Privacy policy

With this privacy policy we inform you, pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR), who is responsible for the processing of your personal data, which data we process for which purposes and on which legal basis, and which rights you have. You can access this policy on our website at any time.


Controller

The controller within the meaning of the GDPR is:

MiG UG (haftungsbeschränkt)
represented by its managing director Dr. Gunnar Frießner
Hitdorfer Str. 61b
51371 Leverkusen
Germany

Telephone: +49 (0) 214 - 890 97 225
Email: info@tolisto.shop

For questions about data protection and to exercise your rights, an informal message to this address or email address is sufficient.

This website is a marketplace. If you buy from a manufacturer or retailer, that seller processes the data required to handle your purchase (such as name, delivery address, order contents) as an independent controller. You can see who your seller is on the product page, in the order confirmation and on the invoice; you will also find the seller’s contact details there.


Legal bases for processing

We only process personal data where one of the following legal bases permits this:

Consent (Art. 6(1)(a) GDPR) – for example for the newsletter. You may withdraw your consent at any time with effect for the future; processing carried out up to that point remains lawful.

Contract and pre-contractual measures (Art. 6(1)(b) GDPR) – your customer account, your orders, payment processing, the transfer of order data to the respective seller and messages relating to your order.

Legal obligation (Art. 6(1)(c) GDPR) – in particular the retention obligations under commercial and tax law (§ 257 HGB, § 147 AO) for invoices and accounting records.

Legitimate interest (Art. 6(1)(f) GDPR) – secure and stable operation of the website (server logs), the prevention of misuse and fraud, and functions such as the radius search. You may object to processing on this basis (see ‘Your rights’).

Without your consent, the storage of information on your device (cookies, localStorage) is limited to what is technically necessary (§ 25(2) TDDDG); statistics and Google Analytics only run with your consent (§ 25(1) TDDDG). Details can be found in the cookie notice.


Hosting

We operate the website and all associated services – databases, email, search, statistics – on servers that we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. The servers are located in data centres in Germany (Falkenstein and Nuremberg). Hetzner processes the data only on our behalf and in accordance with our instructions (processing on behalf of a controller pursuant to Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and reliable operation.


Data transmission and logging for internal system and statistical purposes

When you access our website, your internet browser automatically transmits data to our web server for technical reasons. These include, among other things, the date and time of access, the URL of the referring website, the file retrieved, the amount of data sent, the browser type and version, the operating system and your IP address. These data are stored separately from other data that you enter when using our services. We are not able to attribute these data to a specific person. We use them to ensure operation and to detect errors and attacks (for the storage period, see below).


Inventory data

Where a contractual relationship between you and us is to be established, its content defined or amended, we collect and use personal data from you to the extent necessary for these purposes.
By order of the competent authorities, we may in individual cases provide information about these data (inventory data) to the extent necessary for the purposes of criminal prosecution, averting danger, fulfilling the statutory tasks of the authorities for the protection of the constitution or of the Military Counterintelligence Service, or enforcing intellectual property rights.


Use of the website and your customer account

So that you can use the website, we process the data required for this: your login data (email address and login token), the time of your last login and of your last failed login attempt (to protect your account), the contents of your shopping basket and wish list, the items you last viewed and your settings such as language. The legal basis is Art. 6(1)(b) GDPR where you use a customer account or place an order, otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in a functioning website.

Without your consent, we do not create usage profiles, either for advertising or for market research. Your usage behaviour is only analysed if you have consented to statistics (see ‘Statistics’).

We only provide information about these data to authorities if we are legally obliged to do so in an individual case, for example by order for the purposes of criminal prosecution or averting danger (Art. 6(1)(c) GDPR).


Cookies

In order to extend the range of functions of our website and to make its use more convenient for you, we use so-called ‘cookies’. With the help of these ‘cookies’, data can be stored on your computer when you access our website. You can prevent cookies from being stored on your computer by adjusting the settings of your browser accordingly. However, this could restrict the range of functions of our services.


Location search and distance information (OpenStreetMap)

For the radius search (‘Near me’) and the distance information for manufacturers, we determine coordinates. We first resolve places in Germany using our own location table. If this is not successful – for example for places outside Germany or when searching for a postcode –, we query the Nominatim service of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). Only the place or postcode entered and the country are transmitted; if you use the search with your customer account, the town or postcode and the country of your delivery address – not the street and name. For the locations of the suppliers, we transmit their business address. The request is made by our server; your IP address is not transmitted to OpenStreetMap. We cache the coordinates determined for up to 180 days so that the same place does not have to be queried again. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a functioning radius search and correct distance information. Further information: Privacy policy of the OpenStreetMap Foundation.


Statistics (only with your consent)

If you have consented to statistics in the consent dialogue, we record which pages you access and which areas you click on in order to improve our services. For this purpose, we store a random identifier in your browser. In doing so, we record neither your IP address nor your full browser identifier, and never what you enter in forms. If you are logged in, we assign these data to your customer account. This analysis runs on our own servers; no third-party provider is involved. If we additionally use Google Analytics on this website, the following section applies.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). It is valid for twelve months. You can withdraw it at any time in the cookie settings; we will then delete the data recorded up to that point. Without consent, no statistics are collected.


Google Analytics (only with your consent)

On some of our websites we additionally use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). Whether this is the case on this website can be seen in the consent dialogue: Google Analytics is mentioned there if we use it here. Google Analytics is only loaded after you have consented to statistics. Google then sets cookies (such as ‘_ga’ and ‘_ga_…’, storage period up to two years) and records which pages you access, how long you stay, which page you come from, as well as information about your device, browser and approximate location. Google Analytics 4 does not store IP addresses. We do not use advertising features or the linking with Google advertising services.

Google may also transfer the data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Google processes the data on our behalf (processing on behalf of a controller pursuant to Art. 28 GDPR). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time in the cookie settings; Google Analytics will then no longer be executed, and the Google Analytics cookies in your browser will be deleted. The data stored by Google are deleted after 14 months. Further information: Google’s privacy policy.


Payment processing (Stripe)

If you pay online, we process the payment via Stripe. Stripe receives the data required for the payment, such as name, email address, billing address, amount and order number, as well as the payment details that you enter directly with Stripe. We do not see your full card or account details. If you choose a payment method such as PayPal or Klarna during checkout, that provider also receives the data required for the payment; its privacy notice then applies in addition.

The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe may also transfer data to Stripe, Inc. in the USA; in doing so, Stripe relies on the EU-US Data Privacy Framework and on standard contractual clauses of the European Commission. Insofar as Stripe fulfils legal obligations (such as anti-money laundering checks) or prevents fraud, Stripe is itself responsible for this. The legal basis is Art. 6(1)(b) GDPR and, for fraud prevention, point (f). Further information: Stripe’s privacy policy.


AI services

Some functions use language models from external providers. Personal data are only transmitted to them in the following cases, and only to the extent required by the respective task:

– Translating messages: If you write to a seller or to our customer service in a different language, the text of the message may be transmitted to Groq for translation. We store the translation with the message.
– Emails to sellers and to us: We have incoming emails summarised in one sentence and, on request, translated. For this purpose, the text of the email (no more than the first 4,000 characters) is transmitted to Google (Gemini) or Groq.
– Reply suggestions: Sellers and our customer service can have a draft reply to your message generated. In this case, your message and the status of your order (status, shipping, return – not name or address) are transmitted to Anthropic (Claude). The draft is reviewed and sent by a human.
– AI shopping assistant: If you use it, your question is transmitted to Anthropic (Claude).

We compute the product search itself with a language model on our own servers; your search queries are not passed on to any third-party provider.

The following are used: Groq, Inc. (USA), Google Ireland Limited or Google LLC (Gemini, USA), Anthropic PBC (Claude, USA) and OpenAI (ChatGPT, USA). The providers process the data in order to generate the response; for the transfer to the USA we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR insofar as the function serves the performance of a contract, otherwise point (f); our legitimate interest lies in fast communication across language barriers.


Storage period

We only store personal data for as long as is necessary for the respective purpose or required by law:

– Server logs: only for as long as they are needed for troubleshooting and defending against attacks, after which they are overwritten
– Customer account: until you delete it. Upon deletion, we remove your profile data, address book, shopping basket, wish list, newsletter subscription and your statistics profile; orders are retained for the statutory periods
– Orders, invoices and accounting records: eight years, commercial and business letters six years (§ 257 HGB, § 147 AO), in each case from the end of the calendar year
– Messages and emails: for as long as they are needed to deal with your request and for follow-up questions; we keep messages relating to an order for as long as the order
– Newsletter: until you unsubscribe
– Statistics: consent twelve months, recorded data no more than 365 days, immediate deletion upon withdrawal
– Google Analytics: cookies up to two years (upon withdrawal we delete them in your browser), data at Google 14 months
– Location data for the radius search: no more than 180 days

What Stripe and the other providers mentioned store under their own responsibility is governed by their privacy notices.


Your rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

– Access to the stored data, their purposes, recipients and storage period (Art. 15 GDPR)
– Rectification of inaccurate or incomplete data (Art. 16 GDPR)
– Erasure, unless a statutory retention obligation precludes this (Art. 17 GDPR)
– Restriction of processing (Art. 18 GDPR)
– Data portability: provision of the data you have provided in a commonly used, machine-readable format (Art. 20 GDPR)
– Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

On request, we will also provide the information electronically. You can also delete your customer account yourself in your account at any time.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object to this at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to the use of your data for direct marketing at any time without giving reasons.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
www.ldi.nrw.de


Data protection

As a rule, our website can be used without providing personal data. Insofar as personal data (for example name, address or email address) are collected on our pages, this is always done – as far as possible– on a voluntary basis. We only pass on your data insofar as this is necessary for processing your order (for example to the seller, the payment service provider and the shipping company), we are legally obliged to do so or you have given your consent. We would also like to point out that data transmission over the internet (for example when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible. We hereby expressly object to the use by third parties of contact details published in the context of the obligation to provide a legal notice for the purpose of sending unsolicited advertising and information material. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example by spam emails.