• Your style, your rules!

Privacy Policy

Privacy Policy

Table of Contents

  1. Overview, Scope & Legal Bases
  2. Controller & Contact Details
  3. Storage Period, Retention Obligations & Erasure
  4. Your Rights as a Data Subject
  5. Competent Supervisory Authority
  6. Data Transfer to Third Countries (USA / Non-EU Countries)
  7. Data Security & TLS/HTTPS Encryption
  8. Cookies & Consent Management Platform (CMP)
  9. Processing of Customer & Contract Data
  10. User Account & Registration
  11. Web Analytics & Statistics (Google Analytics 4, Google Site Kit, Jetpack)
  12. Security, Spam Protection & Backups (Google reCAPTCHA, UpdraftPlus)
  13. Payment Service Providers (PayPal, Visa)
  14. Multimedia & Video Integration (YouTube)
  15. Web Design & Fonts (Google Fonts)

1. Overview, Scope & Legal Bases

This Privacy Policy informs you about the nature, scope, and purpose of the processing of personal data within our online offering, websites, social media channels, and direct customer communications in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications-Telemedia Data Protection Act (TDDDG).

We process personal data exclusively on the basis of statutory legal permissions:

  • Consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG)
  • Performance of a contract & pre-contractual measures (Art. 6 (1) (b) GDPR)
  • Legal obligations (Art. 6 (1) (c) GDPR)
  • Safeguarding legitimate interests (Art. 6 (1) (f) GDPR, Section 25 (2) TDDDG)

2. Controller & Contact Details

The controller responsible for data processing on this website is:

Pegasus Sportswear
Owner: Klaus Ronny Schulze
Einsteinstraße 28
82152 Planegg near Munich, Germany

3. Storage Period, Retention Obligations & Erasure

Personal data is deleted or blocked as soon as the purpose of storage ceases to apply. Further storage only takes place to the extent provided for by statutory provisions (in particular commercial and tax law retention requirements under Section 147 AO and Section 257 HGB with retention periods of 6 to 10 years). Upon expiration of these statutory periods, corresponding data is routinely deleted.

4. Your Rights as a Data Subject

Within the scope of the statutory provisions of the GDPR, you have the following rights at any time:

  • Right of access (Art. 15 GDPR): to obtain information regarding your personal data processed by us.
  • Right to rectification (Art. 16 GDPR): of inaccurate or incomplete personal data.
  • Right to erasure (Art. 17 GDPR): (“right to be forgotten”), provided no statutory retention duties prevent erasure.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR): in a structured, commonly used, and machine-readable format.
  • Right to object (Art. 21 GDPR): to processing based on Art. 6 (1) (e) or (f) GDPR, as well as against direct marketing.
  • Right to withdraw consent (Art. 7 (3) GDPR): with future effect at any time.
  • Right to lodge a complaint (Art. 77 GDPR): with a competent supervisory authority.

5. Competent Supervisory Authority

The supervisory authority competent for our company in the non-public sector in Bavaria is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Phone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de

6. Data Transfer to Third Countries

Insofar as we transfer data to countries outside the European Union (EU) or the European Economic Area (EEA), this is done on the basis of adequacy decisions of the EU Commission (e.g., the EU-US Data Privacy Framework for certified US providers) or on the basis of EU Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR.

7. Data Security & TLS/HTTPS Encryption

To protect your data from unauthorized access and manipulation, we use modern TLS encryption (Transport Layer Security) in combination with HTTPS across our entire website. You can identify a secure connection by the lock symbol in your browser’s address bar.

8. Cookies & Consent Management Platform (CMP)

Our website uses cookies and similar storage technologies:

  • Technically necessary cookies: These are essential for safe operation, navigation, and core functions such as the shopping cart (Section 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR).
  • Optional cookies (marketing & analytics): Are only set if you have given explicit consent in the cookie banner (Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR).
  • Consent Tool: You can view, adjust, or revoke your consent preferences at any time via our Consent Management Platform.

9. Processing of Customer & Contract Data

We process inventory and contact data (name, billing and shipping address, email address, phone number) as well as payment details for the conclusion, processing, and fulfillment of purchase contracts and pre-contractual inquiries.

  • Legal basis: Art. 6 (1) (b) GDPR.
  • Storage period: After complete contract execution, statutory commercial and tax retention periods apply (up to 10 years).

10. User Account & Registration

Users can create a protected customer account on our website to facilitate the ordering process and review previous transactions.

  • Processed data: Name, address, email address, password (stored exclusively in encrypted form), IP address at the time of registration/login, and log data.
  • Security features: Login credentials and IP addresses are processed to prevent unauthorized access.
  • Legal basis: Art. 6 (1) (b) GDPR (terms of use) and Art. 6 (1) (f) GDPR (IT security).
  • Deletion: You can request deletion of your customer account at any time, provided no outstanding claims or statutory retention obligations prevent it.

11. Web Analytics & Statistics

Google Analytics 4 (GA4)

We use Google Analytics 4 provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).

  • Operation: GA4 collects pseudonymized usage and interaction data (e.g., duration of stay, clicks, page views) to optimize our web offering. IP addresses are automatically anonymized or truncated by Google in the EU.
  • Legal basis: Consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG.
  • Third-country transfer: Google LLC (USA) is certified under the EU-US Data Privacy Framework.

Google Site Kit

We integrate the WordPress plugin Google Site Kit to consolidate analytics and performance metrics from Google Analytics and other Google services directly in our dashboard. Actual data collection is conducted through the respective Google services based on your consent.

Jetpack (WordPress.com / Automattic)

Our website utilizes features of the Jetpack plugin provided by Automattic Inc. (San Francisco, USA). Jetpack collects pseudonymized access statistics for performance evaluation and website security.

  • Legal basis: Art. 6 (1) (a) GDPR (consent) and Art. 6 (1) (f) GDPR.
  • Data transfer: Automattic participates in the EU-US Data Privacy Framework and utilizes Standard Contractual Clauses.

12. Security, Spam Protection & Backups

Google reCAPTCHA

To protect form submissions from abusive automated bot software, we use Google reCAPTCHA (Google Ireland Limited). The service analyzes user interaction behavior (mouse movements, dwell time, IP address) to determine whether input is made by a human.

  • Legal basis: Art. 6 (1) (a) GDPR (consent) and Art. 6 (1) (f) GDPR (legitimate interest in spam defense and system security).

UpdraftPlus (Backup System)

For data backup and system recovery, we use UpdraftPlus provided by Updraft WP Software Ltd. (United Kingdom). Backups may include customer records and website database content. The United Kingdom benefits from an adequacy decision issued by the European Commission (Art. 45 GDPR).

  • Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in data recoverability and website integrity).

13. Payment Service Providers

PayPal

When selecting payment via PayPal, transaction details are transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg).

  • Processed data: Name, billing address, order total, payment method, IP address.
  • Legal basis: Art. 6 (1) (b) GDPR (payment processing).

Credit Card Payment (Visa)

When paying by credit card through Visa, transaction data is transmitted via encrypted channels to Visa Europe Services Inc. and the issuing bank.

  • Legal basis: Art. 6 (1) (b) GDPR.

14. Multimedia & Video Integration (YouTube)

We integrate videos from the YouTube platform (Google Ireland Limited).

  • Processing: Loading and playing embedded videos establishes a connection to Google servers, transferring data such as your IP address and setting tracking cookies.
  • Legal basis: Consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG.

15. Web Design & Fonts (Google Fonts)

To ensure consistent typographic design, we use Google Fonts (Google Ireland Limited).

  • Local hosting (preferred): Where fonts are hosted locally on our own web server, no connection to Google servers is made and no IP address is transferred to Google.
  • External fallback: Should fonts be dynamically loaded from external servers in individual instances, this is done via Google servers based on your consent (Art. 6 (1) (a) GDPR).
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.