- Introduction and Controller Identity
Welcome to www.toughsteeltrowel.com (hereinafter referred to as the “Website”). We respect your privacy and are committed to protecting your personal data in compliance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).
The data controller responsible for the processing of your personal data collected via this Website is:
Address: Rankestraße 26, 10789 Berlin, Germany
Email: inventory@toughsteeltrowel.com
Phone: +49 30220127820
- Types of Data Collected
When you visit our Website or place an order for our stainless steel gardening trowel products, we may collect and process the following categories of personal data:
Identity Data: First name, last name.
Contact Data: Billing address, shipping address, email address, telephone number.
Transaction Data: Details regarding products purchased from us and payment details fulfilled via our payment processor.
Technical Data: Internet Protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform.
- Purpose and Legal Basis for Processing
We process your personal data only when permitted by European and German law. The legal bases for our data processing activities are:
Performance of a Contract (Article 6(1)(b) GDPR): Processing is necessary for the execution of your orders, delivery of goods, and customer service management.
Legal Obligation (Article 6(1)(c) GDPR): Processing is necessary to comply with statutory retention periods under German commercial and tax laws (e.g., Handelsgesetzbuch – HGB, and Abgabenordnung – AO).
Legitimate Interests (Article 6(1)(f) GDPR): Processing is necessary for the security, administration, and optimization of our Website.
- Payment Processing via Stripe
To process your payments securely, we integrate the payment gateway services provided by Stripe. When you complete a purchase, your payment details (such as credit card information or other payment methods supported by Stripe) are collected directly by Stripe Payments Europe, Ltd., located at 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, acting as an independent payment processor.
We do not store complete credit card or sensitive financial credentials on our servers. Stripe processes your financial data in compliance with strict international security standards, including Payment Card Industry Data Security Standards (PCI-DSS). For further details regarding how Stripe handles your personal data and your privacy rights under their administration, please review their privacy policy at https://stripe.com/privacy.
- Data Retention Period
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.
Tax and Commercial Records: In accordance with statutory requirements under German law (specifically Section 257 HGB and Section 147 AO), accounting records, invoices, and relevant contract data are retained for 10 years. Booking vouchers and business correspondence are retained for 6 years.
Customer Account and Communication Data: Data related to active inquiries or unfulfilled orders is retained until the transaction or communication is completely settled, and thereafter archived in compliance with statutory limitation periods (typically 3 years under Section 195 of the German Civil Code – BGB, unless a longer retention period is required by law).
Technical and Log Data: Server log files and technical identifiers are generally deleted or anonymized automatically within 14 days, unless an ongoing security incident requires extended preservation for investigation purposes.
- Data Subject Rights
Under the GDPR, you possess the following rights regarding your personal data:
Right of Access (Article 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed, and access to such data.
Right to Rectification (Article 16 GDPR): You have the right to obtain the correction of inaccurate personal data or completion of incomplete data.
Right to Erasure (Article 17 GDPR): You have the right to request the deletion of your personal data, provided there are no overriding legal retention obligations or statutory grounds preventing erasure.
Right to Restriction of Processing (Article 18 GDPR): You have the right to request the restriction of processing under specific conditions.
Right to Data Portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
Right to Object (Article 21 GDPR): You have the right to object to the processing of your personal data based on legitimate interests.
Right to Lodge a Complaint: You have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. The relevant supervisory authority for Berlin is:
Berlin Commissioner for Data Protection and Freedom of Information (Berlin Beauftragte für Datenschutz und Informationsfreiheit).
- Data Security
We implement technical and organizational measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Our security measures are continuously reviewed and adapted in line with technological advancements. - Updates to This Privacy Policy
We reserve the right to modify this Privacy Policy at any time to reflect changes in legal requirements, regulatory standards, or our operational practices. The current version published on www.toughsteeltrowel.com applies at all times.