1) Introduction and Contact Details of the Data Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when using our website. Personal data includes all data that can identify you personally.

1.2 The data controller responsible for processing data on this website, in accordance with the General Data Protection Regulation (GDPR), is Cobrasa GmbH, Drachmenweg 15, 50859 Cologne, Germany, Tel.: +49 (0) 64 3321233, Email: info@goatward.com. The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

2) Data Collection During the Visit to Our Website

2.1 When you use our website merely for informational purposes, that is, if you do not register or provide us with information in any other way, we only collect data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data that is technically necessary for us to display the website to you:

• Our visited website
• Date and time of access
• Amount of data sent in bytes
• Source/referral from which you accessed the page
• Used browser
• Used operating system
• Used IP address (possibly anonymized)

The processing is carried out in accordance with Art. 6 (1) (f) GDPR based on our legitimate interest in improving the stability and functionality of our website. There is no disclosure or other use of the data. However, we reserve the right to review server log files retrospectively if there are concrete indications of illegal use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the data controller). You can recognize an encrypted connection by the "https://" and the padlock symbol in your browser's address bar.

3) Cookies

To make visiting our website attractive and to enable the use of certain features, we use cookies, which are small text files stored on your device. Some cookies are automatically deleted after closing the browser (so-called "session cookies"), while others remain on your device longer and allow the storage of page settings (so-called "persistent cookies"). In the latter case, you can find out the storage duration from your browser's cookie settings overview.

If individual cookies used by us also process personal data, the processing is carried out in accordance with Art. 6 (1) (b) GDPR for the performance of the contract, in accordance with Art. 6 (1) (a) GDPR if consent has been given, or in accordance with Art. 6 (1) (f) GDPR to safeguard our legitimate interests in the optimal functionality of the website and a user-friendly and effective design of the site visit.

You can configure your browser to notify you when cookies are set and decide individually whether to accept them or exclude the acceptance of cookies in certain cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

4) Contacting Us

When contacting us (e.g., via contact form or email), personal data is processed exclusively for the purpose of processing and responding to your request and only to the extent necessary.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) (f) GDPR. If your contact aims at a contract, then an additional legal basis for processing is Art. 6 (1) (b) GDPR. Your data will be deleted when it is clear from the circumstances that the matter in question has been conclusively resolved and no legal retention periods conflict with this.

5) Data Processing When Opening a Customer Account

In accordance with Art. 6 (1) (b) GDPR, personal data is collected and processed to the extent necessary when you provide this information during the opening of a customer account. The data required for account creation can be found in the input mask of the respective form on our website.

Deleting your customer account is possible at any time and can be done by sending a message to the address mentioned above. After deleting your customer account, your data will be deleted provided that all contracts concluded through it have been fully settled, no legal retention periods conflict, and we have no legitimate interest in further storage.

6) Data Processing for Order Processing

6.1 To the extent necessary for contract processing for delivery and payment purposes, the personal data collected by us will be forwarded in accordance with Art. 6 (1) (b) GDPR to the commissioned transport company and the commissioned financial institution.

If we owe you updates for goods with digital elements or digital products based on a corresponding contract, we process the contact data provided during your order (name, address, email address) to inform you about upcoming updates within the legally prescribed period through a suitable communication method (e.g., by mail or email) in accordance with our legal obligations under Art. 6 (1) (c) GDPR. Your contact details will be used exclusively for notifications about updates we owe and will only be processed to the extent necessary for this purpose.

For order processing, we also work with the following service provider(s) who assist us in performing concluded contracts wholly or partially. Certain personal data is transmitted to these service providers as specified below.

6.2 Use of Payment Service Providers

• PayPal

This website offers one or more online payment methods from the following provider: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method from the provider where you make advance payments, your payment data provided during the ordering process (including name, address, bank and credit card information, currency, and transaction number) as well as information about the content of your order will be transmitted to the provider in accordance with Art. 6 (1) (b) GDPR. The transmission of your data occurs solely for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method where we make advance payments, you will also be asked to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, phone number, if applicable, data on an alternative payment method) during the ordering process.

To safeguard our legitimate interest in assessing your creditworthiness, these data will be forwarded to the provider in accordance with Art. 6 (1) (f) GDPR for the purpose of credit assessment. The provider checks based on the personal data you have provided as well as additional data (such as shopping cart, invoice amount, order history, payment experiences) whether the payment option selected by you can be granted in terms of payment and/or default risk.

The credit report may contain probability values (so-called score values). If score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if necessary for contractually compliant payment processing.

7) Web Analysis Services

7.1 Google Analytics 4

This website uses Google Analytics 4, a web analysis service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which allows the analysis of your use of our website.

By default, when visiting the website, Google Analytics 4 sets cookies, which are small text elements stored on your device that collect certain information. This information includes your IP address, which Google shortens to exclude direct personal reference.

The information is transmitted to Google's servers and processed there. Transfers to Google LLC, based in the USA, are also possible.

Google uses the information collected on our behalf to evaluate your use of the website, compile reports on website activities for us, and provide additional services related to website and internet use. The shortened IP address transmitted by your browser within the framework of Google Analytics is not combined with other Google data. The data collected through the use of Google Analytics 4 is stored for a period of two months and then deleted.

All the above-described processing, including setting cookies on the used device, only occurs if you have given us your explicit consent in accordance with Art. 6 (1) (a) GDPR. Without your consent, the use of Google Analytics 4 during your site visit does not take place. You can revoke your consent at any time with future effect. To exercise your right of withdrawal, please deactivate this service through the "Cookie-Consent-Tool" provided on the website.

We have entered into a data processing agreement with Google that ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://policies.google.com/privacy?hl=en&gl=en and https://policies.google.com/technologies/partner-sites

Demographic Features Google Analytics 4 uses the special feature "demographic features" to create statistics about the age, gender, and interests of site visitors. This is done by analyzing advertisements and third-party information. This allows for the identification of target groups for marketing activities. However, the collected data cannot be assigned to a specific person and will be deleted after storage for a period of two months.

Google Signals As an extension to Google Analytics 4, this website may use Google Signals to create cross-device reports. If you have activated personalized ads and linked your devices to your Google account, data can be combined. This allows reports to be generated about user behavior across multiple devices. This data is aggregated and not combined with your personal data.

8) Social Media

8.1 Social Media Plug-ins

We use social media plug-ins from various providers to make our website more interactive. This is done based on our legitimate interest in improving our marketing efforts and communication with customers in accordance with Art. 6 (1) (f) GDPR. This website uses the plug-ins of the following social networks:

• Facebook

  • The plug-ins of the social network Facebook, operated by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, are integrated into our website. The plug-ins can be recognized by the Facebook logo or the "Like" button. For more information on how Facebook collects and uses your data, please refer to Facebook's privacy policy: https://www.facebook.com/policy.php
  • If you interact with the plug-ins, e.g., by clicking on the "Like" button or leaving a comment, the corresponding information will be transmitted to Facebook and stored there. Even if you do not have a Facebook account, your IP address may be transmitted to Facebook. We have no control over the data collected and processed by Facebook.

• X (formerly Twitter)

  • Social media plug-ins of the platform X, operated by X Corp, 1355 Market St, Suite 900, San Francisco, CA 94103, USA, are integrated into our website. The plug-ins can be recognized by the X logo. For more information on how X collects and uses your data, please refer to X's privacy policy: https://x.com/about/privacy

• LinkedIn

  • Plug-ins of the social network LinkedIn, operated by LinkedIn Ireland Unlimited Company, Wilton Park House, Wilton Park, Dublin 2, Ireland, are integrated into our website. The plug-ins can be recognized by the LinkedIn logo. For more information on how LinkedIn collects and uses your data, please refer to LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy

8.2 Integration of YouTube Videos

We use YouTube in enhanced privacy mode to embed videos on our website. The videos are stored on YouTube and can be played directly from our website. By visiting the website, YouTube may receive information about your visit. In this case, the data processing is based on Art. 6 (1) (f) GDPR. We use this service to offer you a wider range of multimedia content.

For more information on how YouTube collects and uses your data, please refer to YouTube's privacy policy: https://policies.google.com/privacy?hl=en

9) Your Rights

9.1 You have the following rights regarding your personal data:

• Right to Access: You can request confirmation from us whether we are processing personal data concerning you. If this is the case, you can request access to the personal data and further information about the processing.
• Right to Rectification: If personal data concerning you is incorrect or incomplete, you can request rectification or completion.
• Right to Erasure: You can request the deletion of your personal data if the requirements of Art. 17 GDPR are met. This is particularly the case if the data is no longer necessary for the purposes for which it was collected or processed, or if you withdraw your consent on which the processing is based.
• Right to Restriction of Processing: You have the right to request the restriction of processing if one of the conditions of Art. 18 GDPR is met.
• Right to Data Portability: You can receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and request the transmission of this data to another controller, if technically feasible.
• Right to Object: You can object to the processing of your personal data at any time based on Art. 6 (1) (e) or (f) GDPR.

9.2 You also have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates data protection regulations. The supervisory authority responsible for us is:

• Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
  • Postfach 200444
  • 40102 Düsseldorf, Germany
  • Tel.: +49 (0) 2 11 / 38 24 4 - 0
  • Fax: +49 (0) 2 11 / 38 24 4 - 10
  • Email: poststelle@ldi.nrw.de

10) Data Security

10.1 We use appropriate technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction, or against access by unauthorized persons.

10.2 We continuously improve our security measures in line with technological developments.

11) Changes to This Privacy Policy

11.1 We reserve the right to update this privacy policy to ensure it meets current legal requirements or to reflect changes to our services.

11.2 The latest version of this privacy policy is available on our website.