Privacy Policy
Pursuant to Art. 13, 14 EU General Data Protection Regulation (GDPR)
1. Controller and Contact Information
The controller responsible for data processing on this website is:
Registered address: Marwitzer Str. 54a13589 Berlin
Germany
Email: info@diabolofocus.com Phone: +49 163 636 3431
A Data Protection Officer is not required as we regularly employ fewer than 20 persons involved in automated data processing (§ 38 BDSG).
2. Supervisory Authority
The competent data protection supervisory authority is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI) Friedrichstr. 219, 10969 Berlin, Germany Email: mailbox@datenschutz-berlin.de Website: www.datenschutz-berlin.de
You have the right to lodge a complaint with this supervisory authority at any time (Art. 77 GDPR).
3. Your Rights as a Data Subject
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR): obtain confirmation of whether and what personal data we process about you
- Right to rectification (Art. 16 GDPR): request correction of inaccurate data
- Right to erasure (Art. 17 GDPR): request deletion of your data where the legal requirements are met
- Right to restriction of processing (Art. 18 GDPR): request that processing be restricted in certain circumstances
- Right to data portability (Art. 20 GDPR): receive your data in a structured, commonly used, machine-readable format
- Right to object (Art. 21 GDPR): object to processing based on legitimate interest or direct marketing at any time
- Right to withdraw consent (Art. 7(3) GDPR): withdraw any consent given at any time, without affecting the lawfulness of processing prior to withdrawal
To exercise any of these rights, please contact us at info@diabolofocus.com.
4. Data Processing Activities
4.1 Website Hosting and Content Delivery (Cloudflare)
The website is hosted on and delivered through the global network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you visit our website, Cloudflare automatically processes technical data, including your IP address, browser type and version, operating system, referrer URL, date and time of access, and pages visited. Cloudflare also uses this data to protect the site against attacks and abuse (e.g. DDoS mitigation and security filtering).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable, secure and fast website operation).
Cloudflare acts as our data processor under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. Transfers to the United States are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR).
4.2 Online Store, Cart, and Checkout (Wix Headless)
Our product catalog, shopping cart, checkout, and customer accounts are powered by Wix.com Ltd. (40 Namal Tel Aviv St., Tel Aviv 6350671, Israel) via its headless commerce APIs (“Wix Headless”). While the website itself is no longer hosted on the Wix platform, product and cart data is exchanged with Wix’s servers as you browse, and checkout is completed on a Wix-hosted checkout page.
Legal basis: Art. 6(1)(b) GDPR (contract performance).
Wix acts as our data processor under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. Transfers to Israel are covered by the EU Commission’s adequacy decision (Art. 45 GDPR). Transfers to the United States are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR).
4.3 Customer Account and Order Processing
When you place an order, we collect and process: name, email address, billing and shipping address, phone number (if provided), order details, and payment information.
Legal basis: Art. 6(1)(b) GDPR (contract performance). Retention period: Order data is retained for 8 years from the end of the calendar year in which the transaction occurred, as required by German tax and commercial law (§ 147 AO, § 257 HGB).
4.4 Payment Processing
We use the following payment service providers:
- PayPal (Europe) S.à r.l. et Cie, S.C.A.: acts as an independent data controller for payment data. Legal basis: Art. 6(1)(b) GDPR.
- Stripe Payments Europe, Limited: acts as our data processor for credit card payments. Legal basis: Art. 6(1)(b) GDPR.
- Wix Payments: payment processing completed on Wix’s hosted checkout page, part of the Wix Headless commerce platform. Legal basis: Art. 6(1)(b) GDPR.
- SEPA bank transfer: processed by N26 Bank GmbH, Voltairestr. 8, 10179 Berlin. Legal basis: Art. 6(1)(b) GDPR.
4.5 Shipping and Delivery
To fulfill your order, we share your name, delivery address, and (if provided) phone number and email address with our shipping providers, primarily Deutsche Post / DHL Paket GmbH.
Before you have chosen a delivery country yourself, we preselect one from the country your internet connection is in, so that the shipping cost and the delivery dates shown on the page are the ones that apply to you. Cloudflare derives that country from your IP address at the moment your browser asks for it; we receive the country alone, never the IP address, and nothing about it is stored on our side. Your own choice always takes precedence over ours, and the delivery address you enter at checkout is what actually decides the shipping cost and the VAT.
Legal basis: Art. 6(1)(b) GDPR (contract performance); Art. 6(1)(c) GDPR (legal obligation for customs declarations); Art. 6(1)(f) GDPR (legitimate interest in showing you the shipping cost and delivery dates that apply where you are).
4.6 Email Communication
We use your email address to send order confirmations, shipping notifications, and responses to inquiries. If you subscribe to our newsletter, we process your email address based on your consent. Legal basis: Art. 6(1)(b) GDPR (transactional emails); Art. 6(1)(a) GDPR (newsletter).
4.7 Contact Form and Email Inquiries
When you contact us, we process the data you provide (name, email, message content) to respond to your inquiry.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).
Retention: Inquiry data is retained for 3 years from the last contact, unless longer retention is required by law.
4.8 AI Help Assistant (Help Center)
Our help center offers an “ask us anything” box that answers questions with an AI language model. Answers are labelled as AI-generated in the interface (Art. 50(1) EU AI Act). Using the box is entirely voluntary: the same information is available in the written FAQ, and you can always write to us at info@diabolofocus.com instead.
What is processed. The question you type, the earlier questions and answers of the same conversation, your language, and your IP address (for bot protection and rate limiting). Please do not enter personal data into the box: no names, addresses, order numbers or payment details. It has no access to your customer account, your orders or your cart and cannot look anything up about you.
How it works. Your question is matched against our own help texts (FAQ, shipping and withdrawal information, legal documents, product catalogue), which are stored with Cloudflare, Inc. Your question and the matching passages are then sent to a Claude language model operated by Anthropic PBC (548 Market St, PMB 90375, San Francisco, CA 94104, USA), reached through Cloudflare’s AI Gateway, which generates the answer text. Cloudflare may log the request and the answer for diagnostic purposes. Bot protection is provided by Cloudflare Turnstile, which processes your IP address and browser information and may store a short-lived token in your browser; it is strictly necessary for this feature to work (§ 25 Abs. 2 TDDDG).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering visitor questions quickly and in improving our help center).
Processors and transfers. Cloudflare, Inc. and Anthropic PBC act as our data processors under Data Processing Agreements in accordance with Art. 28 GDPR. Transfers to the United States are covered by Standard Contractual Clauses (Art. 46(2)(c) GDPR). Neither provider uses your question or the answer to train AI models; they are retained only for the limited period each provider needs for the delivery of the service and for abuse prevention.
Our own log. We record the questions asked so we can turn the ones the help center answered badly into new FAQ entries. Before a question and its answer are written to that log, email addresses, IBANs and any run of five or more digits are automatically replaced with placeholders. The entry carries no IP address, session, account or other identifier that could link it to you. Entries are deleted once reviewed.
Accuracy. The model can be wrong. Its answers are not legally binding; prices, availability, delivery times and policies are authoritative only as stated on the relevant product page and in our General Terms and Conditions.
4.9 Error Reporting (Sentry)
When something on the site breaks, on our server or in your browser, a technical error report is sent to Sentry so we can fix it. In the browser this happens only at the moment an error occurs: no reporting code is loaded before that. A report contains the error message and the code location, the page address (with credentials such as invoice links removed), your browser and operating system versions, and the last few interactions with the site in the same anonymous vocabulary as our usage measurement (for example “search” or “added to cart”). Your IP address is not stored, and no name, email address, account or order number is included. For a visit that is being recorded as a session replay (see the Cookie Policy below), the report carries the replay’s identifier so we can watch what went wrong; without that consent it carries none.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a working, secure website).
Provider: Functional Software, Inc. (Sentry), 45 Fremont Street, San Francisco, CA 94105, USA, acting as our data processor under a Data Processing Agreement (Art. 28 GDPR). Reports are stored in Sentry’s European Union data region (Germany) and deleted after 90 days. Transfers to the United States, where they occur, are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR).
5. Cookies and Tracking Technologies
Please refer to our separate Cookie Policy for detailed information about cookies used on this website.
Essential cookies (session management, shopping cart, CSRF protection, security) are set without consent as they are strictly necessary for the operation of the website (§ 25 Abs. 2 TDDDG).
Non-essential cookies (marketing, third-party services) are set only after you have provided explicit consent via our cookie consent banner (§ 25 Abs. 1 TDDDG; Art. 6(1)(a) GDPR).
6. International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA):
- United States (Cloudflare, Inc., website hosting and content delivery): Covered by the EU-US Data Privacy Framework and Standard Contractual Clauses (Art. 46(2)(c) GDPR).
- Israel (Wix.com Ltd., headless commerce platform): Covered by the EU Commission’s adequacy decision pursuant to Art. 45 GDPR.
- United States (Wix Inc., Stripe, PayPal, and other sub-processors): Covered by the EU-US Data Privacy Framework for DPF-certified entities, and by Standard Contractual Clauses (Art. 46(2)(c) GDPR).
- United States (Anthropic PBC, AI help assistant): Covered by Standard Contractual Clauses (Art. 46(2)(c) GDPR).
- Destination countries (customs authorities for international shipments): Data disclosure required by applicable customs law (Art. 6(1)(c) GDPR).
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our website uses SSL/TLS encryption for all data transmission.
8. Automated Decision-Making
We do not use automated decision-making or profiling as defined by Art. 22 GDPR. The AI help assistant described in section 4.8 produces text answers only: it makes no decision about you, your account or your order, and no decision producing legal effects concerning you is taken automatically.
9. Obligation to Provide Data
The provision of personal data for the purpose of order processing is a contractual requirement. Without this data, we cannot process or fulfill your order. The provision of data for newsletter signup or contact inquiries is voluntary.
10. Changes to This Privacy Policy
We reserve the right to update this privacy policy to reflect changes in legal requirements or our data processing activities. The current version is always available on our website.
Cookie Policy
Pursuant to § 25 TDDDG and Art. 6(1)(a) GDPR
What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They serve various purposes, from enabling essential website functions to analyzing user behavior.
Essential Cookies (No Consent Required)
These cookies are strictly necessary for the functioning of the website and cannot be deactivated.
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Maintains your session while browsing | Session |
| Shopping cart | Remembers items in your cart | 30 days |
| CSRF token | Security: prevents cross-site request forgery | Session |
| Cookie consent | Remembers your cookie preferences | 12 months |
Language (df_lang) | Remembers the language you chose, or the one your browser asked for on your first visit | 12 months |
Personalization (df_aud) | Set only when you are signed in. Remembers whether you have ordered from us before, so pages can skip what you no longer need. It holds a single letter and no products, dates or order details. Cleared when you sign out | 30 days |
Measurement opt-out (df_no_stats) | Saved only if you ask us to stop counting your visits, so that we can honour it | Until you clear your browser data |
Delivery country (df_shipping_country) | Remembers the delivery country you chose, so the shipping cost and delivery dates are right the next time you visit. A second entry holds the country we preselected for you before you chose one | Until you clear your browser data; 30 days for a country we preselected |
| Security cookies | Fraud prevention and site security | Session |
| Turnstile (bot check) | Confirms a person, not a bot, is using the help center’s ask box | Session |
Usage Measurement (No Cookies, No Consent Required)
We measure how the site is used with our own software, served from and received on our own domain (/stats/*), which is why you will not see a request to a third-party analytics host. It sets no cookies, stores nothing on your device, does not track you across websites and builds no profile of you. Your IP address and browser signature are used only for a moment (to derive your country and an anonymous visitor hash that changes every day) and are then discarded; the IP address itself is never stored. There is no analytics provider and no third party involved: the measurements are written to our own database, which is hosted with Cloudflare, Inc. under the agreement described in section 4.1 above, and they are passed to no one else.
What we record: page views, the referring site, country, device class and browser, page performance timings, and how the site is used (searches typed into our search box, filters used, product clicks, items added to the cart, checkout starts, and completed purchases with the order amount and currency). What we never record: your name, email address, postal address, member ID or order number.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving how our site is used); no consent is required under § 25 Abs. 2 TDDDG because nothing is stored on or read from your device. This measurement runs regardless of your cookie choices.
If you would rather not be counted, you can stop it here: Your visits are not counted. This is saved in this browser only. The same link sits in Cookie Settings, under Usage measurement. Choosing it saves one setting in this browser, df_no_stats, which exists only to carry out your choice, so it applies to this browser on this device.
Non-Essential Storage (Consent Required)
These are only saved to your browser after you accept them via our cookie banner or Cookie Settings. You can change or withdraw your consent at any time.
- Functional: Remembers your recent searches, recently viewed products, and whether you’ve seen the latest news, so the site can show them back to you on your next visit.
- Marketing: We use Google Tag Manager with Google Ads to measure our advertising (e.g. that a purchase followed an ad click) and, with your consent, to show you relevant products on other sites (remarketing). We run it in Google’s Consent Mode: until you grant the Marketing category, no advertising cookies are set and no personal identifiers are shared. Google receives only anonymous, cookieless signals. Granting Marketing enables advertising cookies (e.g.
_gcl_*); withdrawing it in Cookie Settings takes effect immediately on the open page. Provider: Google Ireland Ltd.; data may be transferred to Google LLC (USA) under the EU–US Data Privacy Framework. - Session replays (Marketing): With the Marketing category granted, a share of visits is recorded as a session replay: the pages opened, what was clicked and scrolled, and which fields were focused. Every typed input is masked before it leaves your browser, your name and profile picture are hidden, and the account, review and order pages are never recorded. The recording is linked to the same daily, salted visitor hash as our usage measurement, never to your IP address or account. Recordings are stored in the EU (Cloudflare R2, jurisdiction EU) for 30 days and then deleted. Withdrawing Marketing in Cookie Settings stops the recording at once.
- Third-party cookies: Any embedded content that sets cookies will be disclosed here.
Legal basis: § 25 Abs. 1 TDDDG; Art. 6(1)(a) GDPR (consent).
Managing Your Cookie Preferences
You can manage your cookie preferences at any time: open cookie settings here, or use the cookie settings link in the footer of our website.
You can also delete cookies through your browser settings.
You may withdraw your consent to non-essential cookies at any time with future effect by adjusting your cookie settings.
Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
For questions about our use of cookies, please contact: info@diabolofocus.com