+49-631-75004661 Mon. - Fri. 12 pm - 8 pm

  Free shipping possible

  Many items discounted

  14 days return policy

Privacy Policy

Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Bomto UG (limited liability)
Lämmchesbergstr. 16
67663 Kaiserslautern
Germany
Telephone: +49-(0)631-75004661
E-Mail: info@bomto.de

2. Subject Matter and Scope

This Privacy Policy provides information about the nature, scope, and purpose of the processing of personal data within the framework of our online offering, our business relationships, and our external online presences (e.g., social media).

We process personal data exclusively in accordance with the applicable legal provisions, in particular the GDPR, the German Federal Data Protection Act (BDSG), and other applicable data protection regulations.

3. Definitions

The definitions set out in the GDPR, in particular Article 4 GDPR, shall apply.

4. Legal Bases for Processing

We process personal data on the basis of the following legal grounds:

  • Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures)

  • Art. 6(1)(c) GDPR (legal obligation)

  • Art. 6(1)(f) GDPR (legitimate interests, in particular commercial business operations, IT security, prevention of misuse and fraud, and enforcement of legal claims)

  • Art. 6(1)(a) GDPR (consent)

5. Categories of Personal Data

We process in particular the following categories of personal data:

  • Master data (e.g., name, address)

  • Contact data (e.g., email address, telephone number)

  • Contract and order data

  • Payment data

  • Communication data

  • Usage data (e.g., IP address, log files)

  • Metadata and protocol data

6. Purposes of Processing

Personal data is processed in particular for the following purposes:

  • Initiation, conclusion, execution, and processing of purchase contracts

  • Delivery of goods, including the use of external suppliers and shipping partners

  • Payment processing

  • Customer communication and support

  • Handling of returns, complaints, and warranty claims

  • Fulfillment of legal obligations

  • Operation, security, and optimization of our website

  • Enforcement or defense of legal claims

7. Disclosure of Personal Data to Third Parties

We transfer personal data to third parties insofar as this is necessary for the performance of a contract, for the operation of our business, or for the fulfillment of legal obligations.

This includes, in particular, suppliers, manufacturers, independent online retailers, fulfillment service providers, and other external sales or shipping platforms through which we procure goods for contract performance or arrange direct shipment to our customers (e.g., within the framework of dropshipping models).

Recipients may include in particular:

  • Shipping service providers (e.g., DHL, Hermes, DPD, UPS)

  • Suppliers, manufacturers, and wholesalers

  • Dropshipping partners

  • Marketplace operators and marketplace sellers (e.g., Amazon, eBay, and their respective contractual partners)

  • Independent online retailers

  • Payment service providers and financial institutions (e.g., PayPal, Ratepay, Amazon Pay, banks)

  • IT, hosting, and cloud service providers

  • Service providers for customer support, returns processing, and logistics

  • Tax advisors, auditors, and legal advisors

The transfer takes place exclusively to the extent necessary and on the basis of the GDPR, in particular pursuant to Art. 6(1)(b) GDPR.

8. Dropshipping, External Suppliers, and Marketplace Fulfillment

For the fulfillment of purchase contracts, we may use external suppliers, dropshipping partners, or marketplace sellers who ship goods directly to customers on our behalf or within the framework of a logistical cooperation.

For this purpose, the personal data required for delivery (in particular name, delivery address, and, where applicable, telephone number) will be transmitted to these partners.

The transfer is carried out exclusively for the performance of the contract pursuant to Art. 6(1)(b) GDPR. Without the provision of this data, delivery of the goods is not possible.

9. Independent Responsibility of External Providers

Where external providers (e.g., marketplace operators, payment service providers, or shipping service providers) process personal data under their own responsibility, their respective privacy policies shall apply. We are not responsible for their data processing activities.

10. Ordering Process and Customer Account

Within the ordering process, we collect personal data necessary for the performance of the contract. Customers may optionally create a customer account in order to facilitate future orders.

11. Payment Processing

For the processing of payments, we transmit payment data to the respective payment service providers used. The privacy policies of the respective providers shall additionally apply.

12. Communication and Customer Service

If you contact us by email, telephone, contact form, or other means of communication, we process the transmitted data for the purpose of handling the inquiry and carrying out pre-contractual measures.

13. Storage Period

We store personal data only for as long as necessary to fulfill the respective purposes or as required by statutory retention periods.

  • Contract and invoice data are stored for up to 10 years in accordance with commercial and tax law requirements.

  • Communication data will be deleted once the purpose of processing no longer applies, provided that no statutory retention obligations exist.

14. Rights of Data Subjects

Data subjects have the following rights:

  • Right of access (Art. 15 GDPR)

  • Right to rectification (Art. 16 GDPR)

  • Right to erasure (Art. 17 GDPR)

  • Right to restriction of processing (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)

  • Right to object (Art. 21 GDPR)

  • Right to withdraw consent at any time (Art. 7(3) GDPR)

To exercise these rights, data subjects may contact us at any time.

15. Right to Lodge a Complaint with a Supervisory Authority

Data subjects have the right to lodge a complaint with a data protection supervisory authority. The competent authority is in particular the supervisory authority at the registered office of our company or at the place of residence of the data subject.

16. Server Log Files

When visiting our website, information is automatically collected in so-called server log files, which your browser automatically transmits. This includes in particular:

  • IP address

  • Date and time of the request

  • Browser type and browser version

  • Operating system

  • Referrer URL

Processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest in the technical security and stability of our website).

17. Cookies and Consent Management

Our website uses cookies and similar technologies. Technically necessary cookies are used on the basis of Art. 6(1)(f) GDPR. Non-essential cookies are processed on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

18. Analysis and Tracking Tools

If analysis or tracking tools are used, this will only take place on the basis of your consent or a legitimate interest pursuant to Art. 6(1) GDPR.

19. Newsletter and Direct Marketing

If you subscribe to our newsletter, we process your email address for the purpose of sending the newsletter. Registration takes place using the double opt-in procedure. Consent may be withdrawn at any time.

20. Social Media and External Content

Our website may contain content and plugins from external providers. When accessing such content, data may be transmitted to the respective providers. The privacy policies of the respective providers shall apply.

21. Data Security

We implement appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, or unauthorized disclosure.

22. Obligation to Provide Personal Data

The provision of personal data is required for the conclusion and performance of a purchase contract. Without this data, contract performance is not possible.

23. No Automated Decision-Making

Automated decision-making, including profiling, does not take place.

24. Limitation of Liability

Where we use external service providers or partners in the performance of a contract, data processing may be carried out partly under their own responsibility. The respective providers’ privacy policies shall apply to their data processing activities.

25. Amendments to This Privacy Policy

We reserve the right to amend this Privacy Policy in order to adapt it to changes in legal requirements, technical developments, or changes in our business model.

This Privacy Policy is reviewed regularly and updated when necessary.

Viewed