Privacy Policy

Last updated: 5 October 2026 · Version 1.0 · Earlier versions are available on request.

At a glance

This policy explains which personal data we process when you visit acinfinity.eu, order from us, withdraw from a contract or contact us – and what rights you have.

• Who is responsible? GrowTechnology GmbH in Lauchringen, Germany (section 1). For the shop and for marketing in the EU we work together with the manufacturer AC Infinity Inc. (USA) (section 18). AC Infinity also uses data from the shop for its own purposes (advertising and marketing in the EU, analyses, product development) and is the sole controller for this use (section 18).
• What do we need for your order? Your name, address, e-mail address and the details of the payment method you choose. Without these details we cannot conclude a purchase contract with you. For bulky goods we also need your phone number so that the delivery date can be arranged with you (section 26).
• What is voluntary? A customer account, the newsletter and all cookies and services for which we ask for your consent in the cookie banner.
• Analytics and advertising services only with your consent. The shop loads Google Analytics, Google Ads, the Meta Pixel, the Pinterest tag and the partner programmes only once you agree in the cookie banner. You can change your choice at any time via "Cookie Settings" in the page footer. Videos, maps, the dealer finder, the content of the community page and the customer reviews on category, search results, product and community pages are currently loaded by the shop even without your consent, and the shop platform sets two visit identifiers (sections 4.7, 12 and 15).
• Marketing e-mails: You receive a newsletter only with your consent. You can unsubscribe at any time (section 11.1).
• Where is your data? The shop runs on BigCommerce (USA). Our ERP system runs on our own servers at Hetzner in Germany, the shop connector at Amazon Web Services in Frankfurt, and backups at Microsoft Azure in Germany. Some recipients are based in the USA or in other countries outside the EU; details are in section 21.
• Your rights: access, rectification, erasure, restriction, data portability, withdrawal of consent, complaint to a supervisory authority – and the right to object in the box below.

Contents

1. Controller and contact
2. Overview: which data we process and why
3. Legal bases in brief
4. When you visit the shop
5. Cookies, browser storage and your consent
6. Customer account
7. Order, payment and shipping
8. Withdrawal via our withdrawal function
9. Guarantee and statutory warranty
10. Customer service and other ways to contact us
11. Newsletter and abandoned-cart reminders
12. Product reviews
13. Affiliate and influencer programmes
14. Analytics and marketing – only with your consent
15. Embedded content from other providers
16. Security and protection against abuse
17. Links to social networks
18. Cooperation with AC Infinity Inc.
19. Our internal systems and service providers
20. Recipients at a glance
21. Transfers to countries outside the EU
22. How long we keep data
23. Your rights
24. Your right to object in detail
25. Complaint to a supervisory authority
26. Do you have to provide data?
27. No automated individual decisions
28. Children and young people
29. Changes to this privacy policy
30. Annex A: Cookies and browser storage in detail

---

1. Controller and contact

The controller for data processing on acinfinity.eu and in connection with your orders is:

GrowTechnology GmbH
Riedstraße 14
79787 Lauchringen
Germany

Commercial register: Amtsgericht (Local Court) Freiburg i. Br., HRB 730850
E-mail: service@acinfinity.eu
Phone: +49 7741 835 81 50 (Mon–Fri 9:00–17:00, except public holidays)

Privacy requests: Write to us at service@acinfinity.eu or by post to the address above. You do not need any particular form.

Data protection officer: We are not legally required to appoint a data protection officer and have therefore not appointed one. The address above handles all questions.

For part of the processing we are joint controllers with AC Infinity Inc. What this means is explained in section 18.

---

2. Overview: which data we process and why

The table is a summary. The details are in the section given.

---

3. Legal bases in brief

We process personal data only where a legal basis permits it. In this policy we name the relevant basis for each processing operation:

• Consent (Art. 6(1)(a) GDPR): You have agreed, e.g. in the cookie banner or for the newsletter. You can withdraw your consent at any time, and withdrawing is as easy as giving it. The withdrawal takes effect from that moment; what we did on the basis of the consent before then remains lawful.
• Contract (Art. 6(1)(b) GDPR): We need the data to conclude or perform a contract with you, or because you ask us for something before a contract is concluded.
• Legal obligation (Art. 6(1)(c) GDPR): A law obliges us, e.g. to keep invoices or to confirm your withdrawal.
• Legitimate interest (Art. 6(1)(f) GDPR): We have a legitimate interest that is not overridden by your interests. We name this interest in each case. Here you have the right to object described in the box above.
• Access to your device (Section 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG): We may store information on your device or read information from it (cookies, browser storage, pixels) only with your consent (Section 25(1) TDDDG) or where this is strictly necessary for us to provide a service you have expressly requested (Section 25(2) no. 2 TDDDG), e.g. the shopping cart. If you visit us from another EU country, the rules of your country may apply in addition; like the TDDDG, they are based on Art. 5(3) of the ePrivacy Directive and are very similar.

---

4. When you visit the shop

4.1 Shop platform BigCommerce

Our shop runs on the BigCommerce platform of Commerce.com US, Inc., 11920 Alterra Parkway, Suite 100, Austin, TX 78758, USA (representative in the EU: Commerce Software Ireland Ltd., Block A, George's Quay Plaza, George's Quay, Dublin 2, D02 E440, Ireland). BigCommerce provides the pages, the shopping cart, the checkout, customer accounts and order management, manages the domain acinfinity.eu and sends the e-mails relating to your customer account (section 7.4) and the abandoned-cart reminders (section 11.2).

When you open a page, your browser sends data to the server for technical reasons: IP address, date and time, the address requested, the page you came from, browser type and version, operating system and language setting. BigCommerce needs this data to deliver the page to you. The data is also stored in server logs so that faults and attacks can be detected. How long BigCommerce keeps these logs is determined by BigCommerce; details are in BigCommerce's privacy policy (https://www.commerce.com/privacy/).

Our legitimate interest (Art. 6(1)(f) GDPR) is a secure, working shop. BigCommerce processes the data in the USA (section 21). The BigCommerce account of our shop is held by AC Infinity Inc. (section 18).

4.2 Delivery and protection by Cloudflare

BigCommerce delivers the shop via the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare speeds up delivery and protects the shop against overload attacks and automated access (bots). To do this, Cloudflare analyses your IP address, characteristics of your browser and the request data, and runs a small check script on every page. For this, Cloudflare sets technically necessary cookies (__cf_bm, after a passed security check cf_clearance, __cf_ob) and an entry in session storage (Annex A).

The legal basis is our legitimate interest in a secure shop (Art. 6(1)(f) GDPR); the cookies are strictly necessary for this (Section 25(2) no. 2 TDDDG). Cloudflare acts here as a sub-processor of BigCommerce.

4.3 Encrypted connection

All pages are transmitted in encrypted form only (HTTPS/TLS). Your browser is instructed to open the shop only via an encrypted connection for one year (HSTS).

4.4 Delivery country and language

So that you only see products we can deliver to your country, and get the right prices, taxes and legal texts, the shop pre-selects a delivery country on your first visit. To do this, a script of our own asks Cloudflare, via our own domain (acinfinity.eu/cdn-cgi/trace), which country your IP address belongs to. We use only the country code from this. You can change the delivery country at any time; we do not redirect you automatically.

A second script of our own suggests a language version (German, English, Spanish, Italian or Czech). It goes first by the language of your browser and only if that does not match, by the country of your IP address. It never switches by itself.

We store your choice in your browser (peak_shipping_country_code, aci_lieferland_geo_done, where applicable peak_shipping_zipcode, aci_lang_choice, aci_lang_hint_dismissed in local storage; peak_ship_countries and cms_content_locale in session storage). These entries exist only in your browser; we do not create a profile about you from them.

The legal basis is our legitimate interest in showing you an offer that can be delivered to your country (Art. 6(1)(f) GDPR). Storing your selection is strictly necessary for the shop you are using (Section 25(2) no. 2 TDDDG).

4.5 Images and home page content

• Images: We load product images and banners via the image service Cloudinary (Cloudinary Ltd., Israel, with group companies in the USA). Cloudinary receives your IP address and browser data. Cloudinary does not set cookies. The account at Cloudinary is held by AC Infinity Inc. (section 18).
• Home page: The content of the home page (image carousel, tiles) comes from a database at the provider Supabase (Supabase Pte. Ltd., Singapore). The database is located in Frankfurt am Main; it is accessed via Cloudflare's network. Your IP address and browser data are transmitted, but no data about you is sent. Your browser caches the content (supabase_cache_public_homepage_*) so that the page loads faster. The project at Supabase is held by AC Infinity Inc. (section 18).

The legal basis for both services is our legitimate interest in a fast and up-to-date presentation of the shop (Art. 6(1)(f) GDPR).

4.6 Legal texts from IT-Recht Kanzlei

Our general terms and conditions and other legal texts are embedded from the servers of IT-Recht Kanzlei GmbH & Co. KG, Alter Messeplatz 2, 80339 München, Germany, so that they are always up to date. When you open these pages, the law firm receives your IP address and browser data. The legal basis is our legitimate interest in legally sound, up-to-date texts (Art. 6(1)(f) GDPR).

4.7 BigCommerce visit identifiers

When you open the shop, BigCommerce sets the cookies fornax_anonymousId (at most 400 days in your browser) and athena_short_visit_id (about 30 minutes). They contain a random visitor ID and a visit ID, which BigCommerce uses to analyse, for its platform, how the shop is used. BigCommerce currently sets these cookies regardless of your choice in the cookie banner, i.e. even if you reject all cookies. The legal basis is our legitimate interest in stable operation and in analysing how our shop is used (Art. 6(1)(f) GDPR). You can delete the cookies in your browser at any time.

---

5. Cookies, browser storage and your consent

5.1 What this means

Cookies are small text files that your browser stores. Your browser's local storage and session storage work in a similar way, as do tracking pixels and scripts that read information from your device. In this policy we call all of these together "cookies". A complete list with name, provider, purpose and storage period is in Annex A.

5.2 The categories in the cookie banner

The cookie banner groups cookies and services into four categories. The names in the table are the ones the banner shows on the English pages.

Regardless of your choice, the shop currently loads the YouTube videos, the Google Maps map, the dealer finder, the thumbnails and posts on the community page (section 15) and the Yotpo customer reviews on category, search results, product and community pages (section 12). The BigCommerce visit identifiers (section 4.7) are also set without consent.

5.3 How the cookie banner works

On your first visit the shop shows you a banner at the bottom of the page with the buttons "Settings", "Reject all" and "Accept All Cookies". Under "Settings" you can allow or reject each category individually and save your choice. If you reject, you can still shop as normal.

The banner is BigCommerce's consent management tool, and its text comes from BigCommerce. It says that by using the website you agree to the collection of data. That is not how we handle it: what is in the categories "Functional", "Analytics" and "Targeting; Advertising" loads only once you allow it in the banner; simply continuing to browse does not count as consent. What the shop currently loads regardless of your choice is listed at the end of section 5.2.

Your choice is transmitted to BigCommerce and stored in the cookies bc_consent and tracking-preferences (400 days), so that we do not ask you again on every page and can prove your decision (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR; Section 25(2) no. 2 TDDDG).

When the shop loads Google Analytics and Google Ads (only with "Targeting; Advertising", section 14), they receive your choice (Google's consent mode) so that they act accordingly. The default is "denied". With "Analytics" you allow Google Analytics to store cookies; with "Targeting; Advertising" you allow Google's advertising functions.

The shop does not show the banner in the checkout.

5.4 Changing your choice or withdrawing consent

You can change your choice and withdraw consents you have given at any time via "Cookie Settings" in the page footer. You can also delete cookies in your browser at any time; the shop will then ask you again on your next visit.

---

6. Customer account

You can order from us as a guest without a customer account. If you create an account, you can save your addresses, put items on a wish list, see previous orders and their status, and download your invoices.

Data at registration: e-mail address, password, country, first and last name, address, town/city, state/region and postcode (mandatory fields); address line 2, company and phone number (optional). BigCommerce does not store your password in plain text, only as a non-reversible hash value. During registration and login, Google reCAPTCHA checks whether a human is filling in the form (section 16).

Invoices in your account: When you open an invoice while logged in, a function of our shop connector at Amazon Web Services in Frankfurt uses a login token from BigCommerce to check whether the order belongs to your account. You then receive a link to the invoice as a PDF, valid for 15 minutes. The PDF copies are kept in storage at Amazon Web Services in Frankfurt (section 19).

Synchronisation with our ERP system: When you create an account or change an address, we transfer this data to our ERP system JTL-Wawi and link your account to your customer number. Conversely, we transfer changes to your customer data and your customer group from the ERP system to the shop.

If you have bought from us outside the shop (e.g. by e-mail or phone), we have transferred your customer data (name, company, e-mail, phone, addresses, customer group, language) from our ERP system to the shop platform so that your data and terms are the same in all channels. As a result, your data is also accessible to AC Infinity (section 18). The legal basis is our legitimate interest in a uniform customer database (Art. 6(1)(f) GDPR). You can object to this at any time (section 24).

The legal basis for the account is taking steps prior to entering into a contract and the performance of the contract (Art. 6(1)(b) GDPR). You can have your account deleted at any time; a message to us is enough. Order and invoice data that we are required to keep then remain stored until the statutory periods end (section 22). If you have neither logged in nor ordered for three years, we delete your account.

---

7. Order, payment and shipping

7.1 Order

Data: e-mail address, first and last name, delivery and billing address, where applicable company and phone number, the items ordered, the shipping and payment method, your message to us and the language in which you order. For orders with PayPal or Google Pay via the express checkout buttons, we take your name, address and e-mail address from your PayPal or Google account.

Purpose: We need the data to conclude and perform the purchase contract with you: confirm the order, ship the goods, issue the invoice, match the payment, handle returns and complaints, and inform you about the status of your order (Art. 6(1)(b) GDPR). We use the language so that you receive e-mails and documents in your language. The fact that you accepted our terms and conditions is stored with the order.

IP address: BigCommerce stores the IP address and the country derived from it with every order. This serves to detect fraud attempts (legitimate interest, Art. 6(1)(f) GDPR).

In the checkout, a sentence with a link points you to this privacy policy. Even though this sentence speaks of agreeing, we do not use it to obtain your consent: we process your data in the checkout on the legal bases set out in this section.

7.2 Payment

We offer these payment methods:

• PayPal, credit and debit card via PayPal, Google Pay via PayPal: The payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal is itself the controller for this. We send PayPal the amount, the currency, the order number and your name, address and e-mail address; PayPal needs these details for the payment and buyer protection. You enter card details directly in PayPal's fields; we do not see them. PayPal tells us whether the payment was successful and gives us a transaction number. PayPal may carry out its own identity, fraud and risk checks; details are in PayPal's privacy statement.
• Google Pay: If you use Google Pay, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, also processes your data for the wallet under its own terms; the payment itself runs via PayPal.
• Prepayment (bank transfer): You transfer the amount to our account. Your bank and our bank process the transfer data as independent controllers.
• Gift certificates for influencers: As part of the cooperation (section 13), AC Infinity's marketing team in the USA occasionally issues gift certificates to influencers, which they redeem in their customer account in the shop. For this, the influencer's name and e-mail address and the certificate code are stored at BigCommerce; on redemption, the certificate is linked to the order. The legal basis is our and AC Infinity's legitimate interest in working with influencers (Art. 6(1)(f) GDPR) and, on redemption, the purchase contract (Art. 6(1)(b) GDPR). We and AC Infinity are joint controllers for this (section 18).

What happens when you open the checkout: So that the payment buttons work, the checkout loads scripts from PayPal and Google Pay when it opens. PayPal and Google receive your IP address and browser data; PayPal stores technical entries in your browser, and Google may set the cookie NID (Annex A). The legal basis is taking steps prior to entering into a contract (Art. 6(1)(b) GDPR); the entries are necessary for the payment you choose (Section 25(2) no. 2 TDDDG).

Matching payments: To match incoming payments to orders, we import the transactions of our PayPal account and our bank account into our ERP system. In doing so we process the payer's name and account details, the payment reference, the amount and the date – even if someone else pays for you. For PayPal payments, the transaction number also reaches the ERP system via a short-lived file in our storage at Amazon Web Services in Frankfurt; the file is deleted after the import.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our obligation to keep proper accounts (Art. 6(1)(c) GDPR). We do not carry out credit checks ourselves.

7.3 Shipping and returns

• Parcels: We ship with DHL. Parcels within Germany are carried by DHL Paket GmbH, parcels abroad by Deutsche Post AG, both Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany. DHL receives only your name, delivery address and details of the shipment, not your e-mail address or phone number. For deliveries abroad, Deutsche Post AG hands the parcel over to its partner in the destination country.
• Bulky goods (two-person delivery, Germany and Austria only): DHL 2-Mann-Handling GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany, delivers large items such as our complete kits by appointment. For this, our ERP system automatically sends your e-mail address and phone number, in addition to your name and delivery address, with the shipment data via the DHL interface so that the delivery date can be arranged with you. For bulky goods we therefore need your phone number (section 26).
• Tracking: We send you the tracking number and the tracking link by e-mail and show them in your customer account. We receive the delivery status from DHL.
• Returns: If we provide you with a return label (e.g. for free returns within Germany or in guarantee cases), we create a DHL return label with your name and address as sender and send it to you by e-mail.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

7.4 Processing in our ERP system and e-mails about your order

Every order is transferred automatically from BigCommerce via our shop connector at Amazon Web Services in Frankfurt am Main to our ERP system JTL-Wawi, which we operate on our own servers at Hetzner Online GmbH in data centres in Germany. The connection between Amazon Web Services and our servers is encrypted. In the ERP system we pick and ship the goods, create invoices and process returns. Status, tracking numbers and invoice numbers go back to the shop.

Orders that you place with us outside the shop are also transferred to the shop platform so that you can see them in your customer account. As a result, these orders are also accessible to AC Infinity (section 18). The legal basis is our legitimate interest in showing you all your orders in one place (Art. 6(1)(f) GDPR).

E-mails: We send the order confirmation with the contract documents, the shipping confirmation, the invoice, the payment reminder for prepayment and return labels from the ERP system via Microsoft 365 (section 19). BigCommerce sends only the e-mails relating to your customer account (registration, password reset, access to guest orders) and the abandoned-cart reminders (section 11.2).

Images in our e-mails: Logos and notice graphics in our order e-mails are stored on our file server files.growtechnology.de, which ecomDATA GmbH, Steinamangererstraße 9/16, 7400 Oberwart, Austria, operates for us on servers in Germany. If your e-mail program loads these images, the server receives your IP address, the time and the identifier of your e-mail program. The legal basis is our legitimate interest in displaying our e-mails completely (Art. 6(1)(f) GDPR). The server's access logs are deleted after 90 days. You can switch off the loading of images in your e-mail program.

The legal basis for this processing is the performance of the contract (Art. 6(1)(b) GDPR) and our legal obligations, e.g. to confirm the contract on a durable medium (Art. 6(1)(c) GDPR).

7.5 Invoices, accounting and taxes

We enter invoices, credit notes and payments in our books. For this we use the service AccountOne (AccountOne GmbH, Nordstraße 2, 24937 Flensburg, Germany), and for VAT returns under the EU One-Stop-Shop (OSS) procedure the service countX (countX GmbH, Friedrichstraße 171, 10117 Berlin, Germany). Both process accounting and invoice data on our behalf, which may also include customers' names and addresses. For this, our tax adviser receives accounting data and documents, including customers' names and addresses; the tax adviser is bound by professional secrecy and acts on their own responsibility. The data reach the tax adviser in three ways: via AccountOne, via DATEV Unternehmen online from DATEV eG, Paumgartnerstraße 6–14, 90429 Nürnberg, Germany, and as export files by e-mail. Tax authorities may inspect the records during tax audits.

The legal basis is our obligation to keep accounts and records (Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB) and Section 14b of the German VAT Act (UStG)). How long we keep them is set out in section 22.

---

8. Withdrawal via our withdrawal function

The "Withdraw from contract here" button in the page footer takes you to our withdrawal form at /return-form/. However, you can also declare your withdrawal in any other way, e.g. by e-mail or letter.

Data in the form: first and last name, e-mail address and order number (mandatory fields) and, if you wish, the items you want to withdraw from and a comment. If you are logged in to your customer account, your name and e-mail address are already filled in. We also store the time of receipt and the language of the page. A field that is invisible to humans helps us recognise automated submissions.

What happens next: A function of our shop connector at Amazon Web Services in Frankfurt receives your declaration, stores it with the time of receipt in a database and as a file, compares the order number and e-mail address with your order and immediately sends you an e-mail acknowledging receipt, with the content of your declaration and the time of receipt. At the same time our customer service receives an e-mail with your details in our Zendesk ticket system (section 10) so that it can start the return and refund. Both e-mails are sent via Microsoft 365.

Protection against abuse: So that the form is not flooded with automated requests, we count how often it is submitted from the same IP address and with the same e-mail address. For this we do not store the IP or e-mail address itself, only a non-reversible value generated with a secret key. These counters expire after 25 hours at the latest (counters per IP address after 2 hours at most); the database then deletes them automatically.

Legal basis: We are legally obliged to provide a withdrawal function and to confirm receipt to you (Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB) or the corresponding provisions of your country). The return and refund are based on Art. 6(1)(b) GDPR, the protection against abuse on our legitimate interest in a working form (Art. 6(1)(f) GDPR).

Retention: We store withdrawal declarations for three years from the end of the year in which they were received (limitation period), longer only where we are legally required to keep them as an accounting voucher or business letter (8 or 6 years). This applies to the database, the file, the e-mails in the service mailbox and the ticket in Zendesk.

---

9. Guarantee and statutory warranty

For AC Infinity products we, as guarantor, give a manufacturer's guarantee. You report a guarantee case by e-mail to service@acinfinity.eu with your order number, delivery address and a short description of the problem, ideally with photos. We check the case, send you a return label and ship a repaired device or a replacement.

Disclosure to AC Infinity: We settle the costs of a guarantee case with the manufacturer AC Infinity Inc., 21880 Baker Parkway, City of Industry, CA 91789, USA. For this, AC Infinity usually receives only details of the product: product, serial number, date of purchase, description of the defect and photos, without your name and without your contact details. In individual cases we also pass on your name and contact details, but only to the extent necessary to handle your guarantee case.

The legal basis is the fulfilment of the guarantee (Art. 6(1)(b) GDPR) and our legitimate interest in settling guarantee costs with the manufacturer (Art. 6(1)(f) GDPR). For the transfer to the USA see sections 18 and 21. We handle claims under the statutory warranty on the basis of Art. 6(1)(b) and (c) GDPR.

---

10. Customer service and other ways to contact us

E-mail and phone: You can reach us at service@acinfinity.eu and +49 7741 835 81 50. There is no contact form and no chat. We process the details you give us (e.g. name, e-mail address, phone number, order number, your request and attachments) in order to answer your enquiry. Our mailbox is hosted by Microsoft 365 (section 19).

Zendesk ticket system: We handle enquiries to service@acinfinity.eu, withdrawals and guarantee cases in the Zendesk ticket system (Zendesk, Inc., 181 Fremont Street, 17th Floor, San Francisco, CA 94105, USA). Zendesk stores your messages, your contact details and our replies on our behalf in a data centre in the EU. For maintenance and support, staff of the Zendesk group may also access the data from the USA (section 21).

Phone and voicemail: Our phone numbers and voicemail run via the Placetel telephony service (Gamma Placetel GmbH, Lothringer Straße 56, 50677 Köln, Germany), which works on our behalf. Your phone number and the time and duration of the call are processed. We use the call logs to keep track of calls and to call you back (section 22). We do not record calls. If you leave a message on the voicemail, we store your message with whatever you say in it (e.g. name and call-back number) and your phone number, where it is transmitted. We treat the message like other enquiries (section 22).

AI services for replies: To draft replies to customer enquiries we use the AI services Claude from Anthropic (Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland) and ChatGPT from OpenAI (OpenAI Ireland Limited, Ireland). In doing so, the content of your enquiry, including the details it contains, may be transmitted to the provider. For this we use only business or team plans with a data processing agreement, under which the providers do not use your data to train their AI models. The AI services only write drafts: a member of staff checks every reply before sending it. No automated decision is made on your request (section 27). The providers also process the data in the USA (section 21). How long the providers keep inputs and drafts depends on the settings of our workspace and the providers' terms; details are in their privacy notices.

The legal basis is taking steps prior to entering into a contract and the performance of the contract where your enquiry concerns an order (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). For the use of Zendesk, Freshdesk, Placetel and the AI services, the legal basis is our legitimate interest in handling enquiries in an orderly and prompt manner (Art. 6(1)(f) GDPR).

Dealer enquiries: Retailers and bulk buyers in the EU can reach us at b2b@growtechnology.de and +49 7741 835 81 51. We process the details in order to answer the enquiry and to initiate a business relationship (Art. 6(1)(b), (f) GDPR). We handle dealer enquiries in the Freshdesk ticket system (Freshworks Inc., 2950 S. Delaware Street, Suite 201, San Mateo, CA 94403, USA), which works on our behalf; Freshworks may also process the data in the USA (section 21).

Applications for AC Infinity's partner programmes: You send applications for the affiliate, partner and brand ambassador programmes by e-mail directly to AC Infinity Inc. (Marketing-NoReply@acinfinity.com). AC Infinity handles them in the USA (section 18). Dealers in the USA contact AC Infinity directly (dealers@acinfinity.com).

Product safety: On the product pages we name AC Infinity Inc. as the manufacturer and THEMIS AR Unterstützung UG (haftungsbeschränkt), Düsseldorf, Germany, as the responsible person in the EU. If you contact them directly, they process your data as independent controllers.

---

11. Newsletter and abandoned-cart reminders

11.1 Newsletter

In the checkout and at registration you can tick a box if you would like to receive updates and offers by e-mail. The box is not pre-ticked.

In the BigCommerce subscriber list we store your e-mail address, your name where applicable, and when and where you signed up. We send newsletters via our newsletter service Brevo (Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany), where we have our own account and which acts as our processor. When we send you a newsletter, we transfer your e-mail address and, where applicable, your name to Brevo for this purpose.

Opens and clicks: In newsletters that we send via Brevo, Brevo measures for us whether and when you open a newsletter and which links in it you click. For this, every e-mail contains a small image that is loaded from Brevo when you open the e-mail, and the links are routed via Brevo. This shows us which topics interest you and helps us improve the newsletter. If your e-mail program does not load images, opening is not measured.

The legal basis for the newsletter and the measurement is your consent (Art. 6(1)(a) GDPR, for the measurement also Section 25(1) TDDDG); without it, marketing e-mails would also be unlawful under Section 7(2) no. 2 of the German Act against Unfair Competition (UWG). You can unsubscribe at any time via the unsubscribe link in every e-mail or by sending a message to service@acinfinity.eu; this also ends the measurement. We then delete your address from the mailing list. After that, we keep proof that and when you gave your consent until the limitation period has expired (section 22), so that we can produce it in the event of a dispute. The legal basis for this is our legitimate interest in this proof (Art. 6(1)(f) GDPR in conjunction with Art. 7(1) GDPR).

11.2 Abandoned-cart reminders

If you enter your e-mail address in the checkout and do not complete the order, BigCommerce sends you up to three reminders about your shopping cart – about one hour, one day and two days later. This happens only if you ticked the box for updates and offers in the checkout. BigCommerce stores this consent from the checkout with your e-mail address in its subscriber list. Your e-mail address, your name if you entered it, and the contents of your cart are used. We also receive an overview of unfinished orders.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in the reminder or by sending us a message. If you complete the order, the reminders stop. How long BigCommerce keeps the data of unfinished shopping carts is determined by BigCommerce; details are in BigCommerce's privacy policy.

---

12. Product reviews

We display reviews and stars using the service Yotpo (Yotpo Ltd., Israel, with group companies in the United Kingdom and the USA). Some of the reviews shown come from customers of AC Infinity's US shop. When the reviews load, Yotpo receives your IP address, browser data and the product number. In our measurement we found no cookies or browser storage entries from Yotpo.

On category, search results, product and community pages the shop currently loads the reviews on every visit, regardless of your choice in the cookie banner. There, the legal basis is our legitimate interest in showing you other customers' experience with our products (Art. 6(1)(f) GDPR). On all other pages the shop loads Yotpo only if you have consented to the "Functional" category (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

The account at Yotpo is held by AC Infinity Inc. (section 18). We use Yotpo in the shop to display reviews. Details of the processing at Yotpo are in Yotpo's privacy policy (https://www.yotpo.com/privacy-policy/).

---

13. Affiliate and influencer programmes

For the brand in the EU, AC Infinity works with partners (affiliates) and influencers on a commission basis and runs the programmes and the accounts at the two services below for this purpose. So that a purchase can be attributed to the right partner, we integrate these services into the shop; we and AC Infinity are joint controllers for collecting the data on our website and passing it on to the services (section 18). The shop loads both only if you have consented to the "Targeting; Advertising" category (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

• GoAffPro (India): If you come to us via a partner's link, GoAffPro stores a partner ID in your browser. If you order, GoAffPro receives the order details needed for the attribution and the commission, such as the order number, the order value and any coupon code used. Privacy policy: https://goaffpro.com/policies/privacy
• Grin (Grin Technologies Inc., 901 H St, Suite 120, Sacramento, CA 95814, USA): Grin attributes purchases made via influencers' links and discount codes and receives order details for this purpose. No fingerprint of your device is created. Privacy policy: https://grin.co/privacy/

These services tell us and AC Infinity which partner referred you to us. If you redeem a partner's or influencer's discount code, the order may also be attributed via this code; the legal basis is then our legitimate interest in settling the partner programmes correctly (Art. 6(1)(f) GDPR).

AC Infinity also occasionally issues gift certificates to influencers (section 7.2). Applications for the programmes go directly to AC Infinity (section 10).

---

14. Analytics and marketing – only with your consent

The shop loads the services in this section only if you have consented to the "Analytics" or "Targeting; Advertising" category in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time via "Cookie Settings" (section 5.4).

One exception: the Google Analytics integration set up in BigCommerce requests a script from Google (www.googletagmanager.com) on every page view, even without your consent. Google receives your IP address, browser data and the page requested. Google currently does not deliver this script; it is therefore not executed, sets no cookies and sends no measurement data. The legal basis for this request is our legitimate interest in operating the shop platform with its standard functions (Art. 6(1)(f) GDPR).

The accounts at Google Analytics, Google Ads, Meta and Pinterest are held by AC Infinity Inc., which runs the marketing for the brand in the EU. We and AC Infinity are joint controllers for collecting the data on our website and passing it on to these services (section 18).

14.1 Google Tag Manager

Via Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) we integrate Google Ads and Google Analytics. Tag Manager itself does not analyse usage, but it processes your IP address for technical reasons. It loads only if you have consented to "Targeting; Advertising".

14.2 Google Analytics 4 (with "Targeting; Advertising")

With Google Analytics 4 (Google Ireland Limited) we analyse how the shop is used: pages viewed, scroll depth, starting and submitting forms, and shop events such as products viewed, cart, start of checkout and purchase with products, prices and order value. The shop platform BigCommerce provides the shop events. Google Analytics runs via Tag Manager (section 14.1) and therefore only if you have consented to "Targeting; Advertising":

• Only "Targeting; Advertising" allowed: Google Analytics sends page views and events without setting cookies.
• "Analytics" allowed as well: Google also recognises returning visitors by the cookies _ga and _ga_216CB2E5SL.

According to Google, Google Analytics 4 uses the IP address only to determine an approximate location and does not store it. Google stores the analytics data for the retention period set in the account and provides us with aggregated reports based on it. Details are in Google's privacy policy (https://policies.google.com/privacy).

14.3 Google Ads (with "Targeting; Advertising")

With Google Ads (Google Ireland Limited) we measure whether our ads lead to purchases (conversion tracking) and build audiences in order to show ads to visitors of our shop again later (remarketing). For this, after a purchase we send Google the order number, the order value and the currency. We do not send Google an e-mail address. Cookies such as _gcl_au, entries in local storage (_gcl_ls) and cookies on doubleclick.net (IDE, test_cookie) are used. If you come to us via an ad, a click ID is stored so that a later purchase can be attributed to the ad. Google also receives your IP address and browser data.

14.4 Meta Pixel (with "Targeting; Advertising")

With the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, we measure the success of ads on Facebook and Instagram and build audiences. The pixel is integrated via the shop platform BigCommerce. Events such as page views, categories and products viewed and cart actions with product numbers and values, your IP address, browser data, the identifier in the cookie _fbp and a pseudonymous identifier are transmitted. Meta may link this data to your Facebook or Instagram account.

We and AC Infinity are joint controllers with Meta for collecting and transmitting this data (Art. 26 GDPR); the advertising account at Meta is held by AC Infinity. We inform you here and obtain your consent. Meta is responsible for the security of the data at Meta and for your rights regarding the data stored at Meta. You can exercise your rights against us or against Meta. What Meta then does with the data is Meta's sole responsibility; details are in Meta's Privacy Policy.

14.5 Pinterest tag (with "Targeting; Advertising")

With the Pinterest tag of Pinterest Europe Limited, Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland, we measure the success of ads on Pinterest and build audiences. Page views and events, your IP address, browser data and the identifier in the cookie _pin_unauth are transmitted. We do not send Pinterest an e-mail address. Details are in Pinterest's privacy policy (https://policy.pinterest.com/de/privacy-policy).

14.6 BigCommerce shop statistics (with "Analytics")

With your consent to "Analytics", BigCommerce also records visits, page views and shop events for the reports in our shop's admin area (cookie STORE_VISITOR).

14.7 Audiences and profiling

Google, Meta and Pinterest combine the data from these services with other data and use it to build interest profiles in order to show you relevant advertising. This is profiling, but not a decision with legal effect for you (section 27). You can end it at any time by withdrawing your consent via "Cookie Settings" (section 5.4).

---

15. Embedded content from other providers

Some pages contain content from other providers. The shop currently loads the videos (15.1), the map on the contact page (15.2), the dealer finder (15.3) and the posts on the community page (15.5) when you open the page concerned, regardless of your choice in the cookie banner. The providers receive your IP address and browser data; which cookies and entries they store in your browser is set out for each service and in Annex A. The legal basis is our legitimate interest in showing you guide videos, our location, dealers near you and posts from our community (Art. 6(1)(f) GDPR). The shop loads the fonts from Adobe Fonts (15.4) only with your consent to "Functional".

15.1 YouTube videos

On our guide pages for the controllers we embed videos from YouTube (Google Ireland Limited). When the page loads, YouTube receives your IP address and browser data, sets cookies (e.g. YSC, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA), creates entries in the browser storage of youtube.com (Annex A) and calls Google services for advertising and measurement. If you are logged in to Google, YouTube can link the request to your account. On our community page we also show thumbnails of YouTube videos; when they load, Google receives your IP address. If you click on a thumbnail there, the video is loaded from YouTube. Details are in Google's privacy policy (https://policies.google.com/privacy).

15.2 Google Maps

On our contact page a map from Google Maps (Google Ireland Limited) shows where we are located. When the page loads, Google receives your IP address and browser data; the map also loads fonts from Google. We found no Google cookies in this process; however, Google may set its own cookies.

15.3 Dealer finder

Our dealer finder (/fachhandler-finden/) uses the service Storepoint (Storepoint Inc., Canada) with maps from Mapbox (Mapbox, Inc., USA). Storepoint receives your IP address, browser data, the page visited, the page you came from and your search entries, and uses them to create usage statistics. Mapbox receives your IP address and browser data and stores a random device ID in local storage in order to measure the use of the map. Icons for the dealer finder are loaded via cdnjs.cloudflare.com (Cloudflare). The dealer finder and the account at Storepoint are run by AC Infinity Inc. (section 18). Details are in the privacy policies of Storepoint (https://storepoint.co/privacy) and Mapbox (https://www.mapbox.com/legal/privacy).

15.4 Fonts from Adobe Fonts

For the fonts of our shop we use Adobe Fonts from Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. Adobe Fonts loads only if you have consented to the "Functional" category (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); without consent, the shop shows standard fonts. When the fonts load, Adobe receives your IP address, browser data and the page visited; Adobe counts the page views for licence billing. Adobe Fonts does not set cookies.

15.5 Community page

On our community page we load posts by the brand ambassadors via a service of AC Infinity Inc. that runs on Cloudflare's platform. When you open the page, your IP address and browser data are transmitted; the service does not set cookies. Whatever you submit via the community page goes to AC Infinity (section 18).

---

16. Security and protection against abuse

• Cloudflare: protection against overload and bots, see section 4.2.
• Google reCAPTCHA: At registration and login, Google reCAPTCHA (Google Ireland Limited) checks whether a human or a program is using the form; BigCommerce also loads the reCAPTCHA script on product pages, regardless of your choice in the cookie banner. For this, Google analyses your IP address, browser and device characteristics and your behaviour on the page, and stores entries in the browser storage of google.com. The legal basis is our legitimate interest in protecting our forms against abuse (Art. 6(1)(f) GDPR); the entries in browser storage are strictly necessary for the secure submission of the form you want to use (Section 25(2) no. 2 TDDDG).
• Withdrawal form: protection against abuse with pseudonymous counters (section 8).
• Technical and organisational measures: encrypted transmission, encrypted connections between our systems, access only for staff who need the data for their tasks, and regular backups.

---

17. Links to social networks

In the page footer we link to AC Infinity's profiles on Discord, TikTok, Instagram, Facebook, YouTube, X and LinkedIn. These are simple links: the network concerned receives data from you only when you click on one; its privacy policy then applies. We do not run our own profiles for this shop. The link to our address in the page footer leads via the URL shortener rebrand.ly to Google Maps; here too, rebrand.ly and Google receive data from you only when you click on it.

---

18. Cooperation with AC Infinity Inc.

The products in our shop come from AC Infinity Inc., 21880 Baker Parkway, City of Industry, CA 91789, USA. AC Infinity holds the BigCommerce account through which acinfinity.eu is run, helps design the shop and runs the marketing for the brand in the EU. As a result, AC Infinity has access to the data in the shop (orders, customer accounts, newsletter sign-ups).

AC Infinity's accounts: AC Infinity also holds the accounts at the services that we integrate into the shop for content, reviews, partner programmes, analytics and advertising: Cloudinary, Supabase, Yotpo, Grin, GoAffPro, Storepoint, Google Analytics, Google Ads, Meta and Pinterest (sections 4.5 and 12 to 15). These services work for AC Infinity.

Joint controllership: Where we and AC Infinity jointly determine why and how data is processed in the shop and for marketing in the EU, we are joint controllers (Art. 26 GDPR). The tasks are divided as follows:

• We (GrowTechnology) are your contractual partner. We handle orders, payments, shipping, withdrawals, guarantee and customer service, and we inform you through this privacy policy.
• AC Infinity provides the shop account at BigCommerce, contributes to the design and content, and runs the advertising accounts and campaigns for the EU, the partner and influencer programmes (section 13) and the accounts of the services named above.
• Your rights can be exercised with us; we coordinate with AC Infinity where necessary and make sure you get an answer. You can also contact AC Infinity directly.

Further information on how the tasks are divided between us and AC Infinity is available on request from service@acinfinity.eu.

Legal basis: For the joint processing, the legal basis is in each case the one we name in sections 4 to 15 for the processing operation concerned, e.g. the contract with you for orders and your consent for analytics and advertising.

AC Infinity's own purposes: AC Infinity also uses data from the shop for its own purposes: for advertising and marketing in the EU, for analyses and reports, and for the development of its products. AC Infinity is the sole controller for these own purposes. We base the fact that AC Infinity has access to this data via the shop account and can use it for these purposes on our legitimate interest in marketing and further developing the products together with the manufacturer (Art. 6(1)(f) GDPR). AC Infinity receives data from the analytics and advertising services in section 14 only if you have consented there. You can object at any time to AC Infinity using your data for these own purposes (section 24). You can address questions about this to us or directly to AC Infinity.

Other data that AC Infinity receives:

• Guarantee cases: usually only details of the product, in individual cases also name and contact details (section 9).
• Gift certificates for influencers: AC Infinity's marketing team issues them (section 7.2).
• Applications and community: Applications for the partner programmes (section 10) and submissions via the community page (section 15.5) go to AC Infinity.

Transfer to the USA: AC Infinity is based in the USA and accesses the data from there. AC Infinity is not certified under the EU-US Data Privacy Framework; no adequacy decision of the European Commission therefore applies to AC Infinity. Further information on the transfer to AC Infinity is available on request from service@acinfinity.eu. Please also note the information on access by authorities in the USA in section 21.

---

19. Our internal systems and service providers

For processing in the background we use the following systems and service providers.

• ERP system JTL-Wawi (software from JTL-Software-GmbH, operated by us): customers, orders, invoices, payments, shipping, returns and sending e-mails. It runs on our own servers at Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in data centres in Germany. In support cases, JTL-Software-GmbH, Rheinstraße 7, 41836 Hückelhoven, Germany, occasionally accesses the ERP system via remote maintenance; in doing so it acts as our processor.
• Shop connector at Amazon Web Services (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg; data centres in Frankfurt am Main): transfers orders and customer data between the shop and the ERP system, provides invoices for download, receives withdrawals and, for these purposes, stores mapping tables (customer and order numbers), invoice copies, withdrawal declarations and short-lived payment files. The connector writes operating logs, which may also contain order data with address and e-mail address; we keep them for as long as we need them to find errors and investigate faults. In the event of errors, extracts from these logs are sent by e-mail to us and to our IT service provider; these error e-mails may contain order data with addresses.
• IT service provider for the development and operation of the shop connector: Amitech Group, Poland. The service provider's team works in the EU. It develops and maintains the software of the shop connector, can access the environment at Amazon Web Services and the shop data at BigCommerce for this purpose, and receives the shop connector's error e-mails, which may contain order data with addresses.
• Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland): e-mail mailboxes (e.g. service@acinfinity.eu) and sending of our e-mails; also Microsoft Forms for surveys among our customers and Microsoft Power BI for sales reports, which also contain order and customer data. Taking part in a survey is voluntary. The legal basis for the sales reports is our legitimate interest in analysing our business (Art. 6(1)(f) GDPR); we keep them for as long as we need them for this purpose. The legal basis for surveys is the consent you give by taking part (Art. 6(1)(a) GDPR); we store your answers until the survey has been evaluated. Our Microsoft 365 tenant is within Microsoft's EU Data Boundary; as a result, Microsoft generally stores and processes the data in the EU.
• Microsoft Azure (Microsoft Ireland Operations Limited), region Germany West Central (Frankfurt am Main): backups of the ERP system with customer and order data. Automations (Logic Apps), the retention of system logs and the monitoring of our servers (Azure Arc) also run there; only system and business data are processed for these, no personal data of customers. We keep the backups for 30 days and the system logs in Azure for 90 days.
• File server files.growtechnology.de (Nextcloud, operated by ecomDATA GmbH, Steinamangererstraße 9/16, 7400 Oberwart, Austria; servers in Germany): images for our e-mails (section 7.4).
• Internal portal on our servers at Hetzner: warehouse, shipping and financial reports for our staff, fed from the ERP system. It can only be reached internally.
• Customer service: the Zendesk ticket system, Freshdesk for dealer enquiries, the Placetel telephony service and the AI services of Anthropic and OpenAI (section 10).
• Newsletter: Brevo (section 11.1).
• Accounting: AccountOne, countX, DATEV eG and our tax adviser (section 7.5).

The legal basis is in each case the legal basis of the processing that the service provider supports (mainly Art. 6(1)(b) and (c) GDPR), together with our legitimate interest in secure, available and efficient processing (Art. 6(1)(f) GDPR).

---

20. Recipients at a glance

Within our company, only the staff who need your data for their tasks receive it. Outside the company it goes to:

Processors (process data on our behalf):
BigCommerce (Commerce.com US, Inc.; shop platform, account held by AC Infinity) with Cloudflare as sub-processor · Amazon Web Services EMEA SARL · Microsoft Ireland Operations Limited (Microsoft 365 with Forms and Power BI, Azure) · Hetzner Online GmbH · JTL-Software-GmbH (remote maintenance in support cases) · ecomDATA GmbH · Amitech Group, Poland · Zendesk, Inc. · Freshworks Inc. (Freshdesk) · Gamma Placetel GmbH (Placetel) · Anthropic Ireland, Limited · OpenAI Ireland Limited · Brevo GmbH · AccountOne GmbH · countX GmbH · DATEV eG

Service providers in AC Infinity's accounts (they work for AC Infinity, section 18):
Cloudinary · Supabase · Yotpo · Storepoint · Mapbox · Grin · GoAffPro

Independent controllers:
PayPal (Europe) S.à r.l. et Cie, S.C.A. · Google Ireland Limited (Google Pay; YouTube, Google Maps and reCAPTCHA, insofar as Google uses the data for its own purposes) · DHL Paket GmbH, Deutsche Post AG (parcels abroad) and DHL 2-Mann-Handling GmbH · banks · our tax adviser · IT-Recht Kanzlei GmbH & Co. KG (when embedded legal texts are opened) · authorities, where we are legally obliged to disclose (e.g. tax authorities) · AC Infinity Inc. for its own purposes (section 18), in guarantee cases and for applications sent to AC Infinity · courts and lawyers, where we assert or defend legal claims

Joint controllers:
AC Infinity Inc. (section 18) · Meta Platforms Ireland Limited for the Meta Pixel (section 14.4)

Services we integrate only with your consent (sections 13 to 15): Google Ireland Limited (Tag Manager, Analytics, Ads), Pinterest Europe Limited, Adobe Systems Software Ireland Limited, and Grin and GoAffPro named above.

Content that the shop currently loads without consent (sections 12 and 15): Google Ireland Limited (YouTube, Google Maps), and Yotpo, Storepoint and Mapbox named above.

---

21. Transfers to countries outside the EU

Some recipients are located outside the European Union and the European Economic Area or access data from there. For each of these recipients, the table states whether an adequacy decision of the European Commission applies to it (Art. 45 GDPR) and where we have agreed the European Commission's standard contractual clauses with our processors (Implementing Decision (EU) 2021/914; Art. 46(2)(c) GDPR).

For the USA there is an adequacy decision for companies certified under the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023). You can check whether a company is certified at https://www.dataprivacyframework.gov/list. We checked the certification details in the table against this list on 5 October 2026.

Some providers in turn use sub-processors in other countries, for example in the USA, the United Kingdom, India or Singapore. The providers name them in their lists of sub-processors; on request we will tell you where to find these lists.

You can obtain a copy of the standard contractual clauses we have agreed on request from service@acinfinity.eu. There you can also obtain further information on the transfers for which no adequacy decision applies.

Please note: in the USA, authorities may under certain circumstances access data without you having the same legal remedies against this as in the EU.

---

22. How long we keep data

We store personal data only for as long as we need it for the purpose concerned or a law requires us to keep it. When the purpose ends, we delete the data. If we still have to keep it, we block it for any other use and delete it when the retention period expires. The periods under tax and commercial law start at the end of the calendar year. Where providers store data as independent controllers or under their own rules, the period is determined by their rules; details are in their privacy notices.

---

23. Your rights

You have the following rights towards us:

• Access (Art. 15 GDPR): You can find out whether and which data we process about you and receive a copy.
• Rectification (Art. 16 GDPR): If data is incorrect or incomplete, we correct it.
• Erasure (Art. 17 GDPR): We erase your data insofar as we no longer need it and are not required to keep it.
• Restriction (Art. 18 GDPR): In certain cases we use your data only to a limited extent, e.g. while we check whether it is correct.
• Data portability (Art. 20 GDPR): Data that you have provided to us and that we process by automated means on the basis of your consent or a contract will be given to you in a structured, commonly used and machine-readable format; on request we also transmit it directly to another controller.
• Withdrawal of consent (Art. 7(3) GDPR): at any time with effect for the future, e.g. via "Cookie Settings" or the unsubscribe link in the newsletter.
• Objection (Art. 21 GDPR): see section 24.
• Complaint to a supervisory authority (Art. 77 GDPR): see section 25.

An informal message to service@acinfinity.eu or a letter is enough. We reply within one month; for complex requests the period can be extended by up to two further months, and we will tell you if it is. Handling your request is free of charge for you; only for manifestly unfounded or excessive requests, for example constantly repeated ones, may we charge a reasonable fee or refuse to act (Art. 12(5) GDPR). If we have doubts whether a request really comes from you, we may ask you to confirm your identity, e.g. via the e-mail address of your customer account.

---

24. Your right to object in detail

---

25. Complaint to a supervisory authority

If you believe that we are not processing your data lawfully, you can lodge a complaint with a data protection supervisory authority. This can be the authority in the EU country where you live or work, or the authority responsible for us:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart, Germany
Postal address: Postfach 10 29 32, 70025 Stuttgart, Germany
Phone: +49 711 615541-0 · E-mail: poststelle@lfdi.bwl.de
Website: www.baden-wuerttemberg.datenschutz.de

Other supervisory authorities (selection):

---

26. Do you have to provide data?

• Order: Name, delivery and billing address, e-mail address and the details of the payment method are required to conclude the contract. Without them we cannot accept your order. The phone number is optional, except for bulky goods: for the two-person delivery we need your phone number to arrange the delivery appointment; without it we cannot deliver.
• Withdrawal form: We need the mandatory fields to find your order and to confirm receipt to you. You can also declare your withdrawal in any other way, e.g. by e-mail or letter.
• Guarantee case: Without the order number, address and description of the defect we cannot handle the case.
• Customer account, newsletter, cookies and services for which we ask for your consent in the cookie banner: voluntary. If you do without them, you can still shop and order as normal.

---

27. No automated individual decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). PayPal may carry out its own automated checks during payment; PayPal is responsible for these (section 7.2). Advertising services build interest profiles with your consent (section 14.7); this is not a decision within the meaning of Art. 22 GDPR.

---

28. Children and young people

Our shop is aimed at adults. Only persons with full legal capacity can conclude purchase contracts. We do not knowingly collect data from children and young people under 16. In some countries the age at which a person can give consent themselves is lower (Austria, Spain and Italy 14 years, Czech Republic 15 years, Belgium, Denmark, Sweden and Finland 13 years).

---

29. Changes to this privacy policy

We update this privacy policy when our processing or the legal situation changes. The version shown here when you open the page applies; its date is at the top. Earlier versions are available on request. If we want to use data for a new purpose, we will inform you beforehand.

This privacy policy is also available in German, Spanish, Italian and Czech. You can find it at https://acinfinity.eu/datenschutz/ (German), https://acinfinity.eu/datenschutz/es (Spanish), https://acinfinity.eu/datenschutz/it (Italian) and https://acinfinity.eu/datenschutz/cs (Czech).

---

Annex A: Cookies and browser storage in detail

The list is based on a measurement in the shop on 5 October 2026 in six states: no choice, "Reject all", only one of the three categories allowed (each in turn) and all categories allowed. Entries that arise only in the checkout, in the shopping cart, at registration or login, in the blog or on a visit via a partner link come from our measurement of 1 October 2026 or are marked "not measured". The storage period is the one your browser shows; providers can change it. "Session" means: deleted when you close the browser. "Until deleted" means: until you clear your browser storage. Chrome limits cookies to a maximum of 400 days.

Legal bases: N = strictly necessary (Section 25(2) no. 2 TDDDG; Art. 6(1)(b) or (f) GDPR) · C = consent to the category under which the entry is listed (Section 25(1) TDDDG; Art. 6(1)(a) GDPR) · W = currently set without consent; the legal basis for the data processing is our legitimate interest (Art. 6(1)(f) GDPR; sections 4.7 and 15)

Essential

Set without consent: visit identifiers and embedded content

Functional

Analytics

Analytics and Targeting; Advertising (both allowed)

Targeting; Advertising