Privacy Policy (Online Shop)

1) Controller

Combec Computer-Technik Business-Engineering & Consulting GmbH
Holzkoppelweg 23, 24118 Kiel, Germany
Phone: +49 431 546230
Email: info@combec-kiel.de

2) General information on processing

We process personal data in accordance with the GDPR to provide this online shop, to handle orders, to process payments, to enable shipping or collection, and to respond to enquiries.

Legal bases (depending on the processing):

• Art. 6(1)(b) GDPR (performance of a contract / pre-contractual steps)
• Art. 6(1)(c) GDPR (legal obligation)
• Art. 6(1)(f) GDPR (legitimate interests, e.g. IT security and stability)
• Art. 6(1)(a) GDPR (consent – currently no analytics/marketing tools)

3) Hosting (on-premises) & technical logs

This shop is hosted on our own infrastructure (on-premises). Technical logs may be processed to ensure secure and stable operation.

• Purpose: operation, IT security, troubleshooting
• Legal basis: Art. 6(1)(f) GDPR
• Retention: limited by log rotation, maximum approx. 30 days

4) Shop software (Shopware) & strictly necessary cookies

We use Shopware as our shop system. Shopware uses strictly necessary cookies / local storage entries (e.g. shopping cart, login, language, security settings, cookie consent status). These are required to operate the shop.

• Legal basis: Art. 6(1)(f) GDPR and, where applicable, § 25(2) TTDSG (Germany)

5) Cookie banner / consent management

A cookie banner is used to manage consents for non-essential services. Currently, no analytics or marketing tools are used, so no optional analytics/marketing tracking cookies are activated.

6) Customer account (no guest checkout)

Orders can only be placed with a customer account / login (no guest checkout). In particular, we process:

• Name, email address, password (encrypted/hashed)
• Billing and shipping address, optionally phone, company/VAT ID (if provided)
• Order history and related communication

• Purpose: account and order handling, support, traceability of orders
• Legal basis: Art. 6(1)(b) GDPR
• Retention: until the account is deleted, unless statutory retention obligations apply

7) Orders, shipping, invoices

For order processing, we process order data (items, quantities, prices), customer and address data, and processing data (e.g. payment status). We are also subject to statutory retention obligations (especially tax law).

• Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligation)
• Retention: invoices and tax-relevant data are retained according to statutory requirements (typically up to 10 years)

8) Payment methods / payment service providers

For payment processing, required data is transferred to payment service providers depending on the selected payment method. Payment service providers usually process data as independent controllers.

PayPal (incl. PayPal Express)

If you pay via PayPal (including Express), data is processed for payment handling, including transaction data and identification/contact data. Legal basis: Art. 6(1)(b) GDPR.

Amazon Pay

If you pay via Amazon Pay, required data is transferred to Amazon Pay for payment processing. Legal basis: Art. 6(1)(b) GDPR.

Invoice (payment on account)

If you choose payment on account, we process the data required to handle the transaction. Legal basis: Art. 6(1)(b) GDPR.

9) Shipping / local collection

For delivery, we transfer necessary data to shipping providers (name, delivery address, optionally email/phone for delivery notifications – depending on configuration).

• Shipping providers: DHL, DPD, freight forwarding
• Local collection: for collection, we process data required to prepare and hand over the goods
• Legal basis: Art. 6(1)(b) GDPR

10) Contact form / communication

If you contact us (e.g. contact form/email), we process the data you provide (e.g. name, email, message) to respond to your request.

• Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contract) or Art. 6(1)(f) GDPR (communication)
• Retention: as long as required to handle the request; longer if it becomes part of a contractual process

11) No web analytics / no marketing tracking

Currently, no analytics or marketing tools are used (e.g. Google Analytics, Meta Pixel, Google Ads).

12) Recipients / processors

Where processors are used (e.g. IT maintenance), this is based on a contract pursuant to Art. 28 GDPR. Further recipients may include payment and shipping providers, and authorities/tax advisors where required by law.

13) Transfers to third countries

When using payment services, processing in third countries (e.g. USA) cannot be ruled out. Transfers occur only if the requirements of Arts. 44 et seq. GDPR are met (e.g. adequacy decision or appropriate safeguards).

14) Data subject rights

You have rights to access, rectification, erasure, restriction, data portability and to object to processing based on legitimate interests. Consents can be withdrawn at any time with effect for the future.

Please contact: info@combec-kiel.de

15) Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In Schleswig-Holstein (Germany), the competent authority is the ULD Schleswig-Holstein.

16) Version

Version: 16.02.2026