ZWILLING J.A. Henckels (UK) Ltd. (hereinafter also referred to as "ZWILLING", "we" or "us")

Unit 4, Bardon Hill, Sence Court, Coalville, LE67 1GZ

Phone: 0330 363 0005

Email: compliance@zwilling.co.uk

The following presentation provides you with an overview of our processing activities. We have subdivided these into different areas of activity. Please note that these are for orientation purposes only and that processing activities may overlap (e.g. the same data may be processed in several contexts).

The server on which this online offer is located collects so-called log files each time the online offer is accessed, in which user data is stored. The data is used to maintain and optimise server operation as well as for security purposes, e.g. to detect potential attempts of unauthorised access.

• Categories of data processed: Usage data and metadata (name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user's operating system, referrer URL [the previously visited page], IP address and the requesting provider.
• Legal basis: Art. 6(1)(f) GDPR (Legitimate interests).
• Purpose of processing: Optimisation of server operation and security monitoring.
• Necessity / interest in processing: Security, business interests.
• Categories of recipients: Data is only passed on to third parties if this is necessary for the operation of our website or for security or law enforcement purposes.
• Deletion of data: After 30 days from collection.

In this section, you will find information on our core services and tasks in connection with our online services, such as answering enquiries and providing our contractual services as well as ancillary tasks associated with them.

We process the data of our users to enable them to select and order the selected products and services, as well as to pay for and deliver or execute them.

A user account (including wish list) requires registration. Afterwards, users can track their orders after entering their login data and use further functions of the user account. Users' account information is not searchable or viewable by external entities such as search engines or by other users. Users are responsible for the safekeeping of their access data.

We offer our own single sign-on procedure for the user account. This means that users who register with one of the online services of the companies belonging to the ZWILLING Group can also use the access data with other online services of companies belonging to the ZWILLING Group.

In addition to our own single sign-on procedure, we also offer single sign-on logins via third-party providers. This allows you to log in to our online offering using the authentication data stored with the third-party provider (e.g. Facebook or Google).

Authentication takes place directly with the respective third-party provider. In the course of such authentication, we receive a user ID that cannot be used by us for any other purpose and the information that the user is logged in to the respective single sign-on provider under this user ID (so-called "user handle"). In addition, the user's name and email address are transmitted to us. Whether additional data is transmitted to us depends on the selected data releases in the context of authentication and your privacy or other settings with the third-party provider. Depending on the single sign-on provider and the user's choice, this can be different data, usually the e-mail address and the user name. The password entered as part of the single sign-on procedure with the third-party provider is neither visible to us nor is it stored by us.

• Categories of data processed: Inventory data, contact data.
• Legal basis: Art. 6(1)(a) GDPR (Consent), Art. 7 GDPR (Conditions for consent)
• Purposes of processing: registration and login
• Recipients (depending on single sign-on procedure):

As part of our customer data management and customer relationship management, we store information about your order history and about product or topic-specific issues (e.g. regarding any product registrations you may have made, your preferences with regard to individual product segments, brands or - if you have provided us with these - preparation methods favoured by you) in our customer relationship management system (CRM system) or in similar applications. The same applies to information that we receive from you via our contact form and in other ways, e.g. via e-mail, enquiries.

• Categories of data processed: Inventory data, contact data, contract data, payment data, usage data, metadata.
• Legal basis: Art. 6(1)(f) GDPR (Legitimate interests); Art. 9(2)(a) GDPR (Processing of special categories of personal data), insofar as the customer's request contains special categories of data within the meaning of Art. 9(1) GDPR.
• Purpose of processing: answering enquiries, customer relationship management.
• Necessity / interest in the processing: The processing is necessary to answer incoming enquiries, serves the optimisation of advice, the improvement of user-friendliness as well as business interests.
• Categories of recipients: Provider of the CRM system (order processor). Your data is stored within the European Union. However, in the case of IT support or maintenance work, data access from other third countries, i.e. a country outside the UK and the European Union, cannot be ruled out.
• Deletion of data: We delete the enquiries if they are no longer required. We store enquiries from users who have a user account permanently and refer to the details of the user account for deletion. We delete other data processed within the framework of customer relationship management when your user account is terminated. In the case of statutory archiving obligations, deletion takes place after their expiry (end of contract claims (6 years) and tax law (10 years) retention obligation).

We collect customer feedback in the form of reviews and questions and answers and make them available on our platform so that other users can find out about our products and services. We also offer our customers the opportunity to ask questions about our products on our website and have them answered by us and other users.

• Categories of data processed: Content data (texts, images, videos), user name (username, alias), email addresses, date of review or change, order if applicable, verification data.
• Legal basis: Article 6(1)(f) GDPR (Legitimate interests: review examination).
• Purpose of the processing: Management and offering of the feature.
• Necessity / interest in processing: The data is necessary for communication with the customer, for their identification and for the publication of their reviews and questions. It is in our legitimate interest to check the content of reviews received before publication.
• Categories of recipients: Provider of the review management tool (processor). In the context of processing by our processors, data is transferred to a third country or such data transfer cannot be ruled out.
• Deletion of data: Upon customer request; in the case of unpublished customer contributions, 90 days after submission.

In order to operate our business economically and to be able to recognise market trends as well as customer and user wishes, we analyse the data we have on business transactions, contracts, enquiries, etc. For this purpose, we combine the user data from registrations and orders with the behaviour-related data of the users.

• Categories of data: Inventory data, contact data, contract data, payment data, usage data and metadata, e.g. activity data outgoing from emails via our online channels, e.g. data on the page accessed, the page history, the device used, geo-data and data for pseudonymised identification of the user profile).
• Legal basis: Art. 6(1)(f) GDPR (Legitimate interests).
• Purpose of the processing: Business analyses, marketing and market research.
• Necessity / interest in the processing: Increase in user-friendliness, optimisation of the offer, business management.
• Categories of recipients: Provider of the CRM system (processor). Your data is stored within the European Union. However, in the case of IT support or maintenance work, data access from other third countries, i.e. a country outside the UK and the European Union, cannot be ruled out.
• Deletion of data: If a user account has been created, upon its termination, otherwise after two years from the conclusion of the contract. In all other respects, the business analyses and general trend determinations are prepared anonymously wherever possible.

If you use our ZWILLING Culinary World app, it must access your mobile phone's camera for the following functions:

• Scanning of the QR codes on the boxes and bags of the Fresh & Save vacuum system. The corresponding size and, in the case of the bags, the printed individual ID are recorded to identify the bag.
• Take your own photo of the vacuumed food for the food organiser function.

The photos are only stored locally on your mobile phone. There is no access or other transfer of photo data to ZWILLING or third parties.

We maintain online presences within the social networks and platforms listed below in order to communicate with the users active there and to inform them about our company and our products. If you communicate with us within the social networks and platforms, e.g. write posts on our online presences or send us messages, we process your data for communication purposes. In addition, when you visit and use our respective online presence, the operator of the network or platform may evaluate your usage behaviour and provide us with information obtained from this. This information is used for the purpose of economic optimisation and demand-oriented design of our online presence.

Furthermore, your data within social networks and platforms is usually processed by the respective operator for market research and advertising purposes. For example, user profiles can be created based on your usage behaviour and the resulting interests, in order to place interest-based advertisements within and outside of the networks and platforms. For further information on the operator's processing and any opt-out options, please refer to the privacy policies of the respective operators.

Our processing of your data is in each case based on our legitimate interest (Art. 6(1)(f) GDPR) in increasing awareness of our company, in communicating with people who are interested in our company and our products, and in better understanding your wishes and interests. In doing so, the categories of data we may collect are inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. text entries, photographs, videos), usage data (e.g. websites visited, interest in content, access times), meta and connection data (e.g. device information, IP addresses). The deletion of your data is determined by the privacy policies of the respective operator.

The links/buttons to social networks and platforms (e.g. Facebook, Twitter or Pinterest) used within our online offer generally only establish contact between social networks or platforms and the users when users click on the links/buttons. This function corresponds to the mode of action of a regular online link. If you click on a corresponding link/button, this opens a new page that is retrieved from the servers of the respective social network or platform. Through this, the operator of the social network obtains knowledge that our website was accessed via your IP address. At the same time, the provider may place cookies on your end device or read cookies, unless you have prohibited the use of cookies in your browser. For further information on any processing of your personal data by the operators of the social networks or platforms, please refer to the privacy policy of the respective operator.

In this section, we inform you which content, software or functions (in short "content") of other providers we embed within the scope of our online offer (so-called "embedding"). This does not create a copy of the content, as it is called up from the original server. Embedding is done for legal reasons - e.g. for cookie management - to make our online offer more interesting for our users - e.g. to be able to display directions to our shops - or to improve the security of the online offer - e.g. to prevent bot attacks.

In order to display the content, it is necessary for the third-party providers of this content to process the IP address of the users, as without the IP address they would not be able to send the content to their browser. The IP address is thus necessary for the presentation of this content or function. Insofar as the collection of further categories of data is necessary for the presentation of the content, these are listed below under the respective service. ZWILLING's responsibility under data protection law is limited to the collection and transmission of the IP address and any other data required for the presentation of the content to the third-party provider. The responsibility after transmission of the data lies solely with the third party provider. For further information on any processing of your data by the respective third-party provider, please refer to the privacy policies of the respective third-party provider.

When you visit our website, certain information is placed on your terminal device or read if this is absolutely necessary for the operation of our website. This includes information processed by the "Cookiebot" service of our cookie management service provider Cybot A/S ("Cybot") to ensure that only those cookies are set or read that are technically necessary to operate our website or for which you have consented to use. When the code from Cookiebot is loaded, your IP address is transmitted to Cybot, where it is stored anonymously.

• Categories of data processed: Usage data, connection data.
• Legal basis: Art. 6(1)(c) GDPR (Compliance with a legal obligation), Art. 6(1)(f) GDPR (Legitimate interests)./li>
• Purpose of processing: Cookie management.
• Necessity / interest in processing: The use of Cookiebot prevents the use of optional cookies without the prior consent of the user.
• Categories of recipients: Cookie management service provider (processor).
• Deletion of the data: Depending on the cookie used.

• Categories of data processed: Usage data, connection data, possibly location data (depending on GPS usage).
• Legal basis: Art. 6(1)(c) GDPR (Compliance with a legal obligation), Art.6(1)(f) GDPR (Legitimate interests).
• Purpose of processing: integration of interactive maps and map function of Google Maps.
• Necessity / interest in the processing: The use of Google Maps makes it easier for the user to locate the nearest ZWILLING shop.
• Recipient of the data: Google Ireland Ltd, Gordon House, Barrow Street Dublin 4 Ireland. Within the scope of this service, data is transferred to a third country, i.e. a country outside the UK, cannot be ruled out.

• Categories of data processed: Usage data, connection data.
• Legal basis: Art. 6(1)(f) GDPR (Legitimate interests).
• Purpose of processing: To prevent misuse of our website by verifying that accesses to our website are made by humans and not by bots or similar programs.
• Necessity / interest in processing: It is in our legitimate interest to ensure the security of our website and our information technology systems.
• Recipient of the data: Google Ireland Ltd, Gordon House, Barrow Street Dublin 4 Ireland. Within the scope of this service, data is transferred to a third country, i.e. a country outside the UK, cannot be ruled out.

• Data categories: Usage data, connection data.
• Legal basis: Art. 6(1)(f) GDPR (Legitimate interests).
• Purpose of processing: Integration of videos via the YouTube video plugin.
• Necessity / interest in processing: It is in our legitimate interest to be able to present you with further information on our products by integrating videos. In order to minimise data, we use the so-called extended data protection mode offered by the service provider.
• Recipient of the data: Google Ireland Ltd, Gordon House, Barrow Street Dublin 4 Ireland. Within the scope of this service, data is transferred to a third country, i.e. a country outside the UK, cannot be ruled out.

This section provides you with information on the data processing we carry out for the purposes of optimising our services, marketing and market research.

With your consent, ZWILLING will send general as well as personalized information and invitations from the ZWILLING world. For this purpose, you can be contacted via email as well as via the ZWILLING app, messenger services or social media. You can revoke your consent at any time with effect for the future.

Below you will find further explanations on the scope of any consent you may have given:

Insofar as reference is made to ZWILLING in the consent, this refers to the company named in Section I of this data protection declaration (responsible party). However, the following other companies of the ZWILLING Group and their legal successors are also included:

Insofar as personal data is passed on to these companies, they process the data under their own responsibility and only to the extent of the consent given by you.

In addition to the ZWILLING companies themselves, the ZWILLING World also includes products from the ZWILLING, Staub, Ballarini, Miyabi, Demeyere, and Tweezerman brands, grills and grilling accessories from various manufacturers (including Santos and Flammkraft), and related services (e.g. engraving and grinding services or grilling seminars).

By information we mean, for example 
-    Offers and promotions
-    News about products and services
-    Recipes
-    Tips such as care tips
-    Reminders for unfinished orders in the ZWILLING online store
-    Information on our applications such as our ZWILLING app and our online presences.
-    other interesting news from the ZWILLING world

Invitations can be made to

A personalized communication (e.g. a product recommendation tailored to your interests) can be made on the basis of the evaluation of the following information:

The data of newsletter subscribers are logged, as we are obliged to be able to prove registrations. Furthermore, we keep track of whether newsletters have been opened and whether links have been clicked. This information is stored on a per-user basis for technical reasons, but is not used to monitor individual users, but rather to tailor content and offers to users, for example. Information that we should collect in addition to the e-mail address (e.g. name) is used to address the user personally or to adapt newsletter content to the user.

To the extent permitted by law, we will use your e-mail address, which we have received from you in connection with the sale of a good or service, for direct marketing of our own similar goods or services (hereinafter "direct marketing"). You can object to the use of your e-mail address for direct marketing at any time, for example by unsubscribing via a link contained in every e-mail. 

In the context of sweepstakes and competitions (in short "competitions"), we process the data of the participants for the purpose of conducting the competitions. Users will receive further information on the processing of their data within the framework of the individual competition as well as any consent to the publication of their names or competition entries within the conditions of participation of the respective competition.

• Categories of data processed: Inventory data, contact data, content data (e.g. entries to competitions).
• Legal basis: Art. 6(1)(b) GDPR (Performance of a contract
• Purpose of the processing: Administration of the competitions, notification of prizes, dispatch of prizes, possibly presentation of winners.
• Necessity / interest in processing: The provision of your data is required in each case for the implementation of the competition in accordance with the respective conditions of participation.
• Categories of recipients: Shipping companies for the purpose of shipping the prizes, possibly partners and sponsors of prizes.
• Deletion of data: As soon as the data is not required for the implementation of the competition (e.g. in the event of queries about prizes); when winners or competition entries are published, these generally remain online permanently; otherwise archiving in the event of a legal obligation (end of contract claims (6 years) and tax law (10 years) retention obligation

In connection with your visit to our online shop, it is possible that you will be invited by us to participate in customer surveys. Depending on the survey, you may be invited to participate directly on our website or we may invite you to participate by e-mail.

• Categories of data processed, depending on the survey: Metadata (e.g. referrer URL [the previously visited page], click behaviour, browser type and version, the user's operating system, IP address and the requesting provider), email address (for communication purposes), survey responses. If it is necessary to prevent multiple participations, we use a cookie block by storing a cookie in the participant's browser. This means that the user is recognised on further visits and can be excluded.
• Legal basis: Art. 6(1)(f) GDPR (Legitimate interests).
• Purpose of the processing: Internal analysis of customer preferences, further development and optimisation of our product portfolio as well as sales and marketing purposes.
• Necessity / interest in processing: Participation in a survey is voluntary. However, if you decide to participate, it is in our legitimate interest to use your data for the purposes mentioned above.
• Categories of recipients: Within the ZWILLING Group, access to your data is granted to those business units that need it to fulfil the above-mentioned purposes. Access to your data is also possible by service providers used by us (e.g. service providers who provide the IT infrastructure for processing the survey or for managing our customer data). Your data will be stored within the European Union. However, in the case of IT support or maintenance work, data access fromthird countries, i.e. a country outside the UK and the European Union, cannot be ruled out.
• Deletion of the data: As soon as we no longer have a legitimate interest in further processing and the deletion does not conflict with any statutory retention obligations.

In certain situations, it is conceivable that we or third parties may provide you with vouchers for purchases in our online shop, e.g. as a thank you for your participation in a survey or other promotions or in the form of discount vouchers when using third-party affiliate programmes. For further information on the respective vouchers, please refer to the respective voucher terms and conditions.

• Categories of data processed: Voucher number, issue date, validity date, amount and, depending on the voucher form, authorisation status, name and e-mail address, if applicable.
• Legal basis: Art. 6(1)(b) GDPR (Performance of a contract) (e.g. if you participate in a promotion linked to a voucher), Art. 6(1)(f) GDPR (Legitimate interests) (e.g. if we proactively provide you with vouchers from us).
• Purpose of the processing: Voucher management
• Necessity / interest in processing: The data is necessary for voucher management. It is in our legitimate interest to provide you with vouchers as needed for customer retention or customer acquisition. The redemption of a voucher is voluntary.
• Categories of recipients: Service providers who provide the IT infrastructure for voucher management (order processors). Your data is stored within the European Union. However, in the case of IT support or maintenance work, data access from third countries, i.e. a country outside the UK and the European Union, cannot be excluded.
• Deletion of the data: As soon as we no longer have a legitimate interest in further processing and the deletion does not conflict with any statutory retention obligations.

We are integrated into various affiliate programmes of affiliate network providers (e.g. AWIN) or affiliate platforms (e.g. Unidays). In doing so, so-called affiliate links or other references to our online offer are integrated on third-party websites (collectively referred to as "affiliate links"). If users follow the affiliate links and subsequently purchase products in our online shop, these third-party providers may receive a commission. For this purpose, it is necessary that the respective third-party providers learn that the users have followed an affiliate link and have subsequently made a purchase from us. The assignment of the affiliate links to the respective orders serves the sole purpose of commission settlement.

• Types of data processed: Contract data (e.g. subject matter of contract, term, customer category), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
• Legal basis: Depending on your agreement with the third-party provider, Art. 6(1)(a) GDPR (Consent), Art. 7 GDPR (Conditions for consent), Art. 6(1)(b) GDPR (performance of the contract within the framework of the third-party provider's affiliate programme) or Art. 6(1)(f) GDPR (our legitimate interest in commission accounting).
• Purposes of processing: Affiliate tracking and commission accounting.
• Categories of recipients: Affiliate partners.
• Deletion of the data: In the case of your consent, as soon as you revoke your consent, otherwise when we no longer have a legitimate interest in further processing and the deletion does not conflict with any statutory retention obligations.

In this section, we inform you which services of technology partners we use for reach measurement and online marketing purposes. Insofar as no anonymous or anonymised data is processed or we do not obtain your prior consent in the context of the use of cookie management (Art. 6(1)(a) GDPR (Consent), Art. 7 GDPR (Conditions for consent)), their use is based on our legitimate interest (Art. 6(1)(f) GDPR) in increasing user-friendliness and optimising and controlling our offer in a more targeted manner.

Google Tag Manager is a solution with which we can manage so-called website tags via an interface (and thus, for example, integrate Google Analytics and other Google marketing services into our online offer). The tag manager itself (which implements the tags) does not process any user data. With regard to the processing of users' data, please refer to the following information on Google services.

We use the personalization and web analytics service Kameleoon. The program allows us to analyse user behavior based on (automated) user groups. We can use the analysis of log file data to determine how individual user groups visit the website, which landing pages are visited and how an increase in click-through rates can be achieved. For this purpose, the program analyses your behavior and its context when using this website and assigns this to target groups in an anonymized form.

For the analyses, cookies/local storage of the browser are used, which are linked to a pseudonymized ID. Your IP address is completely anonymized and not stored. The information generated by the cookie/local storage about your use of this website is transmitted to a Kameleoon server in the EU and stored there in aggregated and pseudonymized form. The IP address transmitted by your browser as part of Kameleoon is not merged with other data from Kameleoon.

You have the right to request confirmation as to whether data relating to you is being processed and to be informed about this data and to receive further information and a copy of the data in accordance with Art. 15 GDPR.

In accordance with Art. 16 GDPR, you have the right to request that the data concerning you be completed or that the incorrect data concerning you be corrected.

In accordance with Article 17 of the GDPR, you have the right to demand that data relating to you be deleted without delay or, alternatively, to demand restriction of the processing of the data in accordance with Article 18 of the GDPR.

You have the right to obtain the data concerning you that you have provided to us in accordance with Art. 20 of the GDPR and to request that it be transferred to other data controllers.

You also have the right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 GDPR.

You have the right to revoke any consent you have given in accordance with Art. 7(3) GDPR with effect for the future.

Where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms, you may object to the future processing of data concerning you in accordance with Art. 21 GDPR at any time. The objection can be made in particular against processing for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Unless otherwise stated above in the respective information on the legal basis for processing, you are not obliged to provide data. In the cases of Art. 6(1)(b) GDPR (Performance of a contract)), however, the data is required for the performance or conclusion of a contract. If you do not provide the data concerned, the fulfilment or conclusion of the contract is not possible. In the cases of Art 6(1)(c) GDPR (Legal obligation), we are legally obliged to process the data. If you do not provide us with the data in the cases of Art. 6(1)(a) GDPR (Consent), Art. 6(1)(f) GDPR  (Legitimate Interests), the use of the affected parts of our website or services is not possible or only possible to a limited extent.

If, in the course of our processing, we disclose data to other persons and companies (order processors or third parties), grant access to the data or transfer it in any other way, this will only be done on the basis of legal permission (e.g. if a transfer of the data to third parties, such as to shipping and payment service providers, is necessary for the performance of the contract pursuant to Art. 6(1)(b) GDPR (Performance of a contract)), you have consented, a legal obligation pursuant to Art. 6(1)(c) GDPR (Legal obligation) provides for this or on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR (Legitimate interests) (e.g. in the case of receivables management).

If we commission third parties with the processing of data on the basis of a so-called "order processing agreement", this is done on the basis of Art. 28 GDPR (e.g. in the processing of complaints or general product advice enquiries by service providers commissioned by us), which sets out the requirements for engaging a processor.

If we pass on data to other companies in our group of companies, grant access to the data or transfer it in any other way, this is done in particular for administrative purposes as a legitimate interest pursuant to Art. 6(1)(f) GDPR (Legitimate interests) or on the basis of commissioned processing. To the extent necessary, we have concluded intra-group data processing agreements for this purpose.

Any transfer of your data to a third country (i.e. to a country outside the UK) will take place in accordance with Art. 44 et seq. GDPR. If a transfer is therefore not already permitted on the basis of the legal permissions there (e.g. to enable the delivery of goods ordered by you to an address given to you in the third country, see Art. 49(1)(b) GDPR), we have provided data protection guarantees to ensure a sufficient level of data protection for your data in these cases as well (e.g. the conclusion of officially recognised special contractual agreements, so-called "standard contractual clauses"). To obtain further information on the guarantees mentioned, please contact our data protection officer.