Data Protection Declaration

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. On the following pages, we inform you about the handling of your personal data when using our website. Personal data is all data with which you can be personally identified.

1.2 The controller in charge of data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is Hoopomania GmbH, Käthe-Paulus-Str. 1, 85092 Kösching, Germany, e-mail: support@hula-hoop-shop.eu. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

2) Data Collection When You Visit Our Website

2.1 When using our website for information only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data that is technically necessary for us to display the website to you:

Our visited website
Date and time at the moment of access
Amount of data sent in bytes
Source/reference from which you came to the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

Data processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or used in any other way. However, we reserve the right to check the server log files subsequently, if there are any concrete indications of illegal use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller). You can recognize an encrypted connection by the character string https:// and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

3.1 Hosting by STRATO

We use STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, to provide and operate this website. Connection and server-log data, in particular IP address, time, requested content, referrer, browser and operating system, are processed to provide the website securely and reliably on the basis of Article 6(1)(f) GDPR. STRATO and, where access is actually required, the recipient categories of data-centre, infrastructure, maintenance, support and backup providers may receive these data. Data are deleted when they are no longer required for these purposes and no statutory retention duty or legal claim requires further storage.

3.2 Cloudflare

We use a content delivery network offered by the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) point f GDPR. We have concluded an order processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorised disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

3.3 KeyCDN

We use a content delivery network offered by the following provider: proinity GmbH, Rümikerstrasse 60, 8409 Winterthur, Switzerland

In case of data transfer to the provider's location, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

4) Cookies

In order to make your visit to our website more attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your end device. In some cases, these cookies are automatically deleted again after the browser is closed (so-called "session cookies"), in other cases, these cookies remain on your end device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case, you can find the duration of the storage in the overview of the cookie settings of your web browser.

If personal data is also processed by individual cookies set by us, the processing is carried out either in accordance with Art. 6 (1) point b GDPR for the performance of the contract, in accordance with Art. 6 (1) point a GDPR in the case of consent given or in accordance with Art. 6 (1) point f GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

You can set your browser in such a way that you are informed about the setting of cookies and you can decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general.

Please note that the functionality of our website may be limited if cookies are not accepted.

5) Contacting Us

When you contact us (e.g. via contact form or e-mail), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration.

The legal basis for processing data is our legitimate interest in responding to your request in accordance with Art. 6 (1) point f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b GDPR. Your data will be deleted after final processing of your enquiry; this is the case if it can be inferred from the circumstances that the facts in question have been finally clarified, provided there are no legal storage obligations to the contrary.

6) Data Processing When Opening a Customer Account and for Contract Processing

Pursuant to Art. 6 (1) point b GDPR, personal data will continue to be collected and processed to the extent required in each case if you provide us with this data when opening a customer account. The data required for opening an account can be found in the input mask of the corresponding form on our website. Deletion of your customer account is possible at any time and can be done by sending a message to the above address of the person responsible. After deletion of your customer account, your data will be deleted, provided that all contracts concluded via it have been fully processed, no legal retention periods are opposed and no legitimate interest on our part in the continued storage exists.

7) Processing of Data for Order Handling

7.1 General order handling

We disclose personal data to transport companies, payment institutions and other service providers only to the extent necessary to perform the contract (Article 6(1)(b) GDPR) or to fulfil statutory information duties (Article 6(1)(c) GDPR).

7.2 Amazon Fulfilment (FBA)

For order processing we use Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg. Names, addresses and other necessary order data are transmitted only to the extent required to process the order, on the basis of Article 6(1)(b) GDPR.

7.3 JTL

For order processing we use JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven, Germany. Necessary order data are processed on the basis of Article 6(1)(b) GDPR.

7.4 Shipping providers

For delivery we use DHL Paket GmbH, DPD Deutschland GmbH and General Logistics Systems Germany GmbH & Co. OHG. The recipient name and delivery address are transmitted as required under Article 6(1)(b) GDPR. An e-mail address or telephone number is transmitted for delivery announcements only where the customer has consented under Article 6(1)(a) GDPR; consent may be withdrawn for the future.

7.5 Payment services

Depending on the payment method selected, necessary payment and order data are transmitted to Apple Distribution International (Apple Pay), Bancontact Payconiq Company, Billie GmbH, PSA Payment Services Austria GmbH (EPS), Gini GmbH, Currence Holding BV (iDEAL), Klarna Bank AB, Mollie B.V., PayPal (Europe) S.à r.l. et Cie, S.C.A., Riverty GmbH or SOFORT/Klarna. Processing is carried out primarily to perform the payment contract under Article 6(1)(b) GDPR. Where a provider grants credit or bears a payment-default risk, identity and creditworthiness data may additionally be processed on the basis of Article 6(1)(f) GDPR. The privacy information of the selected provider also applies.

7.6 Electronic withdrawal function for distance contracts

Consumers with a statutory right of withdrawal may submit their declaration through the electronic withdrawal function on this website. The solution is provided by Andreas Hörmann / css-umsetzung, Düsseldorfer Str. 49, 10707 Berlin, Germany. Contract-identification data, first and last name and e-mail address are processed to confirm receipt and transmit the declaration to us. The provider processes the data on the basis of Article 6(1)(f) GDPR; we subsequently process them under Article 6(1)(b) and (c) GDPR. The data are deleted after final handling unless statutory retention duties apply.

8) Online Marketing

8.1 Own Affiliate Program
In connection with the product presentations on our website, we maintain our own affiliate program. In this framework we provide interested third party operators with partner links to be placed on their websites leading to our offers. Cookies are used for the affiliate program, which are generally set on the partner page after clicking on a corresponding partner link and for which we are not responsible according to privacy law. Cookies are small text files that are stored on your end device to enable us to trace the origin of transactions (e.g., "sales leads") generated via such links. In doing so, we can recognize, among other things, that you have clicked on the partner link and have been redirected to our website. This information is required for payment processing between us and the affiliate partners. If this information also contains personal data, the described processing is carried out on the basis of our legitimate financial interest in the processing of commission payments pursuant to Article 6(1)(f) GDPR.
If you wish to block the evaluation of user behavior via cookies, you can do so by setting your browser accordingly to be informed about the setting of cookies and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or generally.

9) Web Analytics Services

9.1 Google Analytics 4

After your consent, we use Google Analytics 4 of Google Ireland Limited to measure the use of our website. Technical usage, device, browser, page, referrer, campaign and conversion data may be processed. Storage or access on your device is based on section 25(1) TDDDG and personal-data processing on Article 6(1)(a) GDPR. Without consent the service is not loaded; consent may be withdrawn through the privacy settings.

9.2 Google Tag Manager

Google Tag Manager is used only after consent as the technical delivery system for configured Google and advertising tags. The manager itself does not replace the separate description and consent required for each service. Google Ireland Limited is the recipient; transfers may also involve Google LLC in the United States.

9.3 Matomo (self-hosted web analytics)

We use a Matomo installation hosted by us under our website domain to evaluate page views, interactions, searches, purchase-advisor use and e-commerce conversions and to improve the shop. Tracking requests are sent to our domain; no analytics-data transfer to InnoCraft Ltd. was identified.

Matomo processes pseudonymous usage and configuration identifiers, a truncated IP address, time, pages and actions, referrer and campaign information, browser, device, operating system, language, approximate location and conversion data. IP anonymisation is enabled; cross-site fingerprinting, account user IDs, cross-domain tracking, heatmaps, session recordings and A/B tests are not used in the verified configuration.

Matomo is loaded only after consent. It may then use first-party cookies or comparable browser storage. Section 25(1) TDDDG and Article 6(1)(a) GDPR apply. Consent may be withdrawn through the privacy settings; after withdrawal Matomo is not loaded on the next navigation. Raw visit data are deleted after 180 days; aggregated reports may be retained for long-term comparisons. Backup retention follows necessity for recovery/security and statutory duties.

9.4 PayPal Marketing Solutions

Where PayPal Marketing Solutions is used, PayPal may process technical usage and attribution data after consent in order to measure and optimise PayPal-related campaigns. Storage/access is based on section 25(1) TDDDG and processing on Article 6(1)(a) GDPR. Consent may be withdrawn through the privacy settings.

10) Advertising and Conversion Measurement

10.1 Microsoft Advertising

This website uses retargeting technology from the following provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA

This enables us to target visitors to our website with personalized, interest-related advertising who have already shown interest in our shop and our products. The advertising material is displayed based on a cookie-based analysis of previous and current user behavior; whereby no personal data is stored. In the cases of retargeting technology, a cookie is stored on your computer or mobile device to collect pseudonymized data about your interests and thus adapt the advertising individually to the stored information. These cookies are small text files that are stored on your computer or mobile device. You are thus shown advertising that is most likely to match your product and information interests.

All processing described above, in particular the setting of cookies for reading out information on the end device used, will only be carried out if you have given us your express consent to do so in accordance with Art. 6 (1) point a GDPR. Without this consent, retargeting technology will not be used during your visit to the website.

You can revoke your consent at any time with effect for the future. To exercise your revocation, please deactivate this service in the "cookie consent tool" provided on the website.

For the transfer of data to the USA, the provider relies on standard contractual clauses of the European Commission, which are meant to ensure compliance with the European level of data protection.

10.2 Google Ads Conversion Tracking

We use Google Ads conversion tracking, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The service helps us measure whether users who interacted with one of our Google advertisements subsequently complete a purchase and allows us to evaluate the effectiveness of our advertising campaigns.

Google tags are blocked on this website until you consent to the Google Ads/Tag Manager service in our Cookie Consent Tool. If you consent, Google Tag Manager and the configured Google Ads conversion tag are loaded. In this state, Google tags may read or write advertising-related cookies or comparable identifiers, in particular first-party click identifiers, and process technical and usage information. Depending on the interaction, this may include the IP address, browser and device information, page URL and referrer, advertising click identifiers, consent signals and conversion information such as the transaction identifier, currency and purchase value. We receive campaign and conversion statistics, but no information from Google that directly identifies you by name.

The storage of or access to information on your device is based on your consent pursuant to section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The associated processing of personal data is based on your consent pursuant to Article 6(1)(a) GDPR. Without your consent, Google Tag Manager and the Google Ads conversion tag are not loaded by this website.

The account-wide “Enhanced Conversions” feature and automatic detection of user-provided data by the Google Ads configuration are currently disabled. Accordingly, contact information entered in forms is currently not automatically detected or transmitted for Enhanced Conversions. The standard purchase conversion remains active and may, after you have given your consent, transmit the transaction identifier, currency and purchase value to Google. As long as processing for audience and remarketing purposes has not been fully disabled technically, data may also be processed for those purposes after you have given your consent.

The recipient of the data is Google Ireland Limited. Data may also be processed by Google LLC and other Google group companies outside the European Economic Area, including in the United States. Google LLC states that it is certified under the EU–US Data Privacy Framework; where required, Google also relies on the European Commission’s Standard Contractual Clauses. Further information is available in Google’s privacy policy and its information on legal frameworks for data transfers:

We process conversion information accessible to us only for as long as it is required to measure and evaluate our advertising campaigns or until you withdraw your consent, unless continued storage is required by law or is necessary for the establishment, exercise or defence of legal claims. Google determines the storage periods for data processed independently by Google in accordance with its own policies and the settings of the Google Ads service.

You can withdraw your consent at any time with effect for the future by deactivating the Google Ads/Tag Manager service in the Cookie Consent Tool. Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before withdrawal.

10.4 OpenAI conversion measurement for ChatGPT Ads

The OpenAI Measurement Pixel of OpenAI Ireland Limited is currently used only on German-language shop pages and is not loaded on this English-language page. On German pages, and only after marketing consent, it may measure page views, product, cart, checkout and purchase events, together with technical event, product, quantity, currency and net-value data. OpenAI may append the click reference oppref and store it in the first-party cookie __oppref.

Automatic Advanced Matching is currently enabled for this data source. On German pages the pixel may detect supported contact information in suitable form fields, normalise it and hash it with SHA-256 before transmission with conversion events. Purchase-advisor answers concerning personal characteristics, weight, pain or discomfort are not transmitted to OpenAI. Further information: OpenAI conversion measurement.

Purchase-advisor answers concerning gender or self-identification, age, height, weight, experience, pain, discomfort or pressure sensitivity are not transmitted to OpenAI. Measurement events are sent with the opt_out parameter and are therefore excluded from future user-related personalisation according to OpenAI documentation.

The pixel is not loaded before consent. Device storage or access is based on section 25(1) TDDDG and the associated processing of personal data on Article 6(1)(a) GDPR. Consent can be withdrawn with effect for the future through the privacy settings.

Hoopomania is responsible for collecting and transmitting measurement data. Where OpenAI processes data as “Restricted Processing” under the OpenAI Ad Tools Data Processing Addendum, OpenAI acts as processor; where OpenAI processes data for its own purposes under the applicable advertising and conversion terms, Hoopomania and OpenAI may each act as independent controllers. Click-through attribution is set to 30 days and view-through attribution, where available, to one day; these windows do not define the entire retention period.

Further information: Measurement Pixel, Conversion Tracking Terms, Data Processing Addendum and subprocessors.

11) Site Functionalities

11.1 YouTube

This website embeds videos provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Data may also be transferred to Google LLC in the United States.

Before you give your consent, the relevant video module displays only a locally provided HTML/CSS text placeholder. At this stage, no YouTube iframe is created and the video module does not establish a connection to servers operated by YouTube or Google.

When you select “Load video”, you are given information about the intended data processing and may separately consent to the loading of that specific video. The player is loaded from the domain youtube-nocookie.com only after you have given your express consent. Your browser then establishes connections to servers operated by YouTube and Google; depending on the content provided, resources may be retrieved not only from youtube-nocookie.com but in particular from fonts.gstatic.com, i.ytimg.com, jnn-pa.googleapis.com, www.google.com, www.gstatic.com and yt3.ggpht.com. In particular, your IP address, browser and device information, the page visited, and the date and time of access may be transmitted. Google may also use cookies or comparable technologies to provide the video, compile playback statistics, prevent misuse and, depending on your settings, pursue further purposes of its own. If you are signed in to a Google account, Google may associate the processed information with that account.

Google may store technical information in the local storage of the youtube-nocookie.com origin. In the tested integration, this included the entries ytidb::LAST_RESULT_ENTRY_KEY and yt-icons-last-purged. Such entries may remain after “Close video” is selected and after the page is reloaded. “Close video” removes the player from the page and ends the current embed, but it does not automatically delete information already stored by YouTube or Google.

Information is stored on or accessed from your device on the basis of your consent in accordance with section 25(1) TDDDG. The associated processing of personal data is based on your consent in accordance with Article 6(1)(a) GDPR. Activation of our video module applies only to the selected video and the current page view. While the video is embedded, you may withdraw consent at any time with effect for the future by selecting “Close video”; the player is then removed. After the page is reloaded, fresh consent is required before the player can be loaded again. Information already stored on the device is not automatically deleted as a result. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Google LLC participates in the EU-U.S. Data Privacy Framework. For transfers covered by that framework, the European Commission has recognised an adequate level of data protection. Further information is available in Google’s Privacy Policy.

11.2 Google Customer Reviews

If you expressly consent after a purchase, we transmit your e-mail address to Google Ireland Limited so that Google can invite you to rate your shopping experience. The legal basis is Article 6(1)(a) GDPR. Consent may be withdrawn from us or Google for the future. See Google Business Data Responsibility.

12) Tools and Miscellaneous

12.1 - DATEV

For the execution of the accounting, we use the service of the cloud-based accounting software of the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany

The provider processes incoming and outgoing invoices and, if applicable, also the bank transactions of our company in order to automatically record invoices, match them to the transactions and create the financial accounting from this in a semi-automated process.

Insofar as personal data is also processed in this context, the processing is carried out in accordance with Art. 6 (1) point f GDPR on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions.

12.2 This website uses a so-called "cookie consent tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The "cookie consent tool" is displayed to users in the form of an interactive user interface when they access the page, on which consent for certain cookies and/or cookie-based applications can be given by ticking the appropriate box.

Using the tool, all cookies/services requiring consent are only loaded if the respective user provides the corresponding consent by ticking the corresponding box. This ensures that such cookies are only set on the respective end device of the user if consent has been granted.

The tool sets technically necessary cookies to save your cookie preferences. Personal user data is generally not processed.
If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning or logging cookie settings, this is done in accordance with Article 6(1)(f) GDPR based on our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.
Further legal basis for the processing is Art. 6 (1) point c GDPR. As the responsible party, we are subject to the legal obligation to make the use of technically unnecessary cookies dependent on the respective user consent.
Further information on the operator and the setting options of the cookie consent tool can be found directly in the corresponding user interface on our website.

12.3 Cloudflare security service

Cloudflare, Inc. protects the website against unauthorised access, attacks, malware and abuse. IP addresses, requested URLs and header information may be compared with known risk indicators and blocked. Processing is based on Article 6(1)(f) GDPR. Cloudflare states that it participates in the EU–US Data Privacy Framework.

12.4 Quality analysis of the Hula Hoop purchase advisor

When you use the purchase advisor, we process selected answers, the advisory path, subsequent changes, abandonment points and resulting recommendations to review, reproduce and improve the advisory logic. If a single body weight is entered, the integer kilogram value within the input range of 45 to 120 kg is processed with the completed advisory path; alternatively a weight group may be selected. Information about pain or discomfort is converted only into a neutral technical signal for a more cautious recommendation and is not stored as a health-related raw statement.

The analysis is not linked to a customer account, order, e-mail address or newsletter profile and uses no persistent cross-device or cross-session identifier. Assignment in raw data is retained for no more than 90 days. Internal review cases are retained for no more than 180 days or until 30 days after the review ends, whichever is earlier.

For long-term statistics, only monthly frequency per kilogram value without account, order, person or session reference is retained; values are shown individually only from five cases onward. Purchase-advisor data are not used for advertising and are not transmitted to Google, Microsoft or OpenAI. Processing is based on Article 6(1)(f) GDPR; you may object for reasons arising from your particular situation.

13) Rights of the Data Subject

13.1 The applicable data protection law grants you the following comprehensive rights of data subjects (rights of information and intervention) vis-à-vis the data controller with regard to the processing of your personal data:

Right of access by the data subject pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure (“right to be forgotten”) pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to be informed pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw a given consent pursuant to Art. 7 (3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

13.2 RIGHT TO OBJECT

IF, WITHIN THE FRAMEWORK OF A CONSIDERATION OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR PREDOMINANT LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON THE GROUNDS THAT ARISE FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN PROVE COMPELLING REASONS WORTHY OF PROTECTION FOR PROCESSING WHICH OUTWEIGH YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA WHICH ARE USED FOR DIRECT MARKETING PURPOSES. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT ADVERTISING PURPOSES.

14) Duration of Storage of Personal Data

The duration of the storage of personal data is based on the respective legal basis, the purpose of processing and - if relevant – on the respective legal retention period (e.g. commercial and tax retention periods).

If personal data is processed on the basis of express consent pursuant to Art. 6 (1) point a GDPR, this data is stored until the data subject revokes his consent.

If there are legal storage periods for data that is processed within the framework of legal or similar obligations on the basis of Art. 6 (1) point b GDPR, this data will be routinely deleted after expiry of the storage periods if it is no longer necessary for the fulfillment of the contract or the initiation of the contract and/or if we no longer have a justified interest in further storage.

When processing personal data on the basis of Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection in accordance with Art. 21 (1) GDPR, unless we can provide compelling grounds for processing worthy of protection which outweigh the interests, rights and freedoms of the data subject, or the processing serves to assert, exercise or defend legal claims.

If personal data is processed for the purpose of direct marketing based on Art. 6 (1) point f GDPR, this data is stored until the data subject exercises his right of objection pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the information contained in this declaration on specific processing situations, stored personal data will be deleted if it is no longer necessary for the purposes for which it was collected or otherwise processed.

Last update code: 59876513