Data Protection & GDPR Compliance

Privacy Policy

Legal Status: October 2026 · Compliant with EU General Data Protection Regulation (GDPR), BDSG, and § 25 TDDDG

Your Privacy Settings

Cookie & Tracking Consent Preferences

Pursuant to Art. 7(3) GDPR and § 25 TDDDG, you may modify or revoke your consent for optional analytics or marketing cookies at any time with future effect.

1. Name and Contact Details of the Controller

The controller responsible for data processing on this website within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the German Digital Services Telecommunications Data Protection Act (TDDDG) is:

Happy Kids Box GmbH eat&play

Represented by Managing Director: Ugur Doganay

Am Schafhaus 28 · 53557 Bad Hönningen · Germany

Commercial Register: Amtsgericht Montabaur · HRB 27031
Phone: +49 2635 9232699 · Email: info@happy-kids-box.eu

2. General Information, Legal Bases & Retention Periods

We process personal data only where permitted by European or national statutory provisions:

  • Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG): Where you have granted explicit consent for specific operations (e.g., non-essential analytics cookies).
  • Contract Performance & Pre-Contractual Measures (Art. 6(1)(b) GDPR): For order fulfilment, shipping, and customer account handling in our online shop.
  • Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Retention obligations under German commercial (HGB) and tax laws (AO).
  • Legitimate Interests (Art. 6(1)(f) GDPR): Technical IT security, bot prevention via local honeypots, and uninterrupted operation.

3. Website Provision, Hosting & Server Log Files

Every visit to our website automatically generates standard server log files (IP address, timestamp, requested URL, HTTP status code, browser user agent) for IT security and infrastructure monitoring.

Hosting Provider & Server Location: Our website is hosted on high-security servers of ALL-INKL.COM – Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany). The server location is exclusively within Germany. A Data Processing Agreement (DPA / AVV) pursuant to Art. 28 GDPR is established.

Technical Web Design & Maintenance: The technical maintenance and visual frontend development of this website are conducted on behalf of the controller by our digital agency Alvia Werbeagentur (Neuwied / Germany, www.alviawerbeagentur.de) under a Data Processing Agreement (DPA / AVV) pursuant to Art. 28 GDPR. No independent data processing for agency-owned purposes takes place.

Retention Period: Server log files are stored separately from all customer records, are never evaluated for marketing, and are automatically deleted after 14 days at the latest.

4. SSL / TLS Encryption & Technical Security Measures (Art. 32 GDPR)

To protect all submitted data (e.g. configurator choices, cart contents, order forms), our website uses modern TLS 1.3 encryption over HTTPS with strict HSTS security.

5. 100% Local Fonts & Self-Hosted Media (Zero External CDN Leaks)

In accordance with German court precedent (LG München I, Az. 3 O 17493/20), all typography (Inter & Fraunces) and production media are hosted exclusively on our own server. No user IP addresses or browser data are leaked to third-party CDNs (e.g. Google Fonts, FontAwesome, or Cloudflare).

6. Cookies, LocalStorage (§ 25 TDDDG) & Consent Management

Pursuant to § 25 TDDDG, non-essential cookies require prior opt-in. Essential local storage items (such as the Custom Box Builder cart state and customer mode) are used strictly under § 25(2) No. 2 TDDDG to deliver the requested shopping features.

7. E-Commerce, Box Configurator & Order Processing (B2B & B2C)

Data submitted during checkout (name, delivery address, company details, VAT ID for B2B) are processed strictly for contract fulfilment pursuant to Art. 6(1)(b) GDPR. Guest checkout is fully supported with no forced user accounts.

8. Payment Service Provider: Mollie B.V.

Online payments (Credit Card, PayPal, Klarna, SEPA) are processed securely via Mollie B.V. (Keizersgracht 126, 1015 CW Amsterdam, Netherlands). Payment data are entered directly into Mollie’s encrypted PCI-DSS-certified infrastructure. No payment credentials or credit card numbers are ever stored on our servers.

9. Your Rights as a Data Subject (Art. 15–22 GDPR)

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). To exercise your rights, contact us at info@happy-kids-box.eu.

Präferenz-Center · TDDDG § 25 & DSGVO

Individuelle Cookie- & Datenschutz-Einstellungen

Hier können Sie detailliert festlegen, welchen Diensten Sie zustimmen. Ohne Ihre aktive Zustimmung bleiben Statistik- und Marketing-Skripte vollständig blockiert (Strict Prior Blocking). Bei aktivierter Einwilligung können Daten an Server von Google und Meta (auch in Drittländern wie den USA auf Basis des EU-US Data Privacy Framework) übermittelt werden.

1. Technisch notwendige Speicherung (Essenziell)

Immer aktiv

Diese Funktionen sind für den sicheren Betrieb unseres E-Commerce-Systems zwingend erforderlich (§ 25 Abs. 2 Nr. 2 TDDDG, Art. 6 Abs. 1 lit. b und f DSGVO). Sie ermöglichen das Speichern Ihrer Box-Konfiguration, des Warenkorbs, der Netto/Brutto-Ansicht sowie Ihrer Datenschutz-Auswahl.

Eingesetzte Elemente: hkb_cart_v2 (Warenkorb & Box-Konfigurator im Browser-Speicher), hkb_cookie_consent_v2 (Speicherung Ihrer Einwilligung, Speicherdauer: 180 Tage), Mollie Checkout Session (Zahlungsabwicklung erst bei Bestellabschluss), lokale Schriftarten (@fontsource, kein externer CDN-Abruf).

Hilft uns zu verstehen, wie Besucher unsere Seiten, den 3-Schritte Box-Konfigurator und unsere Magazin-Beiträge nutzen, um die Benutzerfreundlichkeit fortlaufend zu verbessern (Rechtsgrundlage: Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG).

Dienst & Anbieter: Google Analytics 4 (GA4) – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (Muttergesellschaft: Google LLC, USA; zertifiziert nach dem EU-US Data Privacy Framework).
Technik & Consent Mode v2: Setzt bei Zustimmung analytics_storage = 'granted' (Cookies u. a. _ga, _ga_*, Funktionsdauer bis zu 14 Monate, IP-Anonymisierung standardmäßig aktiv).

Ermöglicht es uns, den Erfolg unserer Werbeanzeigen auf Google, Facebook und Instagram zu messen (Conversion-Tracking) und relevante Angebote für Gastronomie-Betriebe sowie Familien anzuzeigen (Rechtsgrundlage: Art. 6 Abs. 1 lit. a DSGVO, § 25 Abs. 1 TDDDG).

Google Ads Conversion-Tracking & Remarketing: Google Ireland Limited, Dublin, Irland. Steuert über Google Consent Mode v2 die Parameter ad_storage, ad_user_data und ad_personalization (Cookies u. a. _gcl_au, Speicherdauer bis zu 90 Tage).
Meta Pixel (Facebook & Instagram Ads): Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Irland (Muttergesellschaft: Meta Platforms Inc., USA; EU-US Data Privacy Framework). Erfasst nach Einwilligung Seitenaufrufe und E-Commerce-Ereignisse wie Warenkorb-Interaktionen (Cookies u. a. _fbp, _fbc, Speicherdauer bis zu 90 Tage).