1. Introduction

Thank you for visiting our website.

Data protection is of central importance to us, and we want you to feel safe and protected while exploring our content.

You can use our website without providing any personal data. However, if you wish to use specific services or offers on our site, it may become necessary to process your personal data. We collect, process and use your personal data only if you have given us your consent or if a legal basis permits or requires it.

In this privacy policy, we explain in detail the nature, scope and purpose of the collection, use and processing of data, and inform you of your rights as a data subject in connection with our website and all related services and offers of Favori Art.

2. Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) is:

Favori Media – Franziska Sevik
Kurfürstendamm 30
10719 Berlin
Germany

Phone: +49 (030) 759 353 50
Email: info@favori-art.com

Hereinafter: “Favori Art”

For data protection inquiries, please contact us at:
Email: info@favori-art.com

Data protection officer: Favori Art is currently not legally required to appoint a data protection officer. Should this change, this policy will be updated accordingly.

3. Types of Data Processed

When you use our website and services, the following categories of personal data may be processed:

• Contact data: name, email address, phone number, postal address
• Contract data: order data, billing information, payment data
• Usage data: pages visited, click paths, time spent on the site, device information
• Communication data: messages sent via contact forms or email
• Metadata: IP address, browser type, operating system, time stamp

4. Legal Bases for Processing

Favori Art processes personal data on the following legal bases:

• Art. 6(1)(a) GDPR – consent of the data subject
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR – compliance with a legal obligation
• Art. 6(1)(f) GDPR – legitimate interests of the controller

5. Cookies and Consent Management

Our website uses cookies – small text files stored on your device. In accordance with Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), we distinguish between:

• Strictly necessary cookies: required for the operation of the website; no consent required (Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR).
• Analytics and marketing cookies: set only with your express consent (Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR).

On your first visit to our website, a cookie consent banner informs you and asks for your consent. You can adjust or withdraw your settings at any time via our cookie preference center. Disabling certain cookies may limit the functionality of our website.

6. Server Log Files

Our web server automatically records information that your browser transmits and stores it in server log files. This data includes:

• Page visited on our domain
• Date and time of the server request
• Browser type and version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• IP address

This information is not combined with other data sources and is used solely to ensure the technical operation of the website and to defend against attacks.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and uninterrupted operation).

Retention: Server log files are usually deleted automatically after 7 to 14 days, unless security-related events require longer retention.

7. Personal Information

We collect personal data in various ways, including through visits to our website, registrations, newsletter sign-ups and other activities and services on our site. You can also visit our website anonymously.

We only collect personal data that users provide voluntarily. Users can always choose not to provide personal information, although this may limit the use of certain services.

8. Withdrawal of Your Consent to Data Processing

Where data processing is based on your consent, you can withdraw that consent at any time with effect for the future. An informal email to info@favori-art.com is sufficient. The lawfulness of processing carried out before the withdrawal remains unaffected.

9. Contact Form

We store data submitted via our contact form in order to process your inquiry and to be available for any follow-up questions. We do not share this data without your express consent.

Legal basis: Art. 6(1)(a) GDPR (consent by submitting the form) and, where applicable, Art. 6(1)(b) GDPR (pre-contractual measures).

Retention: The data remains with us until you ask us to delete it, withdraw your consent, or the purpose of storage no longer applies. Statutory retention periods (e.g. 6 years under Section 257 of the German Commercial Code (HGB), 10 years under Section 147 of the German Fiscal Code (AO)) remain unaffected.

10. Newsletter

To subscribe to our newsletter, we need your email address. We use the double opt-in procedure: after signing up, you will receive a confirmation email in which you must actively confirm your subscription. No further data is collected unless you provide it voluntarily.

Newsletter Delivery via Our CRM System (Favori Flow)

We use our internal CRM system, Favori Flow, to send our newsletter. The service manages subscriber data, handles delivery and analyzes our newsletter campaigns. When a newsletter is opened, technical information is recorded (time of access, IP address, browser type, operating system and clicks on included links).

We have concluded a data processing agreement with the CRM provider in accordance with Art. 28 GDPR.

Legal basis: Art. 6(1)(a) GDPR (consent).

You can withdraw your consent at any time – via the “unsubscribe” link in the newsletter or by sending us an informal email. The lawfulness of processing carried out before the withdrawal remains unaffected.

Retention: After you unsubscribe, your data will be deleted from the newsletter distribution list. We reserve the right to add your email address to a block list if you have objected to advertising (Art. 6(1)(f) GDPR).

11. Appointment Bookings and Calendar

We offer the option of booking appointments online. For this purpose, we use our CRM system Favori Flow. When you book an appointment, we collect:

• Name
• Email address
• Phone number, if provided
• Date and time of the requested appointment
• Any further information you provide voluntarily

Legal basis: Art. 6(1)(b) GDPR (performance of a contract / pre-contractual measures) and Art. 6(1)(a) GDPR (consent).

Retention: Booking data is deleted after the appointment has taken place and statutory retention periods have expired.

12. Customer Management via Our CRM System (Favori Flow)

We use the CRM system Favori Flow to manage our customer relationships and communications. This allows us to handle customer inquiries in a structured way, organize incoming messages and continuously improve our service.

In this context, personal data (e.g. name, contact details, communication history) is processed. Access is limited to authorized Favori Art staff and to automated processes for service optimization – always under strict security measures and solely for the stated purposes.

We have concluded a data processing agreement with the CRM provider in accordance with Art. 28 GDPR.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient customer management).

13. Payment Service Providers

We use the following external service providers to process payments:

Stripe

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.

PayPal

PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

If you choose one of these payment methods, the data required for the transaction is transmitted to the respective provider. This includes:

• First and last name
• Address
• Email address
• IP address
• Phone number (if provided)
• Bank or credit card details
• Order information

The data is transmitted for payment processing and fraud prevention. The payment service providers may share this data with affiliated companies and credit agencies.

Legal bases: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (fraud prevention).

Transfers to third countries: Data may be transferred to the USA or other third countries on the basis of the EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR.

For more information, please refer to the privacy policies of Stripe and PayPal on their official websites.

14. Analytics and Tracking Services

14.1 Google Tag Manager

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used to centrally manage analytics and marketing tags on our website. It does not create user profiles and does not set cookies, but it does record your IP address, which is transmitted to Google servers.

Legal basis: Art. 6(1)(f) GDPR; where your consent is required: Art. 6(1)(a) GDPR.

Transfers to third countries: on the basis of the EU Standard Contractual Clauses.

14.2 Google Analytics 4 (GA4)

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

We use Google Analytics 4 to analyze user behavior on our website. The tool uses cookies and similar technologies to record the following information:

• Origin of visitors, page views and time spent on the site
• Device and browser information
• Demographic characteristics (based on separate consent)

IP anonymization: enabled – IP addresses from the EU/EEA are truncated before being transferred to the USA.

Data processing agreement: concluded with Google.

Retention: user-level data is deleted or anonymized after 14 months.

Objection: browser add-on at tools.google.com/dlpage/gaoptout

Legal basis: Art. 6(1)(a) GDPR (consent via the cookie consent banner).

Transfers to third countries: on the basis of the EU Standard Contractual Clauses.

14.3 Microsoft Clarity

Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

We use Microsoft Clarity to understand how visitors use our website. The tool records behavioral metrics, heatmaps and session recordings (session replays). For this purpose, cookies as well as first- and third-party tracking technologies are used.

Legal basis: Art. 6(1)(a) GDPR (consent via the cookie consent banner).

Transfers to third countries: on the basis of the EU Standard Contractual Clauses.

15. Advertising Services

15.1 Google Ads and Conversion Tracking

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

If you click on one of our Google ads, a conversion cookie is stored on your device. This cookie is not used for personal identification; it serves solely to record anonymously whether a specific action took place on our website after an ad was clicked. Conversion cookies expire after 30 days.

Objection: you can deactivate the conversion cookie in your browser settings.

Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in optimizing advertising).

Transfers to third countries: on the basis of the EU Standard Contractual Clauses.

15.2 Meta Pixel (Facebook/Instagram)

Provider (for EU users): Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

To optimize our advertising, we use the Meta Pixel. It is activated when you visit our website and may store a cookie on your device. It enables us to:

• measure the effectiveness of our ads on Meta platforms (Facebook, Instagram)
• show ads specifically to people who have already shown interest in our offering
• use the “Advanced Matching” and “Custom Audiences” features

The data collected for us is anonymous (no direct identification of individuals is possible), but it is used by Meta to analyze and improve advertising efficiency.

Objection: adjust the settings for usage-based advertising in your Meta profile or opt out via the Network Advertising Initiative (NAI).

Legal basis: Art. 6(1)(a) GDPR (consent via the cookie consent banner).

Transfers to third countries: on the basis of the EU Standard Contractual Clauses.

15.3 Personalized Advertising

To present relevant offers to you, we may use certain user data (e.g. interests, behavior on our website) for personalized ads. Your data is processed exclusively by Favori Art and is not shared with third parties for purposes other than those stated.

Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest), provided your interests or fundamental rights do not override it.

16. Google API Services

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

We use Google API services to provide certain features on our website (e.g. calendar integration). Their use complies with the Google API Services User Data Policy, including the Limited Use requirements.

Personal data (e.g. email addresses, calendar information) may be processed as part of these services.

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR.

Transfers to third countries: on the basis of the EU Standard Contractual Clauses.

17. YouTube (Privacy-Enhanced Mode)

Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

Our website embeds YouTube videos. We use the privacy-enhanced mode, so a connection to YouTube servers is only established when you actively start a video. In that case, YouTube records information about the pages visited, your IP address and device information via cookies.

If you are logged into your Google account, Google may associate this data with your profile. To prevent this, please log out of your Google account before visiting our website.

Please note: even in privacy-enhanced mode, Google may establish connections and collect data via its advertising network.

Legal basis: Art. 6(1)(f) GDPR and Art. 6(1)(a) GDPR (where consent has been obtained via the cookie consent banner).

Transfers to third countries: on the basis of the EU Standard Contractual Clauses.

18. Use of Collected Information

We use the personal data we collect to improve our services. This includes:

• operating and further developing our products and services efficiently
• providing requested services and processing transactions
• sending technical notices, updates, security alerts and support information
• responding to inquiries and providing customer support
• analyzing trends and usage behavior to improve our offering
• securing our systems and preventing fraud
• sending promotional materials (only with your consent)
• personalizing our content and services

19. Disclosure of Data to Third Parties

We do not sell your personal data. Data is disclosed only in the following cases:

• Processors: carefully selected service providers for payment processing, IT infrastructure, CRM and email delivery, with whom data processing agreements pursuant to Art. 28 GDPR have been concluded.
• Legal obligations: where we are legally required to transmit data to authorities.
• Business transfers: in the event of a merger or acquisition, in which case your data will always be handled in accordance with applicable data protection standards.

20. Third-Party Websites

Our website contains links to external websites. We have no influence over their data protection practices and accept no responsibility for them. Please refer directly to the respective providers for their privacy policies.

21. Data Storage and Data Security

To protect your personal data, we use technical and organizational measures (TOMs) in accordance with Art. 32 GDPR:

• Encryption of data transmission (SSL/TLS)
• Encrypted data storage
• Restricted access to personal data
• Regular security reviews and updates
• Rapid response to anomalies and proactive measures against threats

Our security measures are continuously adapted to the current state of the art.

22. Data Deletion and Retention

Your personal data will be deleted or blocked as soon as the purpose of storage no longer applies, unless statutory retention obligations require longer storage:

• Retention under commercial law: 6 years (Section 257 HGB)
• Retention under tax law: 10 years (Section 147 AO)

23. Your Rights as a Data Subject

Under the GDPR, you have the following rights. To exercise them, please contact: info@favori-art.com

• Right of access – Art. 15 GDPR
• Right to rectification – Art. 16 GDPR
• Right to erasure (“right to be forgotten”) – Art. 17 GDPR
• Right to restriction of processing – Art. 18 GDPR
• Right to data portability – Art. 20 GDPR
• Right to object (in particular to direct marketing) – Art. 21 GDPR
• Right to withdraw consent – Art. 7(3) GDPR

24. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR (Art. 77 GDPR).

The supervisory authority responsible for Favori Art is:

Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI)
Friedrichstr. 219 | 10969 Berlin, Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de

25. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to reflect changes in the law, regulatory requirements or changes to our services. The current version is always available on our website. We recommend that you review this page regularly. Where required by law, we will inform you separately of any material changes.

Last updated: May 2025