Privacy Policy.

The controller responsible for data processing on this site is:

ATMAN Solutions UG (haftungsbeschränkt) Mahkornstr. 7 94315 Straubing Germany Zaid Aljbour, Managing Director Email: info@squatrat.de

When you use the website, technical access and security data may be processed, including IP address, date and time, requested address, browser and device information, referrer, and security events. This is required to deliver and protect the website, prevent misuse, and diagnose faults.

For orders, payment, delivery, tracking, invoices, returns, refunds, and statutory defect claims, we process the contact, address, order, payment-status, shipment, and communication data needed for the transaction. Payment credentials are entered with the selected payment service provider and are not stored by us.

For customer accounts, we process login and profile information, saved addresses, wishlists, and order history. For restock notifications and newsletters, we process the email address, confirmation status, consent record, and the product or mailing list requested. Newsletter messages are sent only after the required confirmation.

For enquiries, voluntary returns, and the electronic withdrawal function, we process the information submitted, order reference, affected items, communication addresses, and the date and time of the request or declaration so that we can answer, document, and fulfil it.

Contract initiation and performance, including payment, delivery, customer accounts, returns, refunds, and support concerning an order, are processed under Art. 6(1)(b) GDPR. Invoices, accounting records, and legally required withdrawal records are processed under Art. 6(1)(c) GDPR.

Website security, fraud prevention, technical logs, and the defence of legal claims are processed under Art. 6(1)(f) GDPR. Our legitimate interests are reliable shop operation, protection against misuse, and the establishment, exercise, or defence of legal claims.

Newsletters and optional analytics are processed under Art. 6(1)(a) GDPR only after consent. Restock notifications are processed to provide the service you requested under Art. 6(1)(b) GDPR. Consent may be withdrawn at any time with effect for the future.

Where required for the purposes described above, data is disclosed to categories of processors and recipients such as hosting and security providers, database and media-storage providers, payment service providers, email-delivery providers, shipping and logistics providers, tax and accounting advisers, and public authorities where disclosure is legally required. They receive only the data required for their task.

Some processors may handle data outside the European Union or European Economic Area. In that case, the transfer is based on an adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses, together with additional safeguards where required. Information about the applicable safeguard can be requested from us.

Technical logs are retained only for the period required for operation and security and are then deleted or anonymised; they may be kept longer where a security incident must be investigated. Invoices and booking records are generally retained for eight years. Contract, withdrawal, return, and support records are retained for the applicable statutory retention and limitation periods and for as long as an unresolved matter requires them.

Account data is retained until the account is deleted, except where transaction records remain subject to statutory retention. Newsletter data is retained until consent is withdrawn; restock-notification data is deleted after the requested notification has been completed or is no longer required. Consent records may be retained for the period needed to demonstrate lawful processing.

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing of your personal data. You may also withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, contact us at info@squatrat.de. You also have the right to lodge a complaint with a data-protection supervisory authority.

The cart and wishlist are stored locally in your browser. A technically necessary session cookie is used when you sign in. These functions are required to provide the features you requested and are not used for advertising.

Optional audience measurement is activated only after consent. You can refuse or withdraw that consent at any time through the cookie settings; refusal does not affect essential shop functions.

With your consent, we use the Google tag for website and advertising measurement in Google Ads and to measure purchases from Google product listings in Google Merchant Center. Google receives technical browser and connection data, attribution identifiers, order references, order values, currency, and purchased product identifiers and quantities. We do not send customer names, email addresses, delivery addresses, or payment credentials in these events. Customer and authentication query parameters are removed from the page addresses sent for measurement. Advertising storage, advertising user data and advertising personalisation remain disabled in Google Consent Mode. Further information: https://business.safety.google/privacy/.

The website contains links to external websites. Data is transferred to their operators only when you follow such a link; their own privacy notices then apply.

On squatrat.de, with your consent, we also use Kwanko for affiliate attribution and advertising partner tags. Technical browser and connection data, attribution identifiers, product and basket identifiers, prices and quantities, a unique order reference, the order amount after discounts excluding VAT and shipping, currency, payment-method name and any voucher code are transmitted for purchase attribution. Our event payloads do not include your name, email, delivery address or payment credentials. You can refuse this optional measurement or withdraw consent in the cookie settings. Kwanko privacy information: https://www.kwanko.com/gdpr/privacy-policy/.

The contact, account-registration and newsletter-signup forms use Cloudflare Turnstile to distinguish genuine submissions from automated abuse. When you use a protected form, Cloudflare processes technical browser and device signals, IP address and verification results. Your name, email address, password and message are not included in our verification request to Cloudflare. This security check is not used by us for advertising or audience measurement.

The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Our legal basis is Art. 6(1)(f) GDPR: our legitimate interest in protecting the contact service from spam and misuse. The information concerning recipients, international transfers and your rights above also applies. You can alternatively contact us directly by email without using the form. Further information: https://www.cloudflare.com/turnstile-privacy-policy/.

We may update this policy as the shop changes. The current version is always the one on this page.