The protection of your privacy is important to us. Read our privacy policy to find out which personal data we process and for what purpose.
Thank you for your interest in our company. We take the protection of your privacy when you use our website very seriously, which is why we collect and process your personal data in accordance with the statutory data protection regulations.
In the following, we will inform you in detail about which personal data we process, how and for what purpose, and about your rights as a data subject. This privacy policy only applies to www.wenatex.com and the associated subpages, but not to websites that are controlled and operated by third parties.
(1.) Controller and data protection officer
Responsible for the collection, processing and use of your personal data within the meaning of Art. 4 VII GDPR is
Wenatex Das Schlafsystem GmbH
Münchner Bundesstraße 140
5020 Salzburg
Austria
(also referred to as ‘Wenatex’, ‘we’ or ‘us’ in this privacy policy).
Our data protection officer can be contacted at datenschutz@wenatex.com and at the following postal address:
Mein-Datenschutzbeauftragter
Rudolf-Diesel-Straße 10
D-23617 Stockelsdorf
Germany
If you have any comments or questions about data protection, wish to update information we hold about you, wish to object to this data protection policy as a whole or for individual measures, or wish to exercise your rights, you are welcome to contact the person responsible by e-mail.
(2.) Collection and processing of personal data
Personal data is data that can be used to identify a natural person. Therefore, all data that relates or can be related to a natural person and thus allows conclusions to be drawn about that person is personal data.
Personal data also includes data that can only be used to identify a person in combination with other data, often from another data processor, e.g. your IP address in combination with the time you were online.
Personal data is collected and processed by us exclusively for legally authorised purposes and to the extent specified by law. This is the case, for example, if the processing of your data is necessary to fulfil a contract or a legal obligation to which we are subject.
Data is also stored and used if you have given your consent to the processing of personal data for one or more specific purposes.
(2.1.) Data collected by us
In principle, you can visit our website without providing any personal data. As is usual with most websites, the server on which our website is operated automatically stores information about your interaction with us and registers data about your end device and your browser.
The web server recognises your IP address, the date and time of your visit, the website you were previously on, the browser you are using, the operating system you are using, the pages you have visited on our website, as well as the size of the requested data and the status code of the request. If the requested page uses cookies (as explained below), the web server also stores this information.
We regularly evaluate this log data anonymously and without assigning it to you personally or creating any other profile for statistical evaluations for the purpose of operating, securing and optimising our website. This is also our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR. We then optimise our website on the basis of these findings. In addition, in the event of system misuse, we may use this information in cooperation with your internet provider and/or local authorities to identify the perpetrator of this misuse.
(2.2.) Data provided by you
We ask you for certain personal data on some pages in order to provide you with the products or services you wish to receive. For example, if you wish to contact our customer service, arrange a sleep consultation, receive information material or take part in our competitions.
If you correspond with us or fill in a form with data, you acknowledge that the data you provide in the respective form will be processed for the purposes described below (see point 3).
(3.) Legal bases and processing purposes
When you use our Sites, we will notify you in good time or obtain your consent to certain procedures. In many cases, your web browser or mobile device platform will provide additional tools that allow you to control when your device collects or shares certain categories of personal data. For example, your mobile device or web browser will provide tools that allow you to manage cookie usage or location sharing. We encourage you to familiarise yourself with the tools and use them on your devices.
We only store your data for as long as is necessary to fulfil the respective purposes of the data processing. The duration of data processing also depends in particular on the statutory retention periods and the limitation periods for potential legal claims.
The legal bases that are most frequently applied are contract fulfilment, legitimate interest and consent.
(3.1.1.) Contract fulfilment (Art. 6 para. 1 lit. b GDPR)
If the processing of your data is a prerequisite for the fulfilment of a concluded contract, we may and must process your data. For example, when you place an order in our online shop, you conclude a contract with us. This is also the case whenever you accept general terms and conditions or similar. The fulfilment of the contract is also the legal basis for sending newsletters that you have ordered.
(3.1.2.) Legitimate interest (Art. 6 para. 1 lit. f GDPR)
Data protection law weighs up various interests. Risks of damage and misuse are also assessed. If the assessment is positive, the legitimate interest can be the basis for data processing.
The legitimate interests may be the interests of the controller or a third party. In addition to the legitimate interests of the controller, legitimate third-party interests can also be considered as a basis for processing. Legitimate interests include operational and data security, performance measurement, the prevention of misuse, freedom of expression and information, ensuring satisfactory customer communication, promoting the sale of our products and the enforcement of legal claims.
(3.1.3.) Consent (Art. 6 para. 1 lit. a GDPR)
If we would like to process your data and believe that you may also have an interest in the purpose of the processing, but there is otherwise no direct legal basis for the processing, we will ask you for your consent beforehand.
Consent is only valid if it is given voluntarily and in full knowledge of the facts. We therefore take care to inform you precisely before consent is given and data is collected.
You can withdraw any consent you give us at any time. We will then no longer process the corresponding data.
(3.2.1.) Request for information material
If you contact us via the online form for requesting information material on the website, the data you provide will be processed for the purpose of processing the enquiry and for follow-up questions. The request for information material takes place in a so-called double opt-in procedure. After submitting the form on our website, you will receive an email with a confirmation link. Once you have clicked on this link, we will process your enquiry.
The request for information material is logged in order to be able to prove the enquiry process in accordance with the legal requirements. This includes storing the time of the enquiry and confirmation as well as the IP address.
The processing of your personal data in the context of making contact is based on the legitimate interest in being able to process your individual enquiry and answer it as requested (Art. 6 para. 1 lit. f GDPR). Your personal data will be stored for 3 years.
We process the following data:
Selected products, title, first name, surname, street, house number, postcode, city, country, date of birth, telephone number and email address
The optional fields help us to provide you with personalised information.
(3.2.2.) Booking of a sleep consultation
If you would like to make an appointment for a sleep consultation with us via an online form on the website, the data you provide will be processed for the purpose of processing your desired appointment and for follow-up questions. The agreement of a sleep consultation is made in a so-called double opt-in procedure. After submitting the form on our website, you will receive an email with a confirmation link. Once you have clicked on this link, we will process your enquiry.
The enquiry to arrange a sleep consultation is logged in order to be able to prove the enquiry process in accordance with legal requirements. This includes storing the time of the enquiry and confirmation as well as the IP address.
The processing of your personal data in the context of making an appointment is based on the legitimate interest in being able to process and reliably answer your individual enquiry (Art. 6 para. 1 lit. f GDPR) and on the implementation of pre-contractual measures (Art. 6 para. 1 lit. b GDPR). Your personal data will be stored for 3 years.
We process the following data:
Title, first name, surname, street, house number, postcode, city, country, date of birth, telephone number, email address and your preferred date.
The optional fields help us to provide you with personalised information.
(3.2.3.) General contact form
If you correspond with us via a contact form on the website, the data you provide will be processed for the purpose of handling your enquiry.
The processing of your personal data in the context of this contact is based on the legitimate interest in being able to process your individual enquiry and answer it reliably (Art. 6 para. 1 lit. f GDPR). Your personal data will be stored for 12 months.
We process the following data:
Subject, title, first name, surname, street, house number, postcode, city, country, date of birth, telephone number, email address and your message.
The optional fields help us to provide you with personalised information.
(3.2.4.) Use of the feedback form
If you correspond with us via our feedback form on the website, the data you provide will be processed for the purpose of handling your enquiry.
The processing of your personal data in the context of this contact is based on our legitimate interest in being able to process and reliably respond to your individual enquiry (Art. 6 para. 1 lit. f GDPR). Your personal data will be stored for 12 months.
We process the following data:
Subject, title, first name, surname, street, house number, postcode, city, country, date of birth, telephone number, email address and your message.
The optional fields help us to provide you with personalised information.
(3.2.5.) Participation in competitions
If you take part in an online competition, the data you provide will be processed for the purpose of participation, realisation and handling of the competition. Participation in competitions takes place in a so-called double opt-in procedure. After submitting the form on our website, you will receive an email with a confirmation link. Once you have clicked on this link, you will be entered into the competition.
Participation in competitions is logged in order to be able to prove the participation process in accordance with legal requirements. This includes storing the time of enquiry and confirmation as well as the IP address.
The processing of your personal data in the context of participation in a competition is based on the legitimate interest in ensuring your participation in accordance with the conditions of participation (Art. 6 para. 1 lit. f GDPR) as well as on the implementation of pre-contractual measures (Art. 6 para. 1 lit. b GDPR) and on the basis of the consent of the participants in accordance with Art. 6 para. 1 lit. a GDPR. Your personal data will be stored for 12 months.
Depending on the type of competition, we process the following data
Answer to prize question, title, first name, surname, street, house number, postcode, city, country, date of birth, telephone number and email address.
The optional fields help us to provide you with personalised information.
(3.2.6.) Job applications
You have the opportunity to apply for jobs currently advertised on our website. In the event of an application, your data will be processed for the purpose of forwarding it to the responsible department to find a suitable person for the advertised position.
The processing of your personal data in the context of an application is based on the legitimate interest in ensuring your participation in accordance with the conditions of participation (Art. 6 para. 1 lit. f GDPR) and on the implementation of pre-contractual measures (Art. 6 para. 1 lit. b GDPR). Your personal data will be stored until the end of the application process plus 7 months.
We process the following data:
Title, first name, surname, street, house number, postcode, city, country, date of birth, telephone number, email address, CV, photo and other documents.
The optional fields help us to provide you with personalised information
(3.2.7.) Newsletter registration
With the consent of the recipient or legal permission, we regularly send personalised and individual newsletters, emails and other electronic notifications with advertising information (hereinafter ‘newsletter’). Registration for our newsletter takes place in a so-called double opt-in procedure. After giving your consent on our website, you will receive a confirmation email with an activation link to receive the newsletter immediately.
Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes storing the time of registration and confirmation as well as the IP address. We process certain data about your use of the newsletter and our website in order to personalise the newsletter accordingly with news about products and services that may be of interest to you. The sending of the newsletter, its personalisation and the performance measurement associated with it are based on the consent of the recipients in accordance with Art. 6 para. 1 lit. a GDPR or, if consent is not required, on our legitimate interests in direct marketing in accordance with Art. 6 para. 1 lit. f GDPR and Section 7 para. 3 UWG (Act against Unfair Competition). Your personal data will be stored as long as the newsletter is sent and no cancellation is made.
If you no longer wish to receive our newsletter, you can unsubscribe at any time by simply clicking on the ‘Unsubscribe’ link in the footer of one of our newsletters. We may store the unsubscribed email addresses for up to one year on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent, Art. 6 para. 1 lit. f GDPR.
(3.2.8.) User account
You can create a user account on our website. If you wish to do so, we need the personal data requested when you log in. When you log in later, only your email or user name and the password you have chosen will be required.
For new registrations, we collect master data (e.g. name, address), communication data (e.g. e-mail address) and payment data (bank details) as well as access data (user name and password).
To ensure your proper registration and to prevent unauthorised logins by third parties, you will receive an activation link by e-mail after your registration to activate your account. Only after successful registration will we permanently store the data you provide in our system.
Once you have created a user account, you can have it deleted by us at any time without incurring any costs other than the transmission costs according to the basic tariffs. A notification in text form to the contact details stated under point 1 (e.g. e-mail, fax, letter) is sufficient for this. We will then delete your stored personal data, unless we still need to store it to process orders or due to statutory retention obligations.
The legal basis for the processing of this data is your consent in accordance with Art. 6 para. 1 sentence 1 a) GDPR.
(3.2.9.) Online purchase
When you make a purchase in our online shop, the data you provide will be processed for the purpose of processing your order.
Every order is logged in order to be able to prove the order process in accordance with legal requirements. This includes the storage of the time of enquiry and confirmation as well as the IP address.
The processing of your personal data in the context of the order is based on the execution of the offer, the conclusion of the contract, the fulfilment of the contract and the fulfilment of any contractual obligations prior to the conclusion of the contract on the basis of the pre-contractual relationship initiated by you and after the conclusion of the contract on the basis of the contract. (Art. 6 para. 1 lit. b GDPR) and on the basis of the consent of the recipients pursuant to Art. 6 para. 1 lit. a GDPR. Your personal data will be stored for 7 years.
We process the following data:
Title, first name, surname, street, house number, postcode, city, country, telephone number and email address and payment data.
The optional fields help us to provide you with personalised information.
For the fulfilment of contracts or enquiries, we pass on your data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods.
(3.2.10.) Payment processing by service providers
In order to process payments, we pass on the necessary payment data to the credit institution commissioned with the payment and, if applicable, to the payment service provider commissioned by us or to the payment service selected by you in the ordering process. You can request more information about the processors commissioned by us at datenschutz@wenatex.com.
(3.2.10.1) Payment with PayPal
If you select the PayPal payment method, payment will be processed by the online payment service PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). For this purpose, your data required for the payment process (first and last name, street, house number, postcode, city, title, e-mail address, telephone number and IP address) are automatically transmitted to PayPal for the purpose of identity and credit checks. PayPal may also pass on your data to third parties if this is necessary to fulfil contractual obligations or if the data is to be processed on our behalf.
For details on the processing of your data by PayPal, please refer to their privacy policy https://www.paypal.com/at/webapps/mpp/ua/privacy-full
The legal basis for data processing is based on the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR).1 lit. b DSGVO).
(3.2.10.2) Payment by credit card
If you select the ‘credit card’ payment method, payment will be processed by the payment service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we will pass on the information provided during the ordering process together with the information about your order (name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number) in accordance with Art. 6 para. 1 lit. b GDPR. Your data will only be passed on for the purpose of payment processing with the payment service provider Stripe Payments Europe Ltd. and only to the extent that it is necessary for this purpose. You can find more information on Stripe's data protection at the URL https://stripe.com/de/privacy#translation.
The legal basis for data processing is based on the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR).1 lit. b DSGVO).
(3.2.10.3) Payment with SOFORT
If you select the ‘SOFORT’ payment method, payment will be processed via the payment service provider SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany (hereinafter ‘SOFORT’), to whom we will pass on the information you provided during the ordering process together with the information about your order in accordance with Art. 6 para. 1 lit. b GDPR. Sofort GmbH is part of the Klarna Group (Klarna Bank AB (publ), Sveavägen 46, 11134 Stockholm, Sweden). Your data will only be passed on for the purpose of payment processing with the payment service provider SOFORT and only to the extent that it is necessary for this purpose.
Details on the processing of your data by SOFORT GmbH can be found in SOFORT's privacy policy .
The legal basis for data processing is based on the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR).
(3.2.10.4) Payment with Giropay
The giropay payment is processed via giropay GmbH. The payment provider giropay GmbH, (An der Welle 4, 60322 Frankfurt/Main, Germany) transfers, processes and stores any personal data required to process the payment. giropay GmbH is solely responsible for the processing of this data.
For details on payment with giropay, please refer to the payment provider's terms and conditions and privacy policy at: https://www.giropay.de/agb/index.html
The legal basis for data processing is based on the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR)
(4.) Cookies & social plugins
Information about the cookies we use can be found in our cookie policy.
(5.) Integration of customer reviews by eKomi
We use technologies from eKomi (eKomi Ltd., Markgrafenstraße 11, 10969 Berlin, Germany) to give our customers the opportunity to rate our products and services.
We have concluded a contract data processing agreement with eKomi for the technical implementation. eKomi takes all organisational and technical measures to protect your data. In accordance with the statutory retention periods, this data is stored and then deleted. You can find more detailed information on eKomi's data protection policy at www.ekomi.de/de/datenschutz.
After your order has been processed, you will receive an e-mail via eKomi asking you to submit a review. For this purpose, your e-mail address and a unique ID for identification and generation of the review link will be transmitted to eKomi via an interface.
Of course, you have the right not to submit a customer review at any time, but this would be very helpful to us and other customers.
If you submit a review, your entries will be transmitted to eKomi. These are then checked by eKomi and published on their website (https://www.ekomi.de/bewertungen-wenatexcomde.html) and on our website.
The provision of your e-mail address is voluntary and only serves the purpose of contacting you if this is desired by you. In this way, we can, for example, respond individually to your criticism, answer your questions or provide other assistance.
The legal basis for the use of eKomi is Art. 6 para. 1 lit. f GDPR.
(6.) Storage period
Unless specifically stated, we only store personal data for as long as is necessary to fulfil the purposes pursued.
In some cases, the legislator provides for the retention of personal data, for example in tax or commercial law. In these cases, the data will only be stored by us for these legal purposes, but will not be processed in any other way and will be deleted after the statutory retention period has expired.
(7.) Your rights
Under data protection law, you have the following rights as a person affected by data processing:
(7.1.) Information
You have the right to request information from us within the scope of Art. 15 GDPR as to whether and, if so, how we use which of your personal data. You can request a copy of your data processed by us. The exercise of your right to information must not adversely affect the rights and freedoms of other persons.
(7.2.) Rectification
You have the right to request the rectification of your data. Should incomplete or incorrect information be stored despite our efforts to ensure that it is correct and up to date, we will correct it at your request.
(7.3.) Deletion
You have the right to request the erasure of your data, unless it is still being processed on a legal basis that precludes erasure or you withdraw your consent and there is no other legal basis. If the legal requirements for erasure are met, we will carry out the requested erasure immediately.
(7.4.) Restriction
You can request that we restrict the processing of your personal data. This right exists in particular if the accuracy of the personal data is disputed or if you request restricted processing instead of erasure under the conditions of a justified request for erasure. Likewise, if the data is no longer required for the purposes pursued by us, but you need the data for the assertion, exercise or defence of legal claims or if the success of an objection is still disputed.mstritten ist.
(7.5.) Data portability
You may request that we provide you or another controller with the data you have provided to us in a structured, commonly used and machine-readable format, provided that we process the data on the basis of your consent or to fulfil a contract between us and the processing is carried out using automated procedures. The exercise of your right must not adversely affect the rights and freedoms of others.
(7.6.) Objection
You have the right to object to data processing that is carried out on the basis of a legitimate interest (Art. 6 para. 1 lit. f GDPR). In this case, we are legally obliged to weigh your interests against our own. If the result is that our interests prevail, we will reject the objection with reasons. Otherwise, we will immediately cease the corresponding data processing.
(7.7.) Complaint
If you are of the opinion that we have violated data protection law in the processing of your data and thereby infringed your rights, we ask you to contact us in order to clarify any questions. Of course, you also have the right to lodge a complaint with the competent data protection supervisory authority (Art 77 GDPR) or with a European supervisory authority.
(7.8.) Revocation
All consents granted by you (Art. 6 para. 1 lit. a GDPR) can be revoked independently of each other at any time in writing and free of charge. The consequence of a revocation is that we will no longer process your data for the purposes stated in the declaration of consent from this point on, unless we carry out the respective data processing on another legal basis (e.g. in order to be able to continue to fulfil contracts with you). This means that the corresponding rights and benefits can no longer be utilised. Please contact the office to which you have given your consent by e-mail.
(8.) Protection and management of your personal data
(8.1.) Data security
We have taken appropriate technical and organisational measures to protect your data against loss, manipulation or unauthorised access, among other things. The measures taken are subject to regular review and are continuously adapted to the state of the art.
(8.2.) Data transfer to a third country
Personal data that we collect in connection with our website is only transferred to the USA under the EU-US Privacy Shield on the basis of the European Commission's adequacy decision.
We currently work with the following service providers that are certified under the EU-U.S. Privacy Shield:
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, New York 10001, USA
(8.3.) Transfer of data to external service providersister
We rely on contractually affiliated third-party companies and external service providers (‘processors’) to provide the services. In such cases, personal data is passed on to these processors to enable them to continue processing. These processors are carefully selected and regularly checked by us to ensure that your privacy is protected. The processors may only use the data for the purposes specified by us and are also contractually obliged by us to treat your data exclusively in accordance with this privacy policy and the applicable data protection laws.
We currently pass on data to the following processors:
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Die Datenschutzbestimmungen finden Sie hier: https://policies.google.com/privacy
• CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany.
Die Datenschutzbestimmungen finden Sie hier: https://www.cleverreach.com/de-de/datenschutz/
• eKomi Ltd., Markgrafenstraße 11, 10969 Berlin, Germany.
Die Datenschutzbestimmungen finden Sie hier: www.ekomi.de/de/datenschutz
• Vimeo.com, Inc., 330 West 34th Street, 10th Floor, New York, New York 10001, USA
You can find the privacy policy here: https://vimeo.com/privacy
(9.) Changes to this privacy policy
In order to ensure that our privacy policy always complies with the current legal requirements, we reserve the right to make changes at any time. This also applies in the event that the privacy policy has to be adapted due to new or revised services, for example new services or functionalities of the website. The current version can be found at the bottom of the footer on every page of our website under the heading ‘Links’. Please use these links to keep yourself regularly informed about the current status of this privacy policy.