Privacy policy

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about how we handle your personal data when you use our website. Personal data is any data that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is ELBKONSTRUKT GmbH, Malzweg 26, 20535 Hamburg, Germany, Tel.: +49 40 8450 9735, Email: info@elbkonstrukt.de. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

1.3 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller). You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser’s address bar.

2) Data Collection When Visiting Our Website

If you use our website for informational purposes only, i.e., without registering or otherwise providing us with information, we only collect data that your browser transmits to our server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

  • Visited website
  • Date and time of access
  • Amount of data sent in bytes
  • Source/referring page
  • Browser used
  • Operating system used
  • IP address used (if applicable, in anonymized form)

Processing is carried out in accordance with Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are specific indications of unlawful use.

3) Hosting & Content Delivery Network

Hosting by Shopify
We use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”) for the purpose of hosting and displaying the online shop on the basis of processing on our behalf. All data collected on our website is processed on Shopify’s servers. As part of the services provided by Shopify, data may also be transferred to other Shopify entities including Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc., or Shopify (USA) Inc. For data transfers to Shopify Inc. in Canada, an adequate level of data protection is ensured by a European Commission adequacy decision. Further information on Shopify’s data protection can be found at: https://www.shopify.de/legal/datenschutz
Any further processing on servers other than those mentioned above by Shopify only takes place within the scope specified below.

4) Cookies

To make your visit to our website more attractive and to enable the use of certain functions, we use cookies – small text files that are stored on your device. Some cookies are deleted automatically after you close your browser (so-called “session cookies”), while others remain on your device longer and allow us to save your settings (“persistent cookies”). You can find the storage duration in your browser’s cookie settings.
If personal data is also processed by individual cookies implemented by us, the processing is carried out either in accordance with Art. 6(1)(b) GDPR for contract performance, in accordance with Art. 6(1)(a) GDPR if consent has been given, or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interest in the best possible functionality of the website and a customer-friendly and effective website experience.
You can set your browser to notify you when cookies are set and to individually decide whether to accept them or to exclude the acceptance of cookies for specific cases or in general.
Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contacting Us

5.1 Review Reminder via Loox
If you have given us your express consent in accordance with Art. 6(1)(a) GDPR during or after your order, we will transmit your email address and possibly other customer data collected earlier to the review tool Loox, a service provided by Loox Online Ltd., Rehov Har Sinai 2, 6581602 Tel Aviv-Yafo, Israel (“Loox”), so that it can send you a review reminder via email. You may revoke your consent at any time by contacting the controller or the review platform.
For data transfers to Loox in Israel, an adequate level of data protection is ensured by an adequacy decision of the European Commission.
We have entered into a data processing agreement with Loox obligating Loox to protect our customers’ data and not to share it with third parties. You can view the agreement here: https://loox.io/legal/data_processing_addendum.pdf
More information about Loox’s privacy practices is available at: https://loox.io/legal/privacy_policy_merchants.pdf

5.2 When contacting us (e.g., via contact form or email), personal data is collected and processed solely for the purpose of responding to your inquiry and only to the extent necessary. The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6(1)(f) GDPR. If your inquiry relates to a contract, then the additional legal basis is Art. 6(1)(b) GDPR. Your data will be deleted once it is evident that the matter has been conclusively resolved, provided there are no statutory retention obligations.

5.3 WhatsApp Business

We offer visitors to our website the opportunity to contact us via WhatsApp, a messaging service of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We use the so-called “Business Version” of WhatsApp for this purpose.

If you contact us via WhatsApp regarding a specific transaction (e.g., an order you placed), we will store and use the phone number you used with WhatsApp and – if provided – your first and last name in accordance with Art. 6(1)(b) GDPR to process and respond to your inquiry. Based on the same legal basis, we may also ask you for further data (such as order number, customer number, address, or email) in order to assign your request to a specific transaction.

If you use our WhatsApp contact for general inquiries (e.g., about our services, availability, or website), we store and use the WhatsApp number and – if provided – your name in accordance with Art. 6(1)(f) GDPR, based on our legitimate interest in providing the requested information promptly and efficiently.

Your data is used exclusively to respond to your inquiry via WhatsApp and will not be passed on to third parties.

Please note that WhatsApp Business gains access to the address book of the mobile device we use for WhatsApp and automatically transfers phone numbers stored there to a server of the parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account, we use a device where only those contacts are stored who have also contacted us via WhatsApp.

This ensures that each person whose WhatsApp contact data is stored in our address book has already consented to the transmission of their WhatsApp phone number by accepting WhatsApp’s terms of use on their own device pursuant to Art. 6(1)(a) GDPR. Data of persons who do not use WhatsApp or have not contacted us via WhatsApp is not affected.

For information on the purpose, scope, and further processing of your data by WhatsApp as well as your rights and privacy settings, please refer to WhatsApp’s privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy

6) Data Processing When Opening a Customer Account

In accordance with Art. 6(1)(b) GDPR, personal data is collected and processed to the extent necessary when you open a customer account. The data required for account creation is specified in the input form on our website. You may delete your account at any time by sending a request to the controller’s address above. Your data will be deleted once all associated contracts are fully executed, no legal retention obligations apply, and we have no further legitimate interest in retaining the data.

7) Use of Customer Data for Direct Advertising

7.1 Newsletter Subscription

If you subscribe to our newsletter, we will send you regular information about our offers. The only mandatory information required is your email address. Any additional data is voluntary and is used to personalize the communication. We use the so-called double opt-in procedure to ensure that you only receive newsletters after confirming your subscription via a link sent to your email address.

By activating the confirmation link, you consent to the use of your personal data in accordance with Art. 6(1)(a) GDPR. We store your IP address and the date and time of registration to verify and prevent possible misuse of your email address. The data collected is used exclusively for sending the newsletter and is not passed on to third parties. You can unsubscribe at any time via the link in the newsletter or by contacting the controller. After you unsubscribe, your email address will be deleted unless you have expressly consented to further use or we are legally permitted to retain it.

7.2 Newsletter for Existing Customers

If you have provided your email address when purchasing goods or services, we may send you regular offers for similar goods or services from our range. According to § 7(3) UWG, no separate consent is required for this. Data processing is based solely on our legitimate interest in personalized direct marketing pursuant to Art. 6(1)(f) GDPR. If you initially objected to this use, we will not send such emails. You may object at any time by contacting us. After receiving your objection, we will stop using your email address for marketing purposes immediately.

7.3 Postal Advertising
Based on our legitimate interest in personalized advertising, we reserve the right to store and use your name, postal address, and, if provided, your title, academic degree, year of birth, and occupation/industry for sending promotional offers by post in accordance with Art. 6(1)(f) GDPR. You can object to this use at any time by contacting us.

7.4 Cart Abandonment Emails
If you begin but do not complete a purchase, we may send you a one-time email reminder about the contents of your shopping cart. The only required information is your email address. Additional information is optional and used for personalization. This also uses the double opt-in procedure to ensure you have explicitly consented. The data will be deleted immediately after unsubscribing unless we are legally allowed or required to retain it.

8) Data Processing for Order Fulfillment

8.1 If necessary for order fulfillment, we share your personal data (e.g., name, delivery address, payment information) with the responsible shipping and payment service providers in accordance with Art. 6(1)(b) GDPR.

If we are contractually obligated to provide updates for digital content or products with digital elements, we use the contact details provided during your order to notify you via suitable means (e.g., by post or email) about these updates within the legally prescribed period. Your contact data will only be processed for this purpose to the extent necessary.

8.2 Disclosure of Personal Data to Shipping Providers

- Deutsche Post
If delivery is handled by Deutsche Post (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn), we will share your email address with Deutsche Post prior to delivery in accordance with Art. 6 (1) lit. a GDPR, for the purpose of scheduling a delivery date or providing delivery notifications—provided that you have given your express consent during the ordering process. Otherwise, for delivery purposes, we only transmit the recipient's name and delivery address to Deutsche Post, pursuant to Art. 6 (1) lit. b GDPR. The data is only shared as far as necessary for delivering the goods. In this case, scheduling or delivery notifications will not be possible.
You may revoke your consent at any time with future effect by notifying the controller or Deutsche Post.
- DHL
If delivery is handled by the shipping service provider DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn), we will share your email address with DHL prior to delivery in accordance with Art. 6 (1) lit. a GDPR, for the purpose of scheduling a delivery date or providing delivery notifications—provided that you have given your express consent during the ordering process. Otherwise, for delivery purposes, we only transmit the recipient's name and delivery address to DHL, pursuant to Art. 6 (1) lit. b GDPR. The data is only shared as far as necessary for delivering the goods. In this case, scheduling or delivery notifications will not be possible.
You may revoke your consent at any time with future effect by notifying the controller or the shipping provider DHL.

8.3 Use of Payment Service Providers

- Amazon Pay
When selecting the "Amazon Pay" payment method, payment processing is handled by Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg ("Amazon Payments"), to whom we transmit the information provided during the order process along with order details pursuant to Art. 6 (1) lit. b GDPR. The data is shared solely for payment processing and only to the extent necessary. If Amazon Pay uses cookies (small text files stored on your device), this is based exclusively on your express consent under Art. 6 (1) lit. a GDPR. You can revoke this consent at any time via the cookie consent tool on our website. For more information on Amazon Payments’ data protection, visit: https://pay.amazon.de/help/82974
- Apple Pay
If you choose to pay using Apple Pay (Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland), payment is processed through Apple Pay on your iOS, watchOS, or macOS device via a card stored in Apple Pay. Security features integrated into your device's hardware and software protect the transaction. Payment requires entry of a previously defined code and authentication via Face ID or Touch ID.
For processing the payment, your order information is encrypted and sent to Apple, which re-encrypts it and forwards it to the card’s payment processor. Apple then confirms the payment by sending your device account number and a transaction-specific security code to the originating site.
Data processing is conducted solely for payment purposes under Art. 6 (1) lit. b GDPR.
Apple stores anonymized transaction data (approximate purchase amount, date/time, success status). No personally identifiable data is retained. These anonymized data help improve Apple Pay and other Apple services.
When using Apple Pay on Safari from your Mac, encrypted communication with your iPhone or Apple Watch occurs via Apple servers. Apple does not store this data in personally identifiable form.
You can disable Apple Pay usage on your Mac via the iPhone settings under "Wallet & Apple Pay".
Further details on Apple Pay privacy: https://support.apple.com/de-de/HT203027
- Google Pay
If you select “Google Pay” (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland), payment is processed via the Google Pay app on your Android device (Android 4.4 or later) using NFC. Authentication (e.g. fingerprint, face scan) may be required.
Your order information is sent to Google, which forwards a one-time transaction number to the originating site. No real card data is transmitted. Google acts solely as a payment facilitator. Processing is done exclusively for payment purposes under Art. 6 (1) lit. b GDPR.
Google may collect and analyze certain transaction-related data (e.g. amount, date, merchant info, payment method) under Art. 6 (1) lit. f GDPR to ensure proper accounting and service performance.
Google may combine these data with other services. Google Pay terms and privacy: Terms, Privacy
- Klarna
When using Klarna (Klarna Bank AB, Sveavägen 46, 111 34 Stockholm), personal data (name, address, gender, email, phone, IP, order details) may be transmitted to Klarna for identity and credit checks under Art. 6 (1) lit. a GDPR. Credit score data may include address-based scoring. You can revoke consent anytime.
Klarna’s data protection: Germany, Austria
- PayPal
When paying via PayPal, credit card via PayPal, direct debit, or invoice/installments via PayPal, we share payment data with PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Processing is based on Art. 6 (1) lit. b GDPR.
For some methods, PayPal may conduct credit checks under Art. 6 (1) lit. f GDPR. PayPal’s privacy policy and partner info: PayPal Privacy
- PayPal Checkout
This website uses PayPal Checkout, combining PayPal and local third-party payment methods. Payment data may be shared with PayPal and then forwarded to Ratepay GmbH (for "invoice purchase") or local providers like Sofort, iDeal, giropay, etc. Processing is based on Art. 6 (1) lit. b GDPR.
Local providers include:
- Sofort (SOFORT GmbH, Germany)
- iDeal (Currence Holding BV, Netherlands)
- giropay (Paydirekt GmbH, Germany)
- bancontact (Belgium), blik (Poland), eps (Austria), MyBank (France), Przelewy24 (Poland)
PayPal privacy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
- Shopify Payments
For Shopify Payments, payment processing is handled by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. We transmit your data (name, address, account number, bank code, card info, amount, transaction ID) solely for payment processing under Art. 6 (1) lit. b GDPR.
Shopify Payments privacy: Shopify
Stripe privacy: Stripe
- SOFORT
When selecting "SOFORT", payment is handled by SOFORT GmbH, Theresienhöhe 12, 80339 Munich, part of the Klarna Group. Data is shared solely for payment purposes under Art. 6 (1) lit. b GDPR. More info: SOFORT Privacy

9) Online Marketing

9.1 Facebook Pixel for Creating Custom Audiences with Enhanced Data Matching (with Cookie Consent Tool)
Within our online offering, the so-called "Facebook Pixel" from the social network Facebook is used in enhanced data matching mode, operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook").
Based on the user's explicit consent, if a user clicks on an advertisement we run on Facebook, the URL of our linked page will include an additional parameter added by the Facebook Pixel. This URL parameter is then written into the user's browser via a cookie set by our linked site. This cookie captures specific customer data, such as the email address, collected on our linked site during transactions like purchases, account signups, or registrations (enhanced data matching). The Facebook Pixel then reads the cookie and enables the forwarding of the data, including specific customer data, to Facebook.
The use of the Facebook Pixel with enhanced data matching allows Facebook to identify visitors to our website as a target group for displaying ads ("Facebook Ads"). Accordingly, we use the Pixel to show Facebook Ads only to Facebook users who have shown an interest in our website or who have certain characteristics (e.g., interests in particular topics or products) that we communicate to Facebook ("Custom Audiences"). We also want to ensure our Facebook Ads match the potential interests of users and are not intrusive. Furthermore, we use the Pixel to track the effectiveness of Facebook Ads for statistical and market research purposes by determining whether users were redirected to our site after clicking a Facebook Ad ("Conversion"). Compared to the standard Facebook Pixel, the enhanced data matching helps us better measure the effectiveness of our campaigns by capturing more attributed conversions.
All data transmitted to Facebook is stored and processed by Facebook and may be linked to the user’s profile and used for Facebook’s own advertising purposes in accordance with Facebook’s data usage policy (https://www.facebook.com/about/privacy/). This data may allow Facebook and its partners to display ads both on and off Facebook.
These processing operations are only carried out if you have given your explicit consent in accordance with Art. 6(1)(a) GDPR. The information generated by Facebook is usually transmitted to and stored on Facebook servers, and may also be transmitted to Meta Platforms Inc. servers in the USA. You may revoke your consent at any time with future effect by disabling this service in the cookie consent tool on our website.

9.2 Google Ads Conversion Tracking
This website uses the "Google Ads" online advertising program and its conversion tracking, operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). We use Google Ads to promote our offers on third-party websites. Using the data from advertising campaigns, we can determine the success of our ads and aim to display ads that are of interest to you, make our website more relevant, and achieve a fair calculation of advertising costs.
The conversion tracking cookie is set when a user clicks on a Google Ads ad. Cookies are small text files stored on your device. These cookies typically expire after 30 days and do not identify the user. If the user visits specific pages of this site and the cookie is still valid, Google and we can recognize that the user clicked the ad and was redirected. Each Google Ads customer receives a different cookie, which means cookies cannot be tracked across Ads clients’ websites. The information collected using the cookie is used to generate conversion statistics for Ads clients who have opted for tracking. Clients see the total number of users who clicked their ad and landed on a tagged page. They do not receive personal information.
Using Google Ads may result in the transfer of personal data to Google LLC servers in the USA. For details on Google Ads data handling and processing, see: https://policies.google.com/technologies/partner-sites
All processing described above, particularly cookie usage, occurs only if you have granted explicit consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie consent tool.
To permanently opt out of Google Ads conversion cookies, you can use the browser plugin here: https://www.google.com/settings/ads/plugin?hl=de
To show personalized ads to customers whose data we’ve collected in business contexts, we use customer match. We upload files with aggregated customer data (e.g., email, phone numbers) to Google. Google encrypts the data and only uses it to match users with Google accounts. This enables personalized ads across Google services.
We only send customer data to Google if you've explicitly consented under Art. 6(1)(a) GDPR. This consent can be withdrawn at any time. More info: https://support.google.com/google-ads/answer/6334160?hl=de&ref_topic=10550182
Google’s privacy policy: https://www.google.de/policies/privacy/

10) Web Analytics Services

Google (Universal) Analytics
This website uses Google (Universal) Analytics, a web analysis service from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Analytics uses "cookies" — text files stored on your device — to analyze your website usage. The information generated by cookies about your use of the site (including truncated IP address) is typically sent to and stored on Google servers, possibly in the USA.
This website uses Google (Universal) Analytics exclusively with the "_anonymizeIp()" extension, which ensures IP address anonymization and prevents direct personal reference. Only in rare cases is the full IP address transferred to a Google LLC server in the USA and truncated there. On our behalf, Google will use this information to evaluate website use, compile reports on website activity, and provide other services related to site usage and internet usage. The IP address sent by your browser will not be merged with other Google data.
Google Analytics includes a special feature called “demographic data,” allowing us to generate reports on age, gender, and interests of users — based on interest-based advertising and third-party info. These data sets are not attributable to specific individuals.
Details: https://policies.google.com/technologies/partner-sites
All processing, especially cookie setting and data retrieval, takes place only if you’ve provided explicit consent under Art. 6(1)(a) GDPR. Without this, Google Analytics will not be used.
You may revoke consent at any time using the cookie consent tool. We’ve signed a data processing agreement with Google to ensure data protection. Data transfers to the USA are based on EU Standard Contractual Clauses.
More info: https://policies.google.com/privacy?hl=de&gl=de

11) Site Features

Google Web Fonts
This site uses web fonts provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google") for uniform font display. When visiting a page, your browser loads the required fonts into its cache to correctly display text.
To do so, your browser connects to Google servers. This may result in personal data being sent to Google LLC servers in the USA. This connection allows Google to know your IP accessed our site. This processing only occurs with your explicit consent under Art. 6(1)(a) GDPR. You may revoke this consent anytime via the cookie consent tool. If your browser doesn’t support web fonts, a standard font is used instead.
More info on Google Web Fonts: https://developers.google.com/fonts/faq
Privacy policy: https://www.google.com/policies/privacy/

12) Tools and Miscellaneous

Cookie Consent Tool
We use a "cookie consent tool" to collect legally valid user consents for cookies and cookie-based applications. This tool is shown as an interactive interface upon site access, allowing users to grant cookie permissions. All consent-required cookies/services load only if the user checks the corresponding box.
The tool uses necessary cookies to store preferences. No personal user data is processed unless, in specific cases, data like IP address is required for logging or assignment. Such processing is based on our legitimate interest in GDPR-compliant consent management (Art. 6(1)(f) GDPR) or our legal obligation (Art. 6(1)(c) GDPR).
Further information is provided directly in the tool's interface.

13) Data Subject Rights

13.1 The applicable data protection law grants you the following rights regarding your personal data processing (based on the referenced legal grounds):

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to notification (Art. 19 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to revoke consent (Art. 7(3) GDPR)
  • Right to lodge a complaint (Art. 77 GDPR)

13.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR LEGITIMATE INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO SUCH PROCESSING AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION. IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING YOUR DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR CONTINUING THE PROCESSING THAT OUTWEIGH YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR THE PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT TO SUCH PROCESSING AT ANY TIME. ONCE YOU EXERCISE THIS RIGHT, WE WILL STOP PROCESSING YOUR DATA FOR DIRECT MARKETING PURPOSES.

14) Duration of Personal Data Storage

The duration of personal data storage depends on the legal basis, purpose of processing, and statutory retention periods (e.g., tax or commercial law).

Where processing is based on consent (Art. 6(1)(a) GDPR), data is stored until consent is revoked.

If there are statutory retention periods for data processed under Art. 6(1)(b) GDPR, data will be deleted upon expiry unless further processing is needed or we have a legitimate interest.

For processing based on Art. 6(1)(f) GDPR, data will be stored until you exercise your right to object under Art. 21(1) GDPR, unless compelling grounds override or the processing is for legal claims.

Data processed for direct marketing based on Art. 6(1)(f) GDPR will be stored until objection under Art. 21(2) GDPR.

Otherwise, personal data will be deleted when it is no longer needed for its original purpose.