Privacy Policy

1. Controller

The controller for the processing of personal data on this website is:

IT-AT GmbH
Berner Straße 107
60437 Frankfurt am Main
Germany
Email: info@it-at.de

For data protection inquiries, please use the subject line "Datenschutz" (Data Protection).
Personal data is any information relating to an identified or identifiable natural person, such as name, contact details, IP address, order and contract data, or information about the use of our website.
We process personal data exclusively within the framework of applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications-Digital Services Data Protection Act (TDDDG).

2. Legal Basis

Depending on the type and purpose of processing, we base the processing of personal data in particular on Art. 6 Para. 1 lit. a GDPR for consent, Art. 6 Para. 1 lit. b GDPR for the fulfillment of a contract or the implementation of pre-contractual measures, Art. 6 Para. 1 lit. c GDPR for the fulfillment of legal obligations, or Art. 6 Para. 1 lit. f GDPR for the protection of our legitimate interests or the interests of third parties.
Insofar as information is stored on your end device or read from it, the provisions of Section 25 TDDDG apply in addition.

3. Your Data Protection Rights

Within the framework of legal requirements, you have the following rights in particular:

  • Right to information according to Art. 15 GDPR
  • Right to rectification according to Art. 16 GDPR
  • Right to erasure according to Art. 17 GDPR
  • Right to restriction of processing according to Art. 18 GDPR
  • Right to data portability according to Art. 20 GDPR
  • Right to object according to Art. 21 GDPR
  • Right to withdraw given consent according to Art. 7 Para. 3 GDPR
  • Right to lodge a complaint with a data protection supervisory authority according to Art. 77 GDPR

If processing is based on Art. 6 Para. 1 lit. f GDPR, you can object to the processing at any time for reasons arising from your particular situation.
If your personal data is processed for direct marketing purposes, you can object to this processing at any time.
You can withdraw any given consent at any time with effect for the future. The legality of the processing carried out until the withdrawal remains unaffected.
You can assert your rights at info@it-at.de with the subject "Datenschutz".
You also have the right to lodge a complaint with a data protection supervisory authority. The following authority is particularly responsible for us:
The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Germany

4. Data Security

We take appropriate technical and organizational measures to protect personal data from loss, manipulation, unauthorized access, and other unlawful processing.
Our website uses SSL or TLS encryption. You can recognize an encrypted connection in particular by "https://" and the lock symbol in your browser's address bar.

5. Hosting and Shop System Shopify

We operate our website and our online shop via the Shopify e-commerce platform.
For users in the European Economic Area, the following company is particularly responsible:
Shopify International Ltd.
c/o Intertrust Ireland
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Shopify provides us with the technical infrastructure for our website, the online shop, shopping cart, checkout, and other shop functions.
In particular, IP address, browser and device information, usage data, cookie and session information, contact details, customer account data, shopping cart contents, order data, billing and delivery information, and information about the order and payment process can be processed.
For the basic Shopify services we use, Shopify generally processes customer data on our behalf. For individual additional Shopify services, Shopify may also process personal data under its own data protection responsibility.
The processing serves the technical provision of our shop, contract and order processing, ensuring security, and preventing misuse and fraud.
The legal basis depends on the processing and is Art. 6 Para. 1 lit. b or lit. f GDPR.
Shopify operates internationally. Therefore, personal data may also be processed outside the European Economic Area, particularly in Canada or the USA. Shopify uses the protective mechanisms provided for in Art. 44 et seq. GDPR for such transfers, in particular adequacy decisions, Binding Corporate Rules, or standard contractual clauses.

6. Server Log Data

When you visit our website, technically necessary information is automatically processed. This may include your IP address, date and time of access, the page accessed, referrer URL, browser type and version, operating system, device information, and HTTP status codes.
The processing is necessary to provide the website and to ensure its security, stability, and functionality, and to detect technical errors or abusive access.
The legal basis is Art. 6 Para. 1 lit. f GDPR. Our legitimate interest lies in the secure and trouble-free operation of our online offering.

7. Cookies and Consent Management

Our website uses cookies and similar technologies. Cookies are small pieces of information that can be stored on your end device or read from it.
Technically necessary cookies are required, for example, to provide shopping cart, checkout, customer account, session management, security functions, and your privacy settings.
Insofar as the storage or reading of information is absolutely necessary for an explicitly requested digital service, this is done on the basis of Section 25 Para. 2 TDDDG. Insofar as personal data is processed in this context, this is done in particular on the basis of Art. 6 Para. 1 lit. b or lit. f GDPR.
We generally only use cookies and similar technologies for analysis, statistics, or advertising purposes after your consent in accordance with Section 25 Para. 1 TDDDG in conjunction with Art. 6 Para. 1 lit. a GDPR.

To manage your consent, we use the corresponding data protection and cookie functions of our Shopify shop. You can change or revoke your selection at any time via the cookie settings on our website.

8. Orders, Customer Account, and Contract Processing

If you order products through our online shop or use a customer account, we process the data necessary for the execution of the contract.
This includes in particular name, company, billing and delivery address, email address, possibly telephone number, customer number, ordered products, quantities, prices, payment status, and shipping and order information.
We use this data to process your order, deliver the goods, issue invoices, communicate about the order, and process service, warranty, or return procedures.
The legal basis is Art. 6 Para. 1 lit. b GDPR.
Insofar as we have to retain business, contract, booking, or invoice data due to commercial or tax law regulations, further processing is carried out on the basis of Art. 6 Para. 1 lit. c GDPR.
An optionally set up customer account can be deleted, provided that there are no legal retention obligations for the data contained therein.

9. Shopify Payments


We use Shopify Payments for payment processing in our online shop.
If you choose a payment method offered via Shopify Payments, the information required for payment processing will be transmitted to Shopify and, if applicable, to the banks, card organizations, or payment service providers involved in the respective payment process.
This may include in particular name, billing address, order value, currency, payment and transaction information, IP address, and device and security information.
The processing is carried out for the purpose of carrying out the payment, authentication, fraud and abuse prevention, and for fulfilling legal obligations.
The legal basis is in particular Art. 6 Para. 1 lit. b GDPR; insofar as legal obligations or security interests are concerned, additionally Art. 6 Para. 1 lit. c or lit. f GDPR.
The specific payment methods available will be displayed to you at checkout.


10. Shipping and Delivery

To fulfill an order, we pass on the data required for delivery to the respective shipping, transport, or logistics service providers used.
This concerns in particular the name or company, delivery address, and, if applicable, further contact details necessary for delivery.
The legal basis is Art. 6 Para. 1 lit. b GDPR.


11. Google Tag, Google Analytics, and Google Ads


We use or plan to integrate services from
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland.


Google Tag
The Google Tag serves as the technical basis for integrating and controlling various Google services on our website, in particular Google Analytics and Google Ads.
The use of corresponding analysis or marketing functions only takes place in accordance with your selection in the cookie banner.


Google Analytics
We use Google Analytics to statistically evaluate the use of our website and to improve our online offering.
This may include information about pages accessed, time and duration of visit, click and navigation behavior, origin of the visitor, approximate region, browser, operating system, device, referrer URL, and information about orders and other conversions.
Processing takes place exclusively after your consent on the basis of Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TDDDG.


Google Ads and Conversion Tracking
We use Google Ads to promote our products and services through the Google advertising network and to measure the success of our advertising campaigns.
Within the framework of conversion tracking, we can, for example, determine whether a specific action was carried out on our website after clicking on an advertisement, such as an inquiry or order.
This may include in particular cookie or online identifiers, IP address, device and browser information, information about pages accessed, interactions, advertisements, and conversions.

This processing also generally only takes place after your consent in accordance with Art. 6 Para. 1 lit. a GDPR and Section 25 Para. 1 TDDDG.
Google Consent Mode
We can use Google Consent Mode so that Google services technically take into account your consent decisions made in the cookie banner.
You can change or revoke a given consent at any time via the cookie settings on our website with effect for the future.
In connection with Google services, data may also be processed outside the European Economic Area, particularly in the USA. International data transfers are carried out in accordance with Art. 44 et seq. GDPR using the applicable legal protection mechanisms.


12. Contacting Us


If you contact us via a contact form, by email, or by phone, we process the data you provide to process your request.
This may include in particular name, company, email address, telephone number, and the content and subject of your inquiry. Your information may also be stored in our CRM system for processing and documenting your inquiry.
If your inquiry relates to an existing contract or pre-contractual measures, Art. 6 Para. 1 lit. b GDPR is the legal basis. For other inquiries, processing is carried out on the basis of our legitimate interest in efficient processing of business inquiries in accordance with Art. 6 Para. 1 lit. f GDPR.


13. Newsletter


If you subscribe to our newsletter, we process in particular your email address and, if applicable, your name and other voluntarily provided information.
The dispatch is generally based on your consent in accordance with Art. 6 Para. 1 lit. a GDPR.
To document the consent, the time of registration and confirmation as well as technical information may also be stored.
You can revoke your consent at any time via the unsubscribe link in the newsletter or by sending a message to info@it-at.de.


14. Applications


If you apply to us, we process the application data you provide, for example, contact details, resume, qualifications, certificates, and other application documents.

The processing is carried out for the purpose of conducting the application process and deciding on the establishment of an employment relationship on the basis of Section 26 BDSG.
If an employment relationship does not come into being, application data is generally deleted at the latest six months after the conclusion of the application process, unless there are legal reasons for longer storage or you have consented to longer storage.


15. Recipients of Personal Data


We sometimes use external service providers to provide our website and our services. These include in particular Shopify, payment service providers, banks, shipping and logistics companies, IT and hosting service providers, CRM and communication service providers, and Google within the framework of the described analysis and advertising services.
Insofar as service providers process personal data exclusively on our behalf, they are engaged in accordance with legal requirements, in particular on the basis of Art. 28 GDPR.
Any other transfer of personal data only takes place if it is necessary for a contract, there is a legal obligation, we have a legitimate interest, or you have consented.


16. Storage Duration


We generally store personal data only for as long as is necessary for the respective processing purpose.
Insofar as legal retention obligations exist, in particular commercial or tax law retention periods, the data concerned will be stored for the legally prescribed duration.
In addition, storage may take place if this is necessary for the establishment, exercise, or defense of legal claims.
After the processing purpose ceases to apply and the respective retention periods expire, the data will be deleted or anonymized.


17. Obligation to Provide Data and Automated Decisions


The provision of personal data is generally voluntary. However, for certain services, in particular orders, payments, contract processing, or applications, certain information is required. Without this data, we may not be able to provide the respective service.
An exclusively automated decision-making by IT-AT, which has legal effect on you or significantly impairs you in a similar way, does not take place within the framework of the usual use of this website.

Individual payment or security service providers may use their own automated verification procedures for fraud prevention. The data protection information of the respective service provider applies additionally to these procedures.


18. Changes to this

Privacy Policy
We reserve the right to adapt this privacy policy if our website, the services used, or legal requirements change.
The current version published on our website applies.
Status: August 2026