Privacy Policy

We appreciate your visit to homerugs.de and your interest in our products. Protecting your personal data is important to us. In this Privacy Policy, we inform you about which personal data we process, for what purposes we process it, on which legal bases the processing is carried out, and which rights you have.

This Privacy Policy applies to the website homerugs.de and to the services offered by NEGRA Consulting GmbH through this website.

1. Controller

The controller responsible for the processing of personal data is:

NEGRA Consulting GmbH
Seboldstraße 1
76227 Karlsruhe
Germany

Phone: +49 (0)721 961 40 87
Email: kontakt@homerugs.de
Website: https://www.homerugs.de

2. General Information on Data Processing

We process personal data in accordance with the General Data Protection Regulation, GDPR, the German Telecommunications Digital Services Data Protection Act, TDDDG, and the respectively applicable data protection regulations.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, telephone number, order data, payment information, IP address, or usage data relating to our website.

We process personal data in particular when you visit our website, create a customer account, place an order, contact us, subscribe to our newsletter, or use our online services.

3. Legal Bases of Processing

Unless a more specific legal basis is stated in this Privacy Policy, we process personal data on the basis of the following provisions:

• Art. 6(1)(a) GDPR, where you have given us your consent
• Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract or for taking steps prior to entering into a contract
• Art. 6(1)(c) GDPR, where we are legally obliged to process the data
• Art. 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests or those of a third party, provided that your interests, fundamental rights and freedoms do not override those interests

For the storage of information on your end device or access to information already stored on your end device, the provisions of the TDDDG also apply. For technically non-essential cookies and comparable technologies, we obtain your consent where required.

4. Purposes of Data Processing

We process personal data in particular for the following purposes:

• Provision and operation of our website and online shop
• Processing of orders, payments, deliveries and returns
• Communication with customers
• Handling enquiries via contact forms, email or telephone
• Creation and management of customer accounts
• Sending newsletters and marketing information
• Analysis and optimization of our website
• Placement and evaluation of online advertising
• Protection against misuse, fraud and technical attacks
• Fulfilment of legal obligations, in particular commercial and tax retention obligations

5. Visiting Our Website and Server Log Files

When you visit our website, technical data that your browser transmits to our server is automatically collected. This may include in particular:

• IP address
• Date and time of access
• Pages and files accessed
• Referrer URL
• Browser type and browser version
• Operating system used
• Hostname of the accessing computer

This data is processed in order to technically provide our website, ensure system security, analyze errors and prevent misuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and error-free provision of our website.

6. Hosting

Our website is hosted by Mittwald. The server location is Germany. When you visit our website, technical data, in particular server log files, may be processed on Mittwald servers.

The hosting provider is used to provide our website and online shop. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, high-performance and reliable provision of our online offering.

Where Mittwald processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

7. Shopware 6 and Orders in the Online Shop

Our online shop is based on Shopware 6. If you place an order through our online shop, we process the personal data required for contract processing.

This includes in particular:

• First name and last name
• Billing and delivery address
• Email address
• Telephone number, where provided
• Order data
• Payment information
• Delivery and shipping information
• Communication data relating to the order

We use this data to process your order, process payments, deliver the goods, communicate with you as a customer and fulfil statutory retention obligations.

The legal basis is Art. 6(1)(b) GDPR where processing is necessary for the performance of a contract. Where we are legally obliged to retain certain data, processing is carried out on the basis of Art. 6(1)(c) GDPR.

8. Customer Account

You may create a customer account in our online shop. In doing so, we process the data provided by you in order to give you access to your customer account, allow you to manage your orders and provide a more convenient use of our shop.

In the customer account, in particular, name, address, contact details, order history and other account-related information may be stored.

The legal basis is Art. 6(1)(b) GDPR where the customer account is used for the execution or preparation of orders. In addition, processing may be carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in user-friendly customer relationship management.

You may request the deletion of your customer account. Statutory retention obligations, in particular in connection with completed orders, remain unaffected.

9. Payment Processing

We offer various payment methods for processing payments. Depending on the payment method selected, the payment data required is transmitted to the respective payment service provider.

In particular, we offer the following payment methods:

• Klarna
• Bank transfer
• SEPA
• Credit cards
• PayPal
• Apple Pay
• Google Pay

The payment service providers process personal data either under their own responsibility or as service providers, insofar as this is necessary for payment processing. The processed data may include name, billing address, delivery address, email address, payment amount, transaction data, card data or further payment information.

As a rule, we do not receive complete credit card or bank account data, but only information as to whether a payment was successfully completed or not.

The legal basis for the transmission of payment data is Art. 6(1)(b) GDPR, insofar as processing is necessary for carrying out the payment and therefore for the performance of the contract.

10. Klarna

If you choose a Klarna payment method, the data required for payment processing will be transmitted to Klarna. Klarna may process personal data in particular for payment processing, identity verification, credit checks, fraud prevention and receivables management.

The processed data may include in particular name, address, date of birth, email address, telephone number, payment data, order data and information on payment behavior.

Where processing is necessary for carrying out the selected payment method, it is based on Art. 6(1)(b) GDPR. Where Klarna processes data under its own responsibility, Klarna’s privacy policy applies.

11. PayPal

If you pay via PayPal, the data required for payment processing will be transmitted to PayPal. PayPal processes personal data in particular for payment processing, fraud prevention and compliance with legal obligations.

The processed data may include in particular name, email address, payment amount, transaction data, billing data and other information required for payment processing.

The legal basis is Art. 6(1)(b) GDPR.

12. Apple Pay and Google Pay

If you use Apple Pay or Google Pay as a payment method, payment processing is carried out via the respective provider and the integrated payment infrastructure. Payment data, transaction data, device information and other information required for the payment may be processed.

Processing is carried out for the purpose of executing the payment method selected by you. The legal basis is Art. 6(1)(b) GDPR. Where Apple or Google process data under their own responsibility, the privacy policies of the respective provider apply.

13. Delivery and Shipping

For the delivery of your order, we pass on the data required for this purpose to shipping and delivery service providers. This includes in particular name, delivery address, telephone number, email address and information about the ordered goods.

We work in particular with the following delivery partners:

• DHL
• DPD
• UPS
• GLS
• Own delivery by NEGRA Consulting GmbH

The transfer takes place insofar as it is necessary for delivery, appointment coordination, shipment tracking or order processing.

The legal basis is Art. 6(1)(b) GDPR where the data transfer is necessary for the performance of the contract. Where we also have an interest in efficient and reliable delivery, processing is carried out on the basis of Art. 6(1)(f) GDPR.

14. Contacting Us

If you contact us by contact form, email, telephone or by other means, we process the information you provide in order to handle your enquiry and any follow-up questions.

This may include in particular name, email address, telephone number, the content of your message and any further information voluntarily provided by you.

The legal basis is Art. 6(1)(b) GDPR where your enquiry is related to a contract or pre-contractual measures. In all other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of your enquiry.

15. Newsletter with Rapidmail

If you subscribe to our newsletter, we use your email address to regularly send you information about products, offers, promotions or news from homerugs.de.

We use Rapidmail to send our newsletter. The data collected as part of the newsletter registration is processed for the administration and sending of the newsletter as well as for evaluating newsletter usage. This may include in particular opening rates, clicks and technical information.

Where used, registration for our newsletter takes place via a double opt-in procedure. After registration, you will receive an email allowing you to confirm your subscription.

The legal basis for sending the newsletter is your consent pursuant to Art. 6(1)(a) GDPR. Where Rapidmail processes personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

You can unsubscribe from the newsletter at any time. A corresponding unsubscribe link can be found in every newsletter. Alternatively, you can send us a message to kontakt@homerugs.de. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

16. Cookies and Comparable Technologies

Our website uses cookies and comparable technologies. Cookies are small text files stored on your end device. Comparable technologies may store information on your end device or read information already stored there.

We distinguish in particular between technically necessary cookies and optional cookies or comparable technologies for analytics, marketing and external services.

Technically necessary cookies are required for our website and online shop to function correctly. These include, for example, cookies for the shopping cart, session management, language settings, login functions or security-related functions.

Analytics and marketing cookies as well as comparable technologies are used only where legally permitted and, where required, after you have given your consent.

The legal basis for technically necessary cookies is Section 25(2) TDDDG and Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free and user-friendly provision of our website.

The legal basis for optional cookies and comparable technologies is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

You can delete or block cookies in your browser settings. If you disable cookies, the functionality of our website may be limited.

17. Consent Management

We use a consent management solution on our website to obtain, manage and document consents for technically non-essential cookies and comparable technologies.

In this context, your consent decision, date and time of consent, browser information, device information and a pseudonymous identifier may be processed.

The legal basis is Art. 6(1)(c) GDPR insofar as processing is necessary to comply with legal documentation obligations. In addition, processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in the legally compliant documentation and management of consents.

18. Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is used to manage website tags. Other services, in particular Google Analytics, Google Ads or Meta Pixel, can be integrated and controlled via Google Tag Manager.

Google Tag Manager itself does not create user profiles and does not store its own marketing cookies. However, it may process technical data required for the delivery and management of tags.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient management of the services used on our website. Where services that require consent are loaded via Google Tag Manager, these services are activated only after the corresponding consent has been given.

19. Google Analytics

We use Google Analytics, a web analytics service provided by Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics helps us understand how visitors use our website. Information such as pages accessed, time spent on the website, origin of visitors, devices used, browser information and approximate location data may be processed.

We use Google Analytics to analyze and improve our website, our product range, our content and our marketing measures.

Where Google Analytics stores cookies or comparable technologies on your end device or reads such information, this takes place only after your consent.

The legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

In connection with Google services, data may be transmitted to Google companies or servers outside the European Union and the European Economic Area.

20. Google Ads

We use Google Ads to advertise our products and offers in Google Search and on other Google platforms. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Within the scope of Google Ads, cookies and comparable technologies may be used to measure the success of our advertisements, record conversions and display interest-based advertising.

In particular, information about clicks on ads, pages visited, purchases, shopping cart actions, technical data and approximate location data may be processed.

Where Google Ads stores cookies or comparable technologies on your end device or reads such information, this takes place only after your consent.

The legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

21. Meta Pixel

We use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel enables us to measure the effectiveness of advertisements on Meta platforms, in particular Facebook and Instagram, and to display targeted advertising.

Information about your usage behavior on our website, technical data, pages visited, shopping cart actions or purchases may be transmitted to Meta. Meta may link this data to your user account if you are logged into a Meta service.

Where the Meta Pixel stores cookies or comparable technologies on your end device or reads such information, this takes place only after your consent.

The legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

22. YouTube

Our website may embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you access a page with an embedded YouTube video or play a video, data may be transmitted to Google. This may include, in particular, IP address, device information, browser data and information about the page accessed.

Where possible, we embed YouTube videos in a privacy-friendly manner. Nevertheless, it cannot be ruled out that Google processes data for its own purposes.

Where YouTube stores cookies or comparable technologies on your end device or reads such information, this takes place only after your consent.

The legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

23. Google reCAPTCHA v3

We use Google reCAPTCHA v3 to protect our website against spam, misuse and automated access. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA uses various pieces of information to analyze whether an input is made by a human or by automated means. In particular, IP address, time spent on the site, mouse movements, browser information and other technical data may be transmitted to Google.

The service is used to protect our website, our forms and our technical systems.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website against misuse, spam and automated attacks. Where reCAPTCHA uses cookies or comparable technologies, we obtain your consent where required.

24. Disclosure of Personal Data to Third Parties

We disclose personal data only if this is necessary for the provision of our services, if there is a legal obligation, if you have given your consent, or if we have a legitimate interest in doing so.

Recipients of personal data may include in particular:

• Hosting and IT service providers
• Shop and software service providers
• Payment service providers
• Shipping and delivery service providers
• Newsletter service providers
• Marketing and analytics service providers
• Tax advisors, accounting service providers or auditors
• Authorities, courts or other bodies where we are legally obliged to do so

25. Data Transfers to Third Countries

We process personal data primarily in Germany and within the European Union or the European Economic Area. In the case of individual services, in particular Google, Meta, PayPal or other international service providers, personal data may be transferred to countries outside the European Union or the European Economic Area, in particular to the USA.

Where personal data is transferred to third countries, this takes place only if the requirements of Art. 44 et seq. GDPR are met. This may be based in particular on an adequacy decision by the European Commission, suitable safeguards such as EU Standard Contractual Clauses, or explicit consent.

26. Retention Period

We store personal data only for as long as is necessary for the respective purposes or for as long as statutory retention obligations exist.

Order, invoice and contract data are retained in particular for as long as this is necessary for contract processing, warranty, accounting, tax obligations or the enforcement of legal claims.

Data that we process on the basis of consent will be deleted or anonymized if you withdraw your consent, unless another legal basis or retention obligation applies.

27. Data Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration or disclosure.

Our website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser address bar begins with “https://” and a lock symbol is displayed.

28. Your Rights

Subject to the statutory requirements, you have the following rights:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to object pursuant to Art. 21 GDPR
• Right to withdraw consent pursuant to Art. 7(3) GDPR
• Right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR

If you have given consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

29. Right to Object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data for such marketing.

30. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection regulations.

In particular, you may contact the supervisory authority responsible for us:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Germany

31. No Data Protection Officer

We have not appointed a formal Data Protection Officer. For questions regarding data protection, you may contact the controller named above directly.

32. Contact for Data Protection Enquiries

If you have any questions about data protection or wish to exercise your rights, you may contact us at any time:

NEGRA Consulting GmbH
Seboldstraße 1
76227 Karlsruhe
Germany
Email: kontakt@homerugs.de

33. Changes to This Privacy Policy

We may amend this Privacy Policy at any time, in particular if we change our data processing activities or if new legal requirements apply. The version currently published on our website applies.

Last updated: May 2026