privacy policy

Privacy Policy

This is a non-binding English translation for informational purposes only. The legally binding version is the German original ("Datenschutzerklärung").

We are delighted that you are interested in our company. Data protection is a matter of particular importance to the management of SYLVAN GbR. In principle, it is possible to use our online shop without providing any personal data. However, if a data subject wishes to use special services offered by our company via our website, it may become necessary to process personal data. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject.

The processing of personal data, such as the name, address, email address, or telephone number of a data subject, shall always be in line with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection provisions applicable to SYLVAN GbR, in particular the German Telecommunications-Telemedia Data Protection Act (TTDSG). By means of this privacy policy, we would like to inform you about the nature, scope, and purpose of the personal data we collect, use, and process, as well as about the rights to which data subjects are entitled.

As the controller, SYLVAN GbR has implemented technical and organizational measures to ensure the most complete protection possible of personal data processed via this website. Nevertheless, internet-based data transmissions may in principle have security gaps, so absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us by alternative means, for example by email.

1. Definitions

This privacy policy is based on the terms used by the European legislator for the adoption of the GDPR:

a) Personal data Any information relating to an identified or identifiable natural person (the "data subject").

b) Data subject Any identified or identifiable natural person whose personal data is processed by the controller.

c) Processing Any operation performed on personal data, whether or not by automated means, such as collection, recording, organization, storage, adaptation, retrieval, use, disclosure, restriction, erasure, or destruction.

d) Restriction of processing The marking of stored personal data with the aim of limiting its processing in the future.

e) Pseudonymisation The processing of personal data in such a manner that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures.

f) Controller The natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.

g) Processor A natural or legal person which processes personal data on behalf of the controller.

h) Recipient A natural or legal person to whom personal data is disclosed.

i) Third party Any person or body other than the data subject, the controller, the processor, and persons authorized to process the data.

j) Consent Any freely given, informed, and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of personal data relating to them.

2. Name and Address of the Controller

The controller within the meaning of the GDPR is:

SYLVAN GbR c/o Sebastian Harnack Sillemstraße 60a 20257 Hamburg Germany

Email: shop@sylvan.de Website: https://shop.sylvan.de

3. Cookies and Consent

Our online shop uses cookies. Cookies are text files that are stored on a computer system via an internet browser.

We distinguish between:

  • Strictly necessary cookies, which are essential for the operation of the shop (e.g. shopping cart cookie, login session). These are set on the basis of Art. 6 (1) lit. f GDPR in conjunction with § 25 (2) no. 2 of the German TTDSG, without requiring separate consent.
  • Non-essential cookies and services (e.g. social media plug-ins), which are only activated after your explicit consent pursuant to § 25 (1) TTDSG in conjunction with Art. 6 (1) lit. a GDPR. You can manage your consent via our cookie consent tool in the shop and withdraw it at any time with effect for the future.

You can also prevent the setting of cookies at any time through the settings of your internet browser and delete cookies already stored. If you disable cookies, not all functions of our shop may be fully usable.

4. Collection of General Data and Information (Server Log Files)

Each time our online shop is accessed, we automatically collect a range of general data and information, which is stored in the server's log files. This may include: browser type and version, operating system used, referrer URL, sub-pages accessed, date and time of access, IP address, and the internet service provider of the accessing system.

This data is not used to draw conclusions about the data subject, but serves to correctly deliver the content of our website, ensure the continued functionality of our IT systems, and provide law enforcement authorities with the information necessary for prosecution in the event of a cyberattack. The legal basis is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.

5. Hosting

Our online shop is operated by an external hosting provider (currently IONOS SE). Personal data collected in connection with the use of the shop is processed on our hosting provider's servers. A data processing agreement pursuant to Art. 28 GDPR is in place with the hosting provider, ensuring that it only processes personal data of our shop visitors in accordance with our instructions and in compliance with the GDPR.

6. Registration in the Shop

You have the option of registering in our shop by providing personal data. The specific data transmitted depends on the input form used for registration. This data is collected and stored exclusively for internal purposes. We may arrange for the data to be forwarded to processors, e.g. a payment service provider or parcel delivery service, who use the data exclusively for internal use attributable to us.

Registered users may change their data at any time or request the complete deletion of their account. We will provide information about the data stored about you upon request at any time.

7. Order Processing and Shipping

When you place an order, we collect the data necessary to fulfil the contract (name, delivery address, email address, and, where applicable, telephone number and payment data). The legal basis is Art. 6 (1) lit. b GDPR (performance of a contract).

To deliver your order, we forward the data necessary for delivery (name and delivery address) to our shipping provider, DHL. This transfer is made solely for the purpose of delivery and is a prerequisite for fulfilling the purchase contract (Art. 6 (1) lit. b GDPR).

Invoice data is stored for a period of 10 years due to statutory retention obligations (§ 147 German Fiscal Code (AO), § 257 German Commercial Code (HGB)).

8. Contact via the Website

If you contact us by email or via a contact form, the personal data you transmit is automatically stored and used to process your inquiry or to contact you. This data is not passed on to third parties.

9. Routine Erasure and Blocking of Personal Data

We process and store personal data only for the period necessary to achieve the purpose of storage, or as required by law. Once the purpose of storage ceases to apply or a statutory retention period expires, the corresponding data is routinely blocked or erased.

10. Rights of the Data Subject

As a data subject, you have the following rights under the GDPR:

a) Right of confirmation You may request confirmation from us as to whether personal data concerning you is being processed.

b) Right of access (Art. 15 GDPR) You have the right to obtain free information at any time about the personal data stored about you, including the purposes of processing, categories of data, recipients, planned storage period, and your further rights.

c) Right to rectification (Art. 16 GDPR) You may request the immediate rectification of inaccurate data or the completion of incomplete data.

d) Right to erasure (Art. 17 GDPR) Under the statutory conditions, you may request the immediate erasure of your data, e.g. if the data is no longer necessary for the original purposes or you withdraw your consent.

e) Right to restriction of processing (Art. 18 GDPR) Under certain conditions, you may request the restriction of processing of your data, e.g. while the accuracy of the data is contested.

f) Right to data portability (Art. 20 GDPR) You may request to receive the data concerning you in a structured, commonly used, machine-readable format and to transmit it to another controller, provided the processing is based on consent or a contract and is carried out by automated means.

g) Right to object (Art. 21 GDPR) You have the right, on grounds relating to your particular situation, to object at any time to the processing of your data carried out on the basis of Art. 6 (1) lit. f GDPR. In the case of direct marketing, you have an unconditional right to object.

h) Automated individual decision-making You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you.

i) Right to withdraw consent (Art. 7 (3) GDPR) You may withdraw consent you have given at any time with effect for the future.

To exercise these rights, please contact us at any time (see contact details in Section 2). You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information.

11. Facebook

We integrate components of the company Meta (Facebook) on our website. The operating company is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If you have consented to the use of this component, a connection to Meta's servers is established when you access a page of our shop on which a Facebook component is integrated. Meta thereby becomes aware of which sub-page of our shop you have visited. If you are logged into Facebook at the same time, Meta may associate this visit with your Facebook account.

The legal basis is your consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TTDSG, which you provide via our cookie consent tool and may withdraw at any time.

Further information on data processing by Meta can be found at https://de-de.facebook.com/about/privacy/.

12. Instagram

We integrate components of the Instagram service on our website. The operating company is also Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

If you have consented, a connection to Meta's servers is established when you access a page of our shop with an Instagram component, allowing Meta to become aware of the sub-page visited. If you are logged into Instagram at the same time, Meta may associate this visit with your Instagram account.

The legal basis is likewise your consent pursuant to Art. 6 (1) lit. a GDPR in conjunction with § 25 (1) TTDSG, manageable via our cookie consent tool.

Further information: https://www.instagram.com/about/legal/privacy/

13. Payment Method: PayPal

We integrate components of PayPal on our website. We process both classic PayPal payments and credit/debit card payments via PayPal, including for users without a PayPal account.

The European operating company is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If you select "PayPal" or a credit/debit card payment via PayPal as your payment method during checkout, the data necessary for payment processing (including name, address, email address, IP address, and order data) is automatically transmitted to PayPal. By selecting this payment option, you consent to the transmission of data required for this purpose. The legal basis is Art. 6 (1) lit. b GDPR (performance of a contract).

PayPal may pass on the data to affiliated companies, service providers, or subcontractors where necessary to fulfil contractual obligations, and, where applicable, to credit agencies for credit checks.

PayPal's applicable data protection provisions can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

14. Legal Bases for Processing

  • Art. 6 (1) lit. a GDPR: for processing based on your consent (e.g. social media plug-ins)
  • Art. 6 (1) lit. b GDPR: for processing necessary for the performance of a contract with you (e.g. order processing, shipping, payment processing)
  • Art. 6 (1) lit. c GDPR: for processing to which we are subject to a legal obligation (e.g. tax retention obligations)
  • Art. 6 (1) lit. f GDPR: for processing necessary to protect our legitimate interests, provided your interests do not override these (e.g. server log files, IT security)

15. Legitimate Interests Pursued

Where processing is based on Art. 6 (1) lit. f GDPR, our legitimate interest lies in the proper operation and continuous improvement of our online shop, as well as ensuring the IT security of our systems.

16. Duration of Storage of Personal Data

Personal data is erased as soon as the purpose of storage no longer applies, and at the latest upon expiry of statutory retention periods. For invoicing and accounting records, a retention period of 10 years applies pursuant to § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB).

17. Provision of Personal Data

The provision of personal data is in part required by law (e.g. tax regulations) or may result from contractual provisions. Certain data (e.g. name, delivery address) must be provided in order to conclude a purchase contract with us; without this data, the contract cannot be concluded.

18. Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

As of: July 2026

Back to top