1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data means any data by which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Clever Solutions International GmbH, Bärengässchen 6 Top 5, 5020 Salzburg, Austria, Tel.: +436641847264, Email: orders@nomad-secrets.com. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

When using our website for informational purposes only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to the page server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• The website visited

• Date and time of access

• Amount of data sent in bytes

• Source/referrer from which you accessed the website

• Browser used

• Operating system used

• IP address used (where applicable, in anonymized form)

The processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or otherwise used. However, we reserve the right to subsequently review the server log files if there are concrete indications of unlawful use.

3) Contacting Us

When contacting us (e.g. via a contact form or email), personal data is processed exclusively for the purpose of processing and responding to your inquiry and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at entering into a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the matter concerned has been conclusively clarified, provided that there are no statutory retention obligations to the contrary.

4) Data Processing for Order Processing

Where necessary for the processing of the contract for delivery and payment purposes, the personal data collected by us will be disclosed pursuant to Art. 6(1)(b) GDPR to the transport company commissioned by us and the credit institution commissioned by us.

If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided when placing your order in order to inform you personally within the scope of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details will be used strictly for the purpose of notifying you of updates that we are legally or contractually required to provide and will only be processed by us to the extent necessary for the respective notification.

5) Rights of the Data Subject

5.1 Applicable data protection law grants you the following rights vis-à-vis the controller with regard to the processing of your personal data (rights of access and intervention), whereby reference is made to the legal basis specified for the respective conditions for exercising these rights:

• Right of access pursuant to Art. 15 GDPR;

• Right to rectification pursuant to Art. 16 GDPR;

• Right to erasure pursuant to Art. 17 GDPR;

• Right to restriction of processing pursuant to Art. 18 GDPR;

• Right to notification pursuant to Art. 19 GDPR;

• Right to data portability pursuant to Art. 20 GDPR;

• Right to withdraw consent pursuant to Art. 7(3) GDPR;

• Right to lodge a complaint pursuant to Art. 77 GDPR.

5.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA AS PART OF A BALANCING OF INTERESTS ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO SUCH PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE PERSONAL DATA CONCERNED. HOWEVER, WE MAY CONTINUE TO PROCESS THE DATA IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU MAY EXERCISE YOUR RIGHT TO OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE PERSONAL DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

6) Duration of Storage of Personal Data

The duration for which personal data is stored is determined on the basis of the respective legal basis, the purpose of processing and, where applicable, the respective statutory retention period (e.g. commercial and tax retention periods).

When personal data is processed on the basis of explicit consent pursuant to Art. 6(1)(a) GDPR, the data concerned will be stored until you withdraw your consent.

If statutory retention periods exist for data processed in the context of contractual or contractual-like obligations on the basis of Art. 6(1)(b) GDPR, such data will be routinely deleted after the expiry of the retention periods, provided that it is no longer required for the performance or initiation of the contract and/or we no longer have a legitimate interest in continuing to store the data.

When personal data is processed on the basis of Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

When personal data is processed for the purpose of direct marketing on the basis of Art. 6(1)(f) GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21(2) GDPR.

Unless otherwise stated in the other information contained in this privacy policy regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

In the event of discrepancies between any available language versions, only the German version shall prevail.