Privacy Policy

Unless otherwise stated below, providing your personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obligated to provide your data. Not providing it will have no consequences — unless otherwise indicated in connection with specific processing operations. "Personal data" means any information relating to an identified or identifiable person.

Data Controller

Monadjem GmbH
Brooktorkai 8
D-20457 Hamburg
Germany

Phone: +49 40 330764
Email: info@rugsociete.com

Server Log Files

Each time you access our website, usage information is automatically transmitted by your browser to our hosting provider (Vercel Inc., USA) and stored in server log files. This includes: pages accessed, time of access, IP address, data volume transferred, and the requesting internet provider. This processing is based on Art. 6(1)(f) GDPR — our legitimate interest in stable and secure operation of our website. Data may be transferred to servers in the USA based on EU Standard Contractual Clauses.

Contact

When you contact us by email or via the contact form, we collect your personal data (name, email address, message) only to the extent you voluntarily provide it. Processing is for handling your inquiry. If your inquiry relates to a contract, processing is based on Art. 6(1)(b) GDPR. For other inquiries, processing is based on Art. 6(1)(f) GDPR (legitimate interest). Data is deleted after final processing and expiration of statutory retention periods.

Orders

For orders, we process your personal data (name, address, email, phone, payment information) solely to the extent necessary for fulfilling the purchase contract. This data is required for contract performance; without it, the contract cannot be concluded. Processing is based on Art. 6(1)(b) GDPR. Data is shared only with necessary service providers (payment processors, shipping companies) within the framework of legal requirements.

Payment Processing — Stripe

We use Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) for payment processing. Card data (card number, expiry, CVC) is transmitted directly to Stripe — we do not store full card data. Legal basis: Art. 6(1)(b) GDPR (contract performance). Data may be transferred to the USA based on EU Standard Contractual Clauses. stripe.com/privacy

User Accounts

You can create a user account on our website. We process your email address and a password you choose. Processing is based on Art. 6(1)(b) GDPR for providing account functionality (order history, wishlist). Account data is stored with our hosting provider Supabase.

Newsletter

If you subscribe to our newsletter, we use your email address solely for sending our own information and offers. Processing is based on your consent per Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link in the newsletter or by contacting us.

Cookies

Our website uses cookies. These are small text files stored by your browser. You have full control via our consent banner (accessible at any time via "Cookie Settings" in the footer) or your browser settings. Strictly necessary cookies (e.g. shopping cart, wishlist, session storage) are set based on § 25(2) TTDSG. The associated processing is based on Art. 6(1)(f) GDPR — our legitimate interest in a functional website.

Consent Management

We use our own consent management system to record your cookie preferences. Your consent decision is stored locally in your browser (localStorage) and logged server-side for legal compliance. You can change your preferences at any time via "Cookie Settings" in the footer. Legal basis: Art. 6(1)(c) GDPR (legal obligation).

Web Analytics — Vercel Analytics

We use Vercel Analytics (Vercel Inc., USA) for anonymized website usage analysis. No personal data such as IP addresses is stored. No cookies are set. Processing is based on Art. 6(1)(f) GDPR — our legitimate interest in optimizing our online offering. vercel.com/analytics/privacy

Google Maps

On our showroom page, we use Google Maps (Google Ireland Limited, Dublin, Ireland) to display our location. When accessing this page, information (e.g. IP address) is transmitted to Google. Processing is based on Art. 6(1)(f) GDPR — our legitimate interest in a user-friendly location display. Data may be transferred to the USA. policies.google.com/privacy

Data Retention

Personal data is stored only as long as necessary for fulfilling contractual or statutory obligations. After complete settlement, data is retained for the duration of statutory warranty periods, then according to tax and commercial retention periods (e.g. 6 years per § 257 HGB, 10 years per § 147 AO). After expiration, data is deleted.

Your Rights

You have the following rights under Art. 15–20 GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)

Right to Object (Art. 21 GDPR)

Where processing of your personal data is based on our legitimate interest per Art. 6(1)(f) GDPR, you have the right to object at any time for reasons relating to your particular situation. This also applies to processing for direct marketing purposes.

Supervisory Authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 7. OG
20459 Hamburg
datenschutz-hamburg.de

Cookie Declaration

We use the following cookies on rugsociete.com: