Privacy policy
<p><strong>Please note:</strong> This is a translation of our German privacy policy, provided for your convenience. Only the German version is legally binding. In the event of any discrepancy between the language versions, the German version shall prevail.</p>
<p><strong>Last updated: 2 October 2026</strong></p>
<p>In this privacy policy, we inform you in accordance with Art. 13 of the General Data Protection Regulation (GDPR) which personal data we process when you visit our online shop at www.metmaxx.de and place orders there, for what purposes and on what legal basis this is done, and what rights you have.</p>
<h2>1. Controller</h2>
<p>Spranz GmbH<br>Ernst-Sachs-Straße 2<br>56070 Koblenz<br>Germany</p>
<p>Phone: +49 261 98 488-0<br>Fax: +49 261 98 488-40<br>E-mail: <a href="mailto:info@spranz.de">info@spranz.de</a></p>
<h2>2. Data Protection Officer</h2>
<p>You can contact our Data Protection Officer at:</p>
<p>Spranz GmbH – Data Protection Officer –<br>Ernst-Sachs-Straße 2<br>56070 Koblenz<br>Germany<br>E-mail: <a href="mailto:datenschutz@spranz.eu">datenschutz@spranz.eu</a></p>
<h2>3. Provision of the online shop and server log files</h2>
<h3>3.1 Hosting and technical support</h3>
<p>Our online shop is operated on servers of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, in a data centre within the European Union. All systems used to operate the shop run on these servers.</p>
<p>Technical support, maintenance and administration of the servers and the shop software are provided by MagicEverse B.V., Raamweg 24, 2596 HL Den Haag, the Netherlands. In the course of this activity, MagicEverse may obtain access to the personal data stored in the shop.</p>
<p>netcup and MagicEverse act as processors on our behalf and are bound by our instructions; we have concluded data processing agreements pursuant to Art. 28 GDPR with both of them. The legal basis is our legitimate interest in the secure and reliable operation of our online shop (Art. 6(1)(f) GDPR) and, insofar as the processing of your order is concerned, Art. 6(1)(b) GDPR.</p>
<h3>3.2 Server log files</h3>
<p>Each time you access our online shop, your browser automatically transmits information to our server, which is stored in so-called server log files:</p>
<ul>
<li>IP address of the requesting device</li>
<li>Date and time of access</li>
<li>Page or file accessed (URL)</li>
<li>Website from which the access is made (referrer URL)</li>
<li>HTTP status code and amount of data transferred</li>
<li>Browser and operating system used (user agent)</li>
</ul>
<p>We process this data in order to deliver the shop, to ensure the stability and security of our systems and to detect and avert errors and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the purposes stated. The log files are automatically deleted after 14 days. Data whose further retention is necessary for evidentiary purposes (e.g. in the event of a specific security incident) is exempt from deletion until the incident has been conclusively resolved.</p>
<h3>3.3 Encryption</h3>
<p>For security reasons, our online shop uses TLS encryption. You can recognise an encrypted connection by “https://” in the address bar of your browser.</p>
<h2>4. Cookies and similar technologies</h2>
<p>We use only cookies and comparable technologies (e.g. local storage) that are technically necessary to enable you to use our online shop. Depending on their function, they serve, for example, to</p>
<ul>
<li>store the contents of your shopping basket,</li>
<li>keep you logged in to your customer account,</li>
<li>store the language or delivery country you have selected, and</li>
<li>secure the ordering and payment process.</li>
</ul>
<p>The storage of this information on your device and access to it are permitted without consent under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG), because they are strictly necessary in order to provide the service you have expressly requested. The associated processing of personal data is based on Art. 6(1)(b) GDPR (initiation and performance of the contract) or Art. 6(1)(f) GDPR (legitimate interest in a functioning online shop).</p>
<p>We do not use analytics, tracking or marketing cookies. For this reason, we do not ask for your consent to such cookies via a cookie banner either. You can delete or block cookies at any time via your browser settings; in this case, certain functions of the shop (e.g. the shopping basket or ordering) may not be available.</p>
<p>For the cookies used by our payment service provider Stripe in the ordering process, see section 7.</p>
<h2>5. Orders in the online shop</h2>
<p>When you place an order in our online shop, we process the data you provide during the ordering process, in particular:</p>
<ul>
<li>First name and surname</li>
<li>Billing and delivery address</li>
<li>E-mail address</li>
<li>Telephone number, if you provide it</li>
<li>Order data (items, quantities, prices, shipping method, order number, time of order)</li>
<li>Selected payment method and payment status</li>
</ul>
<p>We process this data in order to receive, review and accept your order, ship the goods, process the payment, inform you about the status of your order and handle withdrawals, returns and warranty claims. For this purpose, your order data is transferred to our internal systems (e.g. warehouse management, shipping and accounting). The legal basis is Art. 6(1)(b) GDPR (performance of the contract and pre-contractual measures). Insofar as we are required to retain the data due to obligations under commercial and tax law, the legal basis is Art. 6(1)(c) GDPR.</p>
<h2>6. Customer account and guest orders</h2>
<p>You can order as a guest or create a customer account. In the case of a guest order, we use your data exclusively to process the order in question.</p>
<p>If you create a customer account, we store your name, your e-mail address, your password (not in plain text, but exclusively as a cryptographic hash value), the addresses you have saved and your order history. The customer account enables you to complete orders more quickly and to view your previous orders. Creating a customer account is voluntary. The legal basis is Art. 6(1)(b) GDPR.</p>
<p>You can have your customer account deleted at any time, for example by sending a message to <a href="mailto:info@spranz.de">info@spranz.de</a>. We will then delete your account data, insofar as this is not precluded by statutory retention obligations (see section 13).</p>
<h2>7. Payment processing via Stripe</h2>
<p>To process payments, we use the payment service provider Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). You enter your payment data (e.g. card number) directly into the input fields provided by Stripe; it is transmitted directly to Stripe and is not stored on our servers. We receive from Stripe only information on the payment status and limited details about the payment method (e.g. card type and the last four digits of the card number).</p>
<p>In particular, your name, your e-mail address, your billing address, your payment data, the amount and currency, the order number and technical data such as IP address and device or browser information are transmitted to Stripe. Where necessary for the payment, Stripe forwards the data to the participating banks, card schemes and providers of the payment method you have selected. The legal basis is Art. 6(1)(b) GDPR.</p>
<p>To prevent payment fraud, Stripe carries out risk and fraud checks and, for this purpose, uses cookies and similar technologies in the ordering process. The storage on and access to your device take place on the basis of Section 25(2) No. 2 TDDDG; the further processing is based on our legitimate interest in secure payment processing (Art. 6(1)(f) GDPR).</p>
<p>In processing payments, Stripe acts partly as our processor and partly – for example for fraud prevention and to comply with its own legal obligations (e.g. the prevention of money laundering) – as an independent controller. Stripe may transfer data to Stripe, LLC in the USA. Stripe, LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, Stripe has entered into the European Commission’s standard contractual clauses as a further basis for transfer (Art. 46(2)(c) GDPR). Further information can be found in Stripe’s privacy policy at <a href="https://stripe.com/privacy" target="_blank" rel="noopener">https://stripe.com/privacy</a>.</p>
<h2>8. Shipping of the goods</h2>
<p>To deliver the goods, we transmit your name and delivery address to the shipping company commissioned by us. At present, this is United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany (“UPS”). For deliveries to other Member States of the European Union, the data may be passed on within the UPS group to the UPS company responsible for delivery in the country of destination. The legal basis is Art. 6(1)(b) GDPR.</p>
<p>We only transmit your e-mail address and/or telephone number to UPS if you have expressly consented to this during the ordering process (Art. 6(1)(a) GDPR). UPS uses this information to notify you about the delivery or to coordinate it with you. You can withdraw your consent at any time with effect for the future by notifying us or UPS.</p>
<p>UPS processes the data as an independent controller. Information on data protection at UPS can be found at www.ups.com.</p>
<h2>9. Sending of e-mails</h2>
<p>Transactional e-mails – such as the confirmation of receipt of your order, information on order and shipping status, the confirmation of receipt of a withdrawal and e-mails relating to your customer account (e.g. for resetting your password) – are sent via the e-mail service provider Lettermint B.V., Willemsvaart 16 B, 8019 AB Zwolle, the Netherlands (“Lettermint”). In doing so, Lettermint processes your e-mail address, your name, the content of the respective e-mail and technical sending data (e.g. time and delivery status). The e-mail data is processed on servers within the European Union. Lettermint acts as our processor pursuant to Art. 28 GDPR. There is no evaluation of whether or when you open our e-mails or click on any links they contain.</p>
<p>The legal basis is Art. 6(1)(b) GDPR; insofar as we are legally obliged to send e-mails (e.g. to confirm receipt of a withdrawal), Art. 6(1)(c) GDPR.</p>
<h2>10. Electronic withdrawal function</h2>
<p>You can withdraw from a contract concluded in our online shop by, among other means, using the electronic withdrawal function provided in the shop (“Withdraw from contract”). In doing so, we process the information you enter into the withdrawal function, in particular your name, details identifying the contract (e.g. the order number) and the e-mail address to which we are to send the confirmation of receipt, as well as the date and time of your declaration. We will confirm receipt of your withdrawal by e-mail.</p>
<p>The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (Bürgerliches Gesetzbuch – BGB) and Art. 6(1)(b) GDPR (unwinding of the contract). For withdrawals made by other means (e.g. by e-mail or letter), section 11 applies accordingly.</p>
<h2>11. Contacting us</h2>
<p>If you contact us by e-mail, telephone, fax or post, we process the data you provide (e.g. name, contact details and the content of your enquiry) in order to deal with your request. If your enquiry relates to an order or the initiation of a contract, the legal basis is Art. 6(1)(b) GDPR; otherwise, the processing is based on our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). We delete the data as soon as your request has been finally dealt with, unless statutory retention obligations apply.</p>
<h2>12. Recipients and transfers to third countries</h2>
<p>We only disclose your personal data to third parties to the extent described in this privacy policy. The recipients are:</p>
<ul>
<li>netcup GmbH, Germany – hosting (processor)</li>
<li>MagicEverse B.V., the Netherlands – technical support and administration of the online shop (processor)</li>
<li>Lettermint B.V., the Netherlands – sending of transactional e-mails (processor)</li>
<li>Stripe Payments Europe, Limited, Ireland – payment processing (processor or independent controller)</li>
<li>United Parcel Service Deutschland S.à r.l. & Co. OHG, Germany, and affiliated UPS companies – shipping of the goods (independent controllers)</li>
<li>Tax advisers and auditors who are subject to a professional duty of confidentiality, within the scope of statutory accounting and audit obligations</li>
<li>Public authorities and courts, insofar as we are legally obliged to do so</li>
</ul>
<p>As a rule, we and our processors process your data within the European Union or the European Economic Area. A transfer to a third country only takes place in connection with payment processing via Stripe (USA, see section 7). Insofar as independent controllers such as UPS themselves transfer data to third countries, this is governed by their privacy notices.</p>
<h2>13. Retention period</h2>
<p>We store personal data only for as long as is necessary for the respective purpose. In detail, the following applies:</p>
<ul>
<li>Server log files: 14 days (see section 3.2)</li>
<li>Customer account data: until the customer account is deleted</li>
<li>Order and contract data: until the expiry of the statutory warranty and limitation periods</li>
<li>Documents relevant under commercial and tax law (e.g. invoices, accounting vouchers, business letters): pursuant to Section 257 of the German Commercial Code (Handelsgesetzbuch – HGB) and Section 147 of the German Fiscal Code (Abgabenordnung – AO), six, eight or ten years depending on the type of document</li>
<li>Enquiries: until they have been finally dealt with, subject to statutory retention obligations</li>
</ul>
<p>Where data is subject to a statutory retention obligation, we restrict its processing and delete it once the retention period has expired.</p>
<h2>14. Obligation to provide data and automated decision-making</h2>
<p>The provision of the data marked as mandatory in the ordering process is necessary for the conclusion of the contract. Without this information, we cannot process your order. All other information is voluntary.</p>
<p>We do not carry out decision-making based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. As part of payment processing, Stripe carries out its own automated checks for fraud prevention, which may result in a payment being declined. For details, please refer to Stripe’s privacy policy.</p>
<h2>15. Your rights</h2>
<p>Under the GDPR, you have the following rights:</p>
<ul>
<li>Right of access to the personal data processed by us (Art. 15 GDPR)</li>
<li>Right to rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)</li>
<li>Right to erasure (Art. 17 GDPR)</li>
<li>Right to restriction of processing (Art. 18 GDPR)</li>
<li>Right to data portability (Art. 20 GDPR)</li>
<li>Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before consent is withdrawn remains unaffected</li>
<li>Right to object to processing (Art. 21 GDPR, see section 16)</li>
</ul>
<p>To exercise your rights, an informal message to <a href="mailto:info@spranz.de">info@spranz.de</a> or to our Data Protection Officer (see section 2) is sufficient.</p>
<p>You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority responsible for us is:</p>
<p>Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)<br>Hintere Bleiche 34<br>55116 Mainz<br>Germany<br>E-mail: <a href="mailto:poststelle@datenschutz.rlp.de">poststelle@datenschutz.rlp.de</a></p>
<h2>16. Right to object under Art. 21 GDPR</h2>
<p><strong>Insofar as we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.</strong></p>
<p><strong>You can send your objection informally to <a href="mailto:info@spranz.de">info@spranz.de</a> or to our Data Protection Officer (see section 2).</strong></p>
<h2>17. Changes to this privacy policy</h2>
<p>We will adapt this privacy policy if the legal situation or our data processing changes, for example when new service providers are used. The current version published in the online shop applies in each case.</p>
<p>This privacy policy was drawn up in German and is also available in Dutch, English, French and Spanish translation. In the event of any discrepancy between the language versions, the German version alone shall be authoritative.</p>