This English version is provided for convenience only. Only the German version is legally binding.
1. Controller
[Name or company]
[Street and number]
[Postcode and city]
Germany
E-Mail: service@hntr-legend.de
We are not obliged to appoint a data protection officer. For privacy questions, please contact us at the e-mail address above.
2. Overview
We only process personal data to the extent necessary to provide this website, to process your orders and enquiries, or on the basis of your consent. The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interest). Storing and accessing information on your device is governed by Section 25 TDDDG.
3. Hosting and server log files
This website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg (Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. When you access the website, technically necessary data are processed (IP address, date and time, page requested, referrer, browser and operating system) in order to deliver the website and ensure its security (Art. 6(1)(f) GDPR). Server log files are deleted after 14 days at the latest unless they are needed to investigate a security incident.
Fonts and program libraries are loaded from our own server; no data are transferred to font or CDN providers when you visit the site. The connection is TLS-encrypted.
4. Cookies and consent management
We use technically necessary cookies, e.g. for the shopping cart, the session, the selected language and storing your cookie settings (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). All other services are only used with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We manage consent with the Complianz plugin; your settings are stored locally in your browser. You can change or withdraw your consent at any time with effect for the future via “Cookie settings” in the footer.
5. Orders and customer account
To process your order, we process the data you provide during checkout (name, address, e-mail, phone if applicable, order and payment data) pursuant to Art. 6(1)(b) GDPR. After the order has been completed, the data are stored for the duration of the commercial and tax retention periods (up to 10 years) (Art. 6(1)(c) GDPR) and then deleted. If you create a customer account, we store your data until the account is deleted.
With your consent (marketing), we store with an order which channel brought you to us (e.g. search engine, social media, campaign). For this purpose, information is stored in your browser (WooCommerce order attribution).
6. Shipping
For delivery, we pass your name and delivery address to the carrier DHL (Deutsche Post AG / DHL Paket GmbH, Bonn) (Art. 6(1)(b) GDPR). We only transmit your e-mail address or phone number with your express consent during checkout so that DHL can notify you about the delivery (Art. 6(1)(a) GDPR); you can withdraw this consent at any time.
7. Payment processing
For prepayment, invoice or cash payment, we process your payment data ourselves or via our bank (Art. 6(1)(b) GDPR).
PayPal: If you choose PayPal, your order and payment data are transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal’s privacy policy applies.
Purchase on invoice via PayPal: If you choose purchase on invoice, we transmit your order, contact and address data as well as date of birth and phone number to PayPal (Europe) S.à r.l. et Cie, S.C.A. and its partner Ratepay GmbH, Franklinstraße 28–29, 10587 Berlin, Germany. Ratepay carries out an identity and credit check, where applicable involving credit agencies (Art. 6(1)(b) and (f) GDPR). The privacy policies of PayPal and Ratepay apply.
Card, Apple Pay, Google Pay: These payment methods are also processed via PayPal. For Apple Pay and Google Pay, data are additionally processed by Apple Distribution International Ltd. and Google Ireland Ltd. respectively; a transfer to the USA is possible (EU-US Data Privacy Framework).
8. Contact form and e-mail
If you contact us via the contact form or by e-mail, we process your details (name, e-mail, message, size if applicable) to handle your enquiry (Art. 6(1)(b) or (f) GDPR). The enquiry is stored in our shop system and deleted once it has been dealt with, at the latest after 12 months, unless statutory retention obligations apply.
9. Newsletter
If you subscribe to our newsletter, we use the double opt-in procedure: mailing only starts after you have confirmed your e-mail address via a confirmation link (Art. 6(1)(a) GDPR). We log the subscription and confirmation. You can unsubscribe at any time.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3) GDPR).
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).
11. No automated decision-making
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.
As of: October 2026