✓ Free shipping from €150✓ Firearms shipping flat rate €15✓ Pay in instalments or by invoice with easyCredit
Help & contact Workshop service DE | EN
Sign in Wish list €0.00 0
Home

Privacy Policy

Here you will find the privacy policy of X-⁠Hunter. Find out how your data is handled, about data protection and about the use and deactivation of cookies.

Privacy Policy

This English translation is provided for your convenience. Only the German version is legally binding.

Privacy Policy

1. Controller and contact

The controller responsible for the processing of personal data is Marcus Tetzner, trading as X-HUNTER, Satower Weg 9a, 24357 Fleckeby, Germany. Telephone: +49 (0) 4354 2430257. E-mail: kontakt@x-hunter.de.

This policy relates to our online shop at x-hunter.de. The processing operations described here are decisive; the mere fact that a third-party website is linked does not mean that all services on that website are already executed when you visit our shop.

2. Your rights

Subject to the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent at any time with effect for the future; the lawfulness of the processing carried out before the withdrawal remains unaffected. To exercise your rights, you may use the contact details given above. A customer account is not required for this.

Objection: Where processing is based on Art. 6(1)(f) GDPR, you may object to it on grounds relating to your particular situation. Further processing is then only permitted under the conditions of Art. 21(1) GDPR. You may object at any time, without giving specific reasons, to the processing of your data for direct marketing purposes, including profiling related to such marketing; the data may then no longer be processed for these purposes.

You may lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement. The competent authority for Schleswig-Holstein is the Independent Centre for Privacy Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein): https://www.datenschutzzentrum.de/.

3. Hosting, page access and security

The shop is operated with ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The hosting provider processes the shop data required for provision of the shop on its server systems. Information from the provider: https://all-inkl.com/datenschutzinformationen/.

When a page is accessed, the following are processed in particular: IP address, time of access, requested address, technical browser and connection information and, where applicable, error and access logs. This serves to deliver the pages, to analyse errors and to protect against misuse. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the secure and functional operation of the shop. The technical transmission of this connection data is necessary in order to use the website.

The connection to the shop is HTTPS-encrypted. This protects the transmission; it does not constitute a promise of complete protection of all end devices and communication channels under all circumstances.

Fonts are loaded from our own server; no connection to Google Fonts takes place.

4. Cookies and privacy settings

The shop uses its own cookies for the shopping basket, login, language and for storing your privacy choices. Where access to your end device is strictly necessary for a service you have expressly requested, Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) applies. Depending on the purpose, personal data is processed on the basis of Art. 6(1)(b), (c) or (f) GDPR.

Your privacy choices are stored by the X-Hunter Consentmanager operated on our server. No external consent platform provider is required for this. The selected categories and the time of the selection are stored. The configured lifetime of this choice cookie is 365 days. A lifetime of 480 hours, corresponding to 20 days, is set for the PrestaShop front-end cookie; renewed use may extend this lifetime. The lifetime of a cookie must be distinguished from the retention of contract or account data in the database.

Under Section 25(1) TDDDG, prior consent is generally required for storing or reading information on your end device that is not strictly necessary. Where optional processing is based on your consent, Art. 6(1)(a) GDPR applies. You can change or withdraw your choices via the privacy settings in the page footer. You can also delete cookies in your browser; this may cause the stored choices to be lost, in which case you will be asked for them again.

5. Contact and WhatsApp

If you contact us via the contact form, by e-mail or by telephone, we process the contact and content data you provide in order to handle your enquiry. For contractual or pre-contractual enquiries, Art. 6(1)(b) GDPR applies; for other enquiries, Art. 6(1)(f) GDPR applies on the basis of our interest in responding to your request. Mandatory fields of a form are required for the form to be processed; any additional information is voluntary.

Via the WhatsApp links in our shop (for example in the page footer), you can use the service of WhatsApp Ireland Limited. Only opening the link takes you to this external communication service. If you subsequently contact us, we process the telephone number, profile and message data you transmit in order to handle your request, on the legal bases stated above. The use of WhatsApp is voluntary; e-mail and telephone are available as alternatives.

In addition, WhatsApp processes connection and usage data under its own responsibility, where applicable with the involvement of group companies and service providers outside the European Economic Area. Information on recipients, bases for transfer, retention and data subject rights is contained in the provider's privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea. If, at our request, you send us proof of age or proof of purchase authorisation via WhatsApp, this will also be processed by WhatsApp; alternatively, you can send the documents by e-mail (see section 7).

6. Customer account, order and contract performance

For a customer account and when an order is placed, we process in particular names, contact details, your date of birth (mandatory, as we offer age-restricted goods and are required to verify your age), billing and delivery address, order items, payment method, payment and shipping status and the related communication. The processing serves the customer account and the initiation or performance of the contract (Art. 6(1)(b) GDPR). Invoice data and other data subject to statutory retention obligations are also processed pursuant to Art. 6(1)(c) GDPR. Art. 6(1)(f) GDPR may apply to the prevention of misuse and to the enforcement or defence of specific claims.

The information required for an order is necessary so that the contract can be performed. If it is not provided, an order or delivery is not possible. A permanent customer account is not required for the guest checkout offered. Deleting the account does not remove any independently existing statutory retention obligations.

You can create wish lists in your customer account. If you send a wish list to another person, we use the e-mail address you enter solely for sending it.

Newsletter

If you subscribe to our newsletter, we use your e-mail address to send you information about offers, new products and promotions. Subscription takes place using the double opt-in procedure: your address is only activated for mailing once you click the link in our confirmation e-mail. As proof of your consent, we store the time of subscription and of confirmation as well as the IP address used in the process. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR; for the proof of consent, Art. 6(1)(c) GDPR.

To send the newsletter, we use CleverReach, a service of CleverReach GmbH & Co. KG, Schafjückenweg 2, 26180 Rastede, Germany. CleverReach processes the data on our behalf on servers in the European Union; we have concluded a data processing agreement with CleverReach pursuant to Art. 28 GDPR. We do not evaluate whether a newsletter is opened or which links in it are clicked. Further information: https://www.cleverreach.com/de-de/datenschutz/.

You can unsubscribe from the newsletter at any time, via the unsubscribe link in every issue or by e-mail to kontakt@x-hunter.de. We will then remove your address from the mailing list. We keep the proof of your earlier consent for as long as this is necessary for the defence against possible claims (Art. 6(1)(f) GDPR).

Notification of availability

If you ask to be notified about an item that is currently unavailable, we store your e-mail address (or your customer account, if you are logged in), the item and the time of your consent. As soon as the item is available again, you will receive a one-off e-mail; the entry is then deleted. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time, for example by e-mail or in your customer account under “My alerts”.

Product reviews

Customers who have bought an item from us can review it in our shop. For this purpose we process the star rating, the text, the date and the link to your customer account and your order (so that we can verify that the review comes from a buyer). Only your first name, the initial of your last name, the date and your review are displayed publicly. We only publish reviews you send us by e-mail or telephone with your consent. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting the review and can withdraw at any time – we will then delete your review. Reviews appear immediately; we may remove them afterwards if they are unlawful, offensive or unrelated to the item, and correct obvious errors, but we do not change their meaning. They remain stored until you request deletion or the item is removed from our range.

7. Proof of age and proof of purchase authorisation

For goods subject to statutory restrictions, only the identity, age and authorisation data necessary for the respective required verification and documentation may be processed. This may include relevant information from permit documents and, for transactions subject to a reporting obligation, the required register data. The legal basis is Art. 6(1)(c) GDPR in conjunction with the applicable statutory verification and documentation obligations; where necessary, Art. 6(1)(b) GDPR may additionally apply.

If mandatory proof is missing, no unlawful transfer of the goods may take place. For items subject to purchase requirements, we will ask you after your order to send us a copy or photo of your permit (for example firearms ownership licence (WBK) or hunting licence) and of your identity document and, where applicable, your National Firearms Register (NWR) identifiers by e-mail or WhatsApp. You may black out information on the copy of your identity document that is not needed for the check (for example photo, access and serial number); we need your name, date of birth, address and validity. We use the documents exclusively to verify and document your purchase authorisation and keep them only for as long as statutory documentation and retention obligations, in particular under the German Weapons Act, require; they are then deleted. Competent authorities may be recipients of the required information within the scope of statutory obligations.

8. Payments

For bank transfers, we process the payment amount, payment reference, account holder data and the transaction data required for allocation, for the purpose of payment reconciliation. The legal basis is Art. 6(1)(b) GDPR and, for statutory documentation obligations, additionally point (c).

If you choose an easyCredit payment product offered, TeamBank AG Nürnberg, Beuthener Straße 25, 90471 Nürnberg, is involved. The identity, contact, order and transaction data required for the requested payment processing are processed for the initiation and performance of this payment method (Art. 6(1)(b) GDPR). The payment provider may make approval dependent on an identity and credit check. It processes the relevant data under its own responsibility; its product-specific notices explain in particular the credit reference agencies used, automated checks and rights. Data protection contact and further information: https://www.easycredit.de/datenschutz.

A refusal of an optional payment method does not remove your rights vis-à-vis the payment provider. Where a decision based solely on automated processing within the meaning of Art. 22 GDPR is made, the conditions and safeguards provided for therein apply. PayPal and credit card payments are currently not offered in this shop.

9. Delivery and other recipients

For shipping, we mainly use DHL (Deutsche Post AG or DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn) and DPD (DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg) and, in individual cases – for example for larger consignments or deliveries to other EU countries – also GLS (GLS Germany GmbH & Co. OHG, GLS-Germany-Straße 1–7, 36286 Neuenstein) or Hermes (Hermes Germany GmbH, Essener Straße 89, 22419 Hamburg). The carrier commissioned in each case receives the recipient and address data necessary for delivery. For cash on delivery shipments, DHL additionally receives the amount to be collected. We only pass on your e-mail address or telephone number to the shipping service provider if you have consented to this (Art. 6(1)(a) GDPR), for example for a delivery notification, or insofar as this is necessary for the specific delivery. Where an identity or age check is required, the information and proofs of delivery necessary for this purpose may be added. The legal bases are Art. 6(1)(b) and, where applicable, (c) GDPR. Additional data not required by law may not be passed on merely because it is technically available.

Some of our items are shipped directly to you by our suppliers and wholesalers on our behalf (drop shipping). For this purpose, we transmit to the respective supplier the data necessary for delivery (name, delivery address, items ordered and order reference); the supplier in turn commissions a shipping service provider for this. An order may therefore reach you in several parcels from different senders. The legal basis is Art. 6(1)(b) GDPR.

Other recipients may be commissioned IT service providers, bodies involved in accounting, advisers bound by professional secrecy and competent authorities under the law, insofar as this is necessary for the respective purpose and legally permissible. Processing on behalf of a controller that is bound by instructions is subject to Art. 28 GDPR. This does not mean that every payment or transport provider acting as an independent controller is a processor.

10. External content and links

Product descriptions contain embedded YouTube videos. When a video is activated, a connection is established to the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In this process, data arises in particular on IP address, browser and device, the page accessed and video usage. If you have an existing Google account, it may be possible to link this data to your account. Optional activation takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR and, insofar as information is stored on or read from your end device, Section 25(1) TDDDG. Information, including details of international transfers and storage periods: https://policies.google.com/privacy?hl=de.

Review invitation by e-mail

If you voluntarily consent to receiving a review invitation when placing your order, we will send you a one-off e-mail about six days after your order has been completed, asking you to review the items you bought in our shop or to review us on Google or Trustpilot. For this purpose we use your name, your e-mail address and the details of your order. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, via the unsubscribe link in the e-mail or by e-mail to kontakt@x-hunter.de. After you unsubscribe, we only store your e-mail address so that you do not receive any further invitations. If you review us on Google or Trustpilot via the links, the respective provider processes your data under its own responsibility (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for Trustpilot see the following section). We do not transfer any data to Google for these links.

Reviews via Trustpilot

We work with Trustpilot A/S, Pilestræde 58, 5th floor, 1112 Copenhagen K, Denmark. If, when placing your order, you voluntarily consent to receiving a review invitation, we transmit your name, your e-mail address and the order reference to Trustpilot after the order has been completed, so that Trustpilot can send you an invitation to review your purchase. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. Without consent, no data is transmitted. You can withdraw your consent at any time with effect for the future, for example by e-mail to kontakt@x-hunter.de or via the unsubscribe link in the invitation.

Trustpilot review widgets are only loaded on our pages after you have given your consent in the privacy settings. In this process, connection data such as IP address and browser information may be transmitted to Trustpilot (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Provider information: https://legal.trustpilot.com/for-reviewers/end-user-privacy-terms.

Links to social networks, catalogues and other third-party websites only lead to the respective target page when opened. The respective provider is responsible for the processing carried out there.

Login with Google, Facebook or Amazon

You may optionally log in or register using an existing account with one of the following providers, insofar as the respective button is offered on our login page:

You are only redirected to the respective provider when you click on that provider's button; no connection to these providers is established during a normal page visit. After your confirmation with the provider, we receive your user ID with that provider, your name and your e-mail address, where applicable including its verification status, in order to create your customer account or log you in. We do not request any further data (such as friends lists, posts or orders with the provider). We store the link (provider, ID, e-mail address, display name, time), but no access tokens. The legal basis is Art. 6(1)(b) GDPR and, additionally, point (f) on the basis of our interest in a simple and secure login. You can disconnect the link in your customer account at any time. The providers process the login data under their own responsibility, where applicable also in the USA.

11. International data transfers

In the case of the external communication and media services mentioned, data may be processed outside the European Economic Area. Such transfers are only permitted under the conditions of Art. 44 et seq. GDPR, for example on the basis of an applicable adequacy decision or appropriate safeguards. An adequacy decision for certified companies does not apply across the board to every recipient in a country. This concerns in particular Google (YouTube videos, login with Google), Meta (WhatsApp, login with Facebook) and Amazon (login with Amazon); Google LLC, Meta Platforms, Inc. and Amazon.com Services LLC are certified under the EU-US Data Privacy Framework. Provider-specific information can be found in the information linked above. You can request information on the safeguards applicable to our processing via kontakt@x-hunter.de.

12. Storage period and right to erasure

The permissible duration of storage is determined by the specific purpose of processing and the applicable retention obligations. Account data serves the duration of the account relationship; contract data serves contract performance and the necessary provision of evidence. For contact enquiries, the decisive factors are the final handling of the enquiry and, where applicable, any contractual or legal claims arising from it. Security logs may only be kept for as long as is necessary for the specific purpose of security and error analysis.

For documents subject to retention obligations under tax or commercial law, the following periods apply in particular, depending on their classification: ten years for books and comparable records, eight years for accounting vouchers and six years for commercial or business letters. The period generally begins at the end of the relevant calendar year. Statutory extensions, for example in the case of tax proceedings that are still relevant, as well as separate documentation obligations must still be observed. Not every item of information in a customer account is subject to these periods.

In the case of electronic withdrawal, the name, confirmation address, contract details, any voluntary additional information, time of receipt and confirmation status are stored in order to process the declaration and to provide evidence of it. The legal bases are Art. 6(1)(b) and (c) GDPR and, for any necessary legal defence, point (f). Whether the data continues to be retained depends on its classification as contractual correspondence and, where applicable, on specific cases requiring evidence or disputes.

If a purpose of processing ceases to apply and there is no other legal basis, the statutory obligation to erase applies. An obligation to retain individual records does not permit any further use of this data for any other purposes. You can request information on the classification and storage period of your specific data, as well as a review of your request for erasure or restriction, using the contact details given above.

Print this page