Last updated: 9 October 2026
1. Controller
The controller responsible for data processing in this online shop is:
Stolz und Müller GmbH
represented by Jürgen Müller and Martin Stolz
Bismarckstrasse 9
76761 Rülzheim
Germany
Telephone: +49 (0)6321 189 04 04
E-mail: info@lieht.com
The contact person for data protection enquiries is Martin Stolz, who can be reached using the contact details above. The full imprint can be found at https://lieht.com/en/imprint/.
2. At a glance
| What happens | Without your consent | With your consent |
|---|---|---|
| Page view, server log | yes | yes |
| Audience measurement with Umami (our own server, no cookies) | yes | yes |
| Language selection, cart, customer account, order, appointment booking | yes, technically necessary | yes |
| PayPal on the checkout page | yes, necessary for payment | yes |
| Storage of your cookie selection | – | yes, according to your selection |
| Google reCAPTCHA (login, registration) | no | yes |
| Origin of orders (Order Attribution) | no | yes (statistics) |
| Jetpack statistics | no | yes (statistics) |
| Google tag (Google Ads, Google Analytics 4), Meta Pixel, Pinterest tag | no | yes (marketing) |
| Product adviser chat (OpenAI) | interface yes; data passed to third parties only when a question is submitted | yes |
| 3D view of the luminaire (VisCircle) | only after your click | only after your click |
| Prompt about Google Customer Reviews after the order | yes, on the order confirmation | yes |
Before you give your consent, the shop does not connect to Google, Meta, Pinterest or Automattic. The exceptions are PayPal on the checkout page (Section 11), the 3D view after your click (Section 19) and the prompt about Google Customer Reviews on the order confirmation (Section 20).
3. Hosting and server logs
The shop is operated on our behalf by our technical service provider Ackermann-Online (processing on our behalf under Art. 28 GDPR). The servers are located in a data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A data processing agreement is in place with Hetzner.
Each time the shop is accessed, the web server stores a log containing:
- IP address
- date and time
- requested address and response code
- amount of data transferred and processing time
- previously visited page (referrer)
- browser and operating system (user agent)
The purpose is to deliver the pages, to troubleshoot errors and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the shop.
The logs are rotated daily and automatically deleted after 180 days.
Further systems process IP addresses to defend against attacks:
- Attack detection (CrowdSec): automatically analyses the server logs, blocks suspicious IP addresses for 4 hours and deletes their reports after 7 days at the most. Reports on detected attacks (the attacker’s IP address, type of attack) are also sent to the manufacturer, CrowdSec.
- Firewall log (ModSecurity): retains requests that trigger a protection rule for 30 days.
- Login protection: The security plug-in “Limit Login Attempts Reloaded” stores the IP address and the user name entered in failed login attempts in the database; no automatic deletion period has been set up for this. In addition, the security module of Jetpack checks the IP address against a list of known attackers on login attempts; for this purpose it is transmitted to Automattic (Section 14).
- Activity log (Simple History): records logins, failed login attempts and changes in the administration area, together with user name and IP address. The entries are deleted after 180 days.
- Backups: Database backups are retained on a staggered basis for up to 12 months. The web server’s log files are not included in them.
The legal basis in each case is Art. 6(1)(f) GDPR; our legitimate interest lies in the security of the shop and of the customer accounts.
4. Consent management (Borlabs Cookie)
On your first visit we show a dialog in which you decide which services may be loaded. The services are arranged in groups: “Essential” (always active), “External Media”, “Statistics” and “Marketing”. Until you have made your decision, we do not load any service that requires consent.
We store your selection in the cookies borlabs-cookie and borlabs-cookie-gcs. The second cookie records whether Google services may use cookies for advertising (Google consent mode). In addition, we record in our database when you made which selection; a random identifier with no link to your name is used for this. This allows us to demonstrate that consent has been given (Art. 7(1) GDPR).
The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. Storing the cookies is permitted without consent under Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act), because otherwise we could not remember your decision. The software runs on our own server; no data is passed on to the manufacturer.
Duration: 365 days if you allow services or save your own selection; 60 days if you allow only essential services. We then ask you again. The log entry in our database is deleted after 365 days.
Changing or withdrawing your consent
You can change your selection or withdraw your consent with effect for the future at any time: Change cookie settings. In the dialog, select “Deselect all” and “Save”. After that, none of the services that require consent will be loaded any more, and the cookies of the origin attribution (sbjs_…) are removed.
Cookies and storage entries that services have created after your consent may remain in the browser after withdrawal until they expire; they are no longer read. Cookies of other providers under their own address (such as IDE from Google or _pinterest_ct_ua from Pinterest) cannot be deleted by us from the shop. You can delete all of these entries yourself in your browser settings.
5. Cookies and browser storage at a glance
5.1 Without consent (technically necessary)
| Name | Stored by | Purpose | Duration |
|---|---|---|---|
pll_language | lieht-shop.com | selected language of the shop | 365 days |
woocommerce_items_in_cart | lieht-shop.com | cart contains items | session |
woocommerce_cart_hash | lieht-shop.com | detecting the contents of the cart | session |
wp_woocommerce_session_… | lieht-shop.com | cart session | 2 days |
wc_cart_hash_…, wc_fragments_…, wc_cart_created (browser storage) | lieht-shop.com | cart display without reloading | session or until deleted |
storeApiNonce, storeApiCartData (local storage) | lieht-shop.com | security value and cart data for shop functions | until deleted in the browser |
wp_automatewoo_visitor_… | lieht-shop.com | assigning cart and order for the e-mail module, after login or entry of the e-mail address at checkout | 365 days |
wp_automatewoo_session_started | lieht-shop.com | the same, session marker | session |
paypalplus_session_v2 | lieht-shop.com | PayPal payment session | session |
ts, ts_c, enforce_policy | .paypal.com | PayPal: security, fraud prevention, settings | 365 days |
tsrce | .paypal.com | PayPal: origin of the payment process | 3 days |
LANG | .paypal.com | PayPal: language | approx. 10 hours |
l7_az, nsid, x-pp-s | .paypal.com / www.paypal.com | PayPal: session and load balancing | session |
__paypalBannerSdk_storage__ (local storage) | lieht-shop.com, by PayPal | PayPal notices on payment methods | until deleted in the browser |
The cart cookies are only created when you add an item to the cart. The PayPal cookies are created on the checkout page. The wp_automatewoo_… cookies are created as soon as the e-mail module can assign you to an e-mail address.
5.2 After your consent
| Name | Stored by | Service | Duration |
|---|---|---|---|
borlabs-cookie, borlabs-cookie-gcs | lieht-shop.com | Your selection in the consent dialog | 365 days (essential only: 60 days) |
_GRECAPTCHA | www.google.com | Google reCAPTCHA | 180 days |
_grecaptcha (local storage) | lieht-shop.com | Google reCAPTCHA | until deleted |
sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_migrations, sbjs_udata | lieht-shop.com | Origin of orders | session |
sbjs_session | lieht-shop.com | Origin of orders, current visit | approx. 30 minutes |
_gcl_au | lieht-shop.com | Google Ads | 90 days |
_gcl_ls (local storage) | lieht-shop.com | Google Ads | until deleted |
IDE | .doubleclick.net | Google Ads | 390 days |
test_cookie | .doubleclick.net | Google Ads, checks whether cookies are possible | a few minutes |
_fbp | lieht-shop.com | Meta Pixel | 90 days |
lastExternalReferrer, lastExternalReferrerTime (local storage) | lieht-shop.com | Meta Pixel, last referring page | until deleted |
_pin_unauth | lieht-shop.com | Pinterest tag | 365 days |
_pinterest_ct_ua | .ct.pinterest.com | Pinterest tag | 365 days |
is_eu (session storage) | lieht-shop.com | Pinterest tag | session |
Umami and Jetpack do not set any cookies.
6. Audience measurement with Umami
To understand which pages are used, we use the open-source software Umami. It runs on our own server at the address lieht-shop.com/analytics/ and is operated on our behalf by our technical service provider. No data is passed on to other providers or to third countries.
Umami does not set any cookies and stores nothing in your browser’s storage. The following is transmitted with every page view:
- requested page and previously visited page
- browser and browser language, operating system, device type, screen size
- approximate origin (country, region, city), derived from the IP address
- campaign and product details in the requested address (such as
utm_source,gclid,fbclidor the selected product variant) - date and time
- page load time measurements (how quickly content appears and responds)
Your IP address is not stored. It is used only briefly, together with the browser identifier, to form an irreversible check value. This check value changes at the beginning of each calendar month. Within a month we can therefore recognise the same browser behind the same IP address, but we do not link it to names or account data.
In the ordering process we also count the individual steps (product view, cart, checkout, order completion). On order completion we transmit the order number, order value, currency, selected payment method and, if you arrived via an advertisement, the campaign name and whether an ad click identifier was present. Name, address, payment and contact details are not included in the statistics. The order number serves only to avoid double counting. We also count search queries in the shop, together with the search term entered and the number of results.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in improving our offering without passing data on to third parties. We do not obtain consent for this: no information is stored on your device, and only details that your browser makes available anyway for displaying the page are read (Section 25(2) No. 2 TDDDG). You can object to the processing at any time (Art. 21 GDPR), for example by e-mail to info@lieht.com.
The analytics data is stored for 36 months. A daily deletion run removes older data.
7. Customer account
Under “My account” you can log in or create a customer account. We process the information from the registration form (in particular name, e-mail address, addresses, password in encrypted form) and your orders so that you can view them and order more quickly.
The legal basis is Art. 6(1)(b) GDPR. The account exists until you delete it or ask us to delete it; order data that is subject to a statutory retention obligation is retained by us after that (Section 8).
The login and registration forms are protected by Google reCAPTCHA (Section 12). Registration under “My account” is not possible without your consent to reCAPTCHA; you can instead create an account when ordering. Logging in with an existing account and ordering as a guest or with an account also work without this consent.
8. Order and contract processing
For your order we process the information from the order form: name, billing and delivery address, e-mail address, telephone number, where applicable company and VAT identification number, the items ordered, prices and the selected payment and shipping method. We use this information to conclude the contract, deliver the goods, allocate payments, inform you about the status of the order and handle warranty or withdrawal cases. For invoicing and accounting, we transfer the order data into our office software.
The legal basis is Art. 6(1)(b) GDPR. Without this information we cannot conclude a contract. We are obliged under commercial and tax law to retain invoices and business letters (Art. 6(1)(c) GDPR in conjunction with Section 257 HGB (German Commercial Code) and Section 147 AO (German Fiscal Code)). These periods amount to up to ten years.
Cart: If you add an item to the cart, the shop stores it for your session; the session expires after two days, and the shop deletes expired sessions twice a day. With a customer account, the cart remains stored in the account until you empty it or place an order. The shop’s e-mail module (AutomateWoo) also stores the carts of logged-in customers and of visitors who have entered their e-mail address at checkout, for up to 60 days after the last change.
Origin from advertisements: If you come to the shop via an advertisement or a campaign link, we store the campaign name and the information whether an ad click identifier was present (yes or no, not the identifier itself) in your existing cart session and, if you place an order, save them with the order. No separate cookie is set for this. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in assessing the benefit of our advertising.
Shipping: For delivery, we pass on your name and delivery address to the shipping company commissioned (such as GLS, UPS or DHL). The legal basis is Art. 6(1)(b) GDPR. The shop has no interface to a shipping service provider; the shop does not transmit your e-mail address or telephone number to shipping service providers.
E-mails about the order: We send order confirmations, invoices and shipping notifications by e-mail. They are sent via the e-mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany; the sender address is info@lieht.de. The shop does not store copies of the e-mails sent.
Request for a review: 14 days after an order is completed, we send an e-mail to the e-mail address of the order asking for a review on Google (salutation with first name, order number, link to the review page). The e-mail contains an unsubscribe link; no click tracking takes place. The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG (German Act against Unfair Competition); our legitimate interest lies in feedback on our products. You can object at any time, using the unsubscribe link or by e-mail to info@lieht.com, without incurring any costs other than the transmission costs at the basic rates. For this purpose the e-mail module stores the e-mail address and the assignment to the order; when ordering and on login, it sets the cookies listed in Section 5.1.
We do not offer a newsletter.
9. Appointment booking
You book appointments for a consultation in the showroom in the shop via an appointment item with a calendar. The booking runs through the checkout like an order; in doing so we process your contact details from the order form and the date and time of the selected appointment in order to arrange, confirm and carry out the appointment. No payment is processed, and the appointment data does not go to any external calendar service. The legal basis is Art. 6(1)(b) GDPR.
10. Notification when back in stock
If an item is out of stock, you can add yourself to a waiting list with your e-mail address on the product page. We store the e-mail address with the item and notify you once by e-mail as soon as it is available again. The legal basis is Art. 6(1)(a) GDPR (your sign-up). You can remove yourself at any time, for example by e-mail to info@lieht.com. After the notification has been sent, the entry is kept in an archive with the item so that we can trace who was notified; we delete it on request.
11. Payment methods
At checkout we offer:
| Payment method | Processed by |
|---|---|
| PayPal | PayPal |
| Direct debit | PayPal |
| Credit card | PayPal |
| Invoice | PayPal; the receivable is assigned to PayPal (Europe) S.à r.l. et Cie, S.C.A. |
| Bank transfer / prepayment | we ourselves |
For customer groups that have been enabled (retailers) we additionally offer “Purchase on invoice” and “SEPA direct debit”, which we process ourselves (see below). Guests and end customers do not see these two payment methods.
PayPal
Purpose: processing payment by PayPal, direct debit, credit card or invoice. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
When loaded: on the checkout page, even without your consent, because the payment selection is displayed there. Your browser connects to www.paypal.com and www.paypalobjects.com in the process. On the other shop pages, PayPal is not loaded.
Which data: When the checkout page is loaded, PayPal receives your IP address and details of your browser and device. PayPal sets the cookies listed in Section 5.1. If you choose a payment method from PayPal, we transmit the order data necessary for the payment (name, address, e-mail address, amount, order number). PayPal carries out its own checks for fraud prevention, in the case of purchase on invoice and direct debit where applicable also on identity and creditworthiness, and is itself responsible for processing the payment. Details are set out in PayPal’s privacy policy.
Legal basis: Art. 6(1)(b) GDPR (performance of the purchase contract). We base the loading of the PayPal resources and the setting of the PayPal cookies on the checkout page on Section 25(2) No. 2 TDDDG, because the payment cannot be offered without them.
Third country: PayPal may transfer data to PayPal, Inc. in the USA; see Section 23.
PayPal’s privacy policy: https://www.paypal.com/uk/legalhub/privacy-full
Bank transfer / prepayment
You transfer the amount to our account. For this we process your order data and reconcile the receipt of payment. No data is passed on to payment service providers. The legal basis is Art. 6(1)(b) GDPR.
Invoice and direct debit for enabled customers
Customer groups that have been enabled (retailers) can buy on invoice or pay by SEPA direct debit. We process both ourselves; no data is passed on to payment service providers or credit reference agencies, and no credit check takes place. For direct debit, we store the account holder, IBAN, BIC and the mandate reference with the order; the mandate is granted with the order. The legal basis is Art. 6(1)(b) GDPR; retention is governed by Section 8.
12. Google reCAPTCHA
Purpose: protecting the login and registration forms against automated access. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When loaded: only after your consent (group “External Media”), namely on the “My account” and “Checkout” pages. On the other pages, reCAPTCHA is only loaded when you use the login form in the header area of the page. Until then no connection to Google is made.
Which data: reCAPTCHA analyses your behaviour on the page in order to distinguish humans from programs. In the process, your IP address, details of your browser, operating system and screen, the time spent on the page and mouse and keyboard input, among other things, are sent to Google. Connections are made to www.google.com and www.gstatic.com; Google also loads font files from fonts.gstatic.com.
Cookies: _GRECAPTCHA (180 days) and the storage entry _grecaptcha.
Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
Third country: A transfer to Google LLC in the USA is possible; see Section 23.
13. Origin of orders (WooCommerce Order Attribution)
Purpose: We would like to know by which route an order came about, such as via a search engine, an advertisement or a referring website.
When loaded: only after your consent (group “Statistics”).
Which data: In cookies whose names begin with sbjs_, the shop stores the origin of your visit, the time and number of your visits, and the device type and browser. If you place an order, this information is stored together with the order in our shop system. It is not passed on to third parties.
Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
Storage period: The cookies apply for the duration of the session. The origin information remains stored with the order for as long as the order itself.
14. Jetpack statistics and login protection
Purpose: access statistics for the administration of the shop. The provider is Aut O’Mattic A8C Ireland Ltd., Grand Canal Dock, 25 Herbert Place, Dublin, D02 AY86, Ireland.
When loaded: only after your consent (group “Statistics”), then on every shop page.
Which data: Your browser connects to stats.wp.com and pixel.wp.com. Your IP address, the page accessed, the previously visited page and details of your browser and device are transmitted.
Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
Login protection: Independently of the statistics, Jetpack checks the IP address against a list of known attackers held by Automattic on login attempts. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the customer accounts.
Third country: A transfer to Automattic Inc. in the USA is possible; see Section 23.
Automattic’s privacy policy: https://automattic.com/privacy/
15. Google tag: Google Ads and Google Analytics 4
Purpose: With Google Ads (ID AW-938640269) we measure whether a visit through one of our advertisements has led to a purchase. Via the same Google tag, Google Analytics 4 (ID G-5CQ8FF0GPH) also receives usage data. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When loaded: only after your consent (group “Marketing”, listed in the dialog as “Google Ads”), then on every shop page. Before you give your consent, no connection to Google is made.
Which data: Your browser connects to www.googletagmanager.com, region1.analytics.google.com, stats.g.doubleclick.net, googleads.g.doubleclick.net, www.google.com and www.google.de. The data transmitted includes the pages accessed, the origin of the visit, details of your browser, operating system and device, and your IP address. The shop itself does not pass any customer data such as an e-mail address to Google.
Cookies: _gcl_au (90 days), IDE (390 days), test_cookie and the storage entry _gcl_ls, see Section 5.2. The Google tag runs in consent mode: before you give your consent, all signals are blocked. With your consent, we release the advertising signals (ad_storage, ad_user_data, ad_personalization); analytics storage (analytics_storage) remains blocked. Google Analytics therefore does not create a cookie, but does receive page views without a cookie.
Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
Third country: A transfer to Google LLC in the USA is possible; see Section 23.
Google’s privacy policy: https://policies.google.com/privacy
16. Meta Pixel
Purpose: measuring the effectiveness of our advertisements on Facebook and Instagram and showing relevant advertising there. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Pixel ID: 2475920742685200.
When loaded: only after your consent (group “Marketing”). The cookie _fbp is then set on all shop pages; the pixel script itself loads mainly during the ordering process (after an item is added, in the cart and at checkout) and under “My account”.
Which data: Your browser connects to connect.facebook.net and www.facebook.com. Your IP address, the page accessed, details of your browser and device and events of the purchase process are transmitted. Meta can recognise you across devices if you have a Facebook or Instagram account. “Advanced matching” is switched on: if details about you are known (logged-in account, order), they are encrypted (hashed) in the browser and transmitted to Meta together with the events. Purchase events can additionally be transmitted from our server to Meta (Conversions API). To prepare these events, the shop loads a helper script from unpkg.com on the same pages; your IP address is thereby sent to this service, which is delivered via the Cloudflare network.
Cookies and storage: _fbp (90 days) and the storage entries lastExternalReferrer, lastExternalReferrerTime, see Section 5.2.
Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. For the collection and transmission of the data to Meta, we are joint controllers with Meta (Art. 26 GDPR); the arrangement on this can be found at https://www.facebook.com/legal/controller_addendum.
Third country: A transfer to Meta Platforms, Inc. in the USA is possible; see Section 23. Delivery via Cloudflare may also involve servers in the USA.
Meta’s privacy policy: https://www.facebook.com/privacy/policy
17. Pinterest tag
Purpose: measuring the effectiveness of our advertising on Pinterest. The provider is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Tag ID: 2612697827106.
When loaded: only after your consent (group “Marketing”), then on every shop page.
Which data: Your browser connects to ct.pinterest.com, assets.pinterest.com, log.pinterest.com and s.pinimg.com. Your IP address, the page accessed, details of your browser and device and events of the purchase process (page view, cart, checkout) are transmitted. Enhanced matching with customer data is switched off. The shop does not send order data from the server to Pinterest.
Cookies and storage: _pin_unauth (365 days), _pinterest_ct_ua (365 days) and the session storage entry is_eu, see Section 5.2.
Legal basis: your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
Third country: A transfer to Pinterest, Inc. in the USA is possible; see Section 23.
Pinterest’s privacy policy: https://policy.pinterest.com/en/privacy-policy
18. Product adviser (chat)
On the shop pages we offer a chat that answers questions about our products with the help of artificial intelligence. The chat interface is loaded from our own server as soon as you use the page. Only when you submit a question is your text transmitted via our server to the provider of the language model, OpenAI, and answered there.
Please do not enter personal details such as name, address or order number in the chat.
- In the browser: The conversation history is kept in your browser’s local storage (entry
mwai-chat-default) until you delete it. - On our server: Conversations (messages and IP address) are stored in the shop’s database for up to 90 days and then automatically deleted. Guests may ask no more than 3 questions per day; the IP address is used for this.
- At OpenAI: OpenAI receives the text of your question and the conversation history so far. Processing in the USA is possible; OpenAI bases transfers there on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR).
The legal basis is Art. 6(1)(b) GDPR, insofar as your question serves to initiate a purchase, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering product questions.
19. 3D view on product pages
On individual product pages you can open a 3D view of the luminaire. It is only loaded when you click “Open 3D view”. The provider is VisCircle GmbH, Vahrenwalder Straße 207a, 30165 Hanover, Germany (service 3dcommerce.studio).
After the click, your browser connects to web.3dcommerce.studio, srv.3dcommerce.studio, releases.3dcommerce.studio and app.3dcommerce.studio and to s3.eu-west-2.amazonaws.com (Amazon Web Services, London region). The provider receives your IP address, the product page accessed, details of your browser and device and the ID of the 3D model. The 3D view does not create any cookies or browser storage.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in showing you the luminaire in three dimensions at your request. Because you request the view yourself, the retrieval is permitted under Section 25(2) No. 2 TDDDG. For the United Kingdom, the EU Commission has determined that the level of data protection is adequate (Art. 45 GDPR).
20. Customer reviews from Google
On the home page we show reviews that customers have left about us on Google, with the name of the author as published there. The texts and images of this display are delivered by our own server; no connection to Google is made when the display is shown. Only when you follow a link to Google does Google’s privacy policy apply. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in showing prospective buyers the experiences of other customers. Authors of a review can object to the display on our site at any time.
Prompt about Google Customer Reviews after the order
On the order confirmation and in the view of an order in the customer account, the shop loads a script from apis.google.com. It receives your order number, your e-mail address, the country of delivery and the estimated delivery date, and displays a notice from Google in which you decide whether you would like to receive a survey from Google about your order after delivery. Google sends you the survey only if you agree there. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The script is loaded without a prior selection in the consent dialog. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in obtaining independent customer reviews. A transfer to Google LLC in the USA is possible; see Section 23.
21. Fonts
We deliver our fonts from our own server. The shop does not itself call up Google Fonts. Font files from Google (fonts.gstatic.com) are loaded only by Google reCAPTCHA, after you have given your consent.
22. Links to social networks
Our pages contain simple links to our profiles on Facebook, Instagram, Pinterest and YouTube. When our page is accessed, no data is transmitted to these networks as a result. Only when you follow a link does the privacy policy of the respective network apply.
23. Transfers to third countries
Google, Meta, Pinterest, Automattic and PayPal may transfer data to their parent companies in the USA. For the USA, the adequacy decision of the EU Commission on the EU-US Data Privacy Framework of 10 July 2023 applies. It applies to companies certified under this framework; these include Google LLC, Meta Platforms, Inc., Pinterest, Inc., Automattic Inc. and PayPal, Inc. A transfer to these companies is therefore permitted under Art. 45 GDPR. For OpenAI, see Section 18.
24. Storage period
We delete personal data as soon as the purpose ceases to apply and there is no statutory retention obligation. The periods for individual data are stated in the sections above. How long other providers store data that they receive after your consent is determined by those providers themselves; their privacy policies provide information.
25. Your rights
You have the following rights in relation to us:
- Access to your data stored by us (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability where processing is based on consent or contract (Art. 20 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR), see Section 4
- Objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation, and at any time to direct marketing (Art. 21 GDPR)
A message to info@lieht.com is sufficient. The lawfulness of processing carried out up to the withdrawal remains unaffected.
26. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate)
Hintere Bleiche 34
55116 Mainz
https://www.datenschutz.rlp.de
You can also contact the supervisory authority of your place of residence or work.
27. No automated decision-making
We do not carry out automated individual decision-making, including profiling, under Art. 22 GDPR. Checks that PayPal carries out on its own responsibility in the case of purchase on invoice or direct debit are described in PayPal’s privacy policy.
28. Language versions
This policy applies to all language versions of the shop. In the Italian, French, Spanish and Dutch versions, apart from the technically necessary services we use only the origin of orders (Section 13); Google reCAPTCHA, Jetpack statistics, the Google tag, Meta Pixel and Pinterest tag are not loaded there.
29. Changes and date
We amend this privacy policy when our shop or the legal situation changes. The version published here at any given time applies.
Last updated: 9 October 2026