Privacy Policy
1. Introduction
Baketoolset respects the privacy of visitors and customers who use www.baketoolset.com. This Privacy Policy explains how personal data is collected, used, disclosed, retained and handled when you browse our website, enquire about our products, place an order or contact our customer service team.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable German data protection legislation and other relevant laws governing the processing of personal data.
By providing personal data to us, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is required by law, we will request it separately. Your use of the website does not replace any consent required for optional data processing.
2. Data Controller and Contact Information
For the purposes of this Privacy Policy, Baketoolset is the brand under which the relevant online retail activities are conducted.
Brand: Baketoolset
Website: https://www.baketoolset.com
Email: order@baketoolset.com
The data controller is the legal person or natural person operating Baketoolset who determines the purposes and means of processing personal data.
The controller’s full legal name and postal address must be stated in the website’s legal notice and associated privacy information. Requests concerning personal data may be sent to order@baketoolset.com and will be directed to the responsible controller.
3. Personal Data We Collect
Depending on how you interact with our website, we may collect the following categories of personal data:
3.1 Information You Provide
This may include your name, email address, telephone number, billing address, delivery address and information submitted through customer service enquiries.
When you place an order, we may also process order references, the products purchased, quantities, order totals, payment status and related correspondence.
3.2 Payment-Related Information
Payments on Baketoolset are processed by Stripe, our payment processing provider.
Depending on the payment method selected, information required to process a transaction may include payment method details, billing information, transaction references, payment status and related verification information.
Payment card details are handled through Stripe’s payment services where applicable. We receive the transaction information needed to administer orders, reconcile payments and respond to payment-related enquiries.
3.3 Website Usage Information
When you visit our website, certain information may be collected automatically, depending on the website configuration and the services in use. This may include your IP address, browser type, device information, access timestamps, pages visited and technical request records.
This information is used where necessary to operate the website, identify errors, maintain website functionality and understand relevant usage patterns.
3.4 Cookies and Similar Technologies
Our website may use cookies and similar technologies to maintain essential website functions, remember relevant preferences and support other website features.
Where analytics, advertising or other non-essential cookies are used, they will be activated only where the required consent has been obtained. You may manage your choices through the website’s cookie settings, where available.
Further information about cookie categories, purposes and retention periods will be provided in our Cookie Policy.
4. Purposes and Legal Bases for Processing
We process personal data only where an applicable legal basis exists under Article 6 of the GDPR.
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling orders | Performance of a contract, Article 6(1)(b) |
| Responding to product and customer service enquiries | Contractual necessity or legitimate interests, depending on the enquiry |
| Processing payments through Stripe | Performance of a contract and, where applicable, compliance with legal obligations |
| Maintaining invoices, accounting records and tax documentation | Compliance with legal obligations, Article 6(1)(c) |
| Maintaining website functionality and investigating technical errors | Legitimate interests, Article 6(1)(f), where applicable |
| Handling complaints and establishing, exercising or defending legal claims | Legitimate interests and, where applicable, legal obligations |
| Optional analytics, advertising or non-essential cookies | Consent, where required by applicable law |
Where processing is based on legitimate interests, those interests may include administering our retail activities, maintaining appropriate business records, responding to enquiries and protecting our lawful interests, subject to your rights and freedoms.
Where consent is the legal basis, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5. Payment Processing by Stripe
Baketoolset uses Stripe to process customer payments.
When you proceed to checkout, relevant information may be transmitted to Stripe so that your payment can be processed. Depending on the payment method and transaction, this information may include your name, email address, billing details, order amount, transaction reference and payment method information.
Stripe processes personal data in accordance with its applicable contractual terms and Privacy Policy. Stripe acts as a processor when handling personal data on our behalf and may act as an independent controller for certain activities for which it determines its own purposes and means of processing, including applicable fraud monitoring and legal compliance activities.
Stripe may also share relevant information with financial institutions, payment method providers and other service providers involved in processing the transaction, where necessary.
For further information about Stripe’s handling of personal data, please consult the official Stripe Privacy Centre.
Baketoolset processes payment-related information for order administration, payment reconciliation, customer service and applicable record-keeping obligations.
6. Disclosure of Personal Data
We may disclose relevant personal data to the following categories of recipients where necessary and lawful:
- Stripe: for payment processing and associated transaction administration.
- Delivery and fulfilment providers: for preparing, dispatching and delivering customer orders.
- Website hosting and service providers: for hosting, maintaining and operating the website.
- Professional advisers: including accountants, auditors and legal advisers, where relevant.
- Public authorities and competent bodies: where disclosure is required by law or necessary for a lawful request.
- Other relevant parties: where disclosure is necessary to establish, exercise or defend legal claims.
We limit disclosures to information relevant to the applicable purpose. Where required by law, appropriate contractual arrangements will be maintained with service providers processing personal data on our behalf.
7. International Data Transfers
Some service providers involved in website operation or payment processing may process personal data outside the European Economic Area (EEA).
Where personal data is transferred to a country outside the EEA, we will rely on an applicable transfer mechanism under Chapter V of the GDPR, where required. Depending on the circumstances, this may include an adequacy decision adopted by the European Commission or appropriate safeguards such as Standard Contractual Clauses.
Information about relevant safeguards may be requested by contacting us at order@baketoolset.com.
The actual locations of processing and applicable transfer mechanisms depend on the service providers and services used for the relevant transaction.
8. Data Retention Periods
We retain personal data only for as long as necessary for the purposes for which it was collected, subject to applicable statutory retention requirements and the need to establish, exercise or defend legal claims.
The following periods describe our intended retention approach:
8.1 Order and Customer Records
Order information and related customer correspondence are generally retained for the duration necessary to administer the transaction, handle relevant enquiries and meet applicable contractual and legal requirements.
Where records are required for legal claims, they may be retained for the applicable limitation period or until the relevant proceedings have concluded, where necessary.
8.2 Invoices and Accounting Records
Invoices and accounting documents subject to German statutory retention requirements are generally retained for eight years, calculated from the end of the calendar year in which the relevant invoice was issued or received, as applicable under German law.
Accounting books, records and other documents subject to different statutory retention periods may need to be retained for ten years. Other business correspondence subject to statutory retention requirements may need to be retained for six years.
The applicable period depends on the category of record and the legal requirements governing it. Where a statutory extension or another lawful retention requirement applies, the relevant record will be retained for the required period.
8.3 Customer Service Enquiries
Enquiry records are generally retained for up to three years after the end of the calendar year in which the enquiry was concluded, where necessary for follow-up and the handling of potential legal claims. They may be deleted earlier where no further retention is necessary and no legal obligation applies.
8.4 Website Logs
Website access and operational logs are retained only for the period reasonably required for their stated purposes, subject to applicable legal obligations and any need to investigate relevant incidents.
The actual retention period depends on the type of log and the configuration of the services involved.
8.5 Cookies and Consent Records
Cookies and similar identifiers are retained according to their purpose and configured expiry period. Consent records may be retained for as long as reasonably necessary to document the consent given and demonstrate compliance with applicable requirements.
When a retention period expires, the relevant data will be deleted or anonymised, unless further retention is required or permitted by law.
9. Your Data Protection Rights
Subject to the conditions and exceptions provided by applicable law, you may have the right to:
- Request access to personal data concerning you.
- Request correction of inaccurate or incomplete personal data.
- Request erasure of personal data where the legal conditions are met.
- Request restriction of processing in applicable circumstances.
- Object to processing based on legitimate interests.
- Request data portability where the legal requirements are satisfied.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with the competent data protection supervisory authority.
To exercise your rights, please email order@baketoolset.com and describe your request. We may request information reasonably necessary to verify your identity before acting on the request.
We will respond within the time limits prescribed by applicable data protection law. Where the law permits an extension, we will inform you accordingly.
Requests are assessed individually. Certain information may need to be retained where a statutory obligation applies or where retention is necessary to establish, exercise or defend legal claims.
10. Data Protection Measures
We apply appropriate organisational and technical measures intended to protect personal data against unauthorised access, unlawful processing, accidental loss and damage.
Access to personal data is restricted according to relevant business requirements. Service providers handling personal data on our behalf are selected and engaged in accordance with applicable legal requirements.
No website or method of electronic transmission can be regarded as entirely free from risk. We therefore review our data-handling arrangements as appropriate to the nature of the information processed and the relevant risks.
11. Marketing Communications
We may send promotional emails only where a valid legal basis exists and any required consent has been obtained.
Where you have consented to receive marketing communications, you may withdraw that consent at any time by using the unsubscribe method provided in the message or by contacting order@baketoolset.com.
Where German law permits an existing-customer marketing exception, we will rely on it only if all applicable statutory conditions are satisfied.
Order confirmations, payment notifications and other messages necessary to administer a purchase are transactional communications rather than promotional emails.
12. Automated Processing
Payment processing providers may use automated systems for transaction verification, fraud monitoring or compliance with applicable legal requirements.
Baketoolset does not state that it independently makes decisions based solely on automated processing that produce legal effects concerning customers or similarly significantly affect them.
If such processing is introduced in the future and the requirements of Article 22 of the GDPR apply, the relevant information and safeguards will be provided in accordance with applicable law.
13. Children’s Personal Data
Our website is intended for general retail customers and is not directed specifically at children.
We do not knowingly seek to collect personal data from children where the collection would be unlawful. If we become aware that personal data has been collected unlawfully, we will assess the matter and take appropriate action in accordance with applicable law.
14. Changes to This Privacy Policy
We may update this Privacy Policy when our data-handling practices, website services or applicable legal requirements change.
The revised version will be published on this page with an updated revision date. Where applicable law requires additional notice or consent, we will take the required steps.