Preamble

When you use the BLANCO website, we process personal data about you. Personal data means any information relating to an identified or identifiable natural person. Because the protection of your privacy when using the BLANCO website is important to us, we would like to inform you with the following information about which personal data we process when you use services within the framework of our website and how we handle this personal data. In addition, we will inform you of the legal bases for processing your personal data and, to the extent that the processing is necessary for the purposes of our legitimate interests, also of our legitimate interests.

I. Name and contact details of the controllers in the case of joint controllership

The processing of personal data in the context of the webshop is the joint responsibility of companies of the BLANCO Group. The exact details can be found below. Corresponding contractual provisions have been agreed between the controllers in a joint responsibility agreement.

Principal Responsible Company:

BLANCO direct GmbH
Flehinger Straße 59
75038 Oberderdingen
Germany
Phone: +49 7045 44-81100
E-mail: info@blanco.de

in joint responsibility with:

BLANCO GmbH + Co KG
Flehinger Straße 59
75038 Oberderdingen
Germany
Phone: +49 7045 44-81100
E-mail: info@blanco.de

BLANCO Austria Küchentechnik GmbH
Ignaz-Köck-Straße 11
1210 Vienna
Austria
Phone: +43 12782823
E-mail: office@blanco.at

BLANCO UK Ltd.
1 Victor Way, Colney Street
St. Albans AL2 2FL
United Kingdom
Phone: +44 1923 635200
E-mail: info@blanco.co.uk

BLANCO GmbH + Co. KG
Steinhausen Branch
Hinterbergstrasse 38b
6312 Steinhausen
Switzerland
Phone: +41 62 3888990
E-mail: blanco@blanco.ch

II. Name and contact details of the data protection team and data protection officer

If you have any questions about data protection, you can contact our data protection team at the following e-mail address datenschutz-kt@blanco.com or the following postal address:

BLANCO direct GmbH
-Privacy Team-
Blanc-und-Fischer-Platz 1-3
75038 Oberderdingen
Germany

You can contact our data protection officer at the e-mail address dataprotectionofficer@blanco.co.uk or the following postal address:

BLANCO UK Ltd.
-Data protection officer-
1 Victor Way, Colney Street
St. Albans AL2 2FL
United Kingdom

III. Purpose and legal basis of data processing

1. Data collection website

For security reasons and to protect the transmission of confidential content, we use SSL or TLS encryption on our website. In this way, enquiries can be securely transmitted via the contact form or orders via the site. You can recognise SSL or TLS encryption by the addition of "https://" in the address bar of the Internet browser and by a closed lock symbol next to it.

If SSL or TLS encryption is activated, data can be transmitted to us via the website without being read by third parties.

If you use our website for informational purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data, which are technically necessary for us to display the website to you:

• Our website visited
• Date and time at the time of access
• Amount of data sent in bytes
• Source/reference from which you came to the page
• Browser used
• Operating system used
• IP address used (if applicable: in anonymized form)

The processing is carried out in accordance with Art. 6 para. 1 sentence 1 lit. f UK-GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal use.

2. Cookies

In order to make a visit to our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. when you close your browser (so-called session cookies). Other cookies remain on your device and make it possible to recognise your browser on your next visit (so-called persistent cookies). If cookies are set, they collect and process certain user information such as browser and location data as well as IP address values to an individual extent. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie.

We use different categories of cookies on this website: essential cookies, without which the functionality of our website would be limited, and optional functional and marketing cookies, which are usually from third parties:

2.1. Essential cookies

These cookies are essential to enable you to move around our websites and use their features. For example, you can store: which products you have placed in your shopping cart or the progress of your order process, or they store whether you agree to the use of cookies as well as your choices in the cookie settings. These cookies are usually session-specific and expire after your visit to the website (session), unless the respective functionality requires storage beyond that (e.g. saving the cookie setting). Disabling this category of cookies would limit the functionality of all or part of the website. The legal basis for the use of essential cookies and the processing of your data by these cookies is our legitimate interest in displaying the functions of our website to you and making them available for use, Art. 6 para. 1 sentence 1 lit. f UK-GDPR.

2.2. Functional cookies

We use functional cookies to improve and simplify the use and performance on our website.

The legal basis for the use of functional cookies and the processing of your data by the providers of these cookies is your prior consent (Art. 6 para. 1 sentence 1 lit. a UK-GDPR). You can withdraw your consent at any time in the Privacy settings, which you can access using the link at the bottom of the website.

2.3. Marketing cookies

Marketing cookies are used to tailor and analyse advertising in a more targeted way to you and your interests. They are also used to limit the number of times you see the same ad, to measure the effectiveness of an ad campaign, and to understand how people behave after viewing an ad. These cookies are usually placed by advertising networks on their pages with the consent of the website operator (i.e. in this case us). They recognise that a user has visited a website and pass this information on to others, e.g. advertising companies, or adapt advertising accordingly themselves. Often, they are linked to a website functionality provided by that company. In this way, we intend to tailor advertising to you on other websites and to provide the advertising networks we use with information about your visit so that you can later be presented with exactly the advertisements that are potentially of interest to you based on your browsing behaviour.

The legal basis for the use of marketing cookies and the processing of your data by the providers of these cookies is your prior consent (Art. 6 para. 1 sentence 1 lit. a UK-GDPR). You can withdraw your consent at any time in the "Privacy Settings", which you can access using the link at the bottom of the website.

2.4. List of analytical, functional and marketing cookies

You can view the list of cookies we use and the providers who use the cookies to obtain personal data from you in the Cookie Platform, which you can access via the "Privacy Settings" link at the bottom of the website. There you can find more information about the individual providers and cookies.

If, instead, you would like us to provide you with more information about these cookies, please contact us using the contact details described in section I.

2.5. How can I declare or withdraw my consent to cookies?

If you visit our website for the first time, you will be shown the information on data protection on your home page with the text of your consent to optional cookies. By clicking on the individual categories (essential, functional and marketing cookies) and then confirming by clicking on "Accept", you agree to the setting of these cookies. You can adjust and change these settings at any time in the Cookie Settings, which you can access by clicking on the "Privacy Settings" link at the bottom of the website.

3. Contacting us

Personal data is collected when contacting us (e.g. via contact form, e-mail or telephone). The data collected in the case of a contact form can be seen from the respective contact form. This data will be stored and used exclusively for the purpose of answering your request or for contacting you and the associated technical administration.

The legal basis for the processing of this personal data is our legitimate interest in responding to your request in accordance with Art. 6 para. 1 sentence 1 lit. f UK-GDPR. If your contact is aimed at concluding a contract or for service requests, the additional legal basis for the processing of this personal data is Art. 6 para. 1 sentence 1 lit. b UK-GDPR.

Your data will only be processed until it is no longer required to achieve the purpose for which it is intended and will be deleted after your request has been processed. This is the case if it can be inferred from the circumstances that the matter in question has been conclusively clarified and provided that there are no statutory retention obligations to the contrary

3.1. ReCaptcha

On our website, we use the Google ReCaptcha function of the provider Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland for reasons of prevention of misuse of our content. This system helps us to identify whether the user is a natural person or an internet bot. In this way, we can prevent the automatic use of our contact forms and the sending of spam messages to our stored e-mail accounts.

When using the Google ReCaptcha function, cookies are set that can store various data, such as IP address, referrer URL, information from the operating system, mouse movements, keystrokes, dwell time, location, user input, browser language or settings of the user's device. This information is stored and shared with Google. It cannot be ruled out that the data will be transferred to a Google server in the USA and stored there. We have no influence on the data transfer. Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043 USA has submitted to the Data Privacy Framework.

The legal basis for the processing of personal data by Google ReCaptcha is your voluntarily given consent in accordance with Art. 6 para. 1 sentence 1 lit. a UK-GDPR.

• Your consent is voluntary and can be revoked at any time with effect for the future. To do this, change your cookie settings under "Privacy Settings" under Google ReCaptcha.

We process your personal data for as long as it is necessary to achieve the purpose. If you revoke your consent by making changes to your settings under "Privacy settings", we will delete your data, unless this is contrary to statutory retention obligations.

Further information on Google's handling of the use of Google ReCaptcha can be found in Google's privacy policy, which you can view at the following link: https://www.google.com/intl/de/policies/privacy/ and https://www.google.com/recaptcha/about/.

3.2. Appointment bookings SimplyBook.me

BLANCO UK Ltd, 1 Victor Way, Colney Street, St. Albans AL2 2FL, United Kingdom, Phone: +44 1923 635200, E-mail: info@blanco.co.uk is solely responsible for this data processing under No. 3.2 in terms of data protection law.

On our website you have the possibility to book and manage appointments. For this purpose, we use the SimplyBook.me system of the service provider SimplyBook.me Ltd, 30 Glathonos, P. Makedonas Court, 3041, Limassol, Cyprus. This involves the processing of personal data, such as name, e-mail address, contact details, registration data, appointment data and other data that you provide when booking an appointment. Further information can be found on the following SimplyBook.me website: https://simplybook.me/de/policy & https://simplybook.me/de/legal/gdpr-compliance.

We have concluded a corresponding order processing contract with the service provider SimplyBook.me.

The legal basis for the processing of personal data is our legitimate interest pursuant to Art. 6 para 1 sentence 1 lit. f UK-GDPR. Our legitimate interest basically lies in the fact that this enables you to make and manage appointment bookings quickly and efficiently.

4. Registration of a customer account

If you register for a personal customer account, we process the registration data that can be seen from the respective input forms for the purpose of setting up and managing your customer account as well as for the processing of future orders. As a registered customer, you have access (via your e-mail address and the password you have chosen) to your personal customer account, in which you can, among other things, manage your purchases, view the order history and save and change your personal settings (e.g. password settings, product registrations, billing and delivery addresses, etc.).

The legal basis for the processing is our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f UK-GDPR to provide you with the customer account service described above or the execution of a user contract with you (Art. 6 para. 1 sentence 1 lit. b UK-GDPR).

• You can object to the processing of your data on the basis of Art. 6 para. 1 sentence 1 lit. f UK-GDPR (pursuant to Art. 21 sentence 1 UK-GDPR). In principle, we can then demonstrate compelling grounds for the processing in order to continue it. However, we will not do this for the use of a customer account and the following applies: The customer account must then be deleted and will no longer be available to you. Please use the corresponding functions provided for you (e.g. the deletion function in your registered customer account) or send a corresponding message in writing (keyword: "Objection to BLANCO product registration") or by e-mail to the contact details provided under section 1.

This data will be deleted if the registration on our website is cancelled or changed or the customer account is terminated. If deletion is not possible for legal reasons, the respective data will be blocked. Please note that we may have to store the data about the orders that can be viewed in your customer account for a longer period of time due to legal retention obligations (see section "5. Orders in the online webshop").

5. Orders in the online webshop

5.1. Online Orders

5.1.1. Online ordering with registration of a customer account (user account)

If you order goods via our online shop, the content data entered by you and the content of the data about you will be processed (such as the information from your order, delivery and billing address, telephone number, e-mail address, payment methods, delivery modalities, order information, in the case of commercial customers additionally company name and VAT ID). In addition, we collect information in the online shop about time, scope and, if applicable, time. Place of your order.

We process your order data for the processing of the order, sanction list check, credit check and delivery of the ordered goods as well as for customer service required with the order and pass it on to appropriate delivery and payment service providers for the fulfilment of the purposes. The registration of a customer account is voluntary and does not have to be created. See point 4.

The legal basis for the processing is the conclusion and fulfilment of the purchase contract of the ordered goods in accordance with Art. 6 para. 1 sentence 1 lit. b UK-GDPR or the legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f UK-GDPR for the registration of a customer account.

This data will be deleted when it is no longer required for the performance of the contract (including customer service and warranty), unless we are legally obliged to store it, e.g., due to retention obligations under commercial or tax law.

5.1.2. Online ordering without registering a customer account (guest order)

If you order goods via our online shop, the content data entered by you and the content of your data will be processed (such as the information from your order, delivery and billing address, telephone number, e-mail address, payment methods, delivery methods, order information, etc.). In addition, we collect information in the online shop about time, scope and, if applicable, time. Place of your order.

We process your order data for the processing of the order, sanction list check, credit check and delivery of the ordered goods as well as for customer service required with the order and pass it on to appropriate delivery and payment service providers for the fulfilment of the purposes.

The legal basis for the processing is the conclusion and fulfilment of the purchase contract of the ordered goods in accordance with Art. 6 para. 1 sentence 1 lit. b UK-GDPR.

This data will be deleted when it is no longer required for the performance of the contract (including customer service and warranty), unless we are legally obliged to store it, e.g., due to retention obligations under commercial or tax law.

5.1.3. Order via phone/e-mail (payment link)

You also have the option of placing orders within our BLANCO online webshop by phone or e-mail. To do this, you can use the telephone numbers or e-mail addresses required for this purpose.

In addition to your telephone number or e-mail address, we process other personal data for order processing (such as the information from your order, delivery and billing address, telephone number, e-mail address, payment methods, delivery modalities, order information, in the case of commercial customers additionally company names).

We process your order data for the processing of the order, sanction list check, credit check and delivery of the ordered goods as well as for customer service required with the order and pass it on to appropriate delivery and payment service providers for the fulfilment of the purposes. After placing your order, you will receive a payment link by phone or e-mail with a request to pay for the ordered goods.

The legal basis for the processing is the conclusion and fulfilment of the purchase contract of the ordered goods in accordance with Art. 6 para. 1 sentence 1 lit. b UK-GDPR.

This data will be deleted when it is no longer required for the performance of the contract (including customer service and warranty), unless we are legally obliged to store it, e.g., due to retention obligations under commercial or tax law.

5.2. Payment methods

In order to process payments, we pass on your personal data to our payment service provider Deutsche Bank. Further information on data processing at Deutsche Bank can be found via the following link: https://www.db.com/legal-resources/privacy-notice?language_id=3.

You have the possibility to pay for the ordered goods by credit card, PayPal, Apple Pay, GooglePay.

5.2.1 Credit card

You have the option of paying by credit card on our website. Payment processing is carried out by the service provider Deutsche Bank AG, Taunusanlage 12, 60325 Frankfurt a.M.

To pay for your order by credit card, you can use the payment link provided for this purpose, which you will receive from us for payment by credit card. We will pass on your personal data entered by us and the data of your order to Deutsche Bank AG for payment by credit card and payment of the invoice amount. This usually includes your name, address, e-mail address, order data and other data that is necessary for payment processing. These are used in particular for identity and creditworthiness checks, payment administration and fraud prevention by Deutsche Bank AG. Art. 6 para. 1 sentence 1 lit. b UK-GDPR constitutes the legal basis for the processing of personal data, as the transmission of the data to Deutsche Bank is necessary for the performance of the contract.

We have no influence on the type, scope and purpose of the processing and deletion of the data collected by the service provider. You have the right to object to the processing of your personal data; whereby you must exercise this right vis-à-vis Deutsche Bank AG. The objection does not affect the personal data that is absolutely necessary for payment processing.

Please refer to the privacy policies of Deutsche Bank AG for further information on the type and scope of data processing. For further rights and other information on the protection of your data, please visit: https://www.deutsche-bank.de/dam/deutschebank/de/shared/pdf/ser-DB_EU-Datenschutzhinweise_AG.pdf & https://www.db.com/legal-resources/privacy-notice?language_id=3.

5.2.2 Payment method PayPal

On our website we offer the possibility to make payments via PayPal. PayPal is an online payment processing service provider operated by PayPal (Europe) S.à.r.l & Cie. S.C.A., 2224 Boulevard Royal, 2449 Luxembourg, Luxembourg. By selecting the payment method PayPal, you can process orders immediately via your PayPal account. In addition, it is also possible to make virtual payments by credit card via PayPal, even if you do not have a PayPal account.

We pass on your personal data entered by us and the data of your order to PayPal for the collection of the invoice amount. This usually includes your name, address, email address, telephone number and IP address, as well as other data necessary for payment processing. These are used in particular for identity and credit checks, payment administration and fraud prevention by PayPal. Art. 6 para. 1 sentence 1 lit. b UK-GDPR represents the legal basis for the processing of personal data, as the transmission of the data to PayPal is necessary for the fulfilment of the contract.

We have no influence on the type, scope and purpose of the processing and deletion of the data collected by the service provider. You have the right to object to the processing of your personal data; whereby you must exercise this right against PayPal. The objection does not affect the personal data that is absolutely necessary for payment processing.

In the privacy policy of PayPal you will find further information on the type and scope of data processing. Further rights and other information on the protection of your data can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

5.2.3 Apple Pay

In addition, it is possible to make payments via Apple Pay. The provider of this payment service is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA, represented in Europe by Apple Distribution International Limited., Hollyhill Industrial Estate, Hollyhill, Cork, Republic of Ireland (hereinafter referred to as "Apple"). When you make a payment with Apple Pay, your stored payment information is forwarded to Apple. According to Apple, when using Apple Pay, pseudonymized data is sent to Apple, such as your Apple device's device account number, a transaction-specific dynamic security code, and additional information necessary to complete the transaction.

Please refer to Apple's privacy policy for more information on the type and scope of data processing. Further rights and other information on the protection of your data can be found at: https://support.apple.com/de-de/HT203027 & https://www.apple.com/de/legal/privacy/data/de/apple-pay/.

5.2.4 Google Pay

It is also possible to make payments via Google Pay. The provider of Google Pay is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter referred to as "Google"). If you pay with Google Pay, your stored payment details will be forwarded to Google. According to Google, this is transaction information, as well as information that may be obtained from third parties that concerns you. Transaction information includes, but is not limited to, the time, date and amount of the transaction, the location and description of the merchant, descriptions of the goods purchased, if any, provided by the seller, your name, email address and the payment method used. Third-party information includes, but is not limited to, information related to Google Pay transactions at merchant locations, third-party information about the payment methods you use and accounts associated with Google Pay, the identity of the card issuer or credit institution, information about accessing funds in your Google Pay account, and information from mobile carriers in connection with mobile phone billing. Google may also collect information about you from credit bureaus or credit reference agencies.

Google's privacy policy provides further information on the type and scope of data processing. Further rights and other information on the protection of your data can be found at: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de & https://support.google.com/googlepay/answer/9039712?hl=de.

5.3. Tracking

In order to track your ordered goods, we will provide you with a shipment tracking by e-mail. Personal data such as your e-mail address, name, address data of the recipient and sender, consignment number and shipping or delivery information are processed. To fulfil these purposes, we use the service provider Alaiko GmbH.

The legal basis for the processing of personal data is our legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f UK-GDPR. Our legitimate interest lies in providing you with a service so that you can be informed at all times about the status of the delivery of your ordered goods.

5.4 Purchases for business customers from BLANCO UK

If you are a business customer ordering goods directly from BLANCO UK either via email, telephone, or EDI, in addition to your telephone number or e-mail address, we process other personal data for order processing (such as the information from your order, delivery and billing address, telephone number, e-mail address, payment methods, delivery modalities, order information, company names).

We process your order data for the processing of the order, sanction list check, credit check, and delivery of the ordered goods as well as for customer service required with the order and pass it on to appropriate delivery for the fulfilment of the purposes. Registration of a customer account is a requirement.

You have the option of paying by credit card for your orders. Payment processing is carried out by the service provider GLOBAL PAYMENTS U.K. LTD.

To pay for your order by credit card, you will need to provide necessary security details over the phone. We will input this data and submit it to GLOBAL PAYMENTS U.K. LTD for payment by credit card and payment of the invoice amount. This usually includes your name, address, order data, and other data that is necessary for payment processing. These are used in particular for identity and creditworthiness checks, payment administration, and fraud prevention by GLOBAL PAYMENTS U.K. LTD. Art. 6 para. 1 sentence 1 lit. b UK-GDPR constitutes the legal basis for the processing of personal data, as the transmission of the data to GLOBAL PAYMENTS U.K. LTD is necessary for the performance of the contract.

We have no influence on the type, scope, and purpose of the processing and deletion of the data collected by the service provider. You have the right to object to the processing of your personal data; whereby you must exercise this right vis-à-vis GLOBAL PAYMENTS U.K. LTD. The objection does not affect the personal data that is absolutely necessary for payment processing.

You have the option of paying by bank transfer for your orders. Payment processing is carried out by the service provider HSBC UK BANK PLC. The legal basis for the processing is the conclusion and fulfilment of the purchase contract of the ordered goods in accordance with Art. 6 para. 1 sentence 1 lit. b UK-GDPR or the legitimate interest in accordance with Art. 6 para. 1 sentence 1 lit. f UK-GDPR for the registration of a customer account.

This data will be deleted when it is no longer required for the performance of the contract (including customer service and warranty), unless we are legally obliged to store it, e.g., due to retention obligations under commercial or tax law.

6. Product Registration

You have the option of registering the BLANCO product you have purchased. In doing so, we collect and use your data to document the benefits granted to you with the product registration (e.g. voucher). In addition, we reserve the right to incorporate data into the new and further development of our innovative products.

The legal basis for the processing is your consent in accordance with Art. 6 para 1 sentence 1 lit. a UK-GDPR to provide you with the product registration service described above.

• You can revoke your consent for product registration at any time for the future. Please use the corresponding functions provided for you (e.g. the deletion function in your registered account) or send a corresponding message in writing (keyword: "Revocation of BLANCO product registration") or by e-mail to the contact details given in section 1.

This data will be deleted if the registration on our website is cancelled or changed or the customer account is terminated. If deletion is not possible for legal reasons, the respective data will be blocked.

7. Sending newsletters

You can subscribe to a free newsletter on our website. In this case, the data collected during registration will be processed (the data displayed as mandatory fields are mandatory for the receipt, voluntarily marked data only serve to address and select the displayed information in a more personal way).

We will contact you by e-mail with information, offers and special offers on BLANCO products that are personally tailored to you and

your interests or use, either on the basis of your respective express consent or – if you purchase similar goods or services from us and provide your e-mail address – also without separate consent.

In order for us to be able to obtain your consent in a legally effective manner, we use the so-called double opt-in procedure. To do this, we will send you a message with a confirmation link to the e-mail address you have entered. If you confirm this link, you have successfully registered for the newsletter. If you do not confirm this link within 48 hours, it will expire. With this confirmation, we store your e-mail address, IP address as well as the time of registration as well as the source of the process through which the consent was given. This data serves us as proof of registration and to detect any possible misuse of your personal data.

The legal basis for the processing is your consent (Art. 6 para. 1 sentence 1 lit. a UK-GDPR) and our legitimate interests (Art. 6 para. 1 sentence 1 lit. f UK-GDPR).

• You can object at any time to the use of your personal data for the purposes of advertising and product development as well as to contact you via a certain form or revoke any consent you may have given. Please use the corresponding functions provided for you (e.g. the unsubscribe function in the newsletter e-mails or in your customer account) or send a corresponding message in writing (keyword: "Revocation/objection to the BLANCO Newsletter") or by e-mail to the contact details given in section 1.

This data will be deleted or stored only in aggregated, anonymised form after your objection or the revocation of any consent you may have given, or otherwise at the latest after the end of the use by us. To the extent necessary, we will store the fact of your objection in order to prevent you from being contacted further.

8. "Notify Me"

If products are currently not available in our BLANCO online webshop, you have the option of registering with us using the "Notify Me" function. In doing so, we process your e-mail address and create a database for you, in which you can view all your products for which you would like to be notified by us if they are available again.

The legal basis for the processing of personal data is your consent in accordance with Art. 6 para. 1 sentence 1 lit. a UK-GDPR.

• You can revoke the use of your personal data for the purposes of the "Notify Me" notification at any time with effect for the future. Please use the corresponding functions provided for you within your account or send a corresponding message in writing (keyword: "Revocation/Objection BLANCO "Notify Me" notification) or by e-mail to the contact details given in section 1.

9. Registration Merchant Portal

You have the option of registering on our website in the dealer portal. To do this, register using your customer number and postal code (ZIP). In this retailer portal, you have the opportunity to store and maintain your data as well as to make purchases. In addition, you will receive an overview of your orders and deliveries here or you can adjust your consents.

The legal basis for the processing is our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f UK-GDPR to be able to provide you with the above-described service for registering in the merchant portal and creating a merchant account or to execute a user contract with you (Art. 6 para. 1 sentence 1 lit. b UK-GDPR). Our legitimate interest lies in providing you with a merchant account at your request, in which you have an overview of your data, settings and orders. However, registration in the Merchant Portal is voluntary, as you can place orders without registering in the Merchant Portal.

• You can object to the processing of your data on the basis of Art. 6 para. 1 sentence 1 lit. f UK-GDPR (pursuant to Art. 21 sentence 1 UK-GDPR). In principle, we can then demonstrate compelling grounds for the processing in order to continue it. However, we will not do this for the use of a customer account and the following applies: The customer account must then be deleted and will no longer be available to you.

We will only store your personal data and other information entered in the Dealer Portal for as long as you maintain the Merchant Portal. You have the option to cancel and delete it within the merchant portal. We will then delete your access to the dealer portal. If deletion is not possible for legal reasons, the respective data will be blocked. Please note that we may store the data about orders that can be viewed in your merchant account for a longer period of time (see 5.).

We would like to point out that certain information in the Merchant Portal may be subject to statutory retention periods, which we are required to retain for a longer period of time due to statutory commercial or tax laws. These then only serve the legal purpose of proof and are usually deleted after 10 years.

10. Changes of purpose

Your personal data will only be processed for purposes other than those described if this is permitted by law or if you have consented to the changed purpose of the data processing. In the event of further processing for purposes other than those for which the data was originally collected, we will inform you of these other purposes and provide you with any other relevant information prior to further processing.

IV. Recipients or categories of recipients of the personal data

To operate and maintain the BLANCO online webshop, we use the service providers diva-e Next GmbH as well as systems from the service provider IBM Deutschland GmbH and the service provider DigitalXL GmbH & Co. KG for the XENTRAL ERP system. As a service provider for shipment tracking and associated fulfillment services, we use the service provider Alaiko GmbH. Furthermore, we use the following service providers to fulfill the above-mentioned purposes: Deutsche Bank AG, PayPal (Europe) S.à.r.l & Cie. S.C. A, Apple Inc, Google Ireland Ltd, Commercetools GmbH, Mission One GmbH, Ecovium Holding GmbH, Pandata GmbH, e-Spirit GmbH.

In addition, we make use of Blanc und Fischer IT Services GmbH, among other things, with regard to the IT infrastructure and the provision of further means for the performance of the services with regard to the BLANCO online webshop. Furthermore, we use the systems of the service provider Microsoft Ireland Operations Ltd. to enable communication and exchange.

ecovium Holding GmbH is used for sanctions list checking.

Corresponding order processing agreements have been concluded with the service providers.

Within our company, we only pass on your personal data to the departments and persons who need it to implement and carry out their tasks. These are, in particular, the purchasing department and the corresponding specialist departments of the companies. The data will be passed on to Blanco GmbH + Co. KG for the purpose of checking sanctions lists. In addition, we may also use other companies of the BLANC & FISCHER Group to provide the services/purposes described above, if this is necessary for the implementation of the purposes. This may also include companies in third countries outside the EU.

.

V. Transfer to third countries

In principle, data processing takes place within the EU. Under certain circumstances, it could happen that subcontractors are used by our service providers for service and maintenance purposes or for the fulfilment of other purposes, who may be located in third countries without an adequate level of data protection. For this purpose, we have concluded corresponding data processing agreements, which are intended to ensure that suitable safeguards are in place to ensure an adequate level of data protection when using subcontractors in third countries. Corresponding safeguards for the data transfers are contained in the adequacy decision for the respective country, binding corporate rules or EU standard contractual clauses that have been concluded.

VI. Storage period in accordance with statutory retention obligations

To the extent necessary, we process and store your personal data in relation to the BLANCO online webshop only for as long as it is necessary to achieve the purposes. Subsequently, the personal data will be deleted or anonymized. This generally takes place when the contract has been fulfilled, you unsubscribe from your newsletter, or you delete a registered account.

Statutory retention obligations remain unaffected by this. In this case, the data will be restricted and only stored for the statutory purpose of retention.

VII. Right of access, rectification, erasure, restriction, data portability and objection

As a data subject, you have the right to information (Art. 15 UK-GDPR), rectification (Art. 16 UK-GDPR), deletion of your data (Art. 17 UK-GDPR), restriction of processing (Art. 18 UK-GDPR), a right to data portability (Art. 20 UK-GDPR) and a right to object (Art. 21 UK-GDPR) at any time. To do so, please contact the responsible body using the contact details provided above.

VIII. Right to lodge a complaint

In addition, you have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 UK-GDPR if you believe that the processing of your personal data is not lawful. The supervisory authority responsible for us is The Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, GB—Great Britain, tel.: +44 303 123 1113, e-mail: dpo@ico.org.uk. Contact details of the other German and European supervisory authorities can be found at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html or https://www.bfdi.bund.de/DE/Service/Anschriften/Europa/Europa-node.html.

IX. Existence of a necessity for the provision of personal data

In principle, only the data required for this purpose will be processed in order to fulfil the above-mentioned purposes. Otherwise, no order can be placed via the BLANCO online webshop.

In the case of processing operations that are not necessarily related to the ordering of goods in the online webshop (e.g. creation of a customer account, product registration or registration for Notify Me notifications), data processing will only take place once you have decided to use the options. Otherwise, your personal data will not be processed for these purposes.

X. Changes to this Privacy Notice

We will always keep this Privacy Notice up to date. For this reason, we reserve the right to change them from time to time and to update changes in the collection, processing or use of your data. The current version of the data protection information is always available on the website of the BLANCO online webshop under the following link https://www.blanco.co.uk/legal-references/data-privacy-policy/.

Last updated: July 2024

Download as a PDF