Privacy Policy

1. Data Controller

ApexMP
Owner: Robin Draco
8 Falkenweg
53343 Wachtberg
Germany
Email: info@apexmp.de

2. Collection and Storage of Personal Data, and the Nature and Purpose of Its Use

a) When visiting the website
When you visit our website, the browser on your device automatically sends information to our website’s server. This information is temporarily stored in a log file. The following information is collected automatically without any action on your part and stored until it is automatically deleted:

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the retrieved file
  • Website from which the request originates (referrer URL)
  • the browser you are using and, if applicable, your computer's operating system, as well as the name of your Internet service provider

We process the data listed above for the following purposes:

  • Ensuring that the website loads smoothly
  • Ensuring a comfortable user experience on our website
  • Evaluation of System Security and Stability
  • for other administrative purposes

The legal basis for data processing is Article 6(1), first sentence, subparagraph (f) of the GDPR.

b) When registering in the online store
Registration is required to use our online store. In the process, we collect the following personal data:

  • First Name, Last Name
  • Address
  • Email address
  • Payment Information (when placing an order)
  • Password

This information is necessary to create a customer account for you and to manage your orders. Accounts are automatically deleted after 4 years of inactivity. The data is processed in accordance with Article 6(1), first sentence, point (b) of the GDPR for the purpose of fulfilling the contractual relationship.

3. Disclosure of Data

Your personal data will only be disclosed to third parties if:

  • You have given your explicit consent pursuant to Article 6(1), first sentence, subparagraph (a) of the GDPR
  • the disclosure is necessary under Article 6(1), first sentence, subparagraph (b) of the GDPR for the performance of contractual relationships with you, for example, payment processing via PayPal
  • there is a legal obligation to disclose the data pursuant to Article 6(1), first sentence, subparagraph (c) of the GDPR
  • the disclosure is necessary pursuant to Article 6(1), first sentence, subparagraph (f) of the GDPR for the establishment, exercise, or defense of legal claims
4. Cookies and Similar Technologies

We use cookies and similar technologies that store or retrieve information on your device, such as in your browser's local storage. When you visit our site for the first time, we'll ask you via our cookie banner which of these you'd like to allow.

a) Strictly necessary cookies. We use these without your consent because the online store cannot function without them (Section 25(2)(2) TDDDG). The legal basis for the associated processing is Article 6(1), sentence 1, subparagraph (b) of the GDPR, insofar as it relates to your order; otherwise, it is Article 6(1), sentence 1, subparagraph (f) of the GDPR.

  • Shopping Cart and Session (woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_…): until the end of the session, up to 2 days
  • Your selection in the cookie banner (apexmp_cookie_consent): 180 days
  • Your language selection when you change languages (apexmp_lang): 30 days
  • Cookies from our payment service providers to prevent fraud during the payment process (see Section 6)

b) Optional cookies and services. We only use statistics and advertising performance tracking (Section 5) if you select „Accept All“ in the cookie banner. Until then, the associated scripts are not loaded at all. The legal basis is your consent (Section 25(1) TDDDG, Article 6(1), sentence 1, letter a of the GDPR).

c) Revocation. You may withdraw your consent at any time, effective for the future, by clicking at the bottom of the page „"Cookie Settings"“ Click on it and select „Essential Only.“ The lawfulness of any processing that has taken place up to that point remains unaffected.

5. Statistics and Advertising Performance Measurement (only with consent)

a) Google Ads conversion tracking. We run ads on Google and use Google Ads conversion tracking for this purpose, integrated via the „Google for WooCommerce“ extension. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This allows us to determine whether someone made a purchase from us after clicking on one of our ads, and it enables Google to display our ads in a more targeted manner, including as personalized ads. In particular, the following data is processed: your IP address, information about your browser and device, the pages you visited, a click ID from the ad, and—in the case of a purchase—the order value and order number. Google uses cookies (e.g., _gcl_au) for this purpose, which remain active for up to 90 days. Google may also process data in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework, and the European Commission has issued an adequacy decision for this data transfer (Art. 45 GDPR). For more information: https://policies.google.com/privacy

b) Jetpack Statistics and WooCommerce Analytics. For visitor statistics, we use the analytics features of Jetpack and WooCommerce Analytics. The provider is Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. This allows us to see which pages and products are viewed, where visitors come from, and how they navigate through the shopping cart and checkout process. In particular, we process your IP address, information about your browser and device, the pages you visit, the page you came from, the times of your visits, and your actions within the store. Automattic Inc. is certified under the EU-US Data Privacy Framework. For more information: https://automattic.com/privacy/

c) Order assignment. WooCommerce stores information in short-lived cookies (sbjs_…) about how you found us—for example, through a search engine, an ad, or a link on another website. If you place an order, this information is stored in our store along with your order. We retain this data and do not share it with third parties. The cookies expire no later than 30 minutes after your last page view.

6. Payment Service Providers

We work with the following service providers to process payments. They receive the data necessary for the payment, such as your name, address, email address, order amount, and payment details. The legal basis is Article 6(1), sentence 1, letter b of the GDPR. Fraud prevention is based on our legitimate interest in secure payments (Art. 6(1)(1)(f) of the GDPR, § 25(2)(2) of the TDDDG).

a) Card, Apple Pay, and Google Pay via WooPayments (Automattic Inc.), processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. To ensure that Express Checkout and fraud detection work properly, the Stripe payment script loads on product pages, in the shopping cart, and at checkout, and in doing so collects your IP address as well as information about your browser and device. Stripe is certified under the EU-US Data Privacy Framework. For more information: https://stripe.com/de/privacy

b) PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. To protect payment forms from automated abuse, the PayPal integration uses Google reCAPTCHA (Google Ireland Limited; see Section 5 for the address). In doing so, your IP address and information about your usage behavior are transmitted to Google. For more information: https://www.paypal.com/de/legalhub/privacy-full

7. AI Chat Assistant

On our website, you can use an AI-powered chat assistant that answers questions about our products, fitment, shipping, and payment. Use of this feature is optional. Data is not processed until you open the chat and send a message. Please do not enter any personal information such as your name, address, email address, or order number in the chat. For questions about an order, please use our contact form.

Data Processed: the text of your messages and replies, the URL of the page where you are using the chat, and a pseudonymous identifier calculated from your IP address as a non-reversible hash value. The IP address itself is not stored for this purpose.

Purpose: To answer your questions and protect the service from abuse, for example by limiting the number of requests and temporarily suspending accounts in cases of abuse.

Recipient: To generate the responses, we forward your message, the chat history to date, and, if applicable, the name of the product currently displayed to Anthropic’s AI service, Claude. Our contractual partner is Anthropic Ireland, Limited, Dublin, Ireland. Anthropic processes the data as a data processor based on a data processing agreement pursuant to Article 28 of the GDPR and is not permitted to use it to train its AI models. The request is made by our server; your IP address is not transmitted to Anthropic in the process. Data may also be processed in the United States. This transfer is safeguarded by the EU Standard Contractual Clauses, which form an integral part of the data processing agreement. For more information, please see Anthropic’s Privacy Policy: https://www.anthropic.com/legal/privacy

Retention period: The chat history is stored on our server for a maximum of 2 hours so that the assistant can understand the context. For quality assurance and to prevent abuse, we log the conversations (messages, page, time, and pseudonymous identifier) and automatically delete them after 30 days. Counters for limiting the number of requests expire after one day at the latest; a block due to abuse expires after 7 days.

Storage in your browser: During a conversation, your browser stores the chat history and a random conversation ID in sessionStorage. Both are deleted as soon as you close the tab. If an account is suspended due to misuse, the suspension period is stored in localStorage. This storage is absolutely necessary for the chat feature you are using (Section 25(2)(2) of the TDDDG).

Legal basis: Art. 6(1), sentence 1, subparagraph (b) of the GDPR, to the extent that your inquiry is for the purpose of preparing a purchase; otherwise, Art. 6(1), sentence 1, subparagraph (f) of the GDPR. Our legitimate interest lies in responding quickly to customer inquiries and in protecting the service from misuse.

The assistant's responses are generated automatically, may contain errors, and are not binding. For binding information, please use our contact form or send an email to info@apexmp.de.

8. Your Rights

You have the right to:

  • to request information about your personal data that we process, in accordance with Article 15 of the GDPR
  • in accordance with Article 16 of the GDPR, to request without delay the correction of inaccurate personal data or the completion of your personal data stored by us
  • to request the erasure of your personal data stored by us in accordance with Article 17 of the GDPR
9. Right to Object

If your personal data is processed on the basis of legitimate interests pursuant to Article 6(1), first sentence, subparagraph (f) of the GDPR, you have the right to object to the processing of your personal data.

10. Current Status and Changes to This Privacy Policy

This Privacy Policy is currently in effect and is dated October 2026. As our website evolves or due to changes in legal requirements, it may become necessary to amend this Privacy Policy.