General Terms & Conditions

Applicability

These General Terms & Conditions apply exclusively to consumer orders placed through the IVKO online shop and to the business relationship between IVKO Retail GmbH, Nederlinger Str. 4, 80638 Munich, Germany (hereinafter "IVKO Retail" or the "Company"), and the Customer. A Customer is a consumer within the meaning of section 13 of the German Civil Code (BGB). IVKO Retail is the sole seller, contractual counterparty, issuer of the B2C invoice and recipient of the purchase price. SHE Trading GmbH supplies goods to IVKO Retail and coordinates fulfilment; Finecom Logistics GmbH performs warehousing, pick & pack, dispatch handover and returns processing. Neither SHE Trading GmbH nor Finecom Logistics GmbH is a seller or contractual counterparty of the Customer. The internal transfer of goods to IVKO Retail when they are allocated to a specific Customer order, and the monthly settlement between SHE Trading GmbH and IVKO Retail, do not affect the Customer's contract or rights against IVKO Retail.

Conclusion of Contract

The presentation of products in the online shop does not constitute a legally binding offer, but an invitation to the Customer to submit an order. By clicking the final order button acknowledging the payment obligation, the Customer submits a binding offer to purchase the goods from IVKO Retail. The automated order-receipt e-mail only confirms receipt of the order and does not, by itself, constitute acceptance.

IVKO Retail may accept the order by sending an express order or dispatch confirmation, or by handing the goods to the carrier and confirming dispatch, whichever occurs first. IVKO Retail may reject an order for justified reasons, including unavailability, incorrect order information, an obvious pricing error or a substantiated fraud or sanctions concern. If an order is not accepted, IVKO Retail will inform the Customer without undue delay and release or refund any amount already authorised or received.

The purchase contract is concluded exclusively between the Customer and IVKO Retail. The B2C invoice is issued and stored by IVKO Retail. SHE Trading GmbH, Finecom Logistics GmbH, the payment providers and the carriers act only within the operational chain described in these Terms or under their own statutory responsibilities.

When ordering from the online shop, the Customer selects the desired goods, enters the delivery address and, where applicable, a different billing address, chooses an available payment method, and then has the opportunity to review and correct the order details before submitting the order by clicking "Continue to payment" or the corresponding final order button displayed at checkout.

Goods are supplied only in quantities customary for a household. Orders may be placed only by persons who have reached the age of 18.

The right of withdrawal from the Sales contract

Consumers have the statutory right to withdraw from the Sales Contract within 14 days without giving any reason, subject to the statutory exceptions stated below.

Right of withdrawal

You have the right to withdraw from this contract within 14 days without giving any reason. The withdrawal period is 14 days from the day on which you, or a third party named by you who is not the carrier, take possession of the goods. If several goods ordered together are delivered separately, the period begins when the last item is received. To exercise your right of withdrawal, you must inform us:

IVKO Retail GmbH
Nederlinger Str. 4
80638 Munich, Germany
service@ivko.com
Tel.: +49 (0) 89 998 2528 10

of your decision to withdraw from this contract by an unequivocal statement, for example a letter sent by post or an e-mail. You may use the model withdrawal form below, but this is not obligatory. To meet the withdrawal deadline, it is sufficient to send the communication concerning the exercise of the right of withdrawal before the withdrawal period expires.

Effects of withdrawal

If you withdraw from this contract, IVKO Retail shall reimburse all payments received from you, including the costs of delivery, except for supplementary costs resulting from your choice of a delivery method other than the least expensive standard delivery offered by IVKO Retail. Reimbursement will be made without undue delay and no later than 14 days after IVKO Retail is informed of your decision. The same payment method used for the original transaction will be used unless expressly agreed otherwise and provided that you incur no fees. IVKO Retail may withhold reimbursement until the goods have been received back or you have supplied evidence of dispatch, whichever occurs first.

You must send back the goods without undue delay and in any event no later than 14 days after communicating your withdrawal. Returns are to be addressed to IVKO Retail through its contracted returns facility at:

SHE Trading GmbH
c/o Finecom Logistics GmbH
Otto-Brindl-Straße 1
94447 Plattling, Germany

The deadline is met if the goods are sent before the 14-day period has expired. You bear the direct cost of returning the goods unless IVKO Retail expressly provides a free prepaid return label or otherwise agrees to bear that cost. You are liable only for diminished value resulting from handling beyond what is necessary to establish the nature, characteristics and functioning of the goods.

The right of withdrawal does not apply in the statutory cases, including goods that are not prefabricated and are produced according to an individual choice or are clearly tailored to the Customer's personal needs. Other statutory exclusions apply only where their legal requirements are met.

Withdrawal form:

If you wish to withdraw from the contract, complete this form and send it to:

IVKO Retail GmbH
Nederlinger Str. 4
80638 Munich, Germany
T: +49 (0) 89 998 2528 10
E-mail: service@ivko.com

To IVKO Retail GmbH, Nederlinger Str. 4, 80638 Munich, Germany:

I/We (*) hereby withdraw from the contract concluded by me/us (*) for the purchase of the following goods:
____________________________________________
Ordered on (*) / received on (*): ____________________
Name of consumer(s): ______________________________
Address of consumer(s): ____________________________
Signature of consumer(s) (only if submitted on paper): ____________________
Date: ____________________
(*) Delete as appropriate.

You can download the model withdrawal form in PDF format from the following link.

Return of the goods

In addition to the statutory withdrawal right described above, IVKO Retail may offer a voluntary return benefit under a separate return policy displayed in the online shop. Any voluntary benefit does not restrict the Customer's statutory rights and applies only under the conditions stated for that benefit.

To arrange a voluntary return, the Customer should contact IVKO Retail as soon as possible through service@ivko.com or the return function made available in the online shop. SHE Trading GmbH and Finecom Logistics GmbH may process the return operationally only on IVKO Retail's instructions.

Where IVKO Retail expressly provides a prepaid return label, the label and the instructions supplied with it must be used. Otherwise, the Customer bears the direct return costs as stated in the withdrawal information or the applicable voluntary return policy. Refunds may be withheld until the goods or evidence of dispatch have been received, to the extent permitted by law.

Unless otherwise agreed, refunds are made using the same payment method used for the original transaction. Statutory rules concerning diminished value caused by unnecessary handling remain unaffected.

Delivery

Unless otherwise agreed, IVKO Retail delivers to the delivery address specified by the Customer in the countries made available at checkout. The Customer bears the delivery costs shown before the order is submitted. For consumer purchases, the risk of accidental loss or damage passes only when the Customer, or a third party designated by the Customer other than the carrier, takes physical possession of the goods.

SHE Trading GmbH coordinates fulfilment for IVKO Retail. Finecom Logistics GmbH stores, picks and packs the goods and hands parcels to DHL or, in exceptional cases, UPS for delivery. This operational arrangement does not change IVKO Retail's status as seller or the Customer's rights against IVKO Retail.

The estimated dispatch and delivery times shown in the online shop or at checkout apply. Any stated period begins when the contract is concluded and, for prepayment, when payment is received. Partial deliveries are permitted only where reasonable for the Customer and without additional delivery charges.

If an ordered product unexpectedly becomes unavailable, IVKO Retail will inform the Customer without undue delay. IVKO Retail may decline or terminate the affected order to the extent permitted by law and will promptly reimburse any corresponding payment already received.

Customers must ensure that the delivery address and contact information supplied at checkout are complete and correct. Additional costs caused by an incorrect address may be charged only where the Customer is responsible and the charge is legally permissible.

Prices and shipping costs

All prices displayed in the online shop include the applicable statutory value-added tax. The final total price, delivery costs and any other unavoidable charges are displayed before the Customer submits the order.

Unless expressly stated otherwise, the Customer bears the delivery costs shown at checkout. For destinations outside the European Union customs territory, import duties, taxes or handling charges may be payable by the recipient unless the checkout expressly states that they are included.

If the Customer exercises the statutory right of withdrawal, the direct return costs are borne as stated in the section "The right of withdrawal from the Sales contract". Any separately advertised free or extended return benefit is governed by its stated conditions.

Liability

IVKO Retail is liable without limitation in accordance with the statutory provisions:

• for damage caused intentionally or through gross negligence by IVKO Retail, its legal representatives or vicarious agents;

• for damage resulting from injury to life, body or health caused by a negligent breach of duty by IVKO Retail or by an intentional or negligent breach of duty by its legal representatives or vicarious agents;

• where IVKO Retail has fraudulently concealed a defect or has expressly assumed a guarantee;

• under the German Product Liability Act (Produkthaftungsgesetz); and

• in all other cases in which liability cannot lawfully be excluded or limited.

In the event of slight negligence not covered above, IVKO Retail is liable only for the breach of an essential contractual obligation. An essential contractual obligation is an obligation whose proper performance is necessary for fulfilment of the contract and on whose performance the Customer may ordinarily rely. In such cases, liability is limited to damage that was typical for this type of contract and reasonably foreseeable when the contract was concluded.

To the extent permitted by law, IVKO Retail is not liable for damage caused by a slightly negligent breach of obligations that are not essential contractual obligations.

The above limitations of liability also apply for the benefit of IVKO Retail’s legal representatives, employees and vicarious agents where claims are asserted directly against them.

The Customer’s statutory rights concerning defective goods, including the rights to repair or replacement, price reduction or termination of the contract where the applicable requirements are met, remain unaffected. Claims for damages or reimbursement of expenses relating to defective goods are subject to the limitations set out in this section only to the extent permitted by mandatory law.

Warranty

IVKO Retail is liable as seller for the statutory conformity and defect rights applicable to the purchased goods. A commercial guarantee, if offered, is additional and does not restrict statutory rights.

Where the statutory conditions are met, the Customer may request subsequent performance by repair or replacement and may also have rights to a price reduction, termination of the contract and/or damages.

IVKO Retail may choose the legally permissible form of subsequent performance or refuse a particular form only where the statutory requirements are fulfilled, including where it would be impossible or would involve disproportionate cost.

For new goods, statutory defect claims generally become time-barred two years after delivery, subject to statutory rules on suspension, recommencement and extension of limitation periods.

Warranty or conformity complaints should be sent to service@ivko.com, stating the order number and a brief description of the issue and, where useful, photographs. This does not impose formal requirements on the exercise of mandatory rights.

IVKO Retail decides and responds to the Customer's complaint. SHE Trading GmbH or Finecom Logistics GmbH may inspect returned goods operationally on IVKO Retail's instructions. IVKO Retail will provide return instructions and bear the necessary costs where required by law.

If requested by IVKO Retail, goods for inspection should be sent to:

SHE Trading GmbH
c/o Finecom Logistics GmbH
Otto-Brindl-Straße 1
94447 Plattling, Germany

Payment methods

IVKO Retail offers the payment methods displayed at checkout, which may include card payment processed through Computop/EMS, PayPal, Klarna and other available providers. The relevant provider's additional terms and privacy information may apply.

IVKO Retail is the seller and merchant receiving payment for the goods. A successful payment to the payment provider designated at checkout discharges the Customer's payment obligation to the corresponding extent. IVKO Retail may exclude or restrict a payment method where justified by availability, security, fraud prevention or the result of a provider's identity or credit assessment.

Where payment on invoice or another provider-financed method is selected, the due date and payment instructions shown by the provider and on the invoice apply. Refunds are normally made through the original payment method.

Retention of title

The delivered goods remain the property of IVKO Retail until the purchase price has been paid in full.

Offsetting and retention

The Customer may set off claims where the counterclaim is undisputed, has been finally established by law, or arises from the same contractual relationship. Statutory rights of retention remain unaffected.

Privacy

IVKO Retail GmbH is the controller for personal data processed in connection with the online shop, Customer accounts, checkout, the B2C contract and invoice, payment, delivery, returns, complaints, support, security and marketing. Details concerning the purposes, legal bases, retention periods, recipients, international transfers and data-subject rights are provided in the Privacy Policy available through the online shop.

Ivković d.o.o. in Serbia processes data on IVKO Retail's documented instructions for platform maintenance, back-office operations, Customer support and administration of IVKO Retail's Navision environment. Transfers to Serbia must be protected by the applicable EU Standard Contractual Clauses, a transfer impact assessment and appropriate technical and organisational measures.

SHE Trading GmbH receives only the data necessary for fulfilment and returns on IVKO Retail's instructions. Finecom Logistics GmbH acts within this fulfilment chain for warehousing, pick & pack, carrier handover and returns. For its own B2B accounting and tax obligations, SHE Trading GmbH uses goods-level and aggregate business records and, only where strictly necessary, a limited order reference; it does not use Customer data for its own marketing or Customer relationship. Payment providers, banks and carriers may act as separate controllers for purposes they determine independently.

Storage of the order text

The B2C invoice and sales records are issued and stored in IVKO Retail's Navision system. The contract text and these General Terms & Conditions are sent to the Customer by e-mail on a durable medium. The current General Terms & Conditions can be found at https://de.ivko.com/de/terms-and-conditions/. After completion of the order, the order details may no longer be accessible through the Internet; Customers should retain the confirmation e-mail and invoice.

Online dispute resolution and consumer arbitration

The European Online Dispute Resolution platform was discontinued and Regulation (EU) No 524/2013 was repealed with effect from 20 July 2025. The former ODR platform link is therefore no longer provided.

IVKO Retail GmbH is neither willing nor obliged to participate in dispute-resolution proceedings before a consumer arbitration board, unless IVKO Retail expressly states otherwise or participation becomes legally mandatory.

Final provisions

The law of the Federal Republic of Germany applies to contracts between IVKO Retail and the Customer, excluding the United Nations Convention on Contracts for the International Sale of Goods. This choice of law does not deprive a consumer of mandatory protection under the law of the country of the consumer's habitual residence. Statutory jurisdiction rules remain unaffected. If an individual provision is invalid or unenforceable, the remaining provisions continue to apply and the invalid provision is replaced by the applicable mandatory law. Amendments to these Terms apply only to future contracts; the version supplied when the order is concluded governs that order.

Imprint

The websites de.ivko.com, eu.ivko.com and www.ivko.com, and the associated online shop, are operated by the sole B2C seller:

IVKO Retail GmbH
Nederlinger Str. 4
80638 Munich, Germany

Represented by its Managing Director:

Miloš Ivković

Telephone: +49 (0) 89 998 2528 10
E-mail: service@ivko.com
Register court: Amtsgericht München, HRB 235190
VAT identification number: DE313378221

Goods supplier and fulfilment coordinator (not the seller): SHE Trading GmbH, Nederlinger Str. 4, 80638 Munich, Germany, HRB 179541.
Warehouse, pick & pack and returns facility (not the seller): Finecom Logistics GmbH, Otto-Brindl-Straße 1, 94447 Plattling, Germany.

Privacy Policy

Content

1. Scope and application

2. Controller and responsibility

3. Categories and sources of personal data

4. Purposes of processing

5. Legal bases

6. Retention periods

7. Security

8. Recipients, processors and international transfers

9. Required and optional data; automated decisions

10. Third-party elements and links

11. Data-subject rights, contact and complaints

12. Changes to the policy

13. Appendix 1 - Data-subject rights

1. Scope and application

What does this Privacy Policy cover?

This Privacy Policy explains how IVKO Retail GmbH collects and processes personal data when you visit or use de.ivko.com, eu.ivko.com or www.ivko.com and the associated IVKO online shop (together, the "Site"); create or use a customer account; place or manage a B2C order; make or receive a payment or refund; request delivery, withdrawal, a return, warranty service or customer support; subscribe to marketing; or otherwise communicate with IVKO Retail in relation to the Site.

The Site and B2C online shop are operated by IVKO Retail GmbH. IVKO Retail is the sole B2C seller, contractual counterparty, invoice issuer and recipient of the purchase price. SHE Trading GmbH supplies goods to IVKO Retail and coordinates fulfilment. Finecom Logistics GmbH provides warehousing, pick & pack, carrier handover and returns processing. These operational arrangements do not make SHE Trading or Finecom the seller.

This Privacy Policy is a transparency notice. Merely accessing or using the Site, acknowledging this policy or closing a banner does not constitute consent to processing for which consent is legally required. Where we rely on consent, we request it separately and you may withdraw it at any time with effect for the future.

A separate Cookie Policy and the cookie-settings interface provide current information about cookies and similar technologies. Third-party websites and any separately operated physical stores or B2B services are governed by their own notices unless this policy expressly states otherwise.

2. Controller and responsibility

Who controls the processing of your personal data?

Controller. IVKO Retail GmbH, Nederlinger Str. 4, 80638 Munich, Germany, is the controller for personal data processed in connection with the Site, customer accounts, checkout, B2C contracts and invoices, payments, delivery, returns, complaints, customer support, security, analytics and marketing.

Contact. E-mail: privacy@ivko.com or service@ivko.com; telephone: +49 (0) 89 998 2528 10.

Ivković d.o.o. does not act as a joint controller for B2C online orders merely because it owns an affiliated company or its employees perform back-office and technical work. For the activities described in this policy, Ivković d.o.o. processes personal data on IVKO Retail's documented instructions, subject to the contractual and transfer safeguards described below.

SHE Trading GmbH processes customer data on IVKO Retail's instructions only to the extent required for fulfilment and returns. For limited records that SHE Trading must keep for its own B2B accounting, tax or legal obligations, it may act as a separate controller, using goods-level or aggregate records and only a minimal order reference where strictly necessary.

3. Categories and sources of personal data

What personal data do we process?

Identity and contact data. Name, title where provided, billing and delivery addresses, country, postal code, telephone number and e-mail address; company and VAT details where you request a business-style invoice or provide them voluntarily.

Account and authentication data. Customer-account identifier, username, password hash or other authentication credentials, account settings, language and communication preferences. We do not store your password in readable form.

Order and contract data. Products, sizes, colours, quantities, prices, vouchers, order and invoice numbers, order history, delivery and tracking status, withdrawal, return, exchange, refund, warranty and complaint information.

Payment and transaction data. Selected payment method, amount, currency, payment status and transaction, refund or chargeback references. Full payment-card details are normally collected directly by the payment provider and are not available to IVKO Retail.

Customer-service data. The content of e-mails, calls and other communications, the reason for contacting us, photographs or other evidence you submit, and our handling of the request.

Technical, usage and security data. IP address, date and time, requested URL, referral information, browser, device and operating-system data, session and log identifiers, cookie or similar identifiers, consent records, security events and payment-authorisation or risk results communicated by the selected payment provider.

Marketing data. Newsletter status, consents, objections, suppression-list entries, campaign interactions and preferences, to the extent legally permitted.

Sources. We obtain data from you; from your device and browser; from payment providers; and, where necessary, from SHE Trading, Finecom, DHL, UPS and other service providers involved in fulfilling, tracking, returning or securing your order.

Cookies and similar technologies. Strictly necessary technologies support the basket, checkout, account login, security and consent choices. IVKO uses an internally developed consent mechanism and does not use a separate external consent-management provider. Functional, analytics and marketing technologies are activated only after consent unless a specific statutory exception applies. Rejecting optional technologies or closing the banner is not consent. You can change your choice at any time through Cookie Settings.

4. Purposes of processing

For what purposes do we process your personal data?

Site, basket, checkout and accounts. To display and operate the Site, maintain the basket and checkout, create and administer customer accounts, remember requested settings, and provide the functions you request.

B2C orders and contracts. To receive and accept orders, issue and store invoices, administer products and prices, process payments and refunds, deliver goods, handle withdrawals, returns, exchanges, complaints and statutory conformity rights, and communicate with you about the contract.

Fulfilment. To allocate goods, prepare pick-and-pack instructions, create shipping and tracking data, hand parcels to DHL or exceptionally UPS, receive returned goods and perform physical inspections on IVKO Retail's instructions.

Customer service. To answer questions, provide pre-sale and after-sale assistance, keep an appropriate record of the case and improve the consistency and quality of support.

Payment and security. To confirm payment status, protect accounts and systems, prevent or respond to misuse, enforce our terms and establish, exercise or defend legal claims.

Legal, accounting and compliance obligations. To keep mandatory business, tax and accounting records; respond to authorities; manage product-safety or recall obligations; and comply with other applicable laws.

Service measurement and improvement. To compile necessary technical and aggregated statistics, diagnose errors and improve the Site, products and services. Optional analytics technologies are used only after consent where required.

Marketing and personalisation. To send newsletters or promotional communications, conduct optional surveys, measure campaigns or personalise marketing where you have consented or where another legal permission clearly applies. We do not provide customer data to third parties for their own marketing.

Consent and preference management. To record, demonstrate and apply your consent, cookie choices, objections, withdrawals and communication preferences through IVKO's internally developed consent mechanism.

5. Legal bases

What are the legal bases for processing?

Contract and pre-contractual steps - Article 6(1)(b) GDPR. This applies to the account and checkout functions you request and to processing necessary to conclude and perform the B2C contract, including payment, delivery, withdrawal, returns, refunds, complaints and support connected with the purchase.

Legal obligations - Article 6(1)(c) GDPR. This applies to tax, accounting, commercial-record, product-safety, regulatory and other mandatory obligations.

Legitimate interests - Article 6(1)(f) GDPR. This may apply to Site and network security, misuse prevention, necessary technical logs, service quality, business administration, internal reporting, and the establishment, exercise or defence of claims. We balance these interests against your rights and expectations. You may object as explained below.

Consent - Article 6(1)(a) GDPR. This applies where you choose optional analytics or marketing technologies, newsletter or promotional communications, surveys, profiling or other optional activities for which consent is required. Consent is voluntary, is not a condition of purchase and may be withdrawn for the future.

Direct-marketing exception. Where applicable law permits limited marketing to existing customers without prior consent, processing is based on Article 6(1)(f) GDPR together with the relevant direct-marketing rule, and every message provides a free and simple objection option.

Device access - section 25 TDDDG. Storing information on, or accessing information from, your device requires consent unless the technology is strictly necessary to transmit a communication or provide a digital service you expressly requested. The subsequent processing of personal data also requires an appropriate GDPR legal basis.

6. Retention periods

How long do we retain your personal data?

We retain personal data only for as long as necessary for the relevant purpose and then delete or irreversibly anonymise it, unless continued retention is required or permitted by law.

Orders, contracts, invoices and accounting records. These records are retained for the applicable German commercial and tax periods, generally six, eight or ten years depending on the record category. The relevant period is calculated from the end of the calendar year in accordance with the applicable statutory rules.

Customer accounts. Account data are kept while the account remains active. An account may be deleted after three years without a login, order or other account activity. Where reasonably practicable, we will inform the customer before deletion. We will also delete an account following a valid deletion request, unless particular information must be retained separately because of an open transaction, statutory retention obligation or legal claim. Data retained for these purposes are separated from the active account and their use is restricted accordingly.

Returns, complaints, warranty and support. Records concerning an order, return, complaint or warranty claim are retained until the matter has been resolved and generally for six years from the end of the calendar year in which the relevant correspondence was received or sent. General customer-service inquiries unrelated to a purchase are normally deleted 12 months after the inquiry has been concluded. Records may be retained for longer where necessary for an unresolved dispute or legal claim.

Payments, refunds and chargebacks. Payment and refund records held by IVKO Retail are retained for the applicable transaction, accounting and legal-claim periods, generally for up to eight years where they constitute accounting records. Information concerning an unresolved payment dispute or chargeback is retained until the matter has been finally resolved and the applicable limitation periods have expired. Payment providers acting under their own responsibility determine their respective retention periods in accordance with their legal and regulatory obligations.

Technical and security logs. Routine web-server access and security logs are generally deleted or anonymised after seven days. Application and technical error logs may be retained for up to 30 days where necessary for troubleshooting, system security or misuse prevention. Relevant log information may be retained for longer where a specific security incident or legal matter has been identified.

Marketing, consent and objections. Marketing data are processed until the applicable consent is withdrawn, the customer objects or the relevant marketing purpose otherwise ends. We may retain evidence of consent and a minimal suppression-list entry for as long as necessary to demonstrate compliance and ensure that an objection or withdrawal continues to be respected.

Cookies. The storage periods applicable to individual cookies and similar technologies are stated in the cookie-settings interface and Cookie Policy.

7. Security

How do we protect your personal data?

IVKO Retail uses risk-appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

Measures include role-based access controls, authentication and multi-factor authentication where appropriate, confidentiality obligations, encryption in transit, system and security logging, backup and recovery, patch and vulnerability management, network and environment separation, vendor due diligence, incident-response procedures and staff awareness measures.

Processors and subprocessors must provide appropriate security, confidentiality, assistance, deletion or return and audit commitments through written agreements. Access is limited to personnel who need the data for authorised duties.

No Internet transmission or information system can be guaranteed to be completely secure. This statement does not limit any statutory responsibility of IVKO Retail.

8. Recipients, processors and international transfers

Who receives your personal data and where are they processed?

IVKO Retail and authorised personnel. Personal data are accessible only to personnel who need them for the purposes described in this policy and who are subject to appropriate confidentiality and access obligations.

Ivković d.o.o. - processor in Serbia. Ivković d.o.o., 8. marta 23, 11307 Boleč-Belgrade, Serbia, processes personal data on IVKO Retail's documented instructions for Site and platform maintenance, back-office operations, customer support and administration of IVKO Retail's Navision environment.

SHE Trading GmbH - fulfilment processor. SHE Trading GmbH receives only the data required to coordinate allocation, fulfilment and returns on IVKO Retail's instructions. It may retain limited goods-level, aggregate or order-reference information as a separate controller where strictly necessary for its own B2B accounting, tax or legal obligations.

Finecom Logistics GmbH - authorised subprocessor. Finecom Logistics GmbH, Otto-Brindl-Straße 1, 94447 Plattling, Germany, acts within the fulfilment chain for warehousing, pick & pack, DHL/UPS handover, returns receipt and physical inspection. Finecom receives only the data necessary for those activities.

Technology, hosting and support providers.

IVKO Retail uses specialised service providers to operate and maintain its information systems and online shop. These providers process personal data only on IVKO Retail’s documented instructions and only to the extent necessary to provide their contracted services.

The principal technology providers include:

• NPS d.o.o., Serbia, for maintenance and technical support of IVKO Retail’s Microsoft Dynamics NAV business-management system;

• Nordnet d.o.o. Serbia, develops and maintains the technical infrastructure of IVKO Retail’s CMS and online shop and provides technical support on IVKO Retail’s documented instructions. As part of its technical services, Nordnet d.o.o. uses an authorised hosting subprocessor to host the CMS and online-shop infrastructure on servers located in Germany. Nordnet d.o.o. and its hosting subprocessor may access personal data only to the extent necessary to maintain, secure and troubleshoot these systems.

• Mainstream d.o.o., Serbia, for database and server-hosting services for Microsoft Dynamics NAV business-management system and Ivko API;

• Radiant Tap Aleksandar Vacić PR, Serbia, for development and maintenance of the IVKO API.

Depending on their function, these providers may have limited access to customer, account, order, delivery, payment-status, support and technical-log data. Access is restricted to authorised personnel and governed by confidentiality, security and data-processing obligations.

IVKO’s consent mechanism is internally developed. No separate external consent-management provider receives personal data for this function.

Analytics and advertising providers. Subject to the visitor's consent, the Site currently uses Google Analytics and Google Ads technologies provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. These technologies may process the visitor's IP address, cookie or similar identifiers, consent status, device and browser information, page and referral information and interactions with the Site. Depending on the page and customer journey, Meta events may include PageView or website visit, ViewContent, AddToCart, InitiateCheckout and Purchase or payment-completion events; not every event is transmitted in every situation. Where configured, Google or Meta events may also contain product identifiers, order value, currency or transaction information. IVKO Retail uses Google Analytics to measure Site use and uses Google Ads and the Meta Pixel to measure campaign performance, attribute conversions, create marketing audiences and display or limit advertising. The legal basis for optional storage or access on the visitor's device is consent under section 25(1) TDDDG, and the legal basis for the related processing of personal data is Article 6(1)(a) GDPR. Consent may be withdrawn at any time through Cookie Settings.

Google Consent Mode. The Site uses Google Consent Mode to communicate the consent choices recorded by IVKO's internal consent mechanism to Google tags. Consent Mode does not itself replace the requirement for consent. Its production configuration determines whether Google tags are blocked until consent or whether limited consent-status and cookieless technical pings are transmitted before consent. The mode and related technologies actually used are described in the Cookie Policy.

Provider roles and international transfers. Google and Meta process data under the contractual role applicable to each service and may also process certain information under their own responsibility, as explained in their respective privacy notices. Where personal data are made accessible outside the EEA, the applicable safeguards may include an adequacy decision, including the EU-US Data Privacy Framework where the relevant recipient is certified, or the European Commission's Standard Contractual Clauses together with supplementary measures where required. Further information is available in the Cookie Policy and in the Google Privacy Policy and Meta Privacy Policy.

Newsletter provider. IVKO Retail uses Mailchimp, a service of The Rocket Science Group LLC d/b/a Mailchimp, United States, to manage newsletter subscriptions and distribute newsletters. Mailchimp may receive the recipient's name, e-mail address, subscription and consent status, message-routing and delivery data and, where the relevant tracking is enabled and legally permitted, information about newsletter opens, link clicks and other campaign interactions. To the extent Mailchimp processes newsletter data on IVKO Retail's documented instructions, it acts as a processor under its data-processing addendum. Where personal data are transferred to the United States, the applicable safeguard is the EU-US Data Privacy Framework where the relevant recipient is certified, with the European Commission's Standard Contractual Clauses applying as provided in Mailchimp's data-processing addendum where required.

Where a provider or authorised support team processes personal data in Serbia or another country outside the EEA, IVKO Retail applies an appropriate transfer mechanism under Chapter V GDPR, normally the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required.

Payment processing.

IVKO Retail uses Computop Paygate GmbH as the technical payment gateway for the online shop. Computop securely transmits the information required to initiate and process a payment to the payment provider selected by the customer. Computop does not itself provide all payment methods offered in the online shop.

Depending on the selected payment method, payment and transaction data are transmitted through Computop to:

• European Merchant Services B.V., operating under the name Fiserv, for card acquiring and the processing of credit and debit card payments;

• Klarna Bank AB (publ), Sweden, for direct debit, instalment payments and payment within 30 days; or

• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, for payments made using PayPal.

The information transmitted may include the customer’s name, contact and billing details, order number, transaction amount, currency, selected payment method, payment status and technical transaction data. Card, bank-account or authentication information may also be collected directly by the relevant payment provider or through secure payment fields provided for that purpose.

The processing is necessary to initiate and execute the payment selected by the customer and to perform the purchase contract under Article 6(1)(b) GDPR. The payment providers may process personal data under their own responsibility for payment execution, authentication, fraud prevention, risk and creditworthiness assessments, compliance with anti-money-laundering and other legal requirements, dispute handling and the enforcement of claims. Their respective privacy notices provide further information about this processing.

Personal data are transmitted only to the provider relevant to the payment method selected by the customer. Where a provider or one of its subprocessors processes data outside the EEA, the provider applies the transfer mechanism and safeguards described in its contractual documentation and privacy notice.

Carriers. DHL and, exceptionally, UPS receive delivery contact, parcel and tracking data. They may act as independent controllers for transport operations they determine under applicable law.

Professional and public recipients. Accountants, auditors, legal advisers, insurers, courts, tax authorities, supervisory authorities and other competent bodies may receive data where necessary for professional services, legal obligations or claims.

System locations. The CMS and online-platform infrastructure is hosted on servers located in Germany through Nordnet d.o.o.'s authorised hosting subprocessor. B2C invoices and sales records are issued and stored in IVKO Retail's Microsoft Dynamics NAV environment. Database and server-hosting services for the NAV environment and IVKO API are provided in Serbia by Mainstream d.o.o., and the authorised Serbian providers and support personnel described above may have limited remote access for their respective contracted functions.

Transfers to Serbia. Because Serbia is outside the EEA and is not covered by an EU adequacy decision, transfers and authorised remote access involving Ivković d.o.o., NPS d.o.o., Nordnet d.o.o., Mainstream d.o.o., Radiant Tap Aleksandar Vacić PR and any authorised Serbian support personnel are protected by the applicable 2021 European Commission Standard Contractual Clauses, using the module appropriate to the relevant contractual chain, together with a transfer-impact assessment and supplementary technical and organisational measures where required.

Other transfers outside the EEA. If another provider processes data outside the EEA, we use an adequacy decision or another lawful safeguard, normally Standard Contractual Clauses, together with supplementary measures where required. You may request information about the applicable safeguards at privacy@ivko.com; commercially sensitive terms may be redacted.

We do not sell personal data and do not disclose customer data to third parties for their own marketing.

9. Required and optional data; automated decisions

Which data are required, and do we use automated decision-making?

Required data. Fields marked as required during checkout or account creation are needed to take requested pre-contractual steps, conclude and perform the contract, deliver the goods, collect payment or comply with legal obligations. If you do not provide them, we may be unable to create the account, accept the order or provide the requested service.

Optional data. Marketing consent, optional cookies, surveys and non-essential profile information are voluntary. Refusing or withdrawing them does not prevent you from making a purchase.

Automated decision-making and payment checks. IVKO Retail does not use automated decision-making to accept or reject customer orders and does not perform automated fraud scoring. Orders may be reviewed manually as part of normal order administration.

The selected payment provider may independently perform payment authentication, fraud-prevention, risk or creditworthiness checks and may approve or decline the selected payment method. In particular, Klarna may assess a customer’s eligibility for its payment products. Card payments may be authorised or declined by the relevant acquirer, card network or card-issuing bank, while PayPal applies its own payment-security and risk procedures. These providers perform such processing under their own responsibility and provide further information, including information about applicable review and objection rights, in their respective privacy notices.

Computop Paygate GmbH acts as the technical gateway transmitting the payment request and the provider’s response between the IVKO online shop and the selected payment provider.

10. Third-party elements and links

Does the Site contain third-party elements?

Embedded and linked third-party services. The Site uses Sizebay to provide optional size recommendations, the DHL Location Finder to allow customers to locate and select a DHL pickup point, and YouTube to display embedded video content.

Sizebay is activated only after the visitor gives the applicable functional consent or actively requests the size-recommendation service. Information entered into the sizing tool, together with relevant product, device and usage information, may be transmitted to Sizebay for the purpose of generating the requested size recommendation.

The DHL Location Finder is activated when a customer chooses to search for a DHL pickup point. Search information, such as the entered address, postcode or location, together with technical connection information, may be transmitted to DHL to display available pickup points and record the customer’s selection.

Embedded YouTube content is blocked until the visitor gives the applicable consent. Once activated, the YouTube player may transmit technical and usage information, including the visitor’s IP address, device and browser information, the page visited and interaction with the video, to Google/YouTube. Where available, IVKO uses YouTube’s privacy-enhanced embedding mode.

The Site also contains ordinary links to IVKO’s Facebook and Instagram pages. No information is transmitted to Facebook or Instagram merely because these links are displayed, provided that no external social-media plugin or content is loaded. When a visitor clicks a link, the visitor is redirected to the relevant platform, whose own privacy terms apply.

11. Data-subject rights, contact and complaints

What rights do you have and how can you exercise them?

Subject to the conditions in applicable law, you may request access to and a copy of your personal data, rectification, erasure, restriction, and data portability; object to processing based on legitimate interests; object at any time to direct marketing; withdraw consent for the future; and exercise rights concerning qualifying solely automated decisions.

Contact. Send requests to privacy@ivko.com or by post to IVKO Retail GmbH, Nederlinger Str. 4, 80638 Munich, Germany. You may also use service@ivko.com.

We may request information necessary to identify the relevant records and, where we have reasonable doubts about identity, proportionate proof of identity. We normally respond within one month, subject to the extensions and limitations permitted by law. Requests are normally free of charge; manifestly unfounded or excessive requests may be handled as permitted by Article 12 GDPR.

Complaint. You may lodge a complaint with a competent supervisory authority, including the authority in the EU Member State of your habitual residence, place of work or the alleged infringement. IVKO Retail's competent German supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de, www.lda.bayern.de.

Appendix 1 contains a more detailed summary of these rights.

12. Changes to the policy

Can we change this Privacy Policy?

We may update this Privacy Policy to reflect changes in processing, providers, technology or law. The current version and its effective date will be published on the Site.

If a change materially affects your rights or reasonably requires your attention, we will provide an appropriate additional notice, for example on the Site, in the account or by e-mail where appropriate. If new processing requires consent, we will request consent before starting that processing. Changes do not retrospectively make earlier unlawful processing lawful.

Effective date: [insert after approval].

13. Appendix 1 - Data-subject rights

Right of access. You may obtain confirmation whether we process personal data concerning you and, where applicable, access to the data and the information required by Article 15 GDPR. The rights and freedoms of others remain protected. Additional copies may be subject to a reasonable administrative fee where legally permitted.

Right to rectification. You may request correction of inaccurate personal data and completion of incomplete data, taking account of the purposes of processing.

Right to erasure. You may request erasure where a ground under Article 17 GDPR applies. The right does not apply where processing remains necessary, for example, for a legal obligation or the establishment, exercise or defence of legal claims.

Right to restriction. You may request restriction in the circumstances specified by Article 18 GDPR. Restricted data are, apart from storage, processed only on a permitted basis.

Right to data portability. Where processing is based on consent or contract and carried out by automated means, you may receive personal data you provided in a structured, commonly used and machine-readable format and, where technically feasible, request direct transmission to another controller, provided this does not adversely affect others' rights.

Right to object to legitimate-interest processing. You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. We will stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims.

Unconditional objection to direct marketing. You may object at any time and free of charge to processing for direct marketing, including related profiling. We will then stop such processing.

Right to withdraw consent. You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Rights concerning automated decisions. Where Article 22 GDPR applies, you may have the right not to be subject to a qualifying decision based solely on automated processing and, where an exception applies, to obtain safeguards such as human intervention, an opportunity to express your view and to contest the decision.

Right to complain. You may complain to a competent data-protection authority without prejudice to any other administrative or judicial remedy.

How to exercise your rights. Contact privacy@ivko.com or IVKO Retail GmbH at the address stated above. Please describe the request and the account, order or contact details needed to locate the data. Evidence of identity is requested only where reasonably necessary.

Fees and refusal. Requests are normally free. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act as permitted by Article 12 GDPR and explain our decision.

Cookie Policy

Content

• Overview of key elements in this document. Does this Site use cookies?

• What are cookies?

• What types of cookies does the Site use and what are they for?

• How can you control, delete or withdraw your consent to the use of cookies?

• How can we make changes to our Cookie Policy?

• What are my rights in relation to the processing of my personal data?

• How to contact us?

Overview of key elements in this document. Does this Site use cookies?

Yes, the Site uses cookies and similar technologies.

This Cookie Policy applies to www.ivko.com, de.ivko.com, eu.ivko.com and their associated online-shop and language versions (together, the "Site"). It explains how IVKO Retail uses cookies and similar technologies and supplements the Privacy Policy available through the Site footer.

Controller. IVKO Retail GmbH, Nederlinger Str. 4, 80638 Munich, Germany, is responsible for the use of these technologies and the related processing of personal data, except where a third-party provider acts as a separate controller for its own processing activities.

Consent mechanism. The Site uses an internally developed consent mechanism to record and apply visitors' cookie choices. The mechanism remembers the selected settings and controls the activation of optional technologies.

Strictly necessary technologies may be used without consent only where the applicable statutory exception applies. Functional, preference, statistics, marketing, advertising and external-media technologies are activated only after the relevant consent, unless a specific technology is strictly necessary to provide a digital service expressly requested by the visitor.

Consent is voluntary. Visitors may reject optional technologies, select individual categories and withdraw or change their choices at any time through Cookie Settings. Refusing or withdrawing consent does not prevent the use of essential online-shop functions, although certain optional features may then be unavailable.

What are cookies?

Cookies are small text files stored in a browser or device. Session cookies normally expire when the browser session ends; persistent cookies remain until their stated expiry or until they are deleted. First-party cookies are set for the domain being visited, while third-party technologies originate from another provider.

This Policy also covers local storage, IndexedDB, pixels, tags, server requests, embedded content and comparable technologies that store or read information on a device or transmit technical, consent, usage or advertising events.

Cookies and similar technologies may process online identifiers, IP address, device and browser information, page and referral information, interactions and consent status. Where configured for analytics or advertising, events may also contain product identifiers, order value, currency or transaction information.

The use of these technologies is governed by the rules protecting terminal equipment and, where personal data are processed, by the GDPR.

What types of cookies does the Site use and what are they for?

Categories, consent and legal bases

Strictly necessary technologies. These are used only where their sole purpose is transmission of a communication or where they are strictly necessary to provide a digital service expressly requested by the visitor, such as maintaining a session, basket, checkout or consent choice. Device storage or access is based on section 25(2) TDDDG. Where personal data are subsequently processed, the applicable basis may be Article 6(1)(b), (c) or (f) GDPR, depending on the purpose.

Functional and preference technologies. These remember choices or provide an optional feature, such as language, Sizebay size recommendation or a location finder. Unless a technology is strictly necessary at the moment the visitor expressly requests the feature, it is used only with consent.

Statistics technologies. These measure visits, pages, interactions, devices and campaign results so that IVKO Retail can understand and improve the Site. They are optional.

Marketing and advertising technologies. These measure advertising, attribute conversions, create or use audiences and support relevant advertising. Embedded external media may also place or read identifiers. These technologies are optional.

For optional device storage or access, the legal basis is consent under section 25(1) TDDDG. Where personal data are processed, the legal basis is Article 6(1)(a) GDPR. Optional categories are off by default, and refusing them is as easy as accepting them.

Services and recipients

IVKO shop and consent mechanism. The Site uses session, language, display and consent records. The consent records remember and support proof of the visitor's choice. They are created by IVKO's internally developed mechanism and do not themselves activate optional providers.

Google Analytics and Google Ads. Subject to consent, the Site uses Google Analytics and Google Ads technologies provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics measures how the Site is used. Google Ads and related Google/DoubleClick technologies measure advertising and conversions, support campaign attribution and may create or use advertising audiences. Google tags may process IP address, cookie or similar identifiers, consent status, device and browser information, page and referral information, interactions and, depending on the configuration and relevant customer journey, product identifiers, order value, currency and transaction information.

Google Consent Mode. The internally developed consent mechanism communicates the visitor's choices to Google tags and regulates tag behaviour. Consent Mode does not obtain consent and does not make optional processing necessary. Depending on the technical configuration, Google tags may either remain blocked until consent or load with consent defaults set to denied and send cookieless consent and measurement signals. Analytics or advertising cookies and full measurement data are activated only after the relevant consent.

Meta Pixel. Subject to marketing consent, the Site uses the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Depending on the page and customer journey, events may include PageView or website visit, ViewContent, AddToCart, InitiateCheckout and Purchase or payment completion; not every event is transmitted in every situation. Where configured, an event may contain product identifiers, order value, currency or transaction information. IVKO Retail uses these events to measure campaign performance, attribute conversions, create marketing audiences and display or limit advertising.

Sizebay size recommendation. Sizebay supports the selection and display of clothing sizes on product pages. Depending on use, it may process session and product identifiers, language, technical data, interactions and information voluntarily entered into the tool, such as height, weight, age, gender or measurements. The service is loaded only after functional consent or after the visitor deliberately requests the size-recommendation feature and receives the relevant information.

DHL Location Finder. The checkout may offer a DHL location finder so that the customer can search for and select a DHL pickup point. When deliberately opened, the service may receive IP address, browser and device data, search or location information and the selected pickup point. Technology strictly necessary to provide this expressly requested selection may be used for that purpose; any optional DHL analytics or marketing technology requires separate consent.

Embedded YouTube content. The Site embeds video through YouTube's privacy-enhanced domain, youtube-nocookie.com. Loading or playing the video may nevertheless transmit IP address, device and browser data, page information, identifiers and interaction data to Google/YouTube. The video and related storage remain blocked until external-media or marketing consent is given, or until the visitor deliberately activates the content after receiving the relevant information.

Facebook and Instagram links. Ordinary links to IVKO's Facebook and Instagram pages do not by themselves place Meta cookies on the Site. If a visitor follows a link, Meta processes data on its own service. The Meta Pixel described above is a separate marketing technology used on the Site and requires marketing consent.

Mailchimp newsletter tracking. IVKO Retail uses Mailchimp for newsletters. Mailchimp may use tracking pixels and redirect links in e-mails to record delivery, opening and link interactions. These e-mail technologies are not necessarily Site cookies, but campaign links may interact with the Site's consented analytics or advertising technologies. Further information is provided in the Privacy Policy.

Checkout and payment services. Computop connects the online shop with EMS for card processing, Klarna for the available direct-debit, instalment and pay-later methods, and PayPal. When the customer selects a payment method, technology strictly necessary to authenticate, secure and complete that requested payment may be used. Optional analytics or marketing technology of any payment provider requires separate consent.

Detailed technology inventory

The technologies currently identified on the Site are listed below. Because website functions, providers and technical configurations may change, IVKO Retail reviews and updates this inventory after material changes.

Strictly necessary

Functional and preferences

Statistics

Marketing, advertising and external media

Provider roles and international data transfers

Google Ireland Limited and Meta Platforms Ireland Limited receive data for their respective services and may act as processors or independent controllers depending on the processing operation. Further information about their roles is provided in the Privacy Policy and applicable provider documentation.

Some providers may process data outside the European Economic Area, particularly in the United States. Where the recipient is covered by the European Commission's EU-US Data Privacy Framework adequacy decision, the transfer may rely on that decision. Otherwise, IVKO Retail uses an applicable transfer mechanism, normally the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required.

Mailchimp, Sizebay, Google/YouTube and Meta may involve access or processing in the United States. Depending on the recipient and processing operation, transfers rely on the EU-US Data Privacy Framework or another applicable safeguard, such as the European Commission's Standard Contractual Clauses and supplementary measures where required.

Technical processors. Nordnet and its German hosting subprocessors, Mainstream d.o.o. Serbia, NPS, Radiant Tap and other authorised technical-support providers may have limited service access as described in the Privacy Policy and processing agreements. That access does not by itself make them cookie providers; this Cookie Policy identifies providers that set, read or receive information through the technologies described above.

Provider information

• Google privacy policy

• Google Consent Mode

• Meta privacy policy

• Mailchimp privacy information

• Sizebay privacy information

• DHL data protection information

How can you control, delete or withdraw your consent to the use of cookies?

Cookie Settings. The consent interface allows visitors to accept all optional technologies, continue with strictly necessary technologies only, or select functional, statistics and marketing, advertising or external-media categories separately. Optional categories remain off until the visitor makes an affirmative choice.

A permanently accessible Cookie Settings link or privacy icon allows a visitor to change or withdraw a choice at any time with effect for the future. Withdrawing consent is as easy as giving it. Withdrawal prevents future optional storage and processing but does not affect processing that was lawful before withdrawal.

Browser controls. Visitors may also delete or block cookies and site data through browser settings. Browser deletion may reset the stored consent choice and cause the banner to appear again. Browser settings do not replace the Site's consent and withdrawal controls.

Consequences of refusal. Refusing optional technologies does not prevent essential browsing, basket and checkout functions. Sizebay, embedded YouTube content, optional location-finder functionality, analytics or personalised advertising may be unavailable or limited.

How can we make changes to our Cookie Policy?

We may update this Cookie Policy when technologies, providers, purposes, durations, consent settings or legal requirements change. The current version and its update date will be published on the Site.

Where a change materially affects the scope of an existing consent, the changed optional processing will not begin until the visitor receives the relevant information and makes a new consent choice.

What are my rights in relation to the processing of my personal data?

Where cookies or similar technologies involve personal data, visitors may exercise the rights explained in the Privacy Policy, including access, rectification, erasure, restriction, objection, data portability where applicable, withdrawal of consent and complaint to a competent supervisory authority.

The statutory conditions and limitations apply. Withdrawal of consent affects future processing only and does not affect processing that was lawful before withdrawal.

How to contact us?

For questions about this Cookie Policy or to exercise data-protection rights, contact IVKO Retail GmbH at privacy@ivko.com or write to IVKO Retail GmbH, Nederlinger Str. 4, 80638 Munich, Germany.

IVKO Retail is not required to appoint a data protection officer. The privacy contact above handles data-protection enquiries.

We may request information reasonably necessary to locate the relevant records and, where we have reasonable doubts about identity, proportionate proof of identity.

Requests are normally handled free of charge. If a request is manifestly unfounded or excessive, particularly because of repetition, we may charge a reasonable fee or refuse to act as permitted by Article 12 GDPR and will explain the decision.

Visitors may lodge a complaint with a competent data-protection supervisory authority. IVKO Retail's competent German authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany; poststelle@lda.bayern.de; www.lda.bayern.de.