1.1. Who collects personal data
ESL Gaming GmbH, represented by the Managing Directors Ralf Reichert and David Neichel, Schanzenstraße 23, 51063 Cologne, Germany
Register Court: District Court Cologne, HRB 36678
What does joint controllership mean?
Freaks 4U and we jointly determine if and how personal data of yours (“you” means you as a customer of the Freaks 4U Store) is processed, when you visit or shop at the Freaks 4U Store. Since we and Freaks 4U each are controllers of your data when doing so, the working relationship is called a joint controllership.
Who processes which data and why?
- Providing technical infrastructure processing personal data such as IP-addresses for the delivery of the website;
- Communicating with customers and executing purchases and requests and through this processing personal data such as names, addresses and email addresses.
By appointing us to operate the Freaks 4U Store, by hosting the Freaks 4U Store under its name, and by jointly deciding together with us on specific aspects of the Freaks 4U Store, Freaks 4U has a basic form of control over the operation of the Freaks 4U Store and is the initiator of the processing of personal data for the operation of the Freaks 4U Store and therefore jointly determines the purposes of processing of personal data for the execution of the E-Shop with us.
Who is responsible for what?
Under the GDPR you have certain rights, namely:
- Right of information: You have the right to be provided information regarding the processing of your personal data by us, in accordance with Art. 13 and 14 GDPR.
- Right of access: You have the right to obtain confirmation as to whether or not we are processing your personal data and, if this should be the case, access to the personal data, in accordance with Art. 15 GDPR.
- Right to rectification: You have the right to obtain rectification of inaccurate or incomplete personal data concerning you, in accordance with Art. 16 GDPR.
- Right to erasure (“right to be forgotten”): Under certain circumstances you have the right to obtain the erasure of personal data concerning you, in accordance with Art. 17 GDPR.
- Right to restriction: Under certain circumstances you have the right to obtain the restriction of processing, in accordance with Art. 18 GDPR.
- Right to data portability: Under certain circumstances you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit this data to another controller, in accordance with Art. 20 GDPR.
- Right to object: Under certain circumstances you have the right to object to the processing of personal data concerning you, in accordance with Art. 21 GDPR. This includes but is not limited to the right to object in cases in which we process your personal data on the legal basis of Art. 6 para. 1 let. f) GDPR.
- Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of the EU of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR).
- Right to withdraw consent: If a processing of your personal data is based on your consent as set out in Art. 6 para. 1 let. a) GDPR or Art. 9 para. 2 let. a) GDPR, you have the right to withdraw your consent at any time, in accordance with Art. 7 para. 3 GDPR. Such withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
- Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, as set out in Art. 22 para 1 GDPR.
We are your primary contact point for you to exercise these rights of yours when we process your personal data in connection with the joint controllership. Freaks 4U and we can assist each other to comply with our obligations set out in the GDPR we may have towards you. Irrespective of this, the GDPR grants you the possibility to exercise your rights in respect of and against each of the joint controllers, so you can at any time also contact Freaks 4U to exercise your data subject rights.
How is your data secured?
We have implemented technical and organizational measures to ensure a level of security appropriate to the risk presented by the processing in accordance with Art. 24 and 32 GDPR.
What happens in a case of a personal data breach?
In case of a personal data breach and if this breach is likely to result in a risk to your rights and freedoms, we will, if necessary, with the assistance of Freaks 4U and without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the competent supervisory authority. Should such breach likely result in a high risk for your rights and freedoms, we or – where required by article 34 GDPR – Freaks 4U will inform you about the personal data breach without undue delay.
If you want to contact us to exercise your rights or if you have any questions for us regarding the use of your data, you can contact us via email: firstname.lastname@example.org
Depending on your request, it is possible that Freaks 4U and we will forward your request to one another, should this be necessary to help each other out to answer your request or to get directly in touch with you for this purpose. The legal basis for this is Art. 6 para. 1 lit. f) GDPR, as we each have a legitimate interest in answering your inquiry effectively and satisfactorily for you. In case of a forward of your request, we and Freaks 4U inform each other about the matter to the extent necessary for answering your request.
1.2. Types of processed data:
- inventory data (e.g., name, address).
- contact data (e.g., e.mail, telephone number).
- content data (e.g., text inputs, photographs, videos, purchases).
- usage data (e.g., visited websites, interest in content, access times ).
- meta / data communication (e.g., device-information, ip-addresses).
1.3. Categories of affected persons
Visitors and users of the online offer (in the following the affected persons are referred to collectively as "users").
1.4. Purpose of the process
- Fulfill any orders placed through the website including processing payment information, arranging for shipping, and providing users with invoices and/or order confirmations
- Answering contact requests and communicating with users
- Screen our orders for potential risk or fraud
- When in line with the preferences users have shared with us, provide users with information or advertising relating to our products or services
- Audience measurements
2.1. Used terms
"Processing" means any process performed with or without the aid of automated procedures or any such process associated with personal data. The term goes far and includes virtually every handling of data.
"Responsible person" means the natural or legal person or public authority or institution that decides, alone or in concert with others, on the purposes and means of processing personal data.
2.2. Relevant legal bases
According to Art. 13 DSGVO we inform you about the legal basis of our data processing. If this is not mentioned, the following applies: The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR, for the processing for the fulfillment of our services and the performance of contractual measures as well as the answering of inquiries, this results from Art. 6 para. 1 lit. b DSGVO, for processing in order to fulfill our legal obligations Art. 6 para. 1 lit. c DSGVO, and for processing in order to safeguard our legitimate interests, Art. 6 (1) lit. f DSGVO. In the event that vital interests of the data subject or another natural person require the processing of personal data, Art. 6 para. 1 lit. d DSGVO as legal basis.
3.1. Collaboration with processors and third parties
If, in the course of our processing, we disclose data to other persons and companies (contract processors or third parties), transmit them or otherwise grant access to the data, this is done exclusively on the basis of a legal permission (eg if a transmission of the data to third parties pursuant to Art Art. 6 para. 1 lit. b DSGVO is required to fulfill the contract), you have consented to the transmission, a legal obligation to do so or based on our legitimate interests (eg the use of agents, web hosters, etc.).
Insofar as we commission third parties to process data on the basis of a so-called "contract processing contract", this is done in accordance with Art. 28 GDPR.
3.2. Transfer to third countries
If we process data in a third country (outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of the use of third party services or disclosure or transmission of data to third parties, this is done only if there is Fulfillment of our contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only in the presence of the special conditions of Art. 44 et seq. DSGVO. That the processing is e.g. on the basis of specific guarantees, such as the officially recognized level of data protection (eg for the US through the Privacy Shield) or compliance with officially recognized special contractual obligations (so-called "standard contractual clauses").
4. Your rights
You have the right to request a confirmation as to whether data concerning you are being processed and for information about this data as well as for further information and a copy of the data in accordance with Art. 15 GDPR.
In accordance with Art. 16 GDPR you have the right to demand the completion of the data concerning you or the correction of the incorrect data concerning you.
In accordance with Art. 17 GDPR, you have the right to demand that the relevant data be deleted immediately or, alternatively, to require a restriction on the processing of your data in accordance with Art. 18 GDPR.
You have the right to demand that the data relating to you that you provide us in accordance with Art. 20 GDPR be obtained and request their transmission to other responsible persons.
You also have according to Art. 77 GDPR the right to file a complaint with the competent supervisory authority.
You have the right to withdraw a granted consent according to Art. 7 para. 3 GDPR with effect for the future. For this purpose it is sufficient to send an email to the following address:
You can object to the future processing of your data in accordance with Art. 21 GDPR at any time. The objection may in particular be made against processing for direct marketing purposes. You should address your withdrawal to us as follows:
via e-mail to: email@example.com
After you have revoked your consent, we will use your information solely to provide you with information about our service and we will refrain from submitting any further advertising to you.
“Cookies" are small files that are stored on users' computers. Different information can be stored within the cookies. A cookie is primarily used to store the information about a user (or the device on which the cookie is stored) during or after his visit to an online offer. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online service and closes his browser. In such a cookie, e.g. the contents of a shopping cart are stored in an online store or a login jam. The term "permanent" or "persistent" refers to cookies that remain stored even after the browser has been closed. Thus, e.g. the login status will be saved if users visit it after several days. Likewise, in such a cookie the interests of the users can be stored, which are used for range measurement or marketing purposes. As a "third-party cookie", cookies will be offered by providers other than the person responsible for the online offer (otherwise, if only the cookies are called "first-party cookies").
If you do not want cookies to be stored on your computer, you can disable the corresponding option in the system settings of your browser. Saved cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offer.
6. Deletion of data
According to legal requirements in Germany the storage takes place especially for 6 years according to § 257 Abs. 1 Nr. 2-3, Abs. 4 HGB (trading books, inventories, opening balance sheets, annual accounts, trade letters, accounting documents, etc.) and for 10 years according to § 147 para. 1 AO, §§ 257 para. 1 no. 4, para. 4, 238 HGB (books, records, management reports, accounting documents, commercial and business letters, documents relevant for taxation, etc.).
7. Business-related processing
In addition we process
- contractual data (eg., Subject of contract, duration, customer category).
- payment data (eg., Bank details, payment history)
from our customers, prospects and business partners for the purpose of providing contractual services, service and customer care, marketing, advertising and market research.
The hosting services we use are for the purpose of providing the following services: infrastructure and platform services, computing capacity, storage and database services, security and technical maintenance services we use to operate this online service. Here we, or our hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online offer on the basis of our legitimate interests in an efficient and secure provision of this online offer acc. Art.6 para. 1 lit. f GDPR i.V.m. Art. 28 GDPR (conclusion of contract processing contract).
9. Collection of access data and log files
We, or our hosting provider, collects on the basis of our legitimate interests within the meaning of Art. 6 para. 1 lit. f. GDPR Data on every access to the server on which this service is located (so-called server log files). The access data includes name of the retrieved web page, file, date and time of retrieval, amount of data transferred, message about successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page), IP address and the requesting provider.
Logfile information is stored for security purposes (for example, to investigate abusive or fraudulent activities) for a maximum of 100 days and then deleted. Data whose further retention is required for evidential purposes shall be exempted from the cancellation until final clarification of the incident.
10. Provision of contractual services
We process inventory data (e.g., names and addresses as well as contact information of users), contract data (e.g., services used, names of contacts, payment information) for the purpose of fulfilling our contractual obligations and services in accordance with Art. Article 6 (1) (b) GDPR. The entries marked as obligatory in online forms are required for the conclusion of the contract.
The deletion of the data takes place after expiration of legal warranty and comparable obligations, the necessity of the storage of the data is checked every three years; in the case of legal archiving obligations, the deletion takes place after its expiration. Information in the customer's account remains until it is deleted.
When contacting us (for example, by contact form, email or via social media) your details for processing the contact request and their processing acc. Art. 6 para. 1 lit. b) GDPR processed. The information can be stored in a Customer Relationship Management System ("CRM System") or comparable request organization. We delete the requests, if they are no longer required. We check the necessity every three years; Furthermore, the legal archiving obligations apply.
12. Comments and posts
If you leave comments or other contributions, your IP address will be changed based on our legitimate interests within the meaning of Art. 6 para. 1 lit. f. DSGVO stored for 100 days. This is for our own safety, if someone leaves illegal content in comments and contributions (insults, prohibited political propaganda, etc.). In this case, we ourselves can be prosecuted for the comment or post and are therefore interested in the identity of the author.
Below we would like to inform you about the content of our newsletter as well as the registration, shipping and statistical evaluation procedures as well as your right of objection. By subscribing to our newsletters, you agree to its receipt and the procedure described below.
Consent to receive the newsletter: We only send newsletters with the consent of the recipient or a legal permission. Insofar as the contents of a newsletter are concretely described, this is decisive for your consent. Incidentally, our newsletter contains information about our services and us.
Double opt-in and logging: Registration for our newsletter is done in a so-called double-opt-in procedure. After registration, you will receive an email asking you to confirm your registration. This is necessary so that nobody can log in with external email addresses. Registration for the newsletter will be logged in order to prove the registration process according to the legal requirements. This includes the storage of your registration and confirmation time, as well as your IP address. Likewise, a change of your stored data is logged.
Credentials: To sign up for the newsletter, you must enter your e-mail address. Optionally, we kindly ask you to provide your first name as well as surname for personal address in the newsletter.
The dispatch of the newsletter and the associated performance measurement is based on your consent in accordance with. Art. 6 para. 1 lit. a, Art. 7 GDPR in connection with § 7 Abs. 2 Nr. 3 UWG or on the basis of the legal permission according to Art. § 7 Abs. 3 UWG.
The logging of your registration is based on our legitimate interests in accordance with. Art. 6 para. 1 lit. f GDPR . Our interest includes the use of a user-friendly and secure newsletter system that serves our business interests as well as meeting the expectations of users and allows us to provide evidence of consent.
You can terminate the receipt of our newsletter at any time, ie. Revoke your consent for the future. A link to cancel the newsletter can be found at the end of each newsletter. We may save the submitted email addresses for up to three years based on our legitimate interests before we delete them for the purposes of newsletter distribution, to provide proof of formerly granted consent. The processing of this data is limited to the purpose of a possible defense against claims. In the event that you desire a premature cancellation, you must confirm to us the former existence of a consent.
13.2. Newsletter – Shipping Service
The shipping service provider may use the data of the recipients in pseudonymous form, i. without assignment to a user, to optimize or improve their own services, e.g. for the technical optimization of shipping and the presentation of newsletters or for statistical purposes. However, the shipping service provider does not use the data of our newsletter recipients to address them themselves or to pass the data on to third parties.
13.3. Newsletter – measuring success
Included in the newsletter is a so-called "web-beacon", i. a pixel-sized file which is retrieved from our server when the newsletter is opened or from its server in the case of the use of a mailing service provider. As part of this call, technical information, such as information about the browser and your system, as well as your IP address and time of the call will be collected.
This information is intended to improve the technical performance of the service based on the technical data or the target groups and your reading behavior based on their call locations (which can be determined with the help of the IP address) or the access times. Likewise, it is determined if and when the newsletters are opened and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. This is based on recognizing the reading habits of our users and adapting our content to them or sending different content according to the interests of our users.
14. Payment transactions
For a contract, in which you have to pay a fee, provided that the purchase was made via the website, we need your credit card information (credit card number, country, holder of the credit card) in accordance with Art. 6 (1) (a) and (f) GDPR credit card, credit card verification code (CVV code) and expiration date of your credit card), your name, bank account number and bank code if you choose the direct debit or if you choose another payment method or if you choose SEPA direct debit Your IBAN (international bank account number) and your BIC (International bank code of the institution of the debtor) and your home address. Please note that your credit card details or PayPal payments are collected and processed by your payment processor in relation to your payments for the service.
15. Social Media
We maintain online presence within social networks and platforms in order to communicate with customers and users active there and to inform them about our services. When calling the respective networks and platforms, the terms and conditions and the data processing guidelines apply to their respective operators.
16. Integration of services and contents of third parties
Based on our legitimate interests (ie interest in the analysis, optimization and economic operation of our online offer within the meaning of Art. 6 (1) lit. GDPR), we make use of content or services offered by third-party providers in order to provide their content and services Services, such as Include videos (hereinafter collectively referred to as "Content").
This always presupposes that the third-party providers of this content perceive the IP address of the users, since they could not send the content to their browser without the IP address. The IP address is therefore required for the presentation of this content. We endeavor to use only content whose respective providers use the IP address solely for the delivery of the content. Third parties may also use so-called pixel tags (invisible graphics, also referred to as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user's device and may include, but is not limited to, technical information about the browser and operating system, referring web sites, visit time, and other information regarding the use of our online offer.
We use Shopify (https://www.shopify.com/) according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR) as an e-commerce platform to operate our online stores. Shopify Inc., 150 Elgin Street, Suite 800, Ottawa, ON K2P 1L4, Canada
We use Tradegecko (https://www.tradegecko.com/) according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR) as an inventory management software to process all orders.
TradeGecko Pte. Ltd., 121 Telok Ayer, #02, Singapore, 068590
16.3. Recom Logistik
We use Recom Logistik GmbH (https://www.recom-logistik-koeln.de/) according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR)as a logistics centre to fulfill all orders.
ReCom Logistik Köln GmbH, Marconistr. 20a, 50769 Köln, Germany
We use Zendesk (https://www.zendesk.com/) according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR) as a customer service software to communicate with customers regarding problems and questions about our service.
Zendesk Inc., 1019 Market St, San Francisco, CA 94103, USA
We use Sufio (https://sufio.com/) according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR)to create invoices of all orders.
Sufio Inc., 1317 Ynez Place Suite C & D, Coronado, CA 92118, USA
We use Yotpo (https://www.yotpo.com/) according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR)to ask for reviews, ratings, questions & answers from our users.
Yotpo Ltd, 14 Oscar Shindler, Tel Aviv, Israel
16.7. Edit Order
We use Edit Order by Cleverific (https://www.editorder.net/) according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR) to process product returns or exchanges.
Cleverific, Inc., 924 Anacapa Street Suite 2P, Santa Barbara, CA, 93101, United States
16.8. Back in Stock
We use Back in Stock by Yellow Robot (https://backinstock.org/) according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR) to collect and send out notifications about product availability.
Yellow Robot Ltd., 20-22 Wenlock Road, London, England, N1 7GU
We use Fanmiles according to the fulfillment of our service (article 6 paragraph 1 letter a GDPR) as well as within the scope of our legitimate interest (article 6 paragraph 1 letter e GDPR) as loyalty program.
Fanmiles GmbH, Oranienstraße 6, 10997 Berlin Germany
16.10. Payment providers
We make use of different payment providers. In that regard, your payment information will be used for the purpose of payment processing. Depending on the payment method, we will forward your payment information to third parties. The legal basis for this data processing is Article 6 (1) (a), Article 6 (1) (b), DSGVO and Article 6 (1) (f) GDPR.
This service allows Control to connect with the User’s account on the Stripe network, provided by Stripe, Inc.. Stripe, Inc., 185 Berry Street, Suite 550, San Francisco, CA 94107
You can find more information about the collection of personal data by Stripe under https://stripe.com/us/privacy/
Financial transactions relating to our websites, apps and services may be also handled by our payment services providers Mollie. Mollie, Keizersgracht 313, Amsterdam, Netherlands. You can find information about the payment services providers' privacy policies and practices at:
You can make payment by using Klarna Invoice or Klarna Account, offered by Klarna AB, Registered Office Sveavägen 46, 111 34 Stockholm, Sweden. In this case we will collect and transmit to Klarna AB the necessary personal information for the processing of a purchase on account and the information required for the carrying out of identity and creditworthiness checks.
Klarna has a justified interest in the transmission of the personal data of customers and requires such data in order to obtain information from credit reference agencies for the purpose of identity and creditworthiness checks.
You may withdraw consent for the use of your personal data by Klarna at any time. Notwithstanding this, Klarna may remain entitled to process, use and transmit personal data in certain circumstances insofar as this is necessary for the contractual processing of payments by Klarna’s services, is legally stipulated or is required by a court or government authority.
17. Information about your rights
You can always ask for free which personal data we have stored about you. If your data is incorrect, we look forward to correcting it. Please inform us if your data has changed.
Information requests, complaints or suggestions concerning our data protection please send to the following address:
ESL Gaming GmbH
or via email to:
If you have questions about data protection, you can also contact the data protection officer by email firstname.lastname@example.org