comparable technologies (e.g. analytics and marketing), to reject them or to make a differentiated selection. The buttons for rejecting and accepting are designed to be equivalent. Non-essential scripts are only loaded after your consent.

Your decision is logged in accordance with Art. 7 GDPR and can be changed at any time via the “Cookie settings” link in the footer.

If your browser or terminal device sends a Global Privacy Control (GPC) signal and you are located in an area in which this legally counts as an opt-out request, we treat this signal as an objection to the sale, the sharing or to targeted advertising for the device or browser concerned.

24. Notices for users from certain US states

Under individual US data protection laws, the disclosure of personal data for targeted advertising or its “sale” or “sharing” may be subject to special opt-out rights.

Depending on your place of residence, you may have the right to opt out of this. To do so, please use our “Do-Not-Sell/Share” link or the data sharing settings in our shop, or send us a message.

If you visit our website with an active GPC signal, we treat this – depending on the legal situation at your location – as an opt-out for the device or browser used.

25. Contact form & e-mail contact

If you contact us via the contact form or by e-mail, we process your details exclusively for the purpose of handling your enquiry. No disclosure for advertising purposes takes place.

Legal basis:
Art. 6 (1) (f) GDPR (legitimate interest in handling enquiries).
If your enquiry is aimed at concluding a contract, additionally Art. 6 (1) (b) GDPR.

Storage period:
Until your enquiry has been conclusively handled or until the purpose ceases to apply; statutory retention obligations remain unaffected.

26. Cookies – supplementary information

In addition to management via the consent management tool, you can delete or block cookies in your browser or restrict them to certain categories.

These may be transient or session-related cookies or persistent cookies.

Please note that without technically necessary cookies, individual functions of our shop may not be usable or only usable to a limited extent.

27. Google Analytics – additional information (if activated)

If consent has been given, Google Analytics may be used. In doing so we use privacy-friendly settings where possible, in particular IP anonymisation.

You can withdraw your consent via our consent tool. In addition – depending on the technical configuration – further opt-out options exist, for example via browser extensions or settings of the respective provider.

Details can be found in the information in the consent tool and in the data protection notices of the service used.