Privacy Policy

Privacy Policy

Unless otherwise stated below, providing your personal data is neither legally nor contractually required nor necessary for concluding a contract. You are not obliged to provide the data. Failure to provide data has no consequences. This applies only insofar as no other indication is made in the following processing operations.
"Personal data" means all information relating to an identified or identifiable natural person.

Your data may be transferred to third countries outside the EU, especially to Canada and the USA, and processed there. There is an adequacy decision by the EU Commission for Canada. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the standard contractual clauses of the EU Commission.

Contact

Controller
Contact us if you wish. The controller for data processing is: MAX CARBON GmbH, Gewerbepark Edelweiss 2, 88138 Weißensberg DE, 016095441980, info@carbon-outlet.de

Customer-initiated contact by email
If you initiate business contact with us by email, we collect your personal data (name, email address, message text) only to the extent you provide it. The data processing serves to process and respond to your contact request.
If the contact is for carrying out pre-contractual measures (e.g., consultation for purchase interest, offer creation) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time to the processing of your personal data concerning you based on Art. 6 para. 1 lit. f GDPR for reasons arising from your particular situation.
We use your email address only to process your inquiry. Your data will then be deleted in compliance with legal retention periods unless you have consented to further processing and use.

Collection and processing when using the contact form
When using the contact form, we collect your personal data (name, email address, message text) only to the extent you provide it. The data processing serves the purpose of making contact.
If the contact is for carrying out pre-contractual measures (e.g., consultation for purchase interest, offer creation) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in handling and responding to your inquiry. In this case, you have the right to object at any time to this processing of personal data concerning you based on Art. 6 para. 1 lit. f GDPR for reasons arising from your particular situation.
We use your email address only to process your inquiry. Your data will then be deleted in compliance with legal retention periods unless you have consented to further processing and use.

WhatsApp Business
If you contact us for business purposes via WhatsApp, we use the WhatsApp Business version of WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; “WhatsApp”). If you are located outside the European Economic Area, this service is provided by WhatsApp Inc. (1601 Willow Road, Menlo Park, CA 94025, USA). 
The data processing serves to handle and respond to your contact request. For this purpose, we collect and process your mobile phone number stored with WhatsApp, your name if provided, and other data to the extent you have made available. We use a mobile device for the service, in whose address book only data from users who have contacted us via WhatsApp are stored. No personal data is passed on to WhatsApp without your prior consent given to WhatsApp.
Your data is transmitted by WhatsApp to servers of Meta Platforms Inc. in the USA. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Meta Platforms Inc. has certified itself under the TADPF and thus committed to comply with European data protection principles. If the contact serves the execution of pre-contractual measures (e.g., consultation regarding purchase interest, offer preparation) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in providing quick and easy contact as well as responding to your inquiry. In this case, you have the right to object at any time to this processing of personal data concerning you based on Art. 6 para. 1 lit. f GDPR for reasons arising from your particular situation.
We use your personal data only to process your inquiry. Your data will then be deleted in compliance with legal retention periods unless you have consented to further processing and use.
More information about terms of use and privacy when using WhatsApp can be found at https://www.whatsapp.com/legal/#terms-of-service and https://www.whatsapp.com/legal/#privacy-policy.

Customer account      Orders      

Customer account
When opening a customer account, we collect your personal data to the extent specified there. Data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us without affecting the lawfulness of processing based on consent before revocation. Your customer account will then be deleted.

Your data may be transferred to third countries outside the EU, especially to Canada and the USA, and processed there. There is an adequacy decision by the EU Commission for Canada. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the standard contractual clauses of the EU Commission.

Reviews       Advertising      


Data collection when writing a comment or review
When commenting/reviewing an article or a post, we collect your personal data (name, email address, comment text) only to the extent you provide it. The processing serves the purpose of enabling commenting/reviewing and displaying comments/reviews. 

By submitting the comment/review, you consent to the processing of the transmitted data. The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out based on the consent until the revocation. Your personal data will then be deleted.

When your comment/review is published, the name you provided and the email address you shared will be published.

In addition, when submitting a comment/review, your IP address is stored for the purpose of preventing abuse of the comment or review function and ensuring the security of our information technology systems. By submitting the comment/review, you consent to the processing of the transmitted data. The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out based on the consent until the revocation. Your IP address will then be deleted.

Trustami customer review
The Trustami trust seal is integrated on this website to display collected reviews as well as social media feedback. This serves to implement our legitimate interests in optimally marketing our offer on our own website in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. When the Trustami trust seal is accessed, the web server automatically stores data (access data) in the form of a server log file, which includes the name of the accessed website, the file, the date and time of access, your IP address in shortened form, the amount of data transferred, the message about a successful access, the browser type, the user's operating system, the referrer URL (the previously visited page), and the requesting provider. This access data is not evaluated and is automatically overwritten no later than seven days after the end of your site visit. The Trustami trust seal and the services advertised with it are an offer from Trustami GmbH, Schröderstraße 5, 10115 Berlin. The data protection declaration of Trustami applies to the processing of data collected by Trustami at www.trustami.com/datenschutz.

Use of the email address to send newsletters
We use your email address exclusively for our own advertising purposes to send newsletters, regardless of contract processing, provided you have explicitly consented. The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time without affecting the legality of the processing carried out based on the consent until the revocation. You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the distribution list. 

Shipping service provider       Inventory management      

Passing on the email address to the shipping company to inform about the shipping status
We pass on your email address to the shipping company as part of contract processing, provided you have explicitly consented to this during the ordering process. The transfer serves the purpose of informing you by email about the shipping status. The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us or the shipping company without affecting the legality of the processing carried out based on the consent until the revocation.

Use of an external inventory management system
We use an inventory management system for contract processing as part of order processing. For this purpose, your personal data collected during the order process is transmitted to
iloxx GmbH 
transmitted.

The processing of your personal data serves the purpose of fulfilling the contract concluded with you and is based on Art. 6 para. 1 lit. b GDPR.

Data subject rights and storage duration

Duration of storage
After the contract has been fully completed, the data will initially be stored for the duration of the warranty period, then stored in consideration of legal retention periods, especially tax and commercial law retention periods, and then deleted after the expiration of these periods, unless you have consented to further processing and use.

Rights of the data subject
If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: right to access, to rectification, to erasure, to restriction of processing, to data portability.
In addition, according to Art. 21 para. 1 GDPR, you have the right to object to processing based on Art. 6 para. 1 f GDPR, as well as to processing for direct marketing purposes.

Right to complain to the supervisory authority
According to Art. 77 GDPR, you have the right to complain to the supervisory authority if you believe that the processing of your personal data is not lawful.

You can file a complaint, among other places, with the supervisory authority responsible for us, which you can reach at the following contact details:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 981 1800930
Fax: +49 981 180093800
Email: poststelle@lda.bayern.de

Right to object
If the personal data processing listed here is based on our legitimate interest according to Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation, with effect for the future.
After an objection has been made, the processing of the affected data will be stopped unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing serves the assertion, exercise, or defense of legal claims.

last updated: 06/09/2025