Privacy policy
This English version is a courtesy translation. Only the German version is legally binding.
1. Controller and data protection officer
The controller responsible for processing personal data on this website and the functions provided through it (hereinafter together referred to as the “Website”) is:
wyrld GmbH
(c/o WeWork)
Gerhofstraße 1-3
20354 Hamburg
Germany
Email: info@wyrld.de
Managing director: Jakob Neise
The company is not obliged to appoint a data protection officer.
2. Processing of personal data
Below you will find an overview of the processing carried out in connection with the use of our Website and the services offered through it.
In order to provide and continually improve our services, we also use services of third-party providers in some cases, through which personal data may be processed. We have selected these third-party providers carefully and in accordance with the provisions of the GDPR. Unless stated otherwise, only those employees of ours or of the third-party providers who are entrusted with carrying out the relevant function have access to your personal data. As a rule, your personal data is stored for the period we have set for performing the relevant task, based on the requirements of commercial and tax law, and deleted afterwards.
Unless otherwise mentioned in this privacy policy, your personal data will not be transferred to a third country outside the EU. Any other transfer only takes place if we are required to do so by law or by a public authority, or if the disclosure is necessary as part of your use of the Website.
We only process our users’ personal data within the scope of the statutory provisions, in particular the GDPR.
2a. Visiting the Website
When you merely use the Website, that is, if you do not register or otherwise send us data or information, we only collect the data that your browser transmits to our server (known as “server log files”). So when you visit our Website, we collect the following data, which we technically need in order to display the Website to you:
• The page of our website you visited
• Date and time of access
• Amount of data sent in bytes
• Source/referrer from which you reached the page
• Browser used
• Operating system used
• IP address used
This processing is carried out under Art. 6(1)(b) of the General Data Protection Regulation (“GDPR”) on the basis of your use of our Website, and on the basis of our interest in improving the stability and functionality of our Website pursuant to Art. 6(1)(f) GDPR. We process your data in order to provide you with a working Website, store the data for the period we have set for this purpose and delete your data afterwards.
Counting of views and clicks. When you view a creator profile or a product page, or go to a retailer via a buy button or the price list, we store this visit on our server. We store the page viewed, the date and time, your IP address, information about your browser and operating system, the referring page, the associated creator and product and, when you go to a retailer, the destination address and the name of the shop. We do not set any cookies for this. The purpose is to show creators and agencies their views and clicks, to estimate and settle commissions, and to detect and exclude automated access (bots). The legal basis is our legitimate interest in correct billing with our creators and partners and in preventing misuse pursuant to Art. 6(1)(f) GDPR. We store this data for as long as it is needed for these purposes.
2b. Contacting us (e.g. by email)
If you contact us by email, we process your email address. If you also give us your name and other personal data, we process this as well. The legal basis for this processing is Art. 6(1)(b) GDPR, because we process your data in order to answer your enquiry.
2c. Newsletter
With your consent, you can subscribe to our newsletter, which we use to send you interesting information about our services or products. You can withdraw your consent to receiving the newsletter at any time. You can do so by clicking the link at the end of the newsletter or by emailing info@wyrld.de.
To sign you up for our newsletter, we process your name, if you provide it, and your email address. We use the double opt-in procedure: after you sign up, we send an email to the email address you provided. In this email, we ask you to confirm that you want to receive the newsletter. If you confirm your newsletter subscription, we store your email address, IP address and the time of sign-up and confirmation. The purpose of this processing is to be able to prove your sign-up and, if necessary, to investigate any possible misuse of your personal data. The legal basis for the processing is your consent under Art. 6(1)(a) and Art. 49(1)(a) GDPR. Once you have successfully signed up, you will receive a discount code, if one is offered; we process information about the redemption of the discount for evidence purposes pursuant to Art. 6(1)(b) GDPR.
To send you our newsletters, we use external service providers, some of which are based outside the EU, including the service provider Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA, 02110, USA. The transfer of data to the USA is based on the Data Privacy Framework, under which Klaviyo, Inc. is certified. You can find details of the rules here: https://www.dataprivacyframework.gov/s/program-overview.
2d. Customer account
If you create a customer account with us, or use a corresponding button to indicate that you would like the data you have entered to be stored to make future orders easier, we process the data you provide when registering and afterwards for the purpose of managing customer data and processing the orders placed. The legal basis for the processing is Art. 6(1)(b) GDPR. We store your data for as long as the customer account exists and for up to three years afterwards, where this is necessary in the individual case under the statutory retention periods.
2e. Orders and payments
If you place orders via our Website, in addition to the data listed under server log files and the goods or services ordered, we process your name, your address, your email address, your phone number if applicable, the purchase price together with the payment method and the time stamp of the purchase.
In addition to our employees who are entrusted with processing the order, external service providers involved in order processing also have access to your personal data, to the extent necessary to provide the respective service.
We reserve the right to send you offers for goods or services from our range that are similar to those you have already bought, to the email address we received from you when you placed your order (and therefore in connection with the sale of goods or services). Under § 7(3) UWG (German Unfair Competition Act), this does not require your separate consent. In this context, the data is processed on the basis of our legitimate interest in sending direct marketing pursuant to Art. 6(1)(f) GDPR. However, if you have previously objected to the use of your email address for this purpose, we will not send you any emails. You are also entitled to object at any time, with effect for the future, to the use of your email address for the advertising purpose mentioned above by notifying us, without incurring any costs other than the transmission costs at basic rates.
If your payment data is collected by us and not directly by the payment service provider, it is passed on to the payment service provider you have chosen to process the payment. We pass on the data that you give us and that is needed to process the payment. Depending on the payment service provider you choose, this may include: name, address, account number, bank sort code, credit card number if applicable, invoice amount, currency and transaction number, email address, IP address, mobile phone number. You can see which data is transmitted from the categories requested during the payment process.
The data is processed on the basis of Art. 6(1)(b) GDPR. The data is transferred solely for the purpose of processing the payment; it is deleted after delivery, unless our service providers are themselves required by law to retain it. Please read about the data processing carried out by your chosen payment service provider on the website of the provider with whom you concluded your contract.
In order to offer you the payment services of the respective payment service providers, we transfer personal data, such as contact details and order data, to the respective payment service provider, which processes your personal data in order to carry out the payment. You can find information on the data processing in this respect from the respective payment service provider:
Klarna: Klarna Bank AB (publ). Sveavägen 46, 111 34 Stockholm, Sweden https://www.klarna.com/de/.
PayPal: PayPal Inc., 2211 N 1st St San Jose, CA 95131, USA, www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS
GPay: Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de
Apple Pay: https://www.apple.com/de/privacy/features/
Mastercard: https://www.mastercard.de/de-de/datenschutz.html
3. Third-party services
To optimise our services and offers, we also use the following external services:
Unless stated otherwise in this privacy policy, the operator of all Google services mentioned here is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Where, in the course of using the services, personal data is transferred to recipients outside the European Economic Area in countries for which the European Commission has not issued an adequacy decision (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_de), the transfer is safeguarded by EU standard contractual clauses, which ensure that the processing of personal data is subject to a level of security equivalent to that of the GDPR. If the standard contractual clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR is obtained in advance via the consent management system. The transfer of data to the USA is also based in part on the Data Privacy Framework, under which Google is certified. You can find details of the rules here https://www.dataprivacyframework.gov/s/program-overview.
Google Analytics
This Website uses the “Google Analytics” service. Google Analytics is a web analytics service which, by setting cookies and using the information obtained in this way, enables us to draw conclusions about user behaviour on our Website. The information generated by the cookies is also sent to and stored on a Google server in the USA.
Google Analytics is used to collect and process the following data:
• IP address (anonymised)
• Usage data
• Click path
• App updates
• Browser information
• Device information
• JavaScript support
• Pages visited
• Referrer URL
• Downloads
• Flash version
• Location information
• Purchase activity
• Widget interactions
• Date and time of the visit
The legal basis for the processing is your consent pursuant to Art. 6(1)(a) GDPR. If you do not want Google Analytics to collect and process this data, you can refuse your consent or withdraw it at any time with effect for the future. The personal data is kept for as long as it is needed to fulfil the purpose of the processing. The data is deleted as soon as it is no longer needed for that purpose.
In the course of processing, the data may be transferred to the following recipients in addition to Google Ireland Limited:
• Google LLC.
• Alphabet Inc.
For Google Ireland Limited’s privacy policy and cookie policy, please refer to https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/cookies?hl=en.
In the course of processing by Google Analytics, data may be transferred to the third countries USA, Singapore, Taiwan and Chile.
If you choose to communicate with us via WhatsApp, we process your personal data for this purpose, such as your phone number, your picture, your status information and your name, if you give it to us. We also process the personal data that you send us via WhatsApp. In this regard, we recommend that you only send us the information that is strictly necessary to answer your enquiry and refrain from sending any additional information. Whether you use WhatsApp and contact us this way is up to you, and you can receive the same information by phone, electronically and/or by post.
WhatsApp is a telecommunications service of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and a company of Meta Platforms, Inc.
We process your personal data in order to answer the enquiry you sent via WhatsApp. The legal basis for this data processing is your use of our WhatsApp channel under Art. 6(1)(b) GDPR.
Data processing by WhatsApp is governed by the privacy policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and is available at https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy.
The employees who look after our WhatsApp channels have access to your personal data. It cannot be ruled out that WhatsApp employees may also gain access to your personal data. Nor can it be ruled out that your data may be stored on WhatsApp servers in the United States of America. The transfer of data to the USA is based on the Data Privacy Framework, under which WhatsApp LLC is certified. You can find details of the rules here https://www.dataprivacyframework.gov/s/program-overview.
WhatsApp number in your creator profile. When you sign up as a creator, and under “Edit profile”, you can choose to give us your WhatsApp number. We use it to contact you about questions concerning your profile and your shop; the legal basis is Art. 6(1)(b) GDPR. If you have also ticked the box to receive news on WhatsApp, we occasionally send you news about wyrld on WhatsApp; the legal basis is your consent pursuant to Art. 6(1)(a) GDPR. For this, we store the time and the wording of your consent; after you withdraw it, we keep this information as proof. You can withdraw your consent at any time by unticking the box in your profile or by sending us a message (on WhatsApp or to info@wyrld.de). We store the number for as long as your creator account exists or until you delete it in your profile.
Hosting by Shopify
We use the shop system of the service provider Shopify International Limited, Victoria Buildings, 2. Etage, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”), for hosting and displaying our online shop and for using Shopify add-ons, on the basis of processing on our behalf. The data collected on our Website is processed on Shopify’s servers. The processing is carried out pursuant to Art. 6(1)(b) GDPR on the basis of your use of our Website, and on the basis of our interest in improving the stability and functionality of our Website pursuant to Art. 6(1)(f) GDPR.
As part of the Shopify services mentioned above, data may also be transferred, as part of further processing on our behalf, to Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc., Shopify Payments (USA) Inc. or Shopify (USA) Inc. Where data is transferred to Shopify Inc. in Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission. You can find further information on Shopify’s data protection on the following website: https://www.shopify.de/legal/datenschutz
Where data is transferred to Shopify in the USA, the transfer is safeguarded by EU standard contractual clauses, which ensure that the processing of personal data is subject to a level of security equivalent to that of the GDPR. If the EU standard contractual clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR can serve as the legal basis for the transfer to third countries.
Hosting of this Website
We run this Website on Google Cloud (Cloud Run service) in the Netherlands region. The provider is Google Ireland Limited (for the address, see “Google” above). When you visit the Website, Google processes the data listed under 2a on our behalf. The legal basis is our legitimate interest in operating the Website securely and reliably pursuant to Art. 6(1)(f) GDPR. The “Google” section applies to transfers to third countries. Further information: https://cloud.google.com/terms/cloud-privacy-notice?hl=de.
Delivery of images via Cloudflare
We deliver product and profile images via the address assets.wyrld.de. They are hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, and delivered via its network. In doing so, Cloudflare processes your IP address and technical information about your browser in order to deliver the images. The legal basis is our legitimate interest in fast and secure delivery pursuant to Art. 6(1)(f) GDPR. Cloudflare is certified under the EU-US Data Privacy Framework. Further information: https://www.cloudflare.com/de-de/privacypolicy/.
Links to shops (affiliate programmes)
Our product pages link to online shops. Most of these links are affiliate links: when you click “Buy at …” or a shop in the price list, we forward you to the retailer via an affiliate network. Depending on the shop, we receive a fee for clicks, for purchases there or for both (CPC, CPA), which the recommending creator shares in. The price stays the same for you.
So that a purchase can be attributed, the affiliate network and the retailer process your IP address, information about your browser and device, the time, the referring page and an identifier of the recommending creator when you click, and for this purpose they may store cookies or similar identifiers in your browser. This processing is carried out by the networks and retailers under their own responsibility. We ourselves only receive information about clicks, sales and commissions from the networks, not your name or contact details. The legal basis on our side is our legitimate interest in financing our service through commissions pursuant to Art. 6(1)(f) GDPR.
We currently work with these affiliate networks:
• Awin AG: https://www.awin.com/de/datenschutzerklarung
• Skimlinks: https://www.skimlinks.com/privacy-policy/
• Sovrn (VigLink): https://www.sovrn.com/privacy-policy/privacy-policy/
• Amazon PartnerNet (Amazon Europe Core S.à r.l.): https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010
Social Media
To increase our reach, we maintain social media presences. If you click a link embedded in our Website, you will be taken to the respective page:
Instagram: https://www.instagram.com ,
Facebook: https://www.facebook.com.
Where there is joint controllership with Instagram or Facebook, the joint controller agreement applies. You can find the agreement at https://de-de.facebook.com/legal/terms/page_controller_addendum. You can find more information on the respective responsibilities in the Page Insights Controller Addendum ( https://de-de.facebook.com/legal/terms/page_controller_addendum ). The legal basis for processing the data is Art. 6(1)(f) GDPR. Our legitimate interest in this respect is increasing the reach of our online presence on social media channels. The purpose of the processing is to increase our presence on the internet. Our employees who look after the social media channels have access to the data, as do employees of the respective provider where applicable. Your personal data is transferred to the companies listed below in the USA or can be accessed from there. The transfer is safeguarded by EU standard contractual clauses, which ensure that the processing of personal data is subject to a level of security equivalent to that of the GDPR. If the EU standard contractual clauses are not sufficient to establish an adequate level of security, your consent pursuant to Art. 49(1)(a) GDPR can serve as the legal basis for the transfer to third countries. You can find information on data processing at: Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA): http://instagram.com/about/legal/privacy; Facebook (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland): https://www.facebook.com/about/privacy/legal_bases ).
Sign-in with Facebook or Google
If you use your Facebook or Google account to log in, Facebook or Google (addresses given above) send us the data that you have released for the sign-in function in the privacy settings of your account with the respective provider. This may include, for example, your name and email, but also friends lists. We analyse this data with regard to your activity with us and send the insights gained from this analysis back to the respective provider, so that the provider can add them to your user profile. Before using Facebook or Google sign-in, please check which data you want the respective provider to send us and only release that data. The legal basis for the processing is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time by notifying us, or change your settings in your Facebook account. Our employees who deal with managing your account have access to your data, as does the respective sign-in provider. For further information on data protection, please see the privacy policy of the respective provider.
4. Cookies
When you visit the Website, cookies may be set on your device, depending on your browser settings and on whether you have given us your consent, in order to extend the range of functions of the Website and make it more convenient for you to use.
Cookies are small text files that are stored on your computer. Cookies are stored and read on the basis of § 25 TDDDG. Most of the cookies we use are deleted from your hard drive at the end of the browser session (“session cookies”). We also use permanent cookies (“persistent cookies”), which remain on your device so that we can recognise you on your next visit to the Website. When cookies are set, they collect and process certain user data to an individual extent, such as browser and location data and IP address values, as described above under server log files. Persistent cookies are deleted automatically after a set period, which may differ depending on the cookie.
Where personal data is also processed by individual cookies we use, the processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our Website (for what are known as “necessary cookies”), or pursuant to Art. 6(1)(a) GDPR on the basis of your consent for all other cookies (marketing and analytics cookies).
You can find an overview of the cookies used and how long each cookie is stored in the cookie settings of our cookie consent tool.
Please note that you can also set your browser so that you are informed when cookies are set and can decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or in general. Each browser manages cookie settings differently. Cookie settings are described in each browser’s help menu, which explains how you can change your cookie settings. Please note that if you do not accept cookies, the functionality of our Website may be limited.
5. Cookie consent tool
We use a cookie consent tool to obtain consent for cookies and cookie-based applications that require consent.
Each cookie has to be assessed individually to some extent, because each cookie stores different data. The expiry time of a cookie also varies from a few minutes to a few years. Please therefore refer directly to the cookie settings in our cookie consent tool, which is always shown to you at the bottom of the Website, for an overview of the cookies used and how long each cookie is stored.
So that the cookie consent tool can clearly assign page views to individual users and individually record, log and store for the duration of a session the consent settings made by the user, certain user information, as described under server log files, is collected by the cookie consent tool when you visit our Website, transmitted to the cookie consent tool’s servers and stored there.
The data processing carried out by the cookie consent tool is based on Art. 6(1)(f) GDPR, on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and in designing it in a legally compliant way; to that extent, Art. 6(1)(c) GDPR also applies as a legal basis. We process your data for this purpose for the duration of your session and delete it afterwards, unless you have given your consent to cookies being set; in that case, we process your data for the period stated for each cookie.
6. Your rights
You can contact us either in writing or by email at info@wyrld.de to exercise the following rights:
Access to your data, so that you can check and verify it, pursuant to Art. 15 GDPR;
Receipt of a copy of your personal data, pursuant to Art. 15(3) GDPR;
Rectification, erasure or restriction of processing, including the right to complete incomplete or incorrect data by providing a supplementary statement, pursuant to Arts. 16, 17 and 18 GDPR;
Objection to the processing of personal data that we process on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, pursuant to Art. 21 GDPR; you have a right to object to the processing on grounds relating to your particular situation; where the objection concerns the processing of personal data for direct marketing purposes, you have a general right to object without having to state a particular situation;
Receipt of the data you have provided in a structured, commonly used and machine-readable format, and transfer of this data to another controller, where you have given your consent to the processing or the processing is based on a contract;
You also have the right to lodge a complaint with a supervisory authority in connection with the processing of your personal data. You can contact the authority responsible for where you live, or the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Friedrichstraße 219, 10969 Berlin.
If you have given your consent to processing, you can withdraw it at any time with effect for the future by notifying us, for example via info@wyrld.de. We store your consent for three years after the end of the year in which it is withdrawn.
7. Automated decision-making and profiling
With the exception of the services described above in connection with Google Analytics, your personal data is not used for automated decision-making or profiling. Profiling only takes place with your consent, as described above for the individual services.
8. Changes to this privacy policy
We reserve the right to amend this privacy policy if the legal situation or our services change, or for other reasons. The current version is always available on our Website.