Privacy Policy

Data Protection

GDPR-compliant handling of your data: collection, processing and protection – from Berlin for over 20 years.

Last updated: November 2026

1 – Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we inform you about the handling of your personal data when using our website. Personal data within this meaning is any data by which you can be personally identified.

1.2 The Controller responsible for the data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is subtel GmbH, Mainzer Str. 3, 10247 Berlin, Germany, tel.: +49 (0)30 8020899-50, fax: +49 (0)30 8020899-69, email: info@subtel.es. The Controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 The Controller has appointed a Data Protection Officer, who can be contacted as follows: "Jan Eichelmann, Mainzer Str. 3, 10247 Berlin".

2 – Data Collected When Visiting our Website

2.1 When you use our website purely for informational purposes – that is, when you do not register or otherwise transmit information to us – we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website, we collect the following data that is technically necessary for us to display the website to you:

the website you visit on our site
date and time of access
amount of data sent (in bytes)
the source/referrer from which you arrived at the page
the browser used
the operating system used
the IP address used (where applicable, in anonymised form)

The processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. We do, however, reserve the right to subsequently review the server log files should there be concrete indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the Controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" and the padlock symbol in your browser bar.

3 – Hosting & Content Delivery Network

Hosting. Our online shop, our customer service system and our technical monitoring tools run on our own servers in Germany. For the fast delivery of static files we also use the content delivery network described below.

Bunny.net

We use a content delivery network from the following provider: BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia.

This service enables us to deliver large media files such as graphics, page content or scripts more quickly via a network of regionally distributed servers. The processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6(1)(f) GDPR. We have concluded a data processing agreement with the provider which ensures the protection of our website visitors' data and prohibits unauthorised disclosure to third parties.

The provider is based in the European Union (Slovenia), so that personal data is in principle not transferred to third countries. Insofar as the provider processes data via edge servers outside the EEA, this is done on the basis of the European Commission's Standard Contractual Clauses.

4 – Cookies

In order to make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted again after the browser is closed (so-called "session cookies"); others remain on your device for longer and enable the storage of page settings (so-called "persistent cookies"). In the latter case, you can find the storage duration in the cookie settings overview of your web browser.

Insofar as personal data is also processed by individual cookies used by us, the processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the site visit.

Insofar as cookies that are not strictly necessary for the provision of the service are stored on your device or information is accessed in your device, this is done on the basis of your consent pursuant to Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(a) GDPR. Technically necessary cookies are set on the basis of Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(f) GDPR.

You can set your browser to inform you about the setting of cookies and to decide individually about their acceptance, or to exclude the acceptance of cookies in certain cases or generally. You can withdraw or adjust your consent at any time via the cookie consent tool provided on the website.

Please note that the functionality of our website may be restricted if cookies are not accepted.

4.1 Consent management tool (CookieScript)

To obtain and manage your consent under Art. 22.2 LSSI-CE and Art. 6(1)(a) GDPR we use the consent management tool “CookieScript” of Objectis UAB, Laisvės pr. 60, LT-05120 Vilnius, Lithuania.

On your first visit you can accept or reject all non-essential cookies and tracking tools with equal ease, or make a choice per purpose. Your choice (consents given or refused per category and the time of the choice) is stored in the cookie “CookieScriptConsent” on your device so that we can respect it on later visits; the cookie is deleted after 365 days. Storing this cookie is strictly necessary to provide the service you requested (Art. 22.2, second subparagraph, LSSI-CE); the processing also serves to meet our obligation to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

The analytics and advertising services described below (Google Analytics 4, Google Ads, Microsoft Advertising, Microsoft Clarity, Meta Pixel) receive your choice from the tool and only set cookies or process data for analytics or advertising purposes if you have consented. We have concluded a data processing agreement with the provider under Art. 28 GDPR. You can change or withdraw your consents at any time with effect for the future via the cookie consent tool provided on the website.

4.2 A/B tests

To improve our shop we sometimes compare two versions of a page (A/B test). So that you always see the same version during a test, we store two first-party cookies in your browser: “st_exp” (a random identifier) and “st_exp_v” (the version assigned). These cookies contain no data that identifies you directly and are not passed to third parties. The legal basis is our legitimate interest in improving our shop (Art. 6(1)(f) GDPR). Tests are evaluated statistically in Google Analytics only if you have consented to Google Analytics (see section 8).

5 – Contact

5.1 Review invitations

After your order has been completed, we may send you a review invitation to the email address provided with the order. Its sole purpose is to give you the opportunity to share your experience with the product purchased and with the handling of your order. Review invitations are only sent while this function is active.

The legal basis for this processing is Art. 6(1)(f) GDPR in conjunction with Art. 21.2 of the Spanish Information Society Services Act (Law 34/2002, LSSI-CE). Our legitimate interest lies in ensuring product quality and continuously improving our range on the basis of customer feedback.

We use our email service provider Brevo as a processor to send the invitations (see section 7.4). Your data is not passed to any other third party; reviews submitted are stored exclusively in our own systems.

You can object to the use of your email address for review invitations at any time without incurring any costs other than transmission costs at the basic rates. An informal message to info@subtel.es is sufficient.

5.2 Contact Enquiries

When you contact us (e.g. via the contact form or by email), personal data is processed – exclusively for the purpose of processing and answering your enquiry, and only to the extent necessary for this purpose.

The legal basis for the processing of this data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted if it can be inferred from the circumstances that the matter in question has been definitively resolved and provided that no statutory retention obligations conflict with this.

5.3 Handling of your enquiries

Enquiries you send us by email, via our contact form, by telephone, via the chat on our website (see section 5.5) or via the messaging functions of online marketplaces are handled in our customer service system “subtelcom”. We operate this system ourselves on our own servers in Germany; no external service provider is used for customer communication.

We process the information you give us (in particular name, email address, telephone number, content of your message and any attachments), the time and channel of communication and, where needed to handle the enquiry, your customer and order data. For telephone calls we store the telephone number, the date, the time and the duration of the call in the system. Messages sent to us via an online marketplace are passed to us by the marketplace operator, who is itself the controller for the processing on its platform.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract with us or steps prior to entering into a contract, and otherwise our legitimate interest in answering enquiries quickly and efficiently (Art. 6(1)(f) GDPR). Enquiries, chats and our replies are deleted three years after the end of the year of the last contact, unless statutory retention duties (e.g. 6 years for commercial correspondence) require longer storage.

5.4 Newsletter

If you subscribe to our newsletter (e.g. in the website footer, during checkout or on the order confirmation page), we use your email address and – if provided – your name to send you care tips, information, review requests and offers on batteries and accessories by email. The legal basis is your consent under Art. 21.1 LSSI-CE and Art. 6(1)(a) GDPR.

Double opt-in and logging: After subscribing you receive an email in which you confirm your subscription. Only then do we send you the newsletter. To be able to prove your consent, we store the time of subscription and confirmation, the IP address used, the place of subscription and, where applicable, the time and channel of unsubscribing. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR and our legitimate interest in proving consent (Art. 6(1)(f) GDPR).

Sign-up with an order: By way of exception, we send the newsletter without a confirmation email if you sign up during checkout or on the order confirmation page; we then use the email address you gave with your order. The legal basis is your consent and our legitimate interest in marketing our own similar goods to our customers (Art. 6(1)(f) GDPR; Art. 21.2 LSSI-CE). You can object to the use of your email address for the newsletter at any time, at no cost other than the transmission costs at basic rates, via the unsubscribe link in every newsletter or by email to info@subtel.es. We log the time and place of the sign-up as described above.

Personalised content: So that the newsletter fits your devices, we select the products and tips shown on the basis of: shop and language, place of subscription, number of your orders, date and number of your last order, the items it contained and the device category of your last purchase or of the page on which you subscribed. The legal basis is our legitimate interest in a newsletter that is relevant to you (Art. 6(1)(f) GDPR). No automated decision within the meaning of Art. 22 GDPR is involved. You can object to this evaluation at any time, e.g. by email to info@subtel.es.

Performance measurement: Our newsletters contain a tracking pixel and links through which our email service provider records whether an email was delivered and opened and which links were clicked; links to our shop also contain a tracking parameter. We also determine whether recipients ordered from us within seven days of receiving an email. We evaluate this information per mailing in aggregated form to improve our newsletters. The legal basis is your consent (Art. 22.2 LSSI-CE; Art. 6(1)(a) GDPR), which you give when subscribing. It is not possible to withdraw consent to the performance measurement alone; you can, however, unsubscribe from the newsletter at any time.

Identifying inactive subscribers: If you gave your additional consent when signing up, we store every click on a link in our newsletters together with your email address. We use this information only to identify subscribers who no longer read the newsletter and to stop sending it to them. You count as inactive if you have been subscribed for at least 90 days, have neither clicked a link in a newsletter nor ordered from us in the last 90 days, and have not already been contacted in this way in the last 180 days. You will then receive up to three emails over 12 days in which you can confirm that you want to keep receiving the newsletter. If you click a link in one of our emails or place an order during this time, your subscription continues. Otherwise, we end your newsletter subscription automatically 19 days after the first of these emails; you can sign up again at any time. No decision with legal effect for you is involved. The legal basis is your consent (Art. 22.2 LSSI-CE; Art. 6(1)(a) GDPR). You can withdraw this consent separately at any time, e.g. by email to info@subtel.es; you will continue to receive the newsletter and we will delete the stored clicks. Each stored click is deleted after 12 months, and also when you unsubscribe or withdraw this consent. We keep a record of when and why each such check started and ended together with the proof of your consent and delete it together with that proof.

Service provider Brevo: We use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) to send the newsletter and manage the recipient list. The data listed above is transmitted to and stored by Brevo for this purpose. We have concluded a data processing agreement with Brevo under Art. 28 GDPR; processing takes place within the European Union. Further information is available in Brevo's privacy policy: https://www.brevo.com/legal/privacypolicy/.

Unsubscribing and storage period: You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every newsletter (including one-click unsubscribe) or by email to info@subtel.es. Withdrawal does not affect the lawfulness of processing carried out before it. After you unsubscribe you will no longer receive the newsletter; we remove your email address from the mailing list and delete the data used for personalisation at Brevo. We keep the log data of your subscription, confirmation and unsubscription as proof of your consent until the end of the third year after the year in which you unsubscribed, and delete it afterwards. Unconfirmed subscriptions are deleted after 30 days.

5.5 Chat on our website

You can use the chat window on our website to ask us questions about products, orders, deliveries and returns.

Answers from an AI system: Your questions are first answered by our digital assistant “Mia”, an AI system (language model). We tell you this at the start of every chat in the chat window. The system runs exclusively on our own servers; your chat content is not passed to third parties for this purpose and is not used to train third-party models. AI answers may contain errors; binding information (e.g. on refunds or warranty) is provided by our staff.

Handover to a member of staff: You can ask to speak to a member of staff at any time. If the assistant cannot resolve your request, it hands the chat over to our customer service; the member of staff sees the chat history.

Data processed: your messages and any files you upload (e.g. photos of a product), time, language and shop, the page from which you started the chat and – if you are logged in or provide them – name, email address and order data. To prevent misuse (limiting the number of requests) we calculate a non-reversible hash value from your IP address and browser identifier.

Order information: If you would like information about an order in the chat without being logged in, we send a one-time code to the email address given with the order. We show order information only after this code, which is valid for 10 minutes, has been entered. This ensures that order data is shown only to you (Art. 32 GDPR).

Storage on your device: So that you can continue a chat, e.g. after changing page, we store a random chat identifier in the technical cookie “subtel_chat” (HttpOnly) and in your browser's storage. An ongoing chat can be accessed for 24 hours; as a guest you can resume a chat for up to 30 days. This storage is strictly necessary for the chat function you requested (Art. 22.2, second subparagraph, LSSI-CE).

Legal basis and storage period: The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract with us or steps prior to entering into a contract, and otherwise our legitimate interest in answering customer enquiries quickly (Art. 6(1)(f) GDPR). Chats are stored in our customer service system (see section 5.3). Enquiries, chats and our replies are deleted three years after the end of the year of the last contact, unless statutory retention duties (e.g. 6 years for commercial correspondence) require longer storage. Please do not enter payment data (e.g. card numbers), passwords or particularly sensitive data (e.g. health data) in the chat.

6 – Data Processing when Opening a Customer Account

Pursuant to Art. 6(1)(b) GDPR, personal data continues to be collected and processed to the extent required if you provide it to us when opening a customer account. You can find the data required to open an account on the input mask of the relevant form on our website.

Your customer account can be deleted at any time by sending a message to the above address of the Controller. After your customer account has been deleted, your data will be deleted, provided that all contracts concluded via the account have been fully processed, no statutory retention periods apply, and we no longer have a legitimate interest in further storage.

6.1 Business accounts and VAT number check

If you register as a business customer and provide a VAT identification number, we check its validity via the European Commission's VAT Information Exchange System (VIES), which forwards the query to the competent tax authority of the Member State concerned. Your VAT number and our own VAT number are transmitted for this purpose. We store the result of the check as evidence for net pricing or a tax-exempt intra-Community supply. The legal basis is Art. 6(1)(b) GDPR (application of the business customer terms) and Art. 6(1)(c) GDPR in conjunction with the evidence and retention obligations of VAT law. The evidence is kept for the statutory retention period.

7 – Data Processing for Order Fulfilment

7.1 Insofar as it is necessary for the performance of the contract for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution pursuant to Art. 6(1)(b) GDPR.

If we owe you updates for goods with digital elements or for digital products on the basis of a relevant contract, we process the contact data (name, address, email address) transmitted by you when ordering in order to personally inform you in good time about pending updates, by suitable means of communication (e.g. by post or by email), within the framework of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact data will only be used in a strictly purpose-bound manner for notifications about updates owed by us and will be processed by us for this purpose only to the extent necessary for the respective information.

To process your order, we also cooperate with the following service provider(s), who support us in whole or in part in the performance of contracts concluded. Certain personal data is transmitted to these service providers in accordance with the following information.

7.2 Disclosure of personal data to shipping service providers

General Logistics Systems Spain SLU (GLS)

As a transport service provider, we use the following provider: General Logistics Systems Spain SLU (GLS), C/Tineo 8, 28031 Madrid, España

We pass on your email address and/or telephone number to the provider pursuant to Art. 6(1)(a) GDPR before delivery of the goods for the purpose of arranging a delivery date or delivery notification, provided that you have given your express consent during the ordering process. Otherwise, we only pass on the recipient's name and the delivery address to the provider for the purpose of delivery pursuant to Art. 6(1)(b) GDPR. Such disclosure only occurs to the extent necessary for the delivery of the goods. In this case, prior arrangement of the delivery date with the provider or delivery notification is not possible.

The consent can be withdrawn at any time with effect for the future, either against the Controller named above or against the provider.

Sermoga Ossorio Franqueo SL

For receiving and processing returns in Spain we work with the following logistics service provider: Sermoga Ossorio Franqueo SL, C/ Sierra Nevada 13-15, 28830 San Fernando de Henares, Madrid, Spain. When you return an item, this provider processes the data on the parcel and the enclosed documents (in particular name, address and order number) solely to receive and process the return, pursuant to Art. 6(1)(b) GDPR.

7.3 Use of payment service providers

Adyen

Payments are processed by Adyen N.V., Simon Carmiggeltstraat 6-50, 1011 DJ Amsterdam, Netherlands (“Adyen”). All payment methods offered in our shop (e.g. credit and debit card, Apple Pay, Google Pay, PayPal, Klarna, bank transfer) are processed via Adyen. Depending on the payment method chosen, we transmit to Adyen your name, billing and delivery address, email address, order number and amount, currency and information on the content of your order; you enter card data directly into a field provided by Adyen, and it is not stored on our servers. The legal basis is Art. 6(1)(b) GDPR. Adyen processes this data as a licensed payment institution under its own responsibility to execute the payment, to meet legal obligations (e.g. anti-money-laundering) and to prevent fraud: https://www.adyen.com/policies-and-disclaimer/privacy-policy.

PayPal

If you choose PayPal, you are redirected to PayPal. We or Adyen transmit the order amount, currency and order number and, where applicable, your name and delivery address to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). PayPal processes this data as an independent controller, including for fraud prevention: https://www.paypal.com/es/legalhub/paypal/privacy-full.

Apple Pay and Google Pay

When you pay with Apple Pay or Google Pay, the payment is authorised via your account with the respective provider (Apple Distribution International Ltd., Cork, Ireland, or Google Ireland Limited, Dublin, Ireland). We only receive a payment token, not your full card details. The respective provider is an independent controller for the processing in your wallet.

Klarna

If we offer you Klarna payment methods (e.g. pay now, pay later, financing and invoice purchase for business customers) and you choose one of them, we transmit your contact and order data (name, address, date of birth if requested, email address, telephone number, IP address, order amount and items; for business customers also company name and register details) to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”). Klarna uses this data to check your identity and creditworthiness and decides whether the chosen payment method can be offered to you; for this purpose Klarna may obtain information from credit reference agencies and use probability values (scores). Klarna takes this decision automatically and under its own responsibility, and processes your data as an independent controller in accordance with its privacy notice: https://www.klarna.com/es/privacidad/. There you will also find information on your rights, in particular the right to have an automated decision reviewed by a human. The legal basis for the transmission to Klarna is Art. 6(1)(b) GDPR.

7.4 Sending of emails

The emails we send you in connection with your order and your customer account (e.g. order and shipping confirmations, invoices, account confirmations and password resets) are sent via the email service provider Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). For this purpose your email address, your name and the content of the respective email are transmitted to Brevo. The legal basis is Art. 6(1)(b) GDPR where the email serves the performance of the contract, and otherwise our legitimate interest in reliable delivery (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Brevo under Art. 28 GDPR; processing takes place within the European Union.

7.5 Address autocomplete and verification

To make sure your delivery address is correct and deliveries do not fail, the postcode, house number, street and town you enter during checkout are transmitted while you type to Postcode.nl B.V., Netherlands (“Postcode.eu”), which returns matching address suggestions or verifies the address. Your name and contact details are not transmitted. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in error-free delivery (Art. 6(1)(f) GDPR). Postcode.eu acts on our behalf as a processor; processing takes place within the European Union.

8 – Web Analytics Services

Google Tag Manager

To manage and trigger the analytics and marketing services described below (Google Analytics 4, Google Ads, Microsoft Advertising, Microsoft Clarity and Meta Pixel) we use Google Tag Manager of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”). Google Tag Manager loads these services in your browser and triggers them only in line with the consents you have given in the consent management tool.

When Google Tag Manager loads, your browser connects to Google's servers; in particular your IP address and browser information are processed. Transfers to Google LLC in the USA are possible. The legal basis for the use of Google Tag Manager is our legitimate interest in managing the services we use efficiently and in line with your consents (Art. 6(1)(f) GDPR). Further information: https://marketingplatform.google.com/about/tag-manager/use-policy/.

For data transfers to the USA, Google LLC is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, standard contractual clauses of the European Commission have been concluded (Art. 46(2)(c) GDPR).

Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which enables us to analyse how our website is used.

If you have consented, Google Analytics 4 sets cookies on your device (e.g. “_ga”) to assign repeat visits to a pseudonymous identifier. In particular, pages visited, length of visit, origin of the visit, device and browser information and events such as viewing products, adding to the basket or a purchase are processed. For visitors from the EU, your IP address is used only on servers in the EU to derive an approximate location (country, region, city) and is then discarded immediately; it is not logged or stored by Google Analytics.

The information is transmitted to and processed on Google's servers; transfers to Google LLC in the USA are possible. Google uses the information on our behalf to evaluate the use of the website and compile reports for us. Event data is kept for two months, user-level data for no longer than 14 months.

All processing described, in particular the setting of cookies on your device, takes place only if you have given us your express consent under Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie consent tool provided on the website.

We have concluded a data processing agreement with Google (Art. 28 GDPR). Further information: https://business.safety.google/privacy/ and https://policies.google.com/technologies/partner-sites.

Demographic features

Google Analytics 4 uses the special "demographic features" function and can use it to create statistics that make statements about the age, gender and interests of site visitors. This is done by analysing advertising and information from third-party providers. This allows target groups for marketing activities to be identified. However, the data collected cannot be assigned to any specific person and will be deleted after a storage period of two months.

Google Signals

As an extension to Google Analytics 4, Google Signals may be used on this website to generate cross-device reports. If you have activated personalised advertising and have linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(a) GDPR, analyse your usage behaviour across devices and create database models for, among other things, cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop the cross-device analysis, you can deactivate the "Personalised Advertising" function in your Google account settings. To do so, follow the instructions on this page: https://support.google.com/ads/answer/2662922?hl=en. Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=en.

UserIDs

As an extension to Google Analytics 4, the "UserIDs" function may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(a) GDPR, have set up an account on this website, and log in to this account on different devices, your activities – including conversions – may be analysed across devices.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission. In addition, Standard Contractual Clauses of the European Commission provide a further safeguard.

Microsoft Clarity

If you have consented, we use Microsoft Clarity of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”) to understand how visitors use our website and to improve its usability. Clarity records interactions on our pages (e.g. clicks, mouse movements, scrolling) and presents them as heatmaps and session replays; for this purpose cookies are set on your device and in particular IP address, device and browser information and the pages visited are processed. Transfers to Microsoft Corporation in the USA are possible.

The legal basis is your consent under Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future via the cookie consent tool provided on the website. Further information: https://privacy.microsoft.com/en-gb/privacystatement.

For data transfers to the USA, Microsoft Corporation is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). In addition, standard contractual clauses of the European Commission have been concluded (Art. 46(2)(c) GDPR).

9 – Retargeting / Remarketing and Conversion Tracking

9.1 Google Ads: conversion tracking, remarketing and Customer Match

We use the online advertising programme “Google Ads” of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”) to draw attention to our offers with ads in Google Search and on partner sites, and we measure how successful these ads are.

Conversion tracking: If you click on one of our ads, a click identifier (gclid) is added to the address of our website. If you have consented, it is stored in a cookie on your device (usually for 90 days). If you reach a certain page (e.g. the order confirmation), Google and we can recognise that an order (“conversion”) followed the ad. In particular the click identifier, time, order value, currency, order number, IP address and browser information are transmitted to Google.

Remarketing: If you have consented, the Google Ads remarketing tag stores a pseudonymous identifier in a cookie and records the pages and products viewed. This allows us to show you ads for our offers on other websites and in Google services.

Customer Match: If you have given your consent for this, we transmit contact data (in particular email address and telephone number) to Google in encrypted form (hash values). Google matches them with existing Google accounts in order to show you relevant ads in Google services or to exclude you from certain campaigns. Hash values without a match are deleted by Google.

All processing described, in particular storing and reading information on your device, takes place only if you have given us your consent under Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie consent tool provided on the website. Insofar as Google also uses the data for its own purposes, Google is itself responsible: https://business.safety.google/privacy/, https://policies.google.com/technologies/partner-sites. You can manage personalised Google ads at https://myadcenter.google.com.

9.2 Microsoft Advertising

We use Microsoft Advertising of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland (“Microsoft”).

If you have consented, Microsoft's “Universal Event Tracking” (UET) tag is loaded on our website. It stores in cookies on your device, among other things, the click identifier of a Microsoft ad (msclkid) and a pseudonymous visitor identifier, and transmits pages visited, events (e.g. an order), order value, IP address and browser information to Microsoft. This allows us to measure whether an order followed a click on an ad. Microsoft may also use this data to measure and improve its advertising services; transfers to Microsoft Corporation in the USA are possible.

9.3 Meta Pixel (Facebook Pixel)

We use the so-called "Meta Pixel" (formerly "Facebook Pixel") of the following provider on our website: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Meta").

With the help of the Meta Pixel, it is possible for Meta, on the one hand, to determine the visitors of our online offer as a target group for the presentation of ads (so-called "Meta Ads"). Accordingly, we use the Meta Pixel to display the Meta Ads placed by us only to those users on Meta and within the services of partners cooperating with Meta (so-called "Audience Network") who have also shown an interest in our online offer or who have certain characteristics (e.g. interests in certain topics or products, which are determined on the basis of the websites visited) that we transmit to Meta (so-called "Custom Audiences"). With the help of the Meta Pixel, we also want to ensure that our Meta Ads correspond to the potential interest of users and do not have a harassing effect. Furthermore, we can use the Meta Pixel to track the effectiveness of Meta ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Meta ad (so-called "conversion tracking").

When using the Meta Pixel, data (including IP address, browser information, location information, device ID, and date and time of the page view) is transmitted to Meta's servers. Transmissions to Meta Platforms Inc., based in the USA, are also possible.

All processing described above, in particular the setting of cookies on the device used, will only be carried out if you have given us your express consent pursuant to Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

Insofar as personal data is collected on our website with the help of the procedure described here and forwarded to Meta, we and Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, are jointly responsible for this data processing (Art. 26 GDPR). The joint responsibility is limited exclusively to the collection of the data and its transmission to Meta. The processing carried out by Meta after the transmission is not part of the joint responsibility. The obligations incumbent on us jointly have been laid down in a joint controllership agreement. The agreement is available at https://www.facebook.com/legal/controller_addendum. According to this agreement, we are responsible for providing the data protection information when using the Meta tool and for the implementation of the tool on our website in a manner that is secure under data protection law. Meta is responsible for the data security of the Meta products. Data subject rights (e.g. requests for information) regarding the data processed by Meta can be asserted directly with Meta. If you assert the data subject rights with us, we are obliged to forward them to Meta.

For more information on data protection at Meta, please visit: https://www.facebook.com/privacy/policy/.

10 – Site Functionalities

10.1 Protection against misuse (Google reCAPTCHA Enterprise)

To protect our contact form, registration, customer account login, business customer registration and the online withdrawal form against automated access (e.g. spam, bots, password guessing) we use the reCAPTCHA Enterprise service of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).

reCAPTCHA Enterprise works in the background without puzzles. When you submit a protected form, a Google script is loaded that collects information about your device and your usage behaviour (including IP address, browser and device information, time on page, mouse and keyboard interactions), may set or read cookies and transmits this information to Google. Google uses it to assess how likely it is that an entry was made by a human and sends us a value (“score”). If this value is below a threshold set by us, submission of the form, login or registration may be refused; in that case you can contact us at any time by email at info@subtel.es.

Google processes this data as our processor on the basis of the Google Cloud terms of service and the Cloud Data Processing Addendum; data may be transferred to Google LLC in the USA. Access to your device is strictly necessary to protect the service you requested and your customer account (Art. 22.2, second subparagraph, LSSI-CE); further processing is based on our legitimate interest in protecting our shop and your customer account against misuse (Art. 6(1)(f) GDPR).

10.2 Google Sign-In

We offer a single sign-on function of the following provider on our website: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

In addition to the transmission of data to the above provider location, data may also be transmitted to: Google LLC, USA.

If you have an account with the provider, you can use this account data to create a user account or to register on our website.

When visiting this page, this login function can establish a direct connection between your browser and the provider's servers, even if you do not have an account with the provider or are not logged into one. The provider thus receives the information that you have visited our site. The information collected in this respect (possibly including your IP address) is transmitted from your browser directly to a server of the provider and stored there. However, the information is not used to identify you personally and is not passed on to third parties.

These data processing operations are carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in a user-friendly and interactive design of our online presence.

If you click the login button to register on our website using the data of your account with the provider, the provider will transmit the general and publicly available information stored in your account (user ID, name, address, email address, age and gender) to us solely on the basis of your express consent pursuant to Art. 6(1)(a) GDPR.

We store and use the data transmitted by the provider to set up a user account with the necessary data (salutation, first name, surname, address details, country, email address, date of birth), provided that you have released it to the provider. Conversely, on the basis of your consent, data (e.g. information about your browsing or purchasing behaviour) can be transferred by us to your account with the provider.

The consent given can be withdrawn at any time with effect for the future against us.

Further information on Google's data protection can be found here: https://business.safety.google/privacy/.

10.3 Sign in with Apple

We offer a login function from the following provider on our website: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland ("Apple"). If you have an Apple ID, you can use these login credentials to create a user account or to register on our website.

When you sign in with Apple, Apple transmits to us — solely on the basis of your express consent pursuant to Art. 6(1)(a) GDPR — the information required for identification (an Apple-managed anonymised email forwarding address or, if you have released it, your Apple ID email address, together with your name). Apple gives you the option to hide your actual email address before transmission ("Hide My Email").

You can withdraw the consent given at any time with effect for the future. For further information on data protection at Apple, please visit: https://www.apple.com/legal/privacy/en-ww/.

10.4 Error and performance monitoring (Sentry, self-hosted)

To detect and fix technical errors on our website and in our shop we use the software “Sentry”, which we operate ourselves on our own servers. No data is passed to the software manufacturer or other third parties.

Error reports: If an error occurs while a request is processed on our server or in your browser, we store an error report with technical details (time, address called, error description, browser and system information). Your IP address is not needed for this. The legal basis is our legitimate interest in a correct and secure operation of the shop (Art. 6(1)(f) GDPR).

Performance measurement and Session Replay: Only if you have consented in the “Performance” category of the consent tool do we measure loading times and performance indicators (“Web Vitals”) for a share of visits and, if an error occurs, transmit a recording of your interactions on the page in the period before the error (“Session Replay”) so that we can reproduce the error. In this recording all texts, entries (e.g. in form fields) and images are masked in the browser; only page structure, mouse movements, clicks and page changes are captured. The legal basis is your consent under Art. 22.2 LSSI-CE in conjunction with Art. 6(1)(a) GDPR, which you can withdraw at any time via the cookie consent tool provided on the website.

Error reports and recordings are deleted after 30 days.

10.5 Server performance monitoring (Tideways)

To monitor and optimise the response times of our shop we use the Tideways service of Tideways GmbH, Königswinterer Str. 116, 53227 Bonn, Germany. For a share of requests to our server, technical measurement data (address called, time, run times of program parts and database queries, where applicable IP address and error messages) is transmitted to Tideways. No cookies are set and no information is stored on your device. The legal basis is our legitimate interest in a fast and stable shop (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Tideways under Art. 28 GDPR; processing takes place within the European Union.

11 – Rights of the Data Subject

11.1 The applicable data protection law grants you the following data subject rights vis-à-vis the Controller regarding the processing of your personal data (rights of access and intervention), with reference made to the cited legal basis for the respective conditions of exercise:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent given pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 Our lead supervisory authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: https://www.datenschutz-berlin.de

You can also lodge a complaint with the Spanish supervisory authority:

Agencia Española de Protección de Datos (AEPD)
C/Jorge Juan, 6
28001 Madrid
España
Phone: +34 901 100 099
Email: internacional@aepd.es
Website: https://www.aepd.es

You also have the right to lodge a complaint with any other data protection supervisory authority in the European Union, in particular the authority of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

11.3 Right to object

If, as part of a balancing of interests, we process your personal data on the basis of our overriding legitimate interest, you have the right at any time, on grounds arising from your particular situation, to object to this processing with effect for the future.

If you exercise your right to object, we will end the processing of the data concerned. Further processing is, however, reserved if we can demonstrate compelling legitimate grounds for the processing which override your interests, fundamental rights and freedoms, or if the processing serves the establishment, exercise or defence of legal claims.

Objection to direct marketing: If your personal data is processed by us for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. You can exercise the objection as described above.

If you exercise your right to object, we will end the processing of the data concerned for direct marketing purposes.

12 – Automated Decision-Making

We ourselves do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The following exceptions apply:

If you choose a Klarna payment method, Klarna decides automatically and under its own responsibility whether that payment method can be offered to you (see section 7.3).
To protect against misuse, submission of a form, login or registration may be refused automatically if the reCAPTCHA service suspects automated use (see section 10.1). In that case you can contact us at any time at info@subtel.es; we will then review your request personally.

Insofar as we create profiles for analytics or advertising purposes within the services described above (e.g. Google Analytics 4, Google Ads Customer Match, newsletter personalisation), this serves solely statistical evaluation or the targeted display of advertising and content.

13 – Duration of Storage of Personal Data

The duration of storage of personal data is measured against the respective legal basis, the purpose of processing, and – where relevant – additionally against the respective statutory retention period (e.g. commercial and tax law retention periods).

When processing personal data on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

If statutory retention periods exist for data that is processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer required for the performance or initiation of the contract and/or we no longer have a legitimate interest in further storage.

When processing personal data on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

When processing personal data for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy on specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.