Privacy Policy

The protection of your data is particularly important to us. Below, we will inform you in detail about the processing and handling of your data.

I. General Information on Data Protection & Data Subject Rights

§ 1 General Information

Data protection is an important issue. Below, we provide information about the collection and processing of personal data. Personal data includes all data that can be related to you personally.

Controller pursuant to Art. 4(7) GDPR

think about IT GmbH
Authorized representative: Dipl. jur. Peter Rados
Gesundheitscampus-Süd 19
44801 Bochum
Phone: 0234/3253247
Email: info@think-about.it

Data Protection Officer

You can reach the appointed Data Protection Officer of our company at the following address:
Mr. Patrick Grihn
grihn@dsb.ruhr
DSB Ruhr
℅ nextindex GmbH & Co. KG
Grabenstr. 12
44787 Bochum

If you have questions about the processing, security, or requests for information, you can directly and confidently contact him.

§ 2 General Overview of Data and Processing Activities

We aim to provide you with the required clarity in accordance with Art. 12 GDPR. Therefore, here is an overview of the processing activities:

Types of processed data:

• Usage or communication data (e.g., when accessing a website, IP address, device information, access time, etc.)
• Contact data when registering or entering information
• Master data (name, company, address)
• Communication data (possibly metadata about calls, emails)
• Content data (especially when sending emails and using the contact form).

Additionally (internally), the following data for our customers, prospects, suppliers, and business partners for providing services in the areas of offers, contracts, service, marketing, direct advertising, and customer care:

• Contract data
• Customer master data (CRM)
• Supplier data
• Payment data
• Order and invoice data Data

Persons affected (categories):

• Users of this website (also referred to as visitors)
• Customers
• Suppliers
• Interested parties

Purposes:

• Operating the website and providing information
• Ensuring the operation of the website and our systems (e.g., firewall)
• Communication with our customers
• Responding to inquiries
• Optimizing and analyzing the website
• Providing information to our (potential) customers

§ 3 Your Rights

You have the following rights concerning your personal data processed by us:

Summary:

• Right to access,
• Right to rectification or erasure,
• Right to restrict processing,
• Right to object to processing,
• Right to data portability,
• Right to lodge a complaint with the data protection supervisory authority regarding the processing of your personal data by us.

Detailed rights:

• Pursuant to Art. 15 GDPR, you have the right to request information about your personal data processed by us. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if not collected by us, as well as the existence of automated decision-making, including profiling, and, where applicable, meaningful information about its details
• Pursuant to Art. 16 GDPR, you have the right to demand the immediate correction of inaccurate or completion of your personal data stored by us
• Pursuant to Art. 17 GDPR, you have the right to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right to freedom of expression and information, for fulfilling a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims
• Pursuant to Art. 18 GDPR, you have the right to request the restriction of the processing of your personal data, provided the accuracy of the data is contested by you, the processing is unlawful but you oppose its erasure, and we no longer need the data, but you need it for the establishment, exercise, or defense of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR
• Pursuant to Art. 20 GDPR, you have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request the transfer to another controller
• Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent at any time. This means that we will no longer continue the data processing based on this consent in the future and
• Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority. You can usually contact the supervisory authority of your habitual residence or workplace, or the authority responsible for our office location.

The right to erasure does not exist insofar as processing is necessary:

• for exercising the right to freedom of expression and information
• for fulfilling a legal obligation that requires processing under the law of the Union or the Member States to which the controller is subject, or for performing a task carried out in the public interest or in the exercise of official authority vested in the controller
• for reasons of public interest in the area of public health pursuant to Art. 9(2)(h) and (i) as well as Art. 9(3) GDPR
• for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right referred to in section (a) is likely to render impossible or seriously impair the achievement of the objectives of this processing or
• for the establishment, exercise, or defense of legal claims.

§ 4 General Legal Bases

When processing personal data necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations required for pre-contractual measures. If the processing is necessary for safeguarding a legitimate interest of our company or a third party, and if the interests, fundamental rights, and freedoms of the data subject do not override the former interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing. Where the processing of personal data is required to fulfill a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis. In the event that the vital interests of the data subject or another natural person necessitate the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis. Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.

Summary:

• Right to access,
• Right to rectification or erasure,
• Right to restriction of processing,
• Right to object to processing,
• Right to data portability,
• Right to lodge a complaint with the data protection supervisory authority regarding the processing of your personal data by us.

II. Website

§ 5 Websites and Domains (Scope of Application)

This privacy policy applies to the following online shops operated by Think about IT GmbH:

• www.mynotebook.de
• www.myeducation.de

§ 6 General Information

General Data When Accessing the Website

When you use the website purely for informational purposes, i.e., if you do not register or otherwise transmit information to us, we only collect the personal data that your browser transmits to our server in order to display our website and to ensure stability and security. The processing is based on Art. 6(1)(f) GDPR (Legitimate Interest).

Log Files

Storage in log files occurs to ensure the functionality of the website. The data is also used to optimize the website and ensure the security of our information technology systems. The processing is based on Art. 6(1)(f) GDPR (Legitimate Interest). The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. If the data is stored in log files, this is the case after a maximum of seven days. Further storage is possible. In this case, the IP addresses of the users are deleted or anonymized so that the calling client can no longer be assigned.

Cookies

In addition to the aforementioned data, cookies may be stored on your computer when you use our website. We use technically necessary cookies for the purposes of security and technical implementation of the website. Processing is carried out on the basis of Art. 6 (1) lit. f GDPR (legitimate interest). These cookies are usually deleted after logging out or closing the browser.
We also use cookies for the purpose of analyzing usage behavior or for marketing purposes. These cookies are deleted after a specified period of time. Unless otherwise stated in this privacy policy, processing is based on Art. 6 (1) lit. f GDPR (legitimate interest). Otherwise, it is based on consent in accordance with Art. 6 (1) lit. a GDPR.
You can delete the cookies stored on your computer at any time in your browser settings. You can also configure your browser to either delete cookies when you close the browser or to reject cookies in general. Please note that you may not be able to use some features of our website properly without cookies.

Liste aller verwendeten Cookies

Cookie-Name	Cookie-Typ	Cookie Description	Duration of Storage
__hstc	Necessary	ITScope - HubSpot: Primary tracking cookie for visitor identification.	13 months
_gcl_au	Necessary	ITScope - Google AdSense/Ads: Measurement of Conversions.	13 month
hubspotutk	Necessary	ITScope - HubSpot: stores user ID, recognition for forms.	24 months
_ga	Statistics	Google Analytics: Visitor-Identification (Client-ID).	24 month
_ga_TNV6TRLT62	Necessary	Google Analytics Property-specific (G-Tag/GA4).	24 month
_gid	Necessary	Google Analytics: distinguishes users within 24h.	24 hours
dtCookieb45as7lg, dtPCb45as7lg, dtSab45as7lg	Necessary	Dynatrace Monitoring (Performance- and User-Session-Tracking).	current session
form_key	Necessary	Protection against CSRF attacks on forms.	current session
gdpr_cookie	Necessary	Save consent or display of the cookie banner.	12 month
gdpr_show_popup	Necessary	Save consent or display of the cookie banner.	12 month
lantern	Necessary	Internal tool cookie (monitoring/tracking).	current session
PHPSESSID	Necessary	Standard-PHP-Session-Cookie, keeps the user's current session active.	current session
_ga	Statistics	PayPal - Google Analytics: Visitor-Identifikation (Client-ID).	24 month
_gcl_au	Necessary	PayPal - Google Analytics Property-specific (G-Tag/GA4).	3 month
cookie_check	Necessary	PayPal - Check whether cookies are enabled.	current session
cookie_prefs	Necessary	PayPal - Saves the user's cookie preferences.	12 month
d_id	Necessary	PayPal - Device-ID Cookie (device detection).	24 month
enforce_policy	Necessary	PayPal - Enforces legal/compliance guidelines.	12 month
kndctr_5CE4123F5245B06C0A490D45_AdobeOrg_identity	Necessary	Paypal - Adobe Experience Cloud Identity Service, User-ID Tracking.	24 month
LANG	Necessary	Paypal - User's language setting.	current session/ up to 12 month
rmuc	Necessary	PayPal-Cookie, user status (Login).	6 months
TLTDID	Necessary	Paypal - used for load balancing or tracking transactions.	12 month
ts, ts_c	Necessary	PayPal-Cookies, Security, Fraud-Prevention, Session-Management.	current session
tsrce	Necessary	PayPal-Cookies, Security, Fraud-Prevention, Session-Management.	72 hours
ROUTE	Necessary	Load Distribution / Routing to Server-Cluster.	current session
kampyle_userid, kampyleUserSessionsCount	Necessary	Paypal - Verint / Kampyle Feedback-Tool for surveys & Session-Tracking.	12 month
kampyleSessionPageCounter, kampyleUserSession	Necessary	Paypal - Verint / Kampyle Feedback-Tool for surveys & Session-Tracking.	12 month
mdLogger	Necessary	Paypal - Logging/Monitoring-Cookie (Debugging oder Error Tracking).	current session
nsid	Necessary	PayPal-Session-ID.	current session
WELCOME_ASYNC	Necessary	Asynchronous process / welcome tracking cookie.	current session
rxVisitorb45as7lg, rxvtb45as7lg	Necessary	Dynatrace Real User Monitoring: stores a unique identifier for the visitor.	current session

§ 7 Third-Party Services

We use third-party services to make our website more user-friendly, effective, and secure. This includes the use of analysis tools. We use analysis tools to analyze user behavior in order to optimize our website. Unless otherwise stated in this privacy policy, the use of analysis tools is based on the legal basis of legitimate interest pursuant to Art. 6 (1) lit. f GDPR. This is particularly the case if the service only collects pseudonymized data and the respective service does not use the data for its own purposes.

Google Services

We use services provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland, a company registered and operated under Irish law (registration number: 368047). The use of Google's services only occurs with your informed consent, based on Art. 6(1)(a) GDPR, unless otherwise stated. In connection with the services and features, Google may use cookies that can be stored on your device. The information generated by the cookies (e.g., about your use of the website) may be transmitted to a server in the USA and stored there. This may also include your IP address. As a rule, your IP address is stored in anonymized form. When data is transmitted to the USA, an adequate level of data protection cannot be guaranteed. In particular, access by U.S. authorities cannot be ruled out. The transfer is based on Art. 49(1)(a) GDPR (consent).

We use the following Google services and features:

Google Analytics

We use Google Analytics to analyze the use of our website and regularly improve it. The statistics we gain allow us to improve our offering and make it more interesting for you as a user. We use Google Analytics with the "_anonymizeIp()" extension. This ensures that IP addresses are processed in shortened form, which excludes any direct personal identification. If any data collected about you is personally identifiable, it is immediately excluded, and the personal data is deleted without delay.

Google Ads

We use Google Ads to draw attention to our website on external websites or search engines. As part of this, we use the remarketing function of Google Ads. The remarketing function allows us to present users of our website with advertisements based on their interests on other websites within the Google advertising network. For this purpose, Google stores cookies on a specific device to uniquely identify a web browser. We do not receive any information that can be used to personally identify users. We also use conversion tracking. When you click on an ad placed by Google, a conversion tracking cookie is set. Each Google Ads customer receives a different cookie. The cookies cannot be tracked via the websites of Google Ads customers. The information collected using the conversion cookie is used to generate conversion statistics for Ads customers. We do not receive any information that can be used to personally identify users.

Google Tag Manager

We use Google Tag Manager. This service enables the efficient management of so-called "tags" (small code elements on the website). Among other things, this service allows us to more easily use other Google services.

Possibilities of objection

You have several options to object to or restrict the collection and processing of your data by Google:

• You can prevent the storage of cookies by setting your browser software accordingly (not all functions of the website may be usable as a result).
• You can prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de (Only applies to data collected and processed by Google Analytics).
• You can revoke your consent to the processing of data by Google services at any time. You can do this by deleting the cookies in your browser and not giving your consent the next time you visit our website.
• If you have a Google account, you can make settings for the type, scope and storage of data by Google in the account management under the menu item ‘Data & personalisation’.

Further information on the purpose and scope of data collection and processing can be found in Google's privacy policy https://policies.google.com/privacy?hl=de&gl=de.

Microsoft Services

We use various services provided by Microsoft Corporation (“Microsoft”), One Microsoft Way, Redmond, WA 98052-6399, USA) or Microsoft Ireland Operations Limited for EU users (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland) on our website. Microsoft services are only used with your informed consent on the basis of Art. 6 (1) (a) GDPR. Microsoft uses cookies in connection with the services and functions that may be stored on your device. The information generated by the cookies (e.g., about your use of the website) may be transmitted to a server in the United States and Ireland and stored there. This may also include your IP address. As a rule, your IP address is stored anonymously. Microsoft has submitted to the Data Privacy Framework. The transfer is certified under the Data Privacy Framework on the basis of Art. 45 GDPR (adequacy decision). Further information on the Data Privacy Framework can be found at https://www.dataprivacyframework.gov/s/.

We use the following Microsoft services and features:

Microsoft Clarity

This website uses Microsoft Clarity, a web analytics service provided by Microsoft Corporation (One Microsoft Way, Redmond, WA 98052-6399, USA) or Microsoft Ireland Operations Limited for EU users (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland). Clarity is used to analyze user behavior in order to improve the usability of our website. Clarity collects the following data, among other things:

• Interactions with the website (mouse movements, scrolling behavior, clicks, keyboard entries)
• Heat maps and session replays (recording of user sessions in anonymized form)
• Device and browser information (e.g., screen resolution, operating system, browser version)
• Pseudonymized user IDs (via cookies or similar technologies)
• IP address (transmitted in anonymized or truncated form)

In the webshop, no personal data (e.g., input fields for name, email, address) is recorded when the masking function is activated. Nevertheless, the data collected may be personally identifiable under certain circumstances. Processing is carried out exclusively on the basis of your consent in accordance with Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TTDSG. You can revoke your consent at any time (e.g., via the cookie banner/consent tool). Clarity will not be loaded without consent. Alternatively, you can use your browser's do-not-track function.

The data is transferred to Microsoft servers in the EU/USA. Microsoft is subject to the EU-U.S. Data Privacy Framework (and has implemented appropriate safeguards). For more information about data processing by Microsoft, please refer to the Microsoft Privacy Statement and the Clarity Terms of Use. Session data is generally stored by Microsoft for up to 13 months (after which it is anonymized or deleted). For more detailed information, please refer to the Microsoft documentation.

EHI seal of approval

We use the ‘EHI Geprüfter Online-Shop’ seal on our website, a widget of the EHI Retail Institute GmbH, Spichernstraße 55, 50672 Cologne (‘EHI’). When you visit our website, dynamic content (current rating of the shop, certificate, etc.) is loaded into the widget from EHI servers. Your IP address, the previously visited website, the date and time of access, the amount of data transferred, the browser type and version, the operating system you are using and the requesting provider (referrer data) are transmitted to the EHI servers. Processing is carried out for the purpose of presenting customer reviews on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest). Further information on data protection at EHI can be found at: www.ehi-siegel.de/datenschutz

eKomi seal

The eKomi seal of approval is integrated on this website to display our eKomi seal of approval. The seal of approval and the services advertised with it are an offer of the rating platform eKomi Ltd, Markgrafenstraße 11, 10969 Berlin. Processing is carried out for the purpose of presenting customer reviews on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest). When you access the seal of approval, the web server automatically saves a so-called server log file, which contains, for example, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data) and documents the access. This access data is not analysed and is automatically overwritten no later than seven days after the end of your visit to the site.

Social media

We are also represented on social media. However, we do not directly integrate any platform. If you click on the icons of the corresponding portals, the terms of use and data protection provisions of the respective portals apply. At no time is there an obligation to register with one of these portals for information purposes or to contact us (the provider). Instead, you have various options for contacting us (telephone, email, contact form).

§ 8 Customer service, contact form, and email contact

Our website features a contact form that can be used to contact us electronically. If a user chooses to do so, the data entered in the input mask will be transmitted to us and stored. You can also submit a request in your customer account for this purpose. If you would also like to be contacted by phone, you can voluntarily provide your mobile number. Alternatively, you can contact us via the email address provided. In this case, the user's personal data transmitted with the email will be stored. We process the respective personal data for the purpose of processing the conversation (contact, response) on the basis of Art. 6 (1) lit. f GDPR (legitimate interest) or on the basis of Art. 6 (1) lit. b GDPR (performance of a contract or pre-contractual measures). The data will be deleted when it is no longer needed to fulfill the purpose of processing.

§ 9 Provisions for the web shop

We offer a web shop on our website where we sell our products. In addition to the processing mentioned in §5, we process further data for the purpose of executing orders and processing inquiries/offers. The processing is based on Art. 6 (1) lit. b GDPR (fulfillment of a contract or pre-contractual measures). To make your shopping experience as convenient as possible, you can create a customer account with us for this purpose. With a customer account, you can view and change your orders, your shopping cart, and your quote requests. You can also view and change the data stored about you in your customer account at any time. We store your data until you cancel your customer account with us, unless the relevant data is required for the fulfillment of statutory retention obligations. You can delete your account at any time in the account overview.

Forwarding of data (including recipients)

Your data will be made available in the necessary places within the responsible body. If it is necessary to process your order, we will pass on your name, address and order data to the company responsible for execution/delivery. In the course of a request for information from a credit agency, the notification of a payment default, in the course of tax advice or the defense of rights, the data may be passed on to third parties for appropriate purposes.

Payment provider

We process payment data for the purpose of billing and the payment process. Unless otherwise stated in this privacy policy, the processing of payment data is carried out on the legal basis of contract fulfillment in accordance with Art. 6 para. 1 lit. b GDPR.

Sofortüberweisung
On our website we offer payment via Sofortüberweisung, among other things. The provider of this payment service is Sofort GmbH, Theresienhöhe 12, 80339 Munich. If you select payment via Sofortüberweisung, the payment data you enter will be transmitted to Sofort GmbH. The transmission of your data to Sofort GmbH takes place on the basis of Art. 6 para. 1 lit. b GDPR (processing for the performance of a contract).

PayPal
We offer payment via PayPal on our website. The provider of this payment service is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter referred to as “PayPal”). If you select payment via PayPal, the payment data you enter will be transmitted to PayPal. The transmission of your data to PayPal is based on Art. 6 para. 1 lit. a GDPR (consent). You have the option to revoke your consent to data processing at any time. A revocation does not affect the effectiveness of past processing.

Unzer
If you use the credit card payment options, the payment will be processed by the payment service provider Unzer Group GmbH, Vangerowstraße 18, 69115 Heidelberg (“Unzer”). In this case, the data will be transmitted to Unzer. The transfer of your data to Unzer is based on Art. 6 (1) lit. b GDPR (performance of a contract or pre-contractual measures).

Provisions for e-mail contact
You can contact us electronically via the e-mail address provided. If a user makes use of this option, the data transmitted in the e-mail will be stored. We process the respective personal data for the purpose of processing the conversation (contacting, answering) on the basis of the legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. The data will not be passed on to third parties in this context.

III. Newsletter subscribers

We offer a newsletter that you can subscribe to on our website. The newsletter informs you about current news and offers. We process your name and your e-mail address for the purpose of sending the newsletter and to address you personally. We only send the newsletter with your express consent in accordance with Art. 6 para. 1 lit. a GDPR. You can revoke your consent to the sending of the newsletter at any time. The cancellation can be made by clicking on the link provided in every newsletter email or in the account settings on our website if you have created a customer account with us. We would like to point out that we evaluate your user behaviour when sending the newsletter. For this analysis, the emails sent contain so-called web beacons or tracking pixels, which are one-pixel image files stored on our website. We use the data obtained in this way to create a user profile in order to tailor the newsletter to your individual interests. The user profile is created and analysed on the legal basis of the legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR for the optimal and customer-oriented design of the newsletter.

IV. Status of the privacy policy

The privacy policy is amended from time to time to reflect changes in the business process and the legal situation. You will always find the latest version on the website.

Last update: March 2026