Data Protection

Information

We welcome you to our website and appreciate your interest in our company. We take the protection of your personal data very seriously. Our data protection provisions comply with applicable statutory regulations on the protection of personal data, in particular with the provisions of the EU General Data Protection Regulation (EU GDPR), and are in line with the country-specific data protection provisions that apply to Zapf Creation AG. Therefore, please take a moment to familiarise yourself with our data protection information. It explains which data we collect on our website, what we use it for and what options are available to you. 

Responsibility in terms of data protection law lies with Zapf Creation AG, postal address:
Mönchrödener Str. 13, 96472 Rödental, Germany.

Contact information:
Telephone: +49 9563 725-0
Fax: +49 9563 725-116
Email: info@zapf-creation.com

Data protection contact:
datenschutz@zapf-creation.de

 

Subject of data protection

Subject of data protection is personal data. In accordance with Art. 4 Para. 1 GDPR, personal data encompasses any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
This includes information such as name, postal address, email address or telephone number, but also usage data such as your IP address.

Data that does not enable the personal identification of the user is anonymous data.

 

Purposes and legal basis of the data processing

When processing your personal data, the provisions of EU GDPR and all other applicable requirements according to data protection law are adhered to. The legal bases for data processing are derived from Art. 6 EU GDPR in particular.

We use your data for initiating business contact, fulfilling contractual and legal obligations, conducting the contractual relationship, offering the products and services and strengthening the customer relationship, which can also entail analyses for marketing purposes and direct marketing.

Your consent to data processing can also a represent an authorising provision under data protection law. Before you give your consent, we inform you of the purpose of the data processing and of your right to withdraw consent.

 

Data collection: categories and origin of data

The data we process is determined by the respective context: this depends on whether you submit queries using our contact form or take part in one of our competitions, for example.

 

During your visit to our website, we collect and process the following data:

  • Name of the internet service provider
  • Details of the website from which you are visiting us
  • Web browser and operating system used
  • The IP address assigned by your internet service provider
  • Requested files, transmitted data quantity, downloads
  • Details of our websites visited by you, including date and time

For reasons relating to technical security (in particular to defend against attempted attacks on our web server), this data is stored in accordance with Art. 6 Para. 1 lit. f EU GDPR. This data will be deleted after seven days at the latest.

 

Within the scope of a contact request and depending on the type of request, we collect and process the following data:

  • Last name, first name
  • Contact details
  • Address
  • Title
  • Message

 

Within the scope of competitions, we collect and process the following data:

  • Last name, first name
  • Last name and first name of the legal guardian
  • Address

 

Obligation to provide access to the data

A variety of personal data is required in order to establish, perform and terminate the contractual relationship and to fulfil the contractual and legal obligations involved. The same applies for the use of our website and the various functions that this provides.

We have summarised the details of this in the aforementioned item. In certain cases, data must also be collected or made available due to legal provisions. Please note that it is not possible to process your request or execute the contractual relationship on which this is based without providing this data.

 

Contact form / Contacting us via email (Art. 6 Para. 1 lit. a, b GDPR)

Our website contains a contact form that can be used to contact us electronically. When you use the contact form to write us, we shall process your data provided in the contact form in order to contact you and respond to your questions and wishes. 

In doing so, we observe the principle of data economy and data avoidance by requiring you to provide only the data we require for contacting you.

The data collected here differs according to the type of request; for example, it is sufficient to specify your name and email address when making a general request. If you are interested in a catalogue, we also ask for your address in order to send you the catalogue. Your IP address will also be processed, as this is a technical necessity and required for legal protection. All other data submitted is optional (e.g. for a more individual response to your questions). 

Should you contact us by email, we will use the personal data communicated in the email solely for the purpose of processing your request.

 

Competition (Art. 6 Para. 1 lit. a, b EU GDPR)

On our website, you have the option of entering our competition. When you fill in the competition screen, we process the data specified there solely for the purpose of executing the competition.

In doing so, we observe the principle of data economy and data avoidance by requiring you to provide only the data that is absolutely necessary for executing the competition and notifying you in the event that you win a prize. For example, this can be your name and address.

Without the mandatory fields, we unfortunately cannot execute the competition. Participation is not possible in this case.

 

Birth certificate

Our website offers the chance to create a birth certificate for your Baby Annabell. To do this, the name, date of birth and place of birth selected for your Baby Annabell and the name of the child (doll mummy/daddy) can be entered on the entry screen. The birth certificate with the data entered is then generated as a PDF, which you can save locally on your device. We do not save the data entered in our database. It is merely saved briefly in order to create the PDF. The data is deleted again after one hour.

 

Wish list

Our website offers the chance to create a wish list. This involves saving the name entered, the time the list is created, and the products added to the wish list. You also have the option of adding various comments to the individual products. If you use this option, the data entered there is also saved. We save this data in our database and as a PDF. The purpose of this data processing is to enable you to generate the wish list as a PDF file that you can save locally. All data is deleted after 180 days at the latest.

 

Cookies (Art. 6 Para. 1 lit. f EU GDPR, Art. 6 Para. 1 lit. a EU GDPR, Art. 6 Para 1 lit c EU GDPR)

Zapf Creation AG uses cookies in various locations. These help to make our website more user-friendly, effective and secure. Cookies are small text files that are placed and saved on your end device.

On the basis of our legitimate interest (Art. 6 Para. 1 Sentence 1 lit. f EU GDPR), we set technically necessary cookies that are needed to operate the website and to ensure its functioning. Depending on their purpose, they are permanently saved, even after the end of the session (persistent cookies, e.g. opt-out), or are deleted when the browser is closed (session cookies – these are only valid for a single browser session).

We set additional cookies on the basis of your consent. These cookies enable us to analyse how users use our websites, so that we can design the website content to meet the users’ needs. The cookies also give us the opportunity to measure the effectiveness of a particular advertisement and to position it depending on the topics a user is interested in, for example. The legal basis for this is your consent (Art. 6 Para. 1 Sentence 1 lit. a EU GDPR).

If you have consented to this, you can, of course, withdraw this consent here without giving any reasons:

Google Analytics

This website uses Google Analytics, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer to help the website to analyse how visitors use the site.

The following data concerning you is saved/processed in this connection:

  • IP address
  • Usage data
  • Click path
  • App updates
  • Browser information
  • Device information
  • JavaScript support
  • Visited sites
  • Referrer URL
  • Downloads
  • Flash version
  • Location information
  • Purchasing activity
  • Widget interactions
  • Date and time of visit

The information generated by the cookie about your use of the website will be transmitted to and saved by Google on servers in the United States. However, if IP anonymisation is activated on this website, Google will shorten your IP address before transmitting it within EU Member States or in other member states of the European Economic Area. Your full IP address will only be transmitted to a Google server in the USA and shortened there in exceptional cases. Google will not associate the IP address transmitted by your browser in relation to Google Analytics with any other data held by Google.

We have also deactivated Universal Analytics so that no user ID is created that would enable cross-device tracking.

Google will use this information on behalf of the website operator for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage. The legal basis for this is Art. 6 Para. 1 lit. a EU GDPR.

This service can forward the collected data to a different country. Please note that this service can transmit data outside the European Union and the European Economic Area and to a country without an adequate level of data protection. If the data is transmitted to the USA, there is a risk of your data being processed by US public authorities for control and inspection purposes without you having the possibility of legal redress. However, we take the possible measures that are necessary from the perspective of data protection law in line with Art. 44 et seq. EU GDPR in order to ensure an adequate level of data protection in the third country.

The personal data of the users is erased or anonymised after 14 months.

Further information on the terms of use and data protection can be found at https://marketingplatform.google.com/about/analytics/terms/gb/ and https://policies.google.com/privacy?hl=en-GB.

 

YouTube (Art. 6 Para. 1 lit. a EU GDPR)

We have embedded YouTube videos from the provider Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) in our online offering, which are saved on http://www.youtube.com and can be played directly from our website. These are all embedded in “privacy-enhanced mode”, i.e. no data about you as a user is transferred to YouTube if you do not view the videos. However, the privacy-enhanced mode only relates to the recording of user behaviour and not the provision of ads, the reloading of further content from third parties, the transmission of fonts and possible links with your user account on YouTube. If you start the video, this triggers further data processing operations. We have no influence over this. The legal basis for this is your consent as per Art. 6 Para. 1 Sentence 1 lit. a EU GDPR.

You can withdraw your consent at any time in our cookie settings.

This service can forward the collected data to a different country. Please note that this service can transmit data outside the European Union and the European Economic Area and to a country without an adequate level of data protection. If the data is transmitted to the USA, there is a risk of your data being processed by US public authorities for control and inspection purposes without you having the possibility of legal redress. However, we take the possible measures that are necessary from the perspective of data protection law in line with Art. 44 et seq. EU GDPR in order to ensure an adequate level of data protection in the third country.

As a result of your visit to the website, YouTube is informed that you have called up the corresponding page of our website. Data is transmitted regardless of whether YouTube provides a user account that you are logged in to or whether no user account exists. If you are logged in to Google, your data is assigned directly to the account. If you do not wish this data to be assigned to the YouTube profile, you must log out before activating the button. YouTube saves the data as user profiles and uses it for the purposes of advertising, market research and/or the needs-based use of its website. In particular, and even for users who are not logged in, such an analysis takes place for the purpose of providing needs-based advertising and informing other users of the social network about your activities on our website. You have a right to object to the formation of these user profiles; in order to exercise this right, you must contact YouTube.

Further information regarding data protection can be found at: https://policies.google.com/privacy

 

Google reCAPTCHA (Art. 6 Para. 1 lit. f EU GDPR)

We use the reCAPTCHA function from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on this website. This function is predominantly used to determine whether an entry has been made by a natural person or improperly through automated machine processing.

The legal basis for this processing is Art. 6 Para. 1 lit. f EU GDPR, based on our legitimate interest in the security of our website and in preventing misuse and spam.

The query includes transmission of the IP address and, if applicable, further data needed by Google for the reCAPTCHA service to Google. Your entry is transmitted to Google and used there for this purpose.

This service can forward the collected data to a different country. Please note that this service can transmit data outside the European Union and the European Economic Area and to a country without an adequate level of data protection. If the data is transmitted to the USA, there is a risk of your data being processed by US public authorities for control and inspection purposes without you having the possibility of legal redress. However, we take the possible measures that are necessary from the perspective of data protection law in line with Art. 44 et seq. EU GDPR in order to ensure an adequate level of data protection in the third country.

You can view the Google terms of use at https://policies.google.com/terms; additional, detailed information on data protection is available on the Google website (“Google Privacy Policy”): https://policies.google.com/privacy

Opt-out: https://adssettings.google.com/authenticated.

 

CloudFront (Art. 6 Para. 1 lit. f EU GDPR)

This website uses the CloudFront content delivery network (CDN). This is a service offered by Amazon Web Services Inc., 410 Terry Avenue North, Seattle, WA 98109-5210. The CloudFront CDN makes duplicates of website data available on various Amazon Web Services (AWS) servers located all over the world. This results in faster website loading times, greater reliability and increased protection against data loss. Some of the images and videos embedded in this website are obtained from the CloudFront CDN when calling up the site. By making this request, information about your use of our website (e.g. your IP address) is transferred to Amazon servers in other EU states and saved there. This takes place as soon as you enter our website. Amazon Web Services and the Amazon CloudFront CDN are used in the interests of improving the reliability of the website, increasing protection against data loss and improving loading speeds on this website. This is a legitimate interest in accordance with Art. 6 Para. 1 lit. f GDPR. Information on the data protection measures and the current privacy notice of Amazon Web Services can be found at: https://aws.amazon.com/privacy/
This service can forward the collected data to a different country. Please note that this service can transmit data outside the European Union and the European Economic Area and to a country without an adequate level of data protection. If the data is transmitted to the USA, there is a risk of your data being processed by US public authorities for control and inspection purposes without you having the possibility of legal redress. However, we take the possible measures that are necessary from the perspective of data protection law in line with Art. 44 et seq. EU GDPR in order to ensure an adequate level of data protection in the third country.

 

Social media links

On our website, you will find links to social media services from Facebook and YouTube. You can recognise links to the websites of social media services by the company logos. Following these links will take you to the Zapf Creation AG corporate page on the respective social media service. Clicking on a link to a social media service creates a connection to the servers of the social media service. The fact that you have visited our website is transmitted to the servers of the social media service. Further data is also transmitted to the social media service provider. This may include the following:

  • Address of the website on which the link used was found
  • Date and time at which the website was accessed or the link activated
  • Information on the browser and operating system used
  • IP address

If you are already logged in to the relevant social media service when the link is activated, the provider of the social media service may be able to determine your user name and perhaps even your real name from the data transmitted and to match this information to your personal account on the social media service. You can rule out the possibility of this matching to your personal user account by logging out of your account first.

The servers of the social media services are located in the USA and other countries outside the European Union. The data can therefore be processed by the provider of the social media service in countries outside the European Union. Please note that companies in these countries are subject to data protection laws that generally do not protect personal data to the same level as those in the member states of the European Union do.

Please note that we have no influence over the scope, type or purpose of data processing by providers of social media services. You can find more information on the use of your data by the social media services integrated into our website in the Privacy Policy of the respective social media service.

 

Commerce Connector (“Buy Now” button) (Art. 6 Para. 1 lit. b EU GDPR)

We offer a selection of online retailers on our website, which you can access via a link on our website. They are linked via a “Buy Now” button or via the logo of the respective online shop. If you click on the link, our partner – Commerce Connector GmbH – will save a cookie on your end device for a limited period of time (usually 7 days). Should you make a purchase from the retailer during this period, Commerce Connector can access the cookie in order to obtain information about your purchase from the retailer as soon as you go to the order confirmation page of the retailer.
Commerce Connector receives no personal information that would allow you to be identified, but rather a unique cookie number. Commerce Connector uses the purchasing information thus collected in order to generate anonymised sales statistics for our products that were purchased via the link, and subsequently provides these statistics to us.
Should you wish to receive more information about this “sales tracking” or if you would like to find out how to deactivate it, please read Commerce Connector’s online privacy policy at https://www.commerce-connector.com/web/policy-cco/.

 

Use and disclosure of personal data/earmarking

We will only collect, process and use all the personal data we receive from you during your use of the Zapf Creation AG website for the stated purpose. In doing so, we ensure that this only happens in accordance with the relevant legal provisions and/or only with your permission.
We will not publish, sell or provide the collected personal data to third parties by any other means. This data will not be used for advertising purposes.

 

Recipients of the data / Categories of recipients

Within our company, we make sure that only individuals that require your data to fulfil contractual and statutory obligations are given access to your data.

In many cases, service providers support our departments in performing their tasks. All service providers have signed the required data protection contracts. This concerns the following categories of service providers:

  • IT
  • Credit rating check
  • Marketing
  • Payment services
  • Dispatch
  • Service providers for responding to complaints on our behalf

 

Transfer to third countries / Intended transfer to third countries

We only transfer data to third countries (outside the European Union or the European Economic Area) if this is required to fulfil our obligations, it is prescribed by law, or you have provided us with consent to do so.

We do not transfer your personal data to service providers outside the European Economic Area.

 

Rights of data subjects (Art. 15–22 EU GDPR)

You have the right to gain information about the personal data affecting you, as well as the right to correction or erasure, where this would not violate any statutory storage periods. You are also entitled to demand the restriction of processing from Zapf Creation AG and to assert a right of objection against the processing and the right of data portability. In addition, you have the right to submit a complaint to the supervisory authority.

To assert these rights, please contact: Datenschutz@zapf-creation.de or write to Zapf Creation AG, subject “data protection”, Mönchrödener Str. 13, 96472 Rödental, Germany.

 

Routine erasure and blocking of personal data

Zapf Creation AG processes and saves personal data on the affected person only for the period required in order to achieve the purpose of the storage or for the duration of a statutory storage period. Once the purpose has been fulfilled or the period has expired, the relevant data is routinely erased, unless it is still required for contract fulfilment or prior to concluding a contract. 

 

Data security

We have taken appropriate technical and organizational measures in order to protect the data we store on our staff/customers/suppliers against accidental or deliberate manipulation, loss, destruction or access by unauthorized persons. The security levels are constantly reassessed and adapted to new security standards in collaboration with security experts.

The exchange of data from and to our website is encrypted. We provide a HTTPS transfer protocol for our website, always using the latest encryption protocol. We are the only ones who can decrypt your data. There is also the option of using alternative communication channels (e.g. by post).

 

Online services for children

Persons under the age of 16 may not provide any personal data to us without the consent of parents or legal guardians, nor may they submit a declaration of consent. We encourage parents and legal guardians to play an active role in the online activities and interests of their children.

 

Links to other providers

Our website also contains – clearly recognisable – links to the websites of other companies. Insofar as links to the websites of other providers are present, we have no influence over their content. For this reason, no warranty or liability can be assumed for this content. In all cases, the provider or operator of the linked website is liable for the content.

The linked websites were reviewed for possible and recognisable legal infringements at the time the links were placed. No unlawful content was recognisable at the time the links were placed. A constant review of the content of the linked websites cannot be expected without a specific indication of an infringement of the law. As soon as infringements of the law become known to us, such links will be removed immediately.

 

Automated case-by-case decisions

We do not use any purely automated processing procedures to reach decisions.

 

Privacy policy / Notes on data protection in social media

Zapf Creation AG maintains Baby Annabell channels in “social media”, which are available on Facebook, Instagram and YouTube. Insofar as we have control over the processing of your data, we ensure that the applicable data protection provisions are adhered to.

In the following, you can find the most important information on data protection law in connection with our online offerings. Please note that the use of these platforms and their functions is solely your responsibility. This applies particularly to the use of interactive functions (e.g. commenting, sharing, reviewing). 

 

Name and address of the controller responsible for operation

Alongside Zapf Creation AG, the following are responsible for corporate presences in the meaning of the EU General Data Protection Regulation (EU GDPR) and other data protection provisions:

  • Facebook
    (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
  • YouTube
    (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland)
  • Instagram
    (Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)

However, you are responsible for your use of these platforms and their functions. This applies particularly to the use of interactive functions (e.g. commenting, sharing, reviewing).

Please also note that your data may be processed outside the borders of the European Union in this context.

 

Purpose and legal basis

We maintain the fan pages ourselves in order to communicate with the visitors to these pages and to inform them about our offerings through this channel.

Furthermore, we collect data for statistical purposes in order to further develop and optimise the content and make our offering more attractive. The data required for this (e.g. total number of impressions, page activities, interactions and data provided by the users) is processed by the social networks and made available to us. We have no influence over the generation and display of this data.
Your data may also be processed for market research and advertising purposes. For example, your usage behaviour and the resulting interests may be used to create usage profiles. This may result in advertisements thought to correspond to your interests appearing both on and outside the platforms. Generally, cookies are stored on your computer for this purpose. Irrespective of this, data which is not immediately collected on your end device can also be stored in the usage profiles (in particular when you are a member of the respective platforms and are logged in). 
As the provider of this information service, we only collect and process the data needed in order to respond to the messages you can send us. We do not use your data for any other purposes.  

The processing of users’ personal data is based on our legitimate interest in effective information for and communication with users in accordance with Art. 6 Para. 1 lit. f. GDPR.

If you are prompted by Facebook to provide consent for data processing (i.e. declaring your consent for example by clicking a checkbox or confirming it via a corresponding button), the legal basis for the processing is Art. 6 Para. 1 lit. a., Art. 7 GDPR. 

 

Right to object 

If you are a member of Facebook and do not want the network to collect your personal data via our website and link it to your membership data stored with the respective network, you must 

  • log out of the respective network before visiting our website,
  • delete the cookies stored on your device and 
  • close and restart your browser. 

However, after logging in again, you can again be identified by the network as a specific user. 

Please see the links below for detailed information on the types of processing and the rights to object (opt out):

You have the following rights regarding the processing of your personal data:

The right to access; the right to rectification; the right to erasure; the right to the restriction of processing; the right to object; the right to data portability; and the right to lodge a complaint about the unlawful processing of your personal data with the responsible data protection authority.

However, because Zapf Creation AG does not have complete access to your personal data, you should contact the social media providers directly when asserting claims; these have access to the personal data of their users, can take the corresponding measures and are able to grant access.

Should you nonetheless require assistance, we will of course try to support you. Please contact datenschutz@zapf-creation.de

 

Notes on copyright and artistic copyright

Should you wish to publish images, texts, plans, videos, music, etc. on our channel, you should be aware that by doing so you may be assigning all usage rights to the network, which may ultimately entail legal consequences for you if you are not the originator or copyright holder yourself.

 

Questions on data protection?

In case you have any questions on data protection, please contact datenschutz@zapf-creation.de or write to Zapf Creation AG, subject “data protection”, Mönchrödener Str. 13, 96472 Rödental, Germany.

Dolls
Dolls
Accessories
Accessories
Theme Worlds
Theme Worlds
Play & Fun
Play & Fun
Service
Service