Data protection
Privacy Policy
1. General Information
This English version of the Privacy Policy is provided for information and transparency purposes only. The German version (Datenschutzerklärung) is the legally binding document. All references to statutory provisions (e.g. HGB, AO, UWG) refer to German law. In the event of any discrepancy between the English and German versions, the German version shall prevail.
Thank you for visiting our website! In this Privacy Policy, we explain how Memodo handles your personal data when you use our website or online shop – whether on a desktop, smartphone, or tablet.
Personal data means any information that can be used to directly or indirectly identify you, for example your IP address, contact details, or order information.
Here, we explain in a clear and understandable manner:
- on which legal basis we process data,
- what purposes we pursue, and
- what rights you have regarding your data.
If you have any questions about your data or about data processing at Memodo, you can contact us at any time – you will find the contact details in the next section.
To protect your data, we use SSL/TLS encryption for our online services. You can recognise an encrypted connection by the "https://" prefix and the padlock icon in your browser.
Unless stated otherwise below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide the data will have no consequences. This only applies insofar as no other indication is given in the following processing operations.
"Personal data" means any information relating to an identified or identifiable natural person.
2. Who We Are (Controller)
Memodo GmbH
Linprunstraße 16
80335 Munich
Germany
Email: info@memodo.de
Phone: +49 (0)89 904 101 500
Data Protection Officer:
Email: datenschutz@memodo.de
3. Visiting Our Website
Simply visiting our website automatically results in the anonymised collection of the following data on our server:
- Truncated IP address (last octet replaced by 0)
- Date and time of access
- Time zone of access
- Access status / HTTP status code
- Access method (GET, POST, etc.)
- Protocol type (HTTP/1.1, HTTP/2, etc.)
- Name and size of the files accessed
- Referring website (referrer URL)
- Web browser and operating system used (user agent)
- Type and number of pages accessed on our website
The aforementioned non-personal information is automatically collected through the ordinary operation of our internet services. This usage data is not merged with other personal data. Any identification of individuals based on this usage data is excluded.
We use the aforementioned data for the purpose of troubleshooting, generating statistics, and measuring website activity with the aim of improving the value of our services for you. This constitutes a legitimate interest, and the data processing is therefore justified pursuant to Art. 6(1)(f) GDPR.
The data is only collected for the duration of use; once the use has ended, the data is deleted without delay, but no later than seven days after collection.
4. Cookies and Cookie Management
What Are Cookies?
To make visiting our online services more attractive and to enable the use of certain features, we use so-called cookies on various pages. These are small text files that are stored on your device and serve to temporarily archive information. Your browser stores the cookies as soon as you visit our pages. If you are registered with us, cookies help us recognise your device (computer, tablet, or smartphone) the next time you visit our online services.
What Types of Cookies Do We Use?
Session Cookies:
Some of the cookies we use enable you to use our online services. If this cookie is disabled, access to our pages is not possible. The authentication cookie grants you access to the login area. Without this cookie, neither registration nor access to the login area is possible. These session cookies are automatically deleted after the browser session ends, i.e. after you close your browser.
Persistent Cookies:
Other cookies remain on your device and enable us or our partner companies to recognise your browser on your next visit. Persistent cookies are automatically deleted after a predetermined period, which may vary depending on the cookie.
Tracking and Analytics Cookies:
These cookies help us understand how visitors interact with our website by collecting and analysing information anonymously.
Legal Basis and Purposes
Most of the cookies we use do not store information that identifies you personally. Rather, through these cookies, we receive general and anonymised information about visitors, pages viewed, browsers, and operating systems used. We only capture the IP address in truncated form, so that individual identification and attribution is not possible.
In some cases, cookies serve to simplify the ordering process by storing settings (e.g. remembering the contents of a virtual shopping cart). Insofar as individual cookies we use also process personal data, such processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of the contract with you.
Insofar as we collect data via cookies beyond the performance of the contract, this is done on the basis of Art. 6(1)(f) GDPR, based on our legitimate interest in gaining insights for the optimisation of the functionality and content of our online services.
Cookie Management and Settings
You can configure your browser to inform you about the setting of cookies and to decide individually whether to accept them, or to exclude the acceptance of cookies for certain cases or in general. If cookies are disabled, access to our pages may not be possible or may be limited.
You can find information on how to manage cookies in the most common browsers at the following links:
Chrome Browser: Link
Internet Explorer: Link
Mozilla Firefox: Link
Safari: Link
CCM19 Cookie Consent Manager
We use the cookie consent management tool CCM19 by Papoo Software & Media GmbH (Germany) on our website. CCM19 enables you to grant or refuse your consent to the use of various cookies and tracking tools.
CCM19 itself does not collect any personal user data; it merely performs a technical check as to whether an accessing browser has already set a cookie. Your consent is stored locally in your browser. A data processing agreement is therefore not required.
You can adjust your cookie settings at any time via the cookie banner on our website.
Further information: https://www.ccm19.de/datenschutz/
5. Contact and Forms
Contact Form
When you use the contact form, we collect your personal data (name, email address, message text) only to the extent that you provide it. The data processing serves the purpose of establishing contact. By submitting your message, you consent to the processing of the data provided. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent.
You may withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of your consent prior to the withdrawal. We use your email address only to process your enquiry. Your data will subsequently be deleted, unless you have consented to further processing and use.
6. Customer Account and Order Processing
Customer Account
When you open a customer account, we collect your personal data to the extent specified therein. The data processing serves the purpose of improving your shopping experience and simplifying order processing.
Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of your consent prior to the withdrawal.
Your customer account will subsequently be deactivated. The deletion of your data is carried out in stages in accordance with our deletion and archiving policy:
- Data without statutory retention obligations (e.g. marketing consents, usage history): Immediate deletion
- Data relevant under tax and commercial law (invoices, order data): Retention for 6 years (§ 257 HGB) or 10 years (§ 257 HGB, § 147 AO)
Until the expiry of these periods, processing is restricted to the minimum required by law.
Order Processing
When placing an order, we collect and use your personal data only insofar as this is necessary for the fulfilment and processing of your order and for handling your enquiries. The provision of data is required for the conclusion of the contract. Failure to provide the data means that no contract can be concluded. Processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.
Your data will not be passed on to third parties without your express consent. The only exceptions are our service partners whom we require for the performance of the contractual relationship, or service providers whom we engage as processors. In addition to the recipients named in the respective clauses of this Privacy Policy, these include recipients in the following categories: shipping service providers, payment service providers, ERP service providers, service providers for order processing, web hosting providers, IT service providers, and dropshipping dealers. In all cases, we strictly comply with the statutory requirements. The scope of data transmission is limited to the minimum necessary.
7. Marketing and Newsletter
Newsletter
We use your email address independently of the contract performance exclusively for our own advertising purposes for the dispatch of newsletters, provided that you have expressly consented to this. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent.
You may withdraw your consent at any time, without affecting the lawfulness of the processing carried out on the basis of your consent prior to the withdrawal. You can unsubscribe from the newsletter at any time using the relevant link in the newsletter or by notifying us. Your email address will then be removed from the distribution list.
Your data will be passed on to an email marketing service provider within the scope of processing on our behalf. Data will not be passed on to any other third parties.
Direct Marketing (§ 7 UWG)
We use your email address, which we received in connection with the sale of goods or services, for the electronic transmission of advertising for our own goods or services that are similar to those you have already purchased from us, provided that you have not objected to such use.
The provision of the email address is required for the conclusion of the contract. Failure to provide it means that no contract can be concluded. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on the legitimate interest in direct marketing.
You may object to this use of your email address at any time by notifying us.
The contact details for exercising your objection can be found in the imprint. You may also use the link provided for this purpose in the advertising email. No costs other than the transmission costs at the basic rates will be incurred.
8. Analytics, Tracking, and Advertising
Google Tag Manager
We use Google Tag Manager by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google"). Google Tag Manager is a tool that allows us to integrate tracking and statistics tools as well as other technologies on our website (so-called "tags"). Google Tag Manager itself does not set cookies and does not collect personal data. It merely serves to manage and trigger other tags, which may in turn collect data.
However, Google Tag Manager accesses your IP address, which may also be transmitted to a Google server in the USA. Google Tag Manager triggers other tags, which may in turn collect data. These are described in the respective sections of this Privacy Policy.
Processing is carried out on the basis of Art. 6(1)(f) GDPR based on the legitimate interest in the efficient management and triggering of tracking tools.
Further information:Link
Google Analytics 4 (with Google Signals)
We use the web analytics service Google Analytics 4 by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google") on our website. The data processing serves the purpose of analysing this website and its visitors.
Google Analytics uses cookies that enable an analysis of your use of the website. The information generated by the cookies about your use of this website is generally transmitted to and stored on a Google server in the USA. IP anonymisation is activated on this website. As a result, your IP address is truncated by Google within Member States of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand.
We additionally use the "Google Signals" feature, which enables cross-device analysis when you are signed in to your Google account and have activated the "Personalised advertising" feature.
Processing is carried out on the basis of Art. 6(1)(f) GDPR based on the legitimate interest in the needs-based and targeted design of the website.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR.
You can prevent data collection by Google Analytics by downloading the browser plug-in: Link
Web Analytics Tools (Hotjar / Microsoft Clarity)
We use the following tools on our websites to analyse user behaviour:
- On memodo.de, memodo.at, memodo.nl, and memodo.it (DE/AT/NL/IT): Hotjar Ltd. (Level 2, St Julians Business Centre, 3, Elia Zammit Street, St Julians STJ 1000, Malta)
- On memodo.cz (CZ): Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA)
These tools enable us to better understand the needs of our users and to optimise our services. They create heatmaps and session recordings of user behaviour. We also use these tools for online customer surveys.
These tools collect data such as mouse movements, clicks, scrolling behaviour, screen size, device and browser information, and geographic data (country only). Your IP address is pseudonymised before it is stored.
Processing is carried out on the basis of Art. 6(1)(f) GDPR based on the legitimate interest in the analysis and optimisation of our website.
Microsoft Clarity is certified under the EU-U.S. Data Privacy Framework (DPF). The data transfer to the USA is based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR.
You have the right to object to this processing at any time on grounds relating to your particular situation.
You can deactivate the tools:
- Hotjar: https://www.hotjar.com/policies/do-not-track/
- Microsoft Clarity: Via your browser cookie settings or the Microsoft privacy settings
Google AdWords Conversion Tracking
We use Google AdWords Conversion Tracking by Google LLC. When you click on an advertisement placed by Google, a cookie is placed on your computer. These cookies have a limited validity period and do not contain any personal data.
The information serves the purpose of generating conversion statistics. We learn the total number of users who clicked on our advertisements, but do not receive any personally identifiable information.
Processing is carried out on the basis of Art. 6(1)(f) GDPR based on the legitimate interest in targeted advertising.
You have the right to object to this processing at any time.
You can deactivate personalised advertising on Google: Link
Facebook Remarketing (Meta Pixel)
We use the remarketing feature "Custom Audiences" of Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland; "Meta"). When you visit the website, a connection to the Facebook servers is established via the Meta Pixel. Facebook associates this information with your personal Facebook user account if you are logged in.
Processing is carried out on the basis of Art. 6(1)(f) GDPR based on the legitimate interest in targeted advertising.
You have the right to object to this processing at any time.
You can deactivate "Custom Audiences" in your Facebook settings: Link
Meta Lead Ads
We use Meta Lead Ads via the platforms Facebook and Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) for lead generation. You can voluntarily enter your personal data (e.g. name, email address, phone number, company name) via native forms directly on the Meta platforms without leaving the platform.
The data is processed exclusively for the following purposes: responding to your information requests, providing technical or commercial details, and initiating pre-contractual communication. The collected contacts are only passed on to our internal sales team.
Processing is carried out on the basis of Art. 6(1)(b) GDPR (implementation of pre-contractual measures at your request). The controller for the processing of your data is Memodo. Meta Platforms Ireland Limited provides the technical platform and acts as a processor for the creation and management of lead forms and advertising services.
You may withdraw your request at any time and request the deletion of your data. Please contact us using the contact details provided in this Privacy Policy.
9. Personalisation and Social Media
trbo – Website Personalisation
Our website uses the personalisation platform trbo by trbo GmbH (Leopoldstraße 41, 80802 Munich, Germany) to provide you with a better user experience and to optimally tailor our content to your interests.
Data processed:
- Information about your usage behaviour (pages visited, time spent, clicks)
- Technical data such as IP address, device type, browser type, and operating system
- Anonymised or pseudonymised data for the creation of user profiles
The data is only processed in pseudonymised form. It is not merged with other personal data. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our legitimate interest in the optimisation of our online services.
Further information:Link
Facebook Plugins
Plugins from Facebook (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland) are used on this website. When you access a page with a Facebook plugin, a connection to the Facebook servers is established. If you are logged in to Facebook, Facebook associates this information with your personal user account.
If you do not want Facebook to associate the information with your profile, you must log out of Facebook before visiting our website.
Further information:Link
Instagram Plugins
We use plugins from Instagram (Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland). When you access a page with an Instagram plugin, a connection to Instagram servers is established. If you are logged in to Instagram, Instagram associates this information with your user account.
Further information:Link
YouTube Videos
We use embedded YouTube videos (YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA; affiliated with Google LLC). The "Enhanced privacy mode" option is activated. This means that YouTube does not store any information about visitors until you play a video.
Further information:Link
10. CRM and Business Software
Salesforce
We use Salesforce solutions by salesforce.com Germany GmbH (Erika-Mann-Str. 31, 80636 Munich) and salesforce.com Inc. (One Market Street, Suite 300, San Francisco, CA 94105, USA):
Sales Cloud and Service Cloud:
For the management of customer relationships, orders, and support enquiries. Processing is carried out on the basis of Art. 6(1)(b) GDPR (performance of contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient customer management).
Marketing Cloud Account Engagement (formerly Pardot):
For marketing campaigns and newsletter distribution. No automatic tracking of click paths when visiting the website. Tracking only takes place when you interact with forms or links (e.g. newsletter sign-up) and only with your express consent.
You can block cookies from the domain "pardot.com" in your cookie settings.
Experience Cloud:
For interactive and personalised experiences on our digital platforms. Access to customer portals, specific content, and forms.
Data Transfer and Data Protection:
Salesforce processes personal data on our behalf, partly also in the USA. Salesforce is certified under the EU-U.S. Data Privacy Framework. This adequacy decision of the European Commission pursuant to Art. 45 GDPR ensures an adequate level of data protection.
You have the right to withdraw any consent given at any time. Send your withdrawal to datenschutz@memodo.de.
Further information:Link
11. Third Country Transfers and Data Security
Transfers to the USA
Some of our service providers (e.g. Google, Meta/Facebook, Salesforce) are based in the USA or process personal data there. Depending on the certification status of the service provider, the transfer is based on different legal grounds:
Insofar as our service providers are certified under the EU-U.S. Data Privacy Framework (DPF), the transfer is based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR. The DPF was recognised as an adequacy decision by the European Commission on 10 July 2023 and confirmed by the European Court of Justice in September 2025. You can view the certification of our service providers in the official DPF list of the US government: https://www.dataprivacyframework.gov/s/participant-search
For US service providers not certified under the DPF, as well as for other providers in third countries without an adequacy decision, we base the transfer on appropriate safeguards pursuant to Art. 46 GDPR (in particular EU Standard Contractual Clauses) and conduct an assessment of the level of protection in the recipient country. In doing so, we take into account, in particular, the requirements of the CJEU from the "Schrems II" ruling. Notwithstanding these measures, authorities in third countries may have broader access rights to your data without equivalent legal remedies being available to you in every case.
You can withdraw consents given for the use of tools involving US data processing at any time via our cookie consent banner.
Automated Decision-Making or Profiling
No automated decision-making (e.g. by artificial intelligence) or profiling within the meaning of Art. 22 GDPR takes place on our websites.
12. Shipping and Payments
Disclosure to Shipping Companies
We disclose your email address to the transport company within the scope of the contract performance, provided that you have expressly consented to this during the ordering process. The disclosure serves the purpose of informing you by email about the shipping status.
Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may withdraw your consent at any time.
Credit Check (Coface)
Insofar as we make advance deliveries (e.g. in the case of payment on account or direct debit), we reserve the right to obtain a credit report using Coface N.V. (David Ricardostraat 1, 1066 Amsterdam, Netherlands).
Processing is carried out on the basis of Art. 6(1)(f) GDPR based on the legitimate interest in protection against payment default.
You have the right to object to this processing at any time on grounds relating to your particular situation.
13. Duration of Storage
After the complete performance of the contract, the data is initially stored for the duration of the warranty period, and thereafter taking into account statutory retention periods, in particular under tax and commercial law, and is then deleted after the expiry of these periods, unless you have consented to further processing and use.
14. Your Rights as a Data Subject
Subject to the statutory requirements, you have the following rights pursuant to Art. 15 to 20 GDPR:
Right of Access (Art. 15 GDPR)
You have the right to obtain confirmation from us as to whether your personal data has been processed. If this is the case, you have the right to obtain information about:
- The purposes of processing
- The categories of personal data processed
- The recipients or categories of recipients
- The envisaged period of storage or the criteria used to determine that period
- The existence of further rights (rectification, erasure, restriction, objection)
- The existence of the right to lodge a complaint with a supervisory authority
Right to Rectification (Art. 16 GDPR)
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you or the completion of incomplete personal data.
Right to Erasure (Art. 17 GDPR)
You may request that we erase your personal data without undue delay if one of the following grounds applies:
- The data is no longer necessary for the purposes for which it was collected
- You withdraw your consent and there is no other legal basis for processing
- You object to the processing
- The data has been unlawfully processed
- Erasure is required for compliance with a legal obligation
The right to erasure does not apply where processing is necessary for compliance with a legal obligation (Art. 17(3)(b) GDPR). This concerns in particular statutory retention obligations of 6–10 years under HGB and AO (e.g. for order data, invoices, accounting records). After expiry of these periods, deletion takes place automatically. Until then, you may request the restriction of processing (see Art. 18 GDPR).
Right to Restriction of Processing (Art. 18 GDPR)
You have the right to request the restriction of processing if:
- You contest the accuracy of the data
- The processing is unlawful but you oppose erasure
- We no longer need the data, but you need it for the establishment, exercise, or defence of legal claims
- You have objected to processing and it has not yet been determined whether our grounds override yours
Right to Data Portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format.
Right to Object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6(1)(f) GDPR (legitimate interest).
This also applies to profiling based on this processing.
Direct marketing:
If we process your data for direct marketing purposes, you have the right to object at any time. This also applies to profiling insofar as it is related to such direct marketing.
You can exercise your right to object by contacting:
- Email: datenschutz@memodo.de
- Post: Memodo GmbH, Linprunstraße 16, 80335 Munich
- Phone: +49 (0)89 904 101 500
Withdrawal of Consent (Art. 7(3) GDPR)
You have the right to withdraw any consent given to us at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
You can withdraw your consent at any time by deactivating non-essential cookies in our cookie banner.
Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)
You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes applicable law.
Competent supervisory authority:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de
As of: January 2026