Privacy Policy

The controller responsible for processing your personal data when you use our online store at equion.vet is:

MI Europe GmbH
Fritz-Reuter-Str. 28
D-60320 Frankfurt a. Main
Germany

Managing Director: Kai Lahmann
E-mail: [email protected]
Telephone: +49 69 7953 8662

MI Europe GmbH is not legally required to appoint a data protection officer and has not done so. Please direct all data protection enquiries to the e-mail address above.

We process data you actively provide – such as your name, e-mail address, delivery and billing address, telephone number and payment details – when you place an order, create a customer account, subscribe to our newsletter or contact us.

In addition, our systems automatically collect technical data when you visit our store:

• browser type and version
• operating system
• referrer URL
• host name of the accessing device
• time of the server request
• IP address (truncated)

This data is not merged with other data sources.

We process your data for the following purposes on the legal basis stated in each case:

• Performance of contract – processing your order, managing your customer account, delivering products, handling returns and refunds. Legal basis: Art. 6(1)(b) GDPR.
• Legal obligation – retention of accounting and tax records for the statutory periods. Legal basis: Art. 6(1)(c) GDPR.
• Consent – newsletter and marketing e-mails, analytics and marketing cookies, and the services listed in sections 8 and 9. Legal basis: Art. 6(1)(a) GDPR and, for access to your device, Section 25(1) TDDDG. Consent may be withdrawn at any time with effect for the future; this does not affect the lawfulness of processing carried out before withdrawal.
• Legitimate interests – fraud prevention, IT and store security, technically error-free delivery and improvement of our offering. Legal basis: Art. 6(1)(f) GDPR.

The applicable legal basis is also stated with each individual processing activity in the sections below.

Our store runs on the Shopify platform, provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Shopify processes your personal data as our external host and on our behalf. Processing is based on Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in secure and efficient provision of the store). We have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR.

Shopify may transfer data to third countries, including the USA and Canada. Such transfers are based on the EU Standard Contractual Clauses; Shopify is additionally certified under the EU-US Data Privacy Framework.

Shopify privacy policy: shopify.com/legal/privacy

Our hosting provider automatically collects and stores information in server log files transmitted by your browser (see section 2). Collection is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free presentation and optimisation of our store.

For security reasons and to protect the transmission of confidential content such as orders and payment data, our store uses SSL/TLS encryption. You can recognise an encrypted connection by the address bar changing from "http://" to "https://" and by the padlock symbol. Within our company, access to customer data is restricted to authorised personnel.

Our store uses cookies and comparable technologies. Strictly necessary cookies are set on the basis of Art. 6(1)(f) GDPR and Section 25(2) no. 2 TDDDG. Analytics, preference and marketing cookies are set exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

You can withdraw your consent at any time using the "Cookie settings" link in the footer of every page. Withdrawing consent is as easy as giving it.

We use a consent management platform to obtain and document your consent. It records your consent or its withdrawal, your truncated IP address, information about your browser and device, and the time of your visit. Legal basis: Art. 6(1)(c) GDPR (obligation to demonstrate consent).

The individual cookies set – with name, provider, purpose and lifetime – are listed in our Cookie Policy.

The services in this section are used exclusively on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Consent may be withdrawn at any time.

8.1 Google Tag Manager

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager manages and deploys the tools embedded through it. It does not itself create user profiles, store cookies or perform any analysis, but it does record your IP address, which may be transferred to the USA.

8.2 Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics 4 allows us to analyse user behaviour in our store, including page views, time on page, operating system, traffic source, interactions and e-commerce metrics such as orders placed and order values. Google Analytics uses technologies for recognising users, in particular cookies.

Google Analytics 4 truncates IP addresses within the EU/EEA before further processing; IP addresses are not logged or stored in Google Analytics 4. We have concluded a data processing agreement with Google pursuant to Art. 28 GDPR. Transfers to the USA are based on the EU Standard Contractual Clauses; Google is certified under the EU-US Data Privacy Framework.

Google privacy policy: policies.google.com/privacy

8.3 Google Ads and conversion tracking

Provider: Google Ireland Limited. Conversion tracking allows us to see whether users performed a specific action, such as a purchase, after clicking a Google ad. A cookie is set on your device for this purpose.

8.4 Google Remarketing

Provider: Google Ireland Limited. Google Remarketing allows personalised ads to be shown to visitors of our store across the Google advertising network. You can deactivate personalised advertising at myadcenter.google.com.

8.5 Meta Pixel (Facebook and Instagram)

Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The Meta Pixel allows us to track visitor behaviour after a click on a Meta advertisement, build audiences and serve ads to users who have already visited our store. Your IP address and further attributes may be transferred to Meta Platforms Inc. in the USA. Transfers are based on the EU Standard Contractual Clauses; Meta is certified under the EU-US Data Privacy Framework.

Further information: facebook.com/privacy/policy

8.6 Klaviyo

Provider: Klaviyo, Inc., 125 Summer Street, 6th Floor, Boston, MA 02110, USA. Klaviyo records your behaviour in our store – such as pages visited and products viewed – in order to personalise newsletters and marketing campaigns. Transfers to the USA are based on the EU Standard Contractual Clauses; Klaviyo is certified under the EU-US Data Privacy Framework.

Privacy notice: klaviyo.com/legal/privacy-notice

When you open pages containing elements of the services listed below, a connection to their servers is established and the provider is informed of your visit. These elements are embedded on the basis of your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

• LinkedIn – LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
• Instagram / Meta – Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland.
• YouTube – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We embed YouTube in extended data protection mode.
• Google Maps – Google Ireland Limited. Displaying maps requires the transmission of your IP address.

10.1 Payment service providers

We work with the following providers to process payments:

• Shopify Payments / Stripe – Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
• PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
• Klarna – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For invoice and instalment purchases, Klarna may carry out a credit check.

Disclosure is based on Art. 6(1)(b) GDPR. We do not store full card details; these are processed exclusively by PCI-DSS certified payment service providers.

10.2 Shipping service providers

To deliver your order we pass your delivery details – name, address and, where applicable, telephone number – to the carrier engaged. Disclosure is based on Art. 6(1)(b) GDPR. Carriers use your data solely to deliver your order.

If you wish to subscribe to our newsletter, we need your e-mail address and confirmation that you are the owner of that address and consent to receiving the newsletter (double opt-in).

Processing is based on your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time, for example via the unsubscribe link in every newsletter. Withdrawal does not affect the lawfulness of processing carried out beforehand.

We do not sell personal data. Data is disclosed only where necessary to operate the store and perform your contract.

Service providers processing data on our behalf are contractually bound and act only on our instructions. Payment service providers process your payment data as controllers in their own right, in accordance with their own privacy notices.

Disclosure to law enforcement or supervisory authorities takes place where we are legally obliged to do so.

Our store runs on Shopify, and parts of the infrastructure may be located outside the EU. Some of the services listed in sections 8 and 9 also transfer data to third countries, in particular to the USA.

Where providers are certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision. All other third-country transfers are based on the Standard Contractual Clauses approved by the European Commission, supplemented by additional safeguards. Details are set out in the relevant sections of this policy.

Unless a more specific period is stated in this policy, we retain your data until the purpose of processing ceases to apply:

• Customer account: generally 2 years after the last activity
• Order and accounting records: up to 10 years under German commercial and tax retention rules
• Support correspondence: up to 6 months

If you assert a valid erasure request or withdraw consent, we will delete your data unless statutory retention obligations apply. In that case, deletion follows once the period has expired.

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR) – you may request a copy of the data we hold about you.
• Rectification (Art. 16 GDPR) – you may request correction of inaccurate data or completion of incomplete data.
• Erasure (Art. 17 GDPR) – you may request deletion where no statutory retention obligation applies.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) – you receive your data in a structured, commonly used, machine-readable format.
• Withdrawal of consent (Art. 7(3) GDPR) – at any time with effect for the future.
• Complaint to a supervisory authority (Art. 77 GDPR).

Right to object under Art. 21 GDPR

Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on those provisions.

If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless processing serves to establish, exercise or defend legal claims.

Where your data is processed for direct marketing purposes, you have the right to object at any time to such processing, including any associated profiling.

Exercising your rights

To exercise your rights, contact [email protected]. We respond within one month of receiving your request. Should processing exceptionally take longer, we will inform you.

To prevent unauthorised disclosure, we may verify your identity before acting on a request.

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
Telephone: +49 611 1408-0
E-mail: [email protected]
datenschutz.hessen.de

We hereby object to the use of contact details published under our imprint obligations for the purpose of sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising being sent.

We update this privacy policy when the legal situation or our processing activities change. The current version is always published on this page together with its effective date.