Last updated: 17 September 2026
1. Controller
The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Buitenkeukendeal B.V.
trading under the brand VARETTI
Slachthuiskade 36
7602 CV Almelo
The Netherlands
Phone: +31 (0)85 060 52 85
E-mail: info@varetti.de
2. Visiting our website and hosting
When you visit our website, technically necessary access data is processed. This includes in particular the IP address, date and time of access, the page or file accessed, the amount of data transferred, the referrer URL, browser type and version, operating system, device information and HTTP status code.
This processing is necessary to provide the website securely and reliably, to fend off attacks and to analyse technical errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our online services securely and in working order. Our hosting and IT service providers process this data exclusively on our behalf. Log data is deleted or anonymised as soon as it is no longer required for the purposes stated.
3. Cookies, similar technologies and your consent
We use technically necessary cookies and similar technologies where this is required to provide the website, save your selections or enable security-related functions. Access to information on your terminal equipment for this purpose is based on § 25(2) TDDDG; the processing of personal data is based on Art. 6(1)(f) GDPR.
Analytics and marketing technologies are only used if you have given your prior consent via our cookie settings. The legal basis for accessing information on your terminal equipment is § 25(1) TDDDG; Art. 6(1)(a) GDPR applies to the subsequent processing of personal data. Your consent is voluntary and can be withdrawn or adjusted at any time with effect for the future via "Cookie settings" in the footer. The lawfulness of processing carried out before withdrawal remains unaffected.
As part of consent management, we store your selection, the time of your selection and technical evidence data in order to apply your settings and be able to demonstrate them. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in managing consents in a legally compliant way.
4. Ordering, delivery and contract processing
When you place an order with us, we process the data required to initiate, conclude and perform the contract. This includes in particular your name, billing and delivery address, e-mail address, phone number, the goods ordered, configuration, price, payment status, and delivery and communication data.
We use this data to process your order, handle payment, deliver, communicate with you as a customer, deal with statutory warranty claims and fulfil statutory retention and documentation obligations. The legal bases are Art. 6(1)(b) GDPR (contract or pre-contractual measures) and Art. 6(1)(c) GDPR (legal obligations).
Recipients may include in particular payment service providers, transport companies, IT and hosting service providers, communication service providers, tax and accounting service providers and public authorities, insofar as this is necessary for the respective purposes. Where we use service providers, they process data on the basis of a data processing agreement or as independent controllers.
5. Customer account and contacting us
If you create a customer account, we process the registration and account data you provide in order to provide the account and manage your orders. The legal basis is Art. 6(1)(b) GDPR. You can have your customer account deleted at any time via customer service, unless statutory retention obligations prevent this.
If you contact us by e-mail, phone or via a contact form, we process your details in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR on the basis of our legitimate interest in efficient customer communication.
6. Newsletter
If you subscribe to our newsletter, we process your e-mail address and – if provided – your name in order to send you information about VARETTI, our products and offers. Sign-up generally takes place using the double opt-in procedure. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the unsubscribe link in every newsletter or by notifying info@varetti.de.
To provide evidence of consent, we store the time of sign-up and confirmation as well as the technical data used in the process, to the extent necessary. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest lies in being able to prove a lawful sign-up.
7. Analytics and marketing technologies
We only use the services listed below on the basis of your consent via the cookie settings. They help us understand how our website is used, measure the effectiveness of advertising and deliver interest-based advertising. You can change your selection at any time via "Cookie settings".
7.1 Google Tag Manager
We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"), to manage website tags centrally. Tag Manager itself does not create user profiles; however, it may process technical data such as IP address and event data when tags are triggered. Non-essential tags are only activated after you have given your consent. The legal basis is § 25(1) TDDDG and Art. 6(1)(a) GDPR.
7.2 Google Analytics 4
We use Google Analytics 4 from Google to evaluate and improve the use of our website. In particular, pseudonymous usage and event data, pages viewed, interactions, device and browser information and approximate location information may be processed. The legal basis is your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR.
Further information on data protection at Google can be found at https://policies.google.com/privacy.
7.3 Google Ads
We use Google Ads, including conversion tracking and – where activated – remarketing functions, to measure the effectiveness of our adverts and show you relevant ads. Cookie IDs, online identifiers, and interaction and conversion data may be processed in the process. The legal basis is your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR.
7.4 Meta Pixel and Meta Conversions API
We use the Meta Pixel and the Meta Conversions API from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"), to measure the effectiveness of advertising on Facebook and Instagram and to deliver interest-based advertising. In particular, online identifiers, device and browser data, IP address, page views, interactions and conversion events may be processed and transmitted to Meta. Where technically possible, data is transmitted in pseudonymised or hashed form via the Conversions API.
For certain processing operations in connection with the collection and transmission of event data, we and Meta may be joint controllers. The legal basis is your consent pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR. Further information can be found in Meta's privacy policy at https://www.facebook.com/privacy/policy/.
8. Data transfers to third countries
When Google and Meta services are used, a transfer of personal data to countries outside the European Economic Area, in particular to the USA, cannot be ruled out. Where an adequacy decision of the European Commission exists, we base transfers on it; otherwise we use appropriate safeguards within the meaning of Art. 44 et seq. GDPR, in particular standard contractual clauses, where necessary.
9. Storage period
We only store personal data for as long as is necessary for the respective purposes. In addition, we retain contract and billing data for the duration of statutory retention periods. After that, the data is deleted or anonymised, unless there is another legal basis for storing it.
10. Your rights
Subject to the statutory requirements, you have the right of access to the personal data we hold about you (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and to object to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future.
To exercise your rights, a message to info@varetti.de is sufficient.
11. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is in particular the Dutch supervisory authority, the Autoriteit Persoonsgegevens. You can also contact the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.
12. Updates to this privacy policy
We update this privacy policy when legal requirements, our website or the processing operations we use change. The current version can always be found on this page.