Privacy policy

Last updated: October 2026

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information can be found in the sections below.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section “Information about the controller”.

How do we collect your data?

Some of your data is collected because you provide it to us – for example when you place an order, use the contact or withdrawal form, sign up for the newsletter, suggest a location or register in the reseller area.

Other data is collected automatically by our host's server when you visit the website. This is technical data such as your browser, operating system or the time of the page request; the IP address is stored in truncated form.

What do we use your data for?

We use your data to provide the website without errors, to process your orders and enquiries and – if you wish – to send you our newsletter. We do not analyse your user behaviour: no analytics, tracking or advertising services run on this website.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification or erasure of this data. If you have given consent to data processing, you can withdraw it at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of processing, as well as the right to lodge a complaint with the competent supervisory authority. You can contact us at any time about this and any other questions regarding data protection.

2. Hosting, domain and e-mail

Hosting with Uberspace

This website and the associated shop system – including the data on orders, invoices, enquiries and newsletter sign-ups – are operated on servers of Uberspace:

Uberspace, Jonas Pasche, Kaiserstr. 15, 55116 Mainz

When the website is accessed, the web server processes technically necessary connection data and stores access logs with the date and time, the address accessed, where applicable the previously visited page (referrer) and the browser used. The IP address is stored only in truncated form (IP masking), so that it can no longer be assigned to a connection. This data is not merged with other data sources.

We use the host to perform our contracts with you (Art. 6(1)(b) GDPR) and in the interest of providing our services securely, quickly and reliably (Art. 6(1)(f) GDPR). Uberspace privacy information: https://uberspace.de/de/about/privacy/

Domains and e-mail with ALL-INKL.COM

Our domains (name resolution) and our e-mail mailboxes are hosted by:

ALL-INKL.COM – Neue Medien Münnich, owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf

All e-mails between you and us pass through the mail servers of ALL-INKL.COM – including those the shop sends automatically (order and withdrawal confirmations, invoices, newsletter sign-up confirmations, newsletters). The legal basis is Art. 6(1)(b) GDPR insofar as your order or enquiry is concerned, and otherwise Art. 6(1)(f) GDPR (reliable e-mail communication).

Data processing agreement

We have concluded a data processing agreement (DPA) with both providers. This ensures that they process the personal data of our website visitors and customers only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory information

Data protection

We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Please note that data transmission over the internet (e.g. when communicating by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.

Information about the controller

The controller responsible for data processing on this website is:

H2 Solutions GmbH (Hanf Pate), Bautzner Straße 55, 01099 Dresden

Phone: +49 155 69086021 · E-mail: info@h2s-dresden.de

Managing director authorised to represent the company: Georg Hummel

Data protection officer

We have not appointed a data protection officer, as the legal requirements for doing so (Art. 37 GDPR, Section 38 BDSG) are not met. If you have any questions about data protection, please contact the controller named above.

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing no longer applies. If you assert a justified request for erasure or withdraw your consent, your data will be erased unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in this case, erasure takes place once these reasons no longer apply.

Withdrawal of your consent to data processing

Some data processing – such as sending the newsletter – is only possible with your express consent. You can withdraw consent you have given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION UNDER ART. 21(2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer to another controller, this will only take place insofar as it is technically feasible.

Access, rectification, erasure and restriction of processing

Within the framework of the applicable statutory provisions, you have the right at any time to access, free of charge, information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to rectification or erasure of this data. Under the conditions of Art. 18 GDPR – for example if you dispute the accuracy of your data or the processing is unlawful – you can also request that we restrict the processing. Please contact us at any time to do so.

SSL or TLS encryption

For security reasons and to protect confidential content – such as orders or enquiries that you send to us – this site uses SSL or TLS encryption. You can recognise an encrypted connection by “https://” in the address bar and by the lock symbol in your browser. When the connection is encrypted, the data you transmit to us cannot be read by third parties.

Objection to advertising e-mails

We hereby object to the use of the contact details published as part of our legal notice obligation (Impressum) for sending advertising and information material that has not been expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example by spam e-mails.

4. Data collection on this website

No analytics, tracking or advertising services

We do not use cookies or comparable technologies for analytics, tracking or advertising purposes, and we do not integrate any third-party services that receive data from you when a page is accessed. Fonts, images and the location map are loaded from our own server.

Anonymous counting of page views

To understand how our shop is used, we count how often certain pages are accessed and certain buttons are used (e.g. home page, product pages, age verification, “Add to cart”, checkout). In doing so, your browser sends only the type of event to our own server. Only daily totals per shop are stored – no IP addresses, no identifiers, no individual visits and no data that would allow conclusions to be drawn about you.

No cookies are set for the counting, and no information is stored on or read from your device. The legal basis is our legitimate interest in improving our services (Art. 6(1)(f) GDPR). The IP address is technically required for the transmission but is not stored.

Storage in your browser

In your browser's storage (local storage) we store only information that is strictly necessary for functions you have requested:

• the contents of your shopping cart, until you place an order or empty it,
• your confirmation that you are at least 18 years old, so that we do not have to ask again every time you visit,
• whether you have hidden the notice about installing the site as an app (for 30 days).
• In the reseller area, after you log in, we set a cookie that keeps you logged in until you log out or the login expires.

This information does not leave your device (except for the login cookie, which your browser sends to our server) and is not analysed. The legal basis is Section 25(2) no. 2 TDDDG; the processing is carried out under Art. 6(1)(b) or (f) GDPR. You can delete this data at any time via your browser settings.

Web app (installation on the home screen)

You can install this website as an app on your device. Only then does the app create a cache (service worker) on your device, which holds pages and images you have already visited for use without an internet connection. Checkout, shopping cart and personal details are not stored there. The cache is deleted when you remove the app. No such storage is created in the normal browser.

Protection against misuse of the forms

To prevent forms from being submitted in bulk or automatically, we briefly process your IP address when you submit a form. It is held only in the server's memory and discarded after ten minutes at the latest; it is not stored permanently. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Contact form and enquiries by e-mail or phone

If you contact us via the contact form, by e-mail or by phone, we store and process the details you provide (e.g. name, e-mail address, message) in order to handle your request and in case of follow-up questions. Enquiries submitted via the form are stored in our shop system and additionally delivered to us by e-mail. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your enquiry is related to a contract or serves pre-contractual measures, and otherwise on the basis of our legitimate interest in handling the enquiries addressed to us (Art. 6(1)(f) GDPR). The data remains with us until you request its erasure or the purpose no longer applies (e.g. once your request has been dealt with); statutory retention periods remain unaffected.

Contact via WhatsApp

You can also write to us via WhatsApp. The “WhatsApp” link on this website opens a chat with our number; data is only transmitted to WhatsApp once you click it. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

If you write to us via WhatsApp, WhatsApp and we process your phone number, your profile name and the content of your messages. WhatsApp encrypts the content end-to-end, but receives connection and usage data (e.g. who communicates with whom and when) and may transfer this data to WhatsApp LLC and Meta Platforms, Inc. in the USA; these companies are certified under the EU-US Data Privacy Framework. WhatsApp privacy policy: https://www.whatsapp.com/legal/privacy-policy-eea

The legal basis is Art. 6(1)(b) GDPR insofar as your message concerns an order or a contract, and otherwise our legitimate interest in simple communication (Art. 6(1)(f) GDPR). We use WhatsApp only to answer your enquiry and delete the chat history when it is no longer needed. If you do not wish to use WhatsApp, you can just as well reach us by e-mail, by phone or via the contact form.

Withdrawal via the online form

If you withdraw from a contract using our withdrawal form, we store your details (order number, name, e-mail address, order date and, where applicable, message) together with the time of receipt and confirm receipt to you by e-mail. The legal basis is Art. 6(1)(b) and (c) GDPR (processing of the withdrawal, statutory obligations under Section 356a BGB).

Location suggestions

Using the “Suggest a vending machine” form, you can tell us about places for new vending machines. We store your suggestion and – only if you provide them – your name and e-mail address in order to get back to you. The legal basis is our legitimate interest in planning new locations (Art. 6(1)(f) GDPR) or your consent given by voluntarily providing your contact details (Art. 6(1)(a) GDPR). We will delete the suggestion at any time on request.

Reseller area (registration)

Commercial resellers can register in the reseller area. In doing so, we process the company name, contact person, address, e-mail address, phone number, where applicable the VAT identification number, and the uploaded proof of business registration in order to verify commercial status, manage the reseller account and process reseller orders. We store your password only in encrypted form (as a hash). Only Hanf Pate can view the proof of business registration.

The legal basis is Art. 6(1)(b) GDPR. We store the data for as long as the reseller account exists; after that, it is deleted unless statutory retention periods prevent this.

5. Newsletter

If you subscribe to our newsletter, we need your e-mail address. The subscription only becomes effective once you click the link in our confirmation e-mail (double opt-in). As proof of your consent, we store the wording of the consent as well as the time of sign-up and of confirmation.

We send the newsletter from our own shop system via the mail servers of ALL-INKL.COM; we do not use an external newsletter service. We do not analyse whether or when you open the newsletter or click on links in it.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time – via the unsubscribe link in every newsletter or by sending us a message. After you unsubscribe, we mark your e-mail address as unsubscribed so that we do not send you any further newsletters and can prove the withdrawal (Art. 6(1)(f) GDPR). On request, we will delete the address completely. If you do not confirm a sign-up, you will not receive a newsletter.

6. Location map and route planning

The map of our vending machine locations on hanf-pate.de is loaded from our own server; no data is transmitted to map services in the process.

The “Plan route” link opens Google Maps in a new window. Only when you click it is data (including your IP address and the destination address) transmitted to Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's privacy policy applies to any further processing: https://policies.google.com/privacy

7. Orders, payment and shipping

Customer and contract data

For your order, we process your name, delivery address, e-mail address, where applicable your phone number, the items ordered and your confirmation that you are of legal age and have accepted the terms and conditions. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR insofar as we are legally obliged, e.g. to sell only to adults.

We issue invoices as e-invoices and retain them, together with the underlying order data, for up to ten years in accordance with the periods under tax and commercial law (Section 147 AO, Section 257 HGB, Section 14b UStG). We delete other customer data when it is no longer required for processing the order.

Disclosure for contract processing

We pass on personal data only insofar as this is necessary for processing your order – to the company commissioned with shipping (name and delivery address, where applicable for delivery with age verification) and to the payment service you have chosen. Data is not passed on for advertising purposes. The legal basis is Art. 6(1)(b) GDPR.

Payment in advance

If you pay in advance, you transfer the amount to our business account. In doing so, your bank and our bank process the transfer data (name, account details, amount, payment reference); we match the incoming payment with your order.

Payment with PayPal

If you choose PayPal, we redirect you to the PayPal website for payment. For this purpose, we transmit the order number, amount and the items ordered; you enter your login and payment details directly with PayPal. We receive confirmation of the payment and a transaction number from PayPal. No PayPal script is embedded on our website itself.

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

PayPal may transfer data to affiliated companies in the USA; the transfer is based on the standard contractual clauses of the EU Commission. The legal basis for payment processing is Art. 6(1)(b) GDPR. Details: https://www.paypal.com/de/legalhub/paypal/privacy-full

Customer reviews

If you expressly consent when placing your order, we will send you a one-time e-mail a few days after shipping asking you to review the products you purchased. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG). You can withdraw it at any time with effect for the future, e.g. by e-mail to us; the order itself does not depend on it.

The e-mail contains a personal link that is valid for 60 days and applies only to your order. If you submit a review, we store the stars, text, the display name you have chosen (by default your first name and the first letter of your last name) and the link to your order. Only the display name, date, stars and text are published – after we have checked that the review comes from a buyer and contains no legal violations or personal data. The legal basis for publication is your consent given by submitting the review (Art. 6(1)(a) GDPR).

Reviews remain published for as long as the product is in our range or until you request their deletion. A short message to us is sufficient.