Version: August 2026 — This is a non-binding convenience translation. Only the German version of this privacy policy is legally binding.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
STA Trading
Owner: Sener Kirli
Westuferstr. 25
45356 Essen
Germany
Phone: +49 201 84362510
E-mail: info@statrading.de
VAT ID: DE353055316

A data protection officer is not required by law in our case. For questions regarding data protection, please use the contact details above.

2. General information on data processing

We process personal data of our users only to the extent necessary to provide a functional website and our content and services. Processing generally takes place only with the user’s consent or where a legal basis permits it.

The relevant legal bases are in particular: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest).

Personal data is deleted or blocked as soon as the purpose of storage ceases to apply. Storage beyond this takes place where statutory retention periods exist, in particular commercial and tax law periods of six or ten years (Section 257 HGB, Section 147 AO).

3. Hosting and server log files

Our website is hosted by an external service provider (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus). Personal data collected on this website is stored on the host’s servers.

Each time our website is accessed, the system automatically collects the following data:

• IP address of the requesting device
• date and time of access
• name and URL of the file accessed
• volume of data transferred and notification of successful retrieval
• browser type and version and operating system used
• referrer URL

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical provision, stability and security of our website. Log files are deleted after 30 days at the latest, unless required to investigate a specific security incident. A data processing agreement pursuant to Art. 28 GDPR exists with the host.

4. Cookies and consent management

Our website uses cookies and comparable technologies. Technically necessary cookies required for the operation of the shop, the shopping basket and the ordering process are used on the basis of Art. 6(1)(f) GDPR and Section 25(2) TTDSG.

All non-essential cookies and technologies — in particular statistics and marketing services — are loaded exclusively after your express consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG. We use the consent management tool Complianz to manage these consents. Complianz stores your consent decision locally in your browser; no transmission to third parties takes place.

You may withdraw or change your consent at any time with effect for the future by opening the cookie settings again via the corresponding link on our website. A detailed overview of all cookies used can be found in our Cookie Policy.

5. Customer account and business customer area

You may create a customer account in our shop. We process the data you provide (name, address, e-mail address, telephone number where applicable, company name and VAT ID). The legal basis is Art. 6(1)(b) GDPR.

For commercial customers we offer a business customer area (B2B) with separate prices and conditions. For activation we additionally process information on the company and its commercial activity as well as any evidence thereof. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in verifying entrepreneur status pursuant to Art. 6(1)(f) GDPR.

You may have your customer account deleted at any time. Statutory retention periods for order and invoice data remain unaffected.

6. Order processing in the online shop

To process your order we handle the data you provide during the order process, in particular name, delivery and billing address, e-mail address, telephone number, ordered items and payment and shipping information. The shop runs on WooCommerce; the data is stored in our website database.

The legal basis is Art. 6(1)(b) GDPR. Where we retain data to fulfil tax and commercial obligations, this is based on Art. 6(1)(c) GDPR.

For delivery we pass on your address data and — where necessary for shipment tracking — your e-mail address or telephone number to the commissioned shipping company or freight forwarder.

7. Payment service providers

Depending on the payment method selected, we pass on the data required for payment processing to the respective payment service provider. The legal basis is Art. 6(1)(b) GDPR.

PayPal

When paying via PayPal or PayPal Express, your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. PayPal is an independent controller for the processing carried out there.

Credit and debit cards, Apple Pay, Google Pay and other payment methods

Card, wallet and local payment methods — including credit and debit cards, Apple Pay, Google Pay, iDEAL, Bancontact, EPS, Przelewy24, Blik, Trustly, MyBank and Multibanco — are processed via the PayPal Commerce Platform. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. We do not store your complete card or account details; these are entered directly with PayPal.

Purchase on account (Pay upon Invoice)

For purchase on account via PayPal, payment processing is carried out by PayPal together with Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin, Germany. This involves an identity and credit check; for this purpose your data is transmitted to Ratepay and, where applicable, to credit agencies. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR based on our legitimate interest in securing against the risk of payment default. Further information can be found in the privacy notices of PayPal and Ratepay.

Advance payment by bank transfer

If you pay in advance, we only process the information resulting from the incoming payment to our bank account.

8. Contact and contact form

If you contact us by e-mail, telephone or via our contact form (WPForms), we process your information in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry serves the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.

We use WP Mail SMTP to send system and order e-mails. We delete your enquiries once they have been conclusively processed and no statutory retention obligations apply.

9. Web analytics

Google Analytics

We use Google Analytics 4 (integrated via the MonsterInsights plugin), a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Use takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG. Without your consent the corresponding scripts are not loaded. Data — including IP addresses in truncated form — may be transferred to Google servers, possibly in the USA. The transfer is based on standard contractual clauses and/or the EU-US Data Privacy Framework.

Google Site Kit

To evaluate the visibility of our website we use Google Site Kit, which combines data from Google Search Console and Google Analytics. The provider is likewise Google Ireland Limited. Where consent-requiring technologies are used, this only takes place after your consent.

WooCommerce Analytics

We use WooCommerce Analytics to evaluate shop metrics (e.g. revenue, orders, product performance). The evaluation is largely based on data already stored for order processing. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the economic evaluation and improvement of our offering.

10. Advertising and reach measurement

Google Ads and Google Merchant Center

We transmit product data to the Google Merchant Center and use Google Ads to promote our products and measure the success of advertising campaigns (plugin: Google for WooCommerce, provider: Google Ireland Limited). Conversion and remarketing technologies may be used in this context.

These technologies are loaded exclusively after your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG.

Pinterest

We use Pinterest for WooCommerce (provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland). The Pinterest tag may be used to measure user interactions and display advertising. Use takes place exclusively after your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TTDSG.

11. Recipients, processing on our behalf and third-country transfers

Your data is only passed on where this is necessary for the performance of the contract, where you have consented, or where a legal obligation exists. Recipients are in particular hosting and IT service providers, payment service providers, shipping companies and freight forwarders, tax advisors and — subject to consent — analytics and advertising service providers.

We have concluded data processing agreements pursuant to Art. 28 GDPR with service providers who process data on our behalf. Where data is transferred to countries outside the EU or EEA, this is based on an adequacy decision, standard contractual clauses pursuant to Art. 46 GDPR, or your express consent.

12. Your rights as a data subject

You have the following rights with regard to personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

An informal message to the contact details given above is sufficient to exercise your rights.

13. Right to object

Where we process your personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation. If your data is processed for direct marketing purposes, you have the right to object at any time without giving reasons.

14. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

15. Data security

Within the website visit we use the common SSL/TLS procedure in conjunction with the highest level of encryption supported by your browser. You can recognise whether an individual page is transmitted in encrypted form by the padlock symbol in your browser’s address bar. In addition, we take appropriate technical and organisational measures to protect your data against accidental or intentional manipulation, loss, destruction or unauthorised access.

16. Validity and amendment of this privacy policy

This privacy policy is currently valid and dated August 2026. Further development of our website and offerings, or changes to legal or regulatory requirements, may make it necessary to amend this privacy policy.