Privacy Policy
1. Controller, scope and legal framework
This Privacy Policy explains how SBS Tactical Baits UG (haftungsbeschränkt) processes the personal data of customers and visitors of its international online shop at sbsbaits.com ("Webshop"). Effective from: [date of publication].
1.1 Data controller
| Name | SBS Tactical Baits UG (haftungsbeschränkt) |
| Registered office and postal address | Rosengasse 8, 94469 Deggendorf, Germany |
| Managing director | Agnes Barancic-Kovacs |
| Commercial register | Amtsgericht Deggendorf, HRB 4433 |
| VAT ID | DE306326102 |
| E-mail for data protection requests | info@sbsbaits.com |
| Telephone | +36 42 310 641, +44 20 7558 8630 |
| Data protection officer | The controller is not required to appoint a DPO (Art. 37 GDPR, § 38 BDSG). [Amend if a DPO is appointed.] |
1.2 Legal framework
We process personal data in accordance with:
- Regulation (EU) 2016/679 – General Data Protection Regulation ("GDPR");
- the German Federal Data Protection Act (BDSG);
- the German Telecommunications Digital Services Data Protection Act (TDDDG), in particular § 25 on cookies and similar technologies;
- German commercial and tax law on record-keeping (§ 257 German Commercial Code, HGB; § 147 German Fiscal Code, AO);
- § 7 German Act against Unfair Competition (UWG) on e-mail advertising.
1.3 Principles
We process only the data necessary for the given purpose, for no longer than necessary, lawfully, fairly and transparently. We do not use automated decision-making or profiling that produces legal effects concerning you. We do not knowingly process data of children under 16; orders may only be placed by persons aged 18 or over.
2. What we process, why, and for how long
| Purpose | Personal data | Legal basis (GDPR) | Retention period |
|---|---|---|---|
| Processing orders and performing the contract (order confirmation, dispatch, delivery, payment, customer contact) | Name, billing and delivery address, e-mail, phone number, ordered products, order value, payment method, order number | Art. 6(1)(b) – performance of a contract | Until the end of the statutory limitation period for contractual claims (generally 3 years from the end of the year of the order, § 195 BGB) |
| Invoicing, accounting and tax compliance | Name, billing address, VAT ID (for businesses), invoice and payment data | Art. 6(1)(c) – legal obligation (§ 257 HGB, § 147 AO) | Invoices and accounting records: 8 years; commercial correspondence: 6 years (from the end of the calendar year) |
| Customer account (registration) | Name, e-mail, password (encrypted), addresses, phone number, order history | Art. 6(1)(b) – contract (account use) | Until the account is deleted; order data as above |
| Withdrawal, warranty claims and complaints | Name, contact details, order data, description of the issue, bank account (IBAN) for refunds, photos provided | Art. 6(1)(b) and (c) – contract and legal obligation | Until the warranty and limitation periods expire (generally 2–3 years), longer if a dispute is pending |
| Customer service enquiries (e-mail, phone, contact form) | Name, contact details, content of the enquiry | Art. 6(1)(f) – legitimate interest in answering enquiries; Art. 6(1)(b) where it relates to a contract | 1 year after the enquiry is closed, unless needed for a contract or claim |
| Newsletter | Name, e-mail, date, time and IP address of subscription and confirmation (double opt-in) | Art. 6(1)(a) – consent | Until consent is withdrawn (unsubscribe link in every e-mail or request to info@sbsbaits.com); proof of consent up to 3 years after withdrawal |
| E-mail recommendations of similar products to existing customers | E-mail address, purchase history | Art. 6(1)(f) – legitimate interest in direct marketing, § 7(3) UWG; you may object at any time | Until you object |
| Website operation and security (server logs) | IP address, date and time of visit, browser type, pages viewed | Art. 6(1)(f) – legitimate interest in secure operation | [7–30 days] |
| Analytics and marketing cookies and pixels | Online identifiers, browsing and purchase behaviour | Art. 6(1)(a) GDPR and § 25(1) TDDDG – consent (cookie banner) | See Section 4 |
| Establishing, exercising or defending legal claims | Data relevant to the claim | Art. 6(1)(f) – legitimate interest | Until the claim is finally resolved |
Providing the data required for orders is a condition of the contract: without it we cannot fulfil your order. Providing data for the newsletter or the customer account is voluntary.
Where processing is based on legitimate interest, we have carried out a balancing test, which you may request from us.
3. Processors and recipients
We share personal data only to the extent necessary for the purposes above, with the following processors acting on our instructions under a data processing agreement (Art. 28 GDPR), or with independent controllers where indicated:
| Recipient | Role | Data shared |
|---|---|---|
| SBS Baits In Europe Kft., Debreceni út 195., 4405 Nyíregyháza, Hungary | Warehouse, order fulfilment, returns handling and customer service (processor) | Name, delivery address, phone, e-mail, order data |
| Ginrin Interactive Kft., Mikszáth Kálmán tér 2. 3. em. 8., 1088 Budapest, Hungary; company reg. no.: 01-09-323478; tax no.: 23304178-2-42; phone: +36 70 935 8720; e-mail: attila@ginrin.com | Webshop operation and hosting | All data stored in the Webshop |
| Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland | Card payment (independent controller for card data) | Name, e-mail, billing address, order number, amount |
| PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg | PayPal payment (independent controller) | Name, e-mail, delivery address, order number, amount |
| GLS and its partner carriers in the destination country | Parcel delivery | Name, delivery address, phone, e-mail, parcel data |
| Commerzbank AG | Receiving bank transfers and refunds (independent controller) | Name, bank account, amount, reference |
| [Invoicing software provider – name, address] | Issuing electronic invoices | Billing data |
| [Tax advisor / accountant – name, address] | Bookkeeping and tax compliance (subject to professional secrecy) | Invoice and payment data |
| Sendinblue SAS (Brevo), 106 boulevard Haussmann, 75008 Paris, France | Newsletter and transactional e-mails | Name, e-mail, subscription data |
| Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland | Google Tag Manager; [Google Analytics / Google Ads, if used] | Online identifiers, usage data |
| Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland | Meta Pixel – advertising measurement (joint controller for collection and transmission, Art. 26 GDPR) | Online identifiers, usage and purchase events |
Public authorities (e.g. tax authorities, courts, police) receive data only where required by law.
Transfers outside the EEA
Some providers (e.g. Google, Meta, Stripe, PayPal) may transfer data to the United States. Such transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework, or on the Standard Contractual Clauses (Art. 46 GDPR). We do not sell personal data.
4. Cookies
Cookies are small text files stored on your device. Strictly necessary cookies are used without consent; all other cookies are set only after you accept them in the cookie banner. You can change or withdraw your consent at any time via the "Cookie settings" link at the bottom of every page, or by deleting cookies in your browser.
| Category | Purpose | Legal basis | Typical lifetime |
|---|---|---|---|
| Strictly necessary | Basket, login session, security, storing your cookie choices | § 25(2) no. 2 TDDDG; Art. 6(1)(b)/(f) GDPR | Session – 12 months |
| Preferences | Remembering language and currency | Consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR) | Up to 12 months |
| Analytics | Measuring visits and improving the Webshop (via Google Tag Manager, e.g. Google Analytics) | Consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR) | Up to 24 months |
| Marketing | Measuring and personalising ads (Meta Pixel, [Google Ads]) | Consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR) | Up to 12 months |
[Replace with the actual list of cookies (name, provider, lifetime) generated by your cookie management tool.]
5. Security, your rights and complaints
5.1 Data security
We protect personal data with appropriate technical and organisational measures: encrypted (HTTPS) connections, access control, regular backups and limited staff access. Card data is entered only on Stripe's or PayPal's secure payment page; we never see or store it. In the event of a personal data breach, we notify the supervisory authority within 72 hours and, where the risk is high, the affected persons.
5.2 Your rights
Under the GDPR you have the right to:
- Access – obtain confirmation and a copy of the personal data we process about you (Art. 15);
- Rectification – have inaccurate data corrected or completed (Art. 16);
- Erasure – have your data deleted where there is no legal ground to keep it (Art. 17);
- Restriction – have processing restricted in certain cases (Art. 18);
- Data portability – receive the data you provided in a machine-readable format or have it sent to another controller (Art. 20);
- Objection – object at any time to processing based on legitimate interest, and to direct marketing (Art. 21);
- Withdrawal of consent – withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
Send requests to info@sbsbaits.com or by post to our address. We respond within 1 month, which may be extended by 2 further months for complex requests; we will inform you of any extension. Requests are free of charge unless manifestly unfounded or excessive. We may ask for information to confirm your identity.
5.3 Complaints and remedies
If you believe our processing infringes the law, please contact us first so we can resolve the issue. You may also lodge a complaint with:
- the supervisory authority competent for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany; website: lda.bayern.de; or
- the data protection authority of the EU Member State of your habitual residence or place of work, or of the place of the alleged infringement (Art. 77 GDPR).
You may also bring proceedings before the competent court, including the court of your place of residence.
5.4 Changes
We may update this Privacy Policy. The current version is always available in the Webshop, with its effective date. We will notify you of significant changes by e-mail or in the Webshop.