This privacy notice informs you pursuant to Articles 13 and 14 GDPR and Section 25 TDDDG which personal data we process when you use our online shop. The shop cannot be used without a customer account; placing an order requires registration.
Last updated: 19.08.2026 17:16. The version published on this page applies. Please also see our legal notice and General Terms and Conditions.
§1 Controller
Van de Everest UG (haftungsbeschränkt)
Frankenstraße 152
90461 Nürnberg
Germany
Phone: +49 911 14895050 | +49 1579 2483420
Email: support@remicals.de | business@remicals.de
Website: https://remicals.de
§2 Privacy contact
No data protection officer within the meaning of Articles 37 and 38 GDPR has been appointed. For questions about data protection, access, rectification, erasure or objection, please contact the controller (§1).
§3 Legal bases
Depending on the processing, we rely on:
- Art. 6(1)(b) GDPR (contract / pre-contractual steps),
- Art. 6(1)(c) GDPR (legal obligations, in particular commercial and tax law),
- Art. 6(1)(f) GDPR (legitimate interests, e.g. IT security, abuse prevention, asserting claims, direct marketing of similar own products under Section 7(3) UWG),
- Art. 6(1)(a) GDPR together with Section 25(1) TDDDG (consent, in particular for non-essential cookies and tracking).
§4 Hosting, logs and session
We operate the online shop and related systems ourselves on servers in the European Union. This includes in particular: the shop, content management (Directus), customer and order data (Directus), login (Keycloak), the ticketing system (Zammad), Bitcoin payment processing (Electrum), cache/session (Redis) and our email infrastructure. These systems are not hosted by external processors.
Each request generates technically necessary log data (IP address, date/time, URL, referrer, user agent, status code) for delivery, stability and attack prevention (Art. 6(1)(f) GDPR). Logs are kept only as long as needed for these purposes, usually a few days, longer only in the event of security incidents.
For the session (login status, cart, language, affiliate assignment) we use technically necessary cookies or a server-side session (Redis). Legal basis: Art. 6(1)(b) and (f) GDPR, Section 25(2) no. 2 TDDDG.
§5 Cookies and tracking consent
We set technically necessary cookies (session, cart, storage of your tracking choice) without consent. Analytics and marketing technologies are loaded only after you actively enable tracking. We store that choice in the cookie enable_tracking (15 days). You can change it at any time via the tracking notice at the bottom of the page.
Tracking is disabled by default. Google Analytics and Google Tag Manager are not loaded without your active consent. The shop’s CSS, fonts and JavaScript are served locally from our servers; a normal page load does not fetch external font, CSS or JavaScript CDNs.
§6 Customer account and login
For the account and login we use our self-hosted identity service (Keycloak). We process in particular email address, password hash, name, language, roles, login times and IP addresses for abuse prevention. In the customer account we store addresses, orders, wallet, support references and similar master data. Legal basis: Art. 6(1)(b) and (f) GDPR. Without these data a contract cannot be concluded in the shop.
§7 Orders, shipping and age confirmation
To perform the contract we process order data, billing and shipping addresses (including Packstation/post number where provided), cart, prices, tax, shipping method and tracking numbers. By ordering you confirm that you are of legal age; we store this in the order context.
Physical shipments are handed over to DHL Paket GmbH (or affiliated DHL companies) for carriage and tracking. DHL receives the address and shipment data required for delivery. Legal basis: Art. 6(1)(b) and (c) GDPR. We have an Art. 28 GDPR data-processing agreement with DHL.
To check shipping and billing addresses we transmit the entered address server-side to the Address Validation API of Google Ireland Limited. No Google script is loaded in the browser for this. Legal basis: Art. 6(1)(b) and (f) GDPR (correct delivery, avoiding misrouted shipments). We have an Art. 28 GDPR data-processing agreement with Google.
§8 Payment
Payment is processed by the provider selected at checkout. Depending on availability this may include SEPA/bank transfer (e.g. Qonto, Finom), Stripe, PayPal, Klarna, SumUp, GoCardless and crypto payments (e.g. Bitcoin). The respective provider receives the data needed for payment, fraud prevention and legal duties (including amount, order reference and, depending on the method, name, address, account or payment data, IP address, device and risk indicators).
Where payment providers act as our processors, we have Art. 28 GDPR data-processing agreements in place. Payment providers may also carry out automated risk checks under their own responsibility. Details are set out in their privacy notices. Our legal basis: Art. 6(1)(b), (c) and (f) GDPR.
If you choose Klarna, the order page loads the Klarna script required for payment from servers of Klarna Bank AB (publ). That script is not loaded unless you pay with Klarna.
Crypto payments via Electrum are processed on our own infrastructure; data are not disclosed to an external Bitcoin payment provider.
§9 Wallet, credit and affiliate
We store wallet credit, top-ups, redemptions and affiliate assignments in the customer account to process payments and bonus programmes (Art. 6(1)(b) and (f) GDPR). Affiliate IDs may be kept in the session so a later registration can be attributed.
§10 Invoices (Lexware/Lexoffice)
For accounting and invoicing we transmit the required order and address data to Lexware (Lexoffice), a service of Haufe-Lexware GmbH & Co. KG. Legal basis: Art. 6(1)(b) and (c) GDPR (including Section 14 UStG, Section 147 AO, Section 257 HGB). We have an Art. 28 GDPR data-processing agreement with Lexware.
§11 Support (Zammad)
Contact forms, support tickets and related order references are processed in our self-hosted Zammad ticketing system on servers in the EU. The form script is loaded from our own support host, not from a third-party CDN. Legal basis: Art. 6(1)(b) and (f) GDPR. Support records are deleted or restricted when no longer needed, unless retention duties apply.
§12 Email and direct marketing
Transactional emails (order confirmation, payment and shipping notices, withdrawal instructions) are required to perform the contract (Art. 6(1)(b) GDPR).
We may use the email address provided with an order to inform you about similar own products pursuant to Section 7(3) UWG together with Art. 6(1)(f) GDPR. You may object at any time (contact details in §1) at no cost other than transmission costs at the basic rates.
§13 Fonts
The Roboto font is served locally from our servers. Visiting the shop does not connect to Google Fonts, fonts.googleapis.com, fonts.gstatic.com or any other font CDN.
§14 Google Analytics and Google Tag Manager
Only after your consent (tracking toggle, Art. 6(1)(a) GDPR, Section 25(1) TDDDG) we use Google Analytics 4 and Google Tag Manager of Google Ireland Limited. Google receives usage data (pages viewed, events, approximate location and device data, online identifiers). For logged-in users an internal user ID may be passed to the data layer to attribute order events. Processing by Google LLC in the USA is possible. We have an Art. 28 GDPR data-processing agreement with Google.
You may withdraw consent at any time with effect for the future by disabling tracking. Processing carried out until then remains lawful.
§15 Social-media links
The footer may contain links to profiles (e.g. Facebook, Instagram). Merely visiting our shop does not load social plugins or pixels of those providers. Only when you click a link do that provider’s privacy rules apply.
§16 Recipients and third-country transfers
Self-hosted (no external processors): shop, Directus (content and customer data), Keycloak, Zammad, Electrum, Redis and email infrastructure.
Processors under Art. 28 GDPR agreements: Google (Address Validation; and, where you consent, Analytics/Tag Manager), DHL, Lexware/Lexoffice and the payment providers actually used.
Where data are transferred to the USA or other third countries (typical for Google, PayPal, Stripe, Klarna), this is based on an adequacy decision (EU-US Data Privacy Framework where the recipient is certified) and/or the EU Commission’s standard contractual clauses (Art. 46 GDPR).
§17 Storage period
- Customer account: for as long as the account exists and thereafter until statutory retention periods expire;
- Orders, invoices, payment records: usually 8 to 10 years (Section 147 AO, Section 257 HGB);
- Support cases: until completion plus a reasonable follow-up period, longer in case of disputes;
- Logs: see §4;
- Tracking cookie: 15 days or until you change your choice;
- Session: until logout or session expiry.
§18 Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(e) or (f) GDPR, including direct marketing. You may withdraw consent at any time. To exercise these rights, contact us using the details in §1.
You also have the right to lodge a complaint with a supervisory authority, in particular in your place of residence or with our competent authority:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
https://www.lda.bayern.de
§19 Obligation to provide data
To conclude a contract and meet legal duties you must provide the data marked as required in the order process. Without those data we cannot perform the contract.
We ourselves do not use automated decision-making within the meaning of Art. 22 GDPR. Payment providers may run their own risk checks.