Privacy Policy

As at: 04.09.2026

1. Data protection at a glance

This privacy policy applies to the online shop at shop.wallpen.com. The privacy policy published there applies to the company website www.wallpen.com.

Personal data is any data by which you can be personally identified. Your data is collected in part because you provide it to us, for example when placing an order or via the contact form. Other data is recorded automatically by our IT systems when you visit the shop, primarily technical data such as browser, operating system and time of the page view. No analysis of your usage behaviour takes place in this shop; we do not use any analytics, tracking or advertising services here.

2. Information on the controller

The controller for data processing in this shop is:

wallPen GmbH
Werkstrasse 15
57537 Wissen
Germany

Phone: +49 2742 966800
E-mail: info@wallpen.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

3. Hosting and processing on our behalf

This shop is operated on the Odoo platform. The provider is Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium. The personal data collected on this website is stored on the provider's servers; processing takes place in data centres within the European Union. This may involve in particular IP addresses, contact requests, meta and communication data, contract data, contact data, names and website accesses.

It is used for the purpose of performing our contracts with customers and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) (b) and (f) GDPR). We have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. No transfer to third countries takes place.

4. Accessing this website, server log files

When you access the shop, your browser transmits technically necessary data which is stored in server log files: IP address, date and time of access, page accessed, volume of data transferred, referrer URL as well as browser and operating system identification. This processing serves to deliver the page, to ensure system security and to analyse errors, on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The log files are deleted after 30 days at the latest.

5. Cookies and session data

We use exclusively technically necessary cookies, in particular for session management, the shopping cart and the language setting. These are required for the operation of the shop; the legal basis is Sec. 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (b) and (f) GDPR. No analytics, tracking or advertising cookies are used.

6. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar changing from „http://“ to „https://“ and by the lock symbol in your browser bar. When encryption is active, the data you transmit to us cannot be read by third parties.

7. Customer account and order processing

To create a customer account and to process orders we process company name, contact person, address, billing and delivery address, e-mail address, telephone number, VAT identification number as well as order and payment data. The legal basis is Art. 6 (1) (b) GDPR, as the processing is necessary for the performance of the contract.

8. Payment processing

Bank transfer and credit card are available as means of payment in the shop. In the case of bank transfer, the data required to allocate the incoming payment is transmitted to our bank. Card payments are processed for us by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. The data required to carry out the payment is transmitted to Mollie and processed there; processing takes place within the European Union. You enter the card details exclusively at Mollie; they are not disclosed to us. The legal basis in each case is Art. 6 (1) (b) GDPR.

9. Shipping

In order to deliver your order we pass on your name, delivery address and, where required for delivery notification, e-mail address and telephone number to the shipping company commissioned. The legal basis is Art. 6 (1) (b) GDPR.

10. Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact data you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

This data is processed on the basis of Art. 6 (1) (b) GDPR where your enquiry is connected with the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases the processing is based on our legitimate interest in the effective handling of enquiries addressed to us pursuant to Art. 6 (1) (f) GDPR, or on your consent pursuant to Art. 6 (1) (a) GDPR where this has been requested.

The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for storing the data no longer applies. Mandatory statutory provisions, in particular retention periods, remain unaffected.

11. Enquiry by e-mail or telephone

If you contact us by e-mail or telephone, your enquiry including all personal data arising from it will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR or your consent pursuant to Art. 6 (1) (a) GDPR. The data remains with us until you ask us to delete it, withdraw your consent or the purpose no longer applies.

12. Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data remains with us until the purpose for the data processing no longer applies. Data from orders is subject to commercial and tax retention periods and is retained for six or ten years respectively pursuant to Sec. 257 of the German Commercial Code and Sec. 147 of the German Fiscal Code. We delete customer accounts at your request, provided that no retention obligations conflict with this.

13. Your rights

Within the scope of the applicable statutory provisions you have the right at any time to obtain free information about your stored personal data, its origin and recipients and the purpose of the data processing pursuant to Art. 15 GDPR, as well as a right to rectification pursuant to Art. 16 GDPR and to erasure pursuant to Art. 17 GDPR.

You also have the right to request the restriction of the processing of your personal data pursuant to Art. 18 GDPR, as well as the right to data portability pursuant to Art. 20 GDPR: data that we process automatically on the basis of your consent or in performance of a contract will be handed over to you or to a third party in a common, machine-readable format.

Insofar as we process data on the basis of a legitimate interest, you have the right pursuant to Art. 21 GDPR to object to such processing. You may withdraw consent given at any time with effect for the future; the lawfulness of the data processing carried out up to the withdrawal remains unaffected.

You have a right to lodge a complaint with a supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz.

14. Objection to advertising e-mails

The use of contact data published within the scope of the legal notice obligation for the purpose of sending advertising and information material not expressly requested is hereby objected to. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example by spam e-mails.

15. Necessity of provision

The provision of your data is necessary for the conclusion and performance of a contract. Without this data we cannot process an order. Automated decision-making including profiling does not take place.

The German version of this page prevails.