We, In a nutshell – Kurzgesagt GmbH, operate an online shop at https://shop-eu.kurzgesagt.org/ (“Online Shop”) and offer our customers the option of voluntarily participating in our customer loyalty program (“Loyalty Program”). As part of the Loyalty Program, customers can collect points for purchases and other activities via the Online Shop and redeem them for rewards (“Rewards”). In the course of your participation in the Loyalty Program, personal data of you as a participating customer (“you” or “Participant”) is processed.

In this context, we are subject to specific information obligations under the European General Data Protection Regulation (“GDPR”). Accordingly, we provide you below with information about the processing of your personal data in connection with the registration for, and use of the Loyalty Program.

Participation in the Loyalty Program is voluntary and takes place exclusively through a separate registration by ticking the dedicated opt-in box when creating a customer account for the Online Shop. If you do not wish to participate in the Loyalty Program, you will not suffer any disadvantages. You can use the Online Shop and your customer account without any restrictions, even without participating in the Loyalty Program.

1. Controller and Data Protection Officer within the meaning of the GDPR

• Controller is In a nutshell – kurzgesagt GmbH (“We”), Landwehrstraße 39, 80336 Munich, Germany, reachable by phone at +49 (0)89 9545 730 20 and by email at info@kurzgesagt.org.
• Data Protection Officer is LS Sport GmbH, Widenmayerstraße 28, 80538 Munich, Germany, reachable by email at dataprotection@kurzgesagt.org.

2. What personal data is collected?

In connection with the registration for, and use of, the Loyalty Program, the following personal data relating to you is processed (in connection with the account you created in the Online Shop):

• Master data (first and last name, email address, address phone number (optional, if provided by you))
• Date of birth (optional, if provided by you)
• Transaction data (e.g. orders, purchased products, order values, returns)
• Program data (e.g. date of account creation, activities within the Loyalty Program, points collected and redeemed, Rewards claimed)
• Technical data (e.g. IP address, times of use)

3. On what legal bases and for which purposes is this data processed?

We process the personal data listed under section 2 for the purpose of operating and administering the Loyalty Program, in particular for managing your customer account in connection with the Loyalty Account, awarding and managing points, providing and redeeming Rewards, and for program-related communications with you (e.g. notifications about new Rewards, reaching a new status, or reminders regarding points that have not yet been redeemed).

The legal basis for the processing is the necessity for the performance of a contract with you, as the processing of your data is required for the administration and operation of the Loyalty Program on the basis of the General Terms and Conditions of Participation for the Loyalty Program, insofar as you have decided to participate in the Loyalty Program.

Where we process personal data to ensure the security and proper functioning of the Loyalty Program and to prevent misuse (e.g. blocking an account in the event of breaches of the General Terms and Conditions of Participation for the Loyalty Program), this is carried out on the basis of our legitimate interests in operating the Loyalty Program in an orderly and legally compliant manner.

Promotional communications by email (e.g. newsletters) will only be sent if you have separately consented to this or if the statutory requirements are met.

4. Recipients of the data

Within our organisation, only those persons receive access to the data listed under section 2 who require it for the administration of the Loyalty Program and for the fulfilment of the related contractual and statutory rights and obligations.

5. Transfer of data to third parties

Your personal data will only be disclosed to further third parties if:

1. you have given your express consent thereto,
2. the disclosure is necessary for the establishment, exercise, or defence of legal claims, and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
3. there is a statutory obligation to disclose the data, or
4. the disclosure is made to a service provider acting on our behalf and exclusively on our instructions (data processor), whom we have carefully selected and with whom we have concluded a corresponding data processing agreement.

In connection with the Loyalty Program, we engage the following processors within the meaning of letter d) above:

• LoyaltyLion Ltd., 20 Farringdon Street, London, EC4A 4EN, UK, as our customer loyalty program; 
• Shopify International Ltd., Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, as the operator of the underlying shop system to which the Loyalty Program is linked (in parallel to the Online Shop);
• Klaviyo Inc., 120 Summer Street, Boston, USA, as the email service provider for program-related communications (in parallel to the Online Shop).

Where the involvement of third parties or our data processors results in a transfer of data outside the EU, we will comply with the applicable safeguards pursuant to Art. 44 et seq. GDPR (with regard to the UK and the US, adequacy decisions pursuant to Art. 45(1) GDPR exist in relation to the data processors named above).

6. Retention period and deletion of data

Your data is deleted as soon as it is no longer required for the purposes for which it was collected.

The data processed in the course of the Loyalty Program is generally stored for the duration of your participation in the Loyalty Program. If you deregister from the Loyalty Program or have your customer account deleted, your data will be removed from the Loyalty Program through an automatic synchronisation with the shop system. At that point, all points collected up to that time and not yet redeemed will expire.

In other respects, data will be blocked from further use and deleted upon expiry of any applicable retention periods under tax and commercial law, unless you have expressly consented to the further use of the data.

7. Rights of data subjects

You are entitled to a number of rights under the GDPR, of which we would first like to highlight the right of withdrawal and the right to object:

• Where we process personal data on the basis of your consent, you have the right to withdraw your consent at any time without giving reasons. In this case, we will no longer continue the data processing based on such consent going forward. You may withdraw your consent to participate in the Loyalty Program in particular by deregistering from the program in the settings of your customer account or by sending a corresponding notice to us using the contact details set out under section 1. The withdrawal of your consent does not, however, affect the lawfulness of the processing carried out on the basis of the consent prior to such withdrawal.
• Where your personal data is processed on the basis of legitimate interests, you have the right to object to the processing of your personal data, insofar as there are grounds for doing so arising from your particular situation.

If you wish to exercise your right of withdrawal or right to object, an email to dataprotection@kurzgesagt.org is sufficient.

In addition, you have a right of access regarding the personal data stored about you, a right to rectification of inaccurate data, a right to erasure of the data (subject to the statutory requirements), a right to restriction of processing, and a right to data portability. You also have the right to lodge a complaint with the competent data protection supervisory authority.

The supervisory authority competent for our registered office is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), 
Promenade 18, 91522 Ansbach, Germany, 
phone: +49 (0) 981 180093-0, 
email: poststelle@lda.bayern.de.

To exercise your data subject rights other than the right to lodge a complaint with the supervisory authority, an email to dataprotection@kurzgesagt.org is sufficient.