Privacy policy
tonies GmbH (the operator of the tonies.com and tonies.de website, the domains and subdomains associated with them and the app ‘meinetonies’/‘mytonies’ for iOS and Android (hereinafter ‘app’) takes the protection of your personal data very seriously and ensures that your privacy is maintained. We treat your personal data as confidential and in accordance with statutory data protection regulations (including the EU General Data Protection Regulation (GDPR), German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG)), and California Consumer Privacy Act (CCPA)) as well as this Data Protection Policy. Please take note of the following information in order to ensure that you are fully informed about the collection, use and purpose-based processing of your personal data on our website and about the rights to which you are entitled.
Note to US residents: our US store located athttps://us.tonies.com/ is operated by our United States subsidiary Boxine US, Inc., which shares your personal information with tonies GmbH. See the section “Supplemental notice for US residents” below for more information.
Controller’s name and address and whom you can contact
The controller, within the meaning of the General Data Protection Regulation (GDPR), other applicable data protection laws and other provisions of a data protection nature, is:
tonies GmbH Oststraße 119 40210 Düsseldorf Germany Contact:Contact form (EN),contact form (DE)
You can contact tonies GmbH´s privacy officer at:
Philipp Heroldwww.mein-datenschutzbeauftragter.de Hafenstrasse 1 A 23568 Lübeck Germany Contact:Contact form (EN),contact form (DE)
For US inquiries, please contact Boxine Inc.:
Boxine US, Inc. Attn: Privacy 4251 Los Palos Ave Palo Alto, CA 94306 privacy.us@tonies.com
Purpose and legal basis for processing your data
The use of our website and apps for informational purposes is designed in such a way that as little data as possible is collected from you and is usually possible without providing any personal data. This does not apply if personal data is required as part of an order from our online shops, for the creation of a Tonie-Account, for use of mytonies/meinetonies (my.tonies.com ormeine.tonies.de) (hereinafter ‘mytonies’ collectively for mytonies and meinetonies), including orders from the Audio Library; as part of customer care enquiries, as part of a newsletter subscription that you have requested, through our general contact form or for use of our blog. As a network-based system with a server (mytonies) and client systems (the Tonieboxes and Tonies with audio content), there are also other data exchange processes without which it is impossible to use the system to its full extent. Further information about the general functionality of our system can also be found on ourUS website, ourUK Website and on ourGerman website.
We only ever collect personal data on a voluntary basis where this is possible for the performance of our service. If there exist no legal grounds for such processing, we generally obtain your consent. You can at any time withdraw any consent that you have given. Your data is not disclosed to third parties. Excepted from this are our service partners who require personal data in order to process any orders of yours from our online shop or Audio Library or as part of customer care enquiries (e.g. delivery companies contracted for delivery, financial and payment institutions contracted to process payment, our service partners for customer care enquiries and our technical support). However, in these cases the extent of data that is transferred is limited to the minimum necessary for the relevant service; all personal data is of course also treated as strictly confidential by our service partners and processed in accordance with the GDPR. In the event of a credit check, address and credit history data may be exchanged with a recognised, external company (Schufa or Creditreform), within a legally permitted framework and incorporating the protection of your legitimate interests. However, we do not assume liability for third parties unless such liability is declared separately.
In addition, if we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, then your personal information may be sold or transferred as part of such a transaction, solely as permitted by law and/or contract. We may also disclose any information we store associated with you if we, in good faith, believe doing so is required or appropriate: to comply with law enforcement or national security requests and legal process; protect your, our or others’ rights, property, or safety; enforce our policies or contracts; collect amounts owed to us; or assist with an investigation or prosecution of suspected or actual illegal activity.
If we make adjustments to our business processes and these adjustments have consequences for information obligations pursuant to applicable laws, we will update our Data Protection Policy accordingly and notify you as required under applicable law. Likewise, we will incorporate changes of data protection law and case law and update our Data Protection Policy to reflect them. We recommend that you read our Data Protection Policy regularly for this reason.
Purposes of data processing and legal grounds
We process your personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and German Federal Data Protection Act (BDSG).
- Data entered into the contact form is processed on the basis of your consent (GDPR Article 6(1)(a)). The legal grounds for processing data that is transferred when sending an email are provided in GDPR Article 6(1)(f). If the email contact is for the purpose of entering into a contract, there are additional legal grounds for processing provided in GDPR Article 6(1)(b).
- Your personal data is processed primarily for the performance of our contractual services in our online shops and mytonies (GDPR Article 6(1)(b)), that is, as part of the performance of our contracts with our customers and, if relevant, also for the implementation of pre-contractual measures taken pursuant to a request for our products and services.
- If you have given us your consent to the processing of your personal data for specific purposes (e.g. a newsletter subscription), this data is processed based on your consent. You can withdraw your consent at any time. Such withdrawal only takes effect for the future and does not affect the lawfulness of data processed before the time of withdrawal. (GDPR Article 6(1)(a))
- If we are subject to a legal obligation that requires us to process personal data, for example to fulfil tax obligations, such processing of personal data is based on the grounds provided in GDPR Article 6(1)(c).
The following applies as part of a balancing of interests: if we process personal data that is not included within the aforementioned legal grounds, such processing may also be required if it is necessary to safeguard a legitimate interest of our company or a third party, unless your interests, fundamental rights and fundamental freedoms are overriding. For example, this could be the case if we use your personal data for our own marketing of our products, provided you have not objected to such usage of your data, or if data is exchanged with a recognised external company (Schufa or Creditreform) for a credit check that may form part of an order’s fulfilment. (GDPR Article 6(1)(f), German Unfair Competition Act (UWG) Section 7(3))
Your privacy rights
As required under applicable law and depending on the jurisdiction you reside, you may have the following rights in relation to your personal data:
- access
- rectification
- erasure
- restriction of processing (on the relevant provider’s website)
- objection
- data portability (transfer of the household in your account)
To exercise your rights, you may complete thisContact form (EN), make changes directly from directly within yourprofile, or contact us via the contact listed in the section “Controller’s name and address and whom you can contact” above.
The restrictions set out in BDSG Sections 34 and 35 apply with regard to the rights to access and erasure. Moreover, you have the right to lodge a complaint with the relevant supervisory authority for data protection (GDPR Article 77 in connection with BDSG Section 19).
Note to users in California: additional rights information is listed in “Additional Privacy Rights for California Residents” below.
Data usage in detail
The following explains to you in detail how our systems use your data.
Server log files
The provider of this website automatically gathers and saves information in server log files automatically transferred to us by your browser. This information includes:
- browser type/version
- operating system used
- referrer URL
- host name of the accessing computer
- time of server request
- IP address
- request authorisation
We do not match this data with a specific person or merge it with other data sources. However, we do reserve the right to review this data at a later date if we gain knowledge of concrete indications of unlawful use. The data is required to provide the contents of our website correctly. We do not infer details about specific persons when using this general data and information. Rather, this data/information is required to (1) present the content of our website correctly, , including directing you to the correct version of our site for your region (2) optimise the content and advertisement of our website, (3) assure ongoing operability of our IT systems and our website’s technology and (4) supply information required for criminal prosecution to prosecution authorities in the event of a cyberattack. This data and information, which is collected anonymously, is therefore analysed by us for statistical purposes and, moreover, with the goal of increasing the protection and security of data in our organisation so that an optimal level of protection for the personal data processed by us can ultimately be assured. The anonymous data in the server log files is stored separately from all personal data provided by the data subject. The stored customer data of yours is not sold.
Data use with Toniebox, Tonies, mytonies and the Tonie-Account
Every Toniebox by default comes with an individual client certificate that it can use for unique authentication with mytonies. In addition to this client certificate, there is another Toniebox ID stored in mytonies for each Toniebox. This Toniebox ID is also affixed to the bottom of the Toniebox. When setting up the Toniebox for the first time and connecting it to a new Wi-Fi network, you are asked to enter the Toniebox ID for it to be matched with mytonies. This serves to ensure that only authorised Tonieboxes can make contact with mytonies.
The Toniebox is coupled with a Tonie-Account through the Toniebox ID. All you need to create this account in mytonies is a valid email address and a password that you choose. Furthermore, you must provide your Toniebox ID to link your Toniebox with your Tonie-Account. Creating a Tonie-Account is a requirement for using (and also configuring) the Toniebox, using Creative-Tonies and the Audio Library, connecting with other members and using other functions in the Toniebox ecosystem. If a Tonie-Account is deleted after being used to set up the Toniebox, these special functions of mytonies will no longer be able to be used. Further information about deleting Tonie-Accounts and the effects of doing so can be found here.
When you use your Toniebox, the following events will cause it try to establish a connection with mytonies: initial set-up, powering on, putting on a Tonie unknown to the Toniebox and starting a search for new content. If the connection with mytonies is successfully established, the Toniebox sends your individual client certificate, your IP address and a timestamp. When you use Tonies and Tonieboxes, we also receive data about operational events (Tonie put on or removed, including the Tonie’s identifier (e.g. Creative-Tonie or Benjamin the Elephant Tonie); volume changes, fast-forwarding and skipping, connecting or disconnecting headphones or connecting or disconnecting the charging station) and the content that is assigned to your Tonie at a particular time. When setting up the Toniebox or adding another WiFi, the available networks and the connected network (SSID) are also transmitted. In doing this, we seek to improve our service and product for you on an ongoing basis. The transferred data described above is generally collected by us on an anonymous basis and stored in server log files so that we can analyse it as necessary. If you contact our customer care and state the Toniebox ID as part of a support enquiry (e.g. because your Tonie has a technical problem or because a Toniebox and/or Tonie is/are lost in transit), the data that has been anonymous up until that stage will potentially be linked with the personal data given by you in relation to the enquiry. The customer care staff will actively let you know about this in such cases. Using data in the manner described here makes it possible for us to process your support enquiry, track down Tonieboxes or Tonies that are lost in transit, resolve problems with Audio Library content and uncover instances of misuse or breach of law and defend ourselves against them. The data that is linked in the described manner is deleted as soon as your support enquiry has been brought to a full conclusion. In cases where there has potentially been a breach of the law, we will store the data until the breach of law has been resolved, or until legal proceedings have concluded if such proceedings are opened, and will only erase it when we no longer need the data for evidence and defence purposes or to comply with retention obligations.
After you have set up a Tonie-Account and linked your Toniebox with this account using the Toniebox ID, we can link your customer data with the aforementioned data and will then be able to customise our newsletter (if you have opted in for it) and other marketing activities to you and your personal interests and thus improve our marketing activities and their benefits on an ongoing basis. If you do not wish for this to occur, you of course have the option to deactivate this at any time from withinyour profile on my.tonies.com.
If you upload audio files for your Creative-Tonies to mytonies (through the app or our website), these files will be converted by our server into the required format and then made available for playback on the Creative-Tonies. The data you originally upload will be automatically deleted after seven days. The converted data will be stored in mytonies. You can upload new files for the desired Creative-Tonie as often as you like. As soon as the maximum run time of 90 minutes has been reached for each Creative-Tonie, you must delete your old files so that they can be replaced by new ones. We do not save old data, though for technical reasons the converted data will be stored for at least seven days following conversion. We reserve the right to sample uploaded data and check if it potentially violates applicable law (including copyrights, personality rights or competition law), applicable case law and/or common decency. If we find such a violation, we reserve the right to delete your data in mytonies and cancel your Tonie-Account.
If you cancel/close your Tonie-Account, your Audio Library content and the files you have uploaded for your Creative-Tonies will be deleted after cancelling. If you cancel your Tonie-Account, your order history and any personal information provided voluntarily or to place orders will also be deleted. It is impossible to transfer this information to another user before cancelling your account.
Data use with app and Toniebox QR code packaging
If you use our app, you require a Tonie-Account and must also log into the app with your email address and password before you can use the app. The apps enable you to record speech and combine it with a selected Creative-Tonie through the app by uploading it from the smartphone or tablet to mytonies.
In order for you to be able to use our app and its functions to their full extent, the app must be able to access various functions and data. You must grant the relevant permissions so that we receive this access (representing a declaration of consent under laws such as GDPR Article 6(1)(a)). We only obtain permissions that are actually required for usage in practice. Please be aware that you cannot use the full extent of our app’s functionality unless all permissions are provided.
All users must ensure they have the proper consent of any individual they record via the app (or, in the case of a child’s voice, the child’s parent or legal guardian) when uploading content to the app. Please see the relevant Terms and Conditions/Terms of Use for your territory for more information.
The app uses the following data:
- audio recordings, titles uploaded to mytonies
- customer data for verification
- Toniebox name
- Push token (for sending push notifications)
The app accesses the following items for specific purposes:
- identity/accounts on the device and usage of it
- photographs/media/files for transfer as part of the app’s defined usage
- microphone for recording audio files
- network for the display of network connections
- stopping the device from entering sleep mode
- changing audio settings
Finally, we would also like to point out that every Toniebox package is given a QR code during manufacturing. This primarily serves internal purposes (our ERP system); as a rule, this information is not linked with your Tonie-Account. The contrary only applies if we have sufficient evidence of fraud. In this case, we link the QR code with your Tonie-Account to detect Tonieboxes that have not arrived, which serves to protect us from breaches of the law. We delete the personal data used in this process as soon as the suspicion of fraud proves unsubstantiated and/or the fraud investigation process has been concluded and the data is no longer needed for evidence and legal defence purposes.
We may send you push notifications through our app. You may at any time opt-out from receiving these types of communications by changing the settings on your mobile device.
Newsletter, marketing emails, and other promotional activities
If you wish to receive our newsletter by email, we require an email address from you; you may also provide your forename, surname and gender voluntarily. Additional data is not collected. We use this data exclusively for the delivery of the requested information and forward it to our delivery contractor in the United States. We have signed corresponding agreements with our contractor to ensure that the requirements for protecting your personal data under data protection laws are met. You also may opt in to receive marketing communications from us via text message, which may include text notifications for your order, (including abandoned cart reminders) and/or other text marketing offers. Message and data rates may apply. You may opt out of receiving text messages from us by following the instructions in the text message you have received from us or by otherwise contacting us.
We obtain statistics through the means described here. They include information about whether the newsletter is opened and the links that are clicked on. While this information can be matched with individual newsletter recipients, it is not the purpose of the processing for our analyses. The analyses serve solely to identify the reading habits of our users and adapt our content to you or send different content in line with the interests of users, including individual ones.
You can at any time withdraw the consent you give for the storage and usage of data and your email address for delivery of the newsletter by clicking on the ‘Unsubscribe’ link in the newsletter.
We may offer various tools and functionalities to allow you to share information from third parties. For example, we may allow you to provide information about your friends through our referral services. Our referral services may allow you to forward or share certain content with a friend, such as an email inviting your friend to use our services. If you use these features, we will retain your friend’s email solely to enable the referral. Note that we may also provide surveys, sweepstakes, contests, or other social media content, which may entail the collection of personal information. Contact information you provide may be used to reach you about the sweepstakes or contest and for other promotional, marketing and business purposes, if permitted by law. In some jurisdictions, we are required to publicly share information of winners.
Online shop
We require your personal data in order to process your order from our online shop. To this end, we require your title, first names, surnames, email address, delivery address, billing address and telephone number for queries regarding your order. If you wish to create a Tonie-Account in our online shop, we will store your personal data so that you do not have to re-enter it for every order. This saves you time and stops you from making any mistakes when typing. Furthermore, it gives you personalised access to your order history and you can specify individual user settings if you desire them. You also need a Tonie-Account to set up the Toniebox and use special functions ofmytonies, including the Audio Library. When you create a Tonie-Account in the shop, all you need to begin is your email address and a password chosen by you. Later when you make an order the following personal data of yours is additionally stored: title, forename, surname, delivery address, billing address, payment method (setting the default during the first purchase) and your telephone number (information for queries regarding your order).
Data processing for order fulfilment through Amazon
Orders are fulfilled by the service provider ‘Amazon’ (Amazon EU S.à r.l., 5, Rue Plaetis 2338, Luxembourg) as part of the ‘Fulfilment by Amazon’ program. Your personal data is shared with Amazon exclusively for the purpose of fulfilling your online order. It is transferred in accordance with GDPR Article 6(1)(b) and only to the extent necessary for the order’s fulfilment. Furthermore, we obtain your data when you use Amazon customer service in connection with your order.
Any other data processing that extends beyond the data processing explained above is the responsibility of Amazon. Further information about data protection at Amazon and Amazon’s privacy notice can be viewedhere.
Audio Library
If you possess a Tonie-Account and log in with it at meine.tonies.com, you can use our Audio Library. When creating a Tonie-Account in meinetonies, all you need is your email address and a password that you choose. For orders for Audio Library content, we also require your personal data in order to fulfil your order. To this end, we require your title (voluntary), forename, surname, billing address, the country to which your IP address belongs (but not the IP address itself) and telephone number (voluntary information for queries regarding your order). If you use the Audio Library to assign previously purchased Audio Library content to your Tonies and manage your purchased content, we do not require any personal data for this apart from your Tonie-Account log-in details.
Tonie-Blog
We offer the option of commenting on our Tonie-Blog posts on our website attonies.com andtonies.de. If you use this option, your comment, information about the time the comment was submitted and the username or pseudonym chosen by you will be stored and published. Additionally, the IP address assigned by your Internet service provider will be logged as well. We will also ask for your email address, and while we will store it, we will not publish it. We store this personal data for security reasons and in case you violate third-party rights through a comment that you leave or in case you post unlawful content. Storing this personal data enables us to clear ourselves of wrongdoing in the event of a breach of law. We do not disclose your personal data to third parties except when such disclosure is legally required or serves as legal defence for us.
Customer care by telephone
If you contact our customer care by telephone, your telephone number and email address, as well as other information that you provide to our customer care staff, are recorded, stored and assessed for the purpose of processing your enquiry. Doing this serves the purpose of answering your enquiry and improving our products and the quality of our service. If you are required to provide your Toniebox ID for an answer to your enquiry as part of such a support request, the previously anonymous data of yours about operational events may possibly be linked with the personal data that you provide in connection with the enquiry. However, our customer care staff will actively let you know about this in such cases before a link is made, and you can, of course, refuse it at any time.
Customer care through the contact form
If you send us enquiries through our contact form, your information from the contact form, including the contact details that you voluntarily provide on it (personal data), your name and your email address, are automatically stored with us for the purpose of processing your enquiry and in case of follow-up questions until the relevant matter has been conclusively resolved. Naturally we do not share this data without your consent.
Customer care by live chat (guuru) (EU, UK, and Swiss customers only)
We provide a chat function operated by guuru-AG on our website; the principal place of business for guuru AG is Bösch 67, 6331 Hünenberg, Switzerland. However, no data for it is collected through our website and no data for it is stored with tonies GmbH. If you ask a question through this chat function, a real person from a selected group of customers of tonies GmbH answers you. tonies GmbH is not responsible for content that is exchanged in chats. The data sent in chats is transferred directly to guuru and stored for analysis purposes. The personal data provided is treated as confidential and regularly erased by guuru after the relevant enquiry is processed. Data is not forwarded to third parties for marketing purposes.
Further information about the processing of data by guuru can be found in theguuru privacy policy. If you have questions, you can also contact the guuru data protection officer directly: dataprotection@guuru.com.
Cookies
Parts of our website use what are called cookies. Cookies do not cause any harm to your computer and do not contain any viruses. Cookies serve to make our offering more user-friendly, effective and secure. Cookies are small text files that are stored on your computer by your browser. We notify you about the use of cookies, this Data Protection Policy and your options for protection in relation to them through a corresponding banner on our websites when you open them. If you continue to visit our websites, we assume that you agree to the use of cookies on our websites.
Most of the cookies that we use are so-called session cookies. They are automatically deleted after you finish your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognise your browser when you next visit so that our websites are made more user-friendly. The following data, in particular, is stored in such cookies and transferred: items in the shopping basket and log-in details.
Furthermore, our websites use cookies that enable an analysis of your surfing patterns. The aim of this is to improve the quality of our websites and the content on them and for us to be able to optimise our offering constantly. The following data, in particular, may be transferred: frequency of page visits, utilisation of website functions. This user data is made pseudonymous through the technical precautions that we have taken, which leaves us unable to match the data with the visiting user. The data is not stored together with other personal data of our users.
You can configure your browser’s settings to inform you when cookies are set and to allow cookies only in certain situations, to prohibit cookies in certain situations or in general or to delete cookies automatically when you close your browser. Furthermore, you can at any time delete cookies that have already been set using your browser or other software programs. If you deactivate cookies, the functionality of our websites may be restricted.
If you want to adjust the cookie settings on my.tonies.com, you can do sohere. To change the cookie settings on meine.tonies.de, please clickhere.
Please refer to the following table for a list of the cookies that are set by us.
Cookie name |
Provider |
Set on |
Description |
Function |
Standard expiry time |
__adroll_fpc |
Boxine |
us.tonies.com |
Used for real-time bidding by advertisers to present relevant advertisements |
Marketing |
365 days |
_ajs%3Acookies |
Boxine |
us.tonies.com |
Supports use, service performance, and functionality of our website |
Technologically neccessary |
364 days |
__ar_v4 |
Boxine |
us.tonies.com |
Associated with the DoubleClick advertising service from Google. Helps with tracking conversion rates for ads |
Statistics |
364 days |
_attrb |
Boxine |
us.tonies.com |
Used to track performance of ads and marketing campaigns |
Statistics |
364 days |
_attrg |
Boxine |
us.tonies.com |
Used to track performance of ads and marketing campaigns |
Statistics |
364 days |
_attru |
Boxine |
us.tonies.com |
Used to track performance of ads and marketing campaigns |
Statistics |
364 days |
cart |
Boxine |
us.tonies.com |
Used in connection with our shopping cart |
Technologically necessary |
13 days |
cart_currency |
Boxine |
us.tonies.com |
Used in connection with our shopping cart |
Technologically necessary |
13 days |
cart_sig |
Boxine |
us.tonies.com |
Used in connection with checkout |
Technologically necessary |
13 days |
cart_ts |
Boxine |
us.tonies.de |
Used in connection with checkout |
Technologically necessary |
13 days |
cart_ver |
Boxine |
us.tonies.com |
Used in connection with checkout |
Technologically necessary |
13 days |
_landing_page |
Boxine |
us.tonies.com |
Used for tracking on landing pages |
Statistics |
13 days |
_orig_referrer |
Boxine |
us.tonies.com |
Used for tracking on landing pages |
Statistics |
13 days |
secure_customer_sig |
Boxine |
us.tonies.com |
Used in connection with a customer login |
Technologically necessary |
7304 days |
_secure_session_id |
Boxine |
us.tonies.de |
Used in connection with navigation through a storefront |
Technologically necessary |
1 day |
_shg_user_id |
Boxine |
us.tonies.com |
Collects data on userbehaviour from multiple websites, in order to present more relevant advertisements and limit the number of times that the visitor is shown the same advertisement |
Marketing |
1824 days |
_shopify_fs |
Boxine |
us.tonies.com |
used for Shopify analytics |
Statistics |
719 days |
_shopify_y |
Boxine |
us.tonies.com |
Associated with Shopify's analytics suite |
Statistics |
364 days |
_swym-np_r |
Boxine |
us.tonies.de |
Enables user to store items in a wishlist |
Technologically necessary |
364 days |
swym-session-id |
Boxine |
us.tonies.de |
Enables user to store items in a wishlist |
Technologically necessary |
1 day |
_y |
Boxine |
us.tonies.com |
used for Shopify analytics |
Statistics |
364 days |
_fbp |
us.tonies.com, tonies.com/en-gb/, tonies.de |
Displays a number of advertising products, including real-time offers from third-party providers |
Marketing |
3 months |
|
_fr |
us.tonies.com, tonies.com/en-gb/, tonies.de |
Encrypted Facebook and browser IDs for optimisation of advertising |
Marketing |
3 months |
|
_ga |
us.tonies.com, support.tonies.de, tonies.com, tonies.de |
Website statistics and optimisation of the website's functionality |
Statistics |
2 years |
|
_gat |
us.tonies.com, support.tonies.de, tonies.com/en-gb/, tonies.de |
Used by Google Analytics to limit the request rate |
Statistics |
1 day |
|
_gid |
us.tonies.com, tonies.com/en-gb/, tonies.de |
Registers a unique ID to generate statistical information about how the visitor uses the website |
Statistics |
1 day |
|
IDE |
us.tonies.com, support.tonies.de, tonies.com/en-gb/, tonies.de |
Registers and reports user actions on the website after being displayed or clicked on, for the purpose of measuring effectiveness |
Statistics |
1 year |
|
guuruGa |
Guuru |
tonies.com/en-gb/, tonies.de, my.tonies.com |
Preserves the chat on the website |
Technologically necessary |
2 years |
guuruGa_gid |
Guuru |
tonies.com/en-gb/, tonies.de, my.tonies.com |
Preserves the chat on the website |
Technologically necessary |
8 days |
guuru-state |
Guuru |
tonies.com/en-gb/, tonies.de, my.tonies.com |
Preserves the chat on the website |
Technologically necessary |
Never |
_hjClosedSurveyInvites |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
It is used to ensure that the same invite does not reappear if it has already been shown. |
Statistics |
365 days |
_hjDonePolls |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
It is used to ensure that the same invite does not reappear if it has already been shown. |
Statistics |
365 days |
_hjMinimizedPolls |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
It is used to ensure that the widget stays minimized when the visitor navigates through your site. |
Statistics |
365 days |
_hjShownFeedbackMessage |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This is done so that the Incoming Feedback will load as minimized immediately if the visitor navigates to another page where it is set to show. |
Statistics |
365 days |
_hjid |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
It is used to persist the Hotjar User ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID. |
Statistics |
365 days |
_hjRecordingLastActivity |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This gets updated when a visitor recording starts and when data is sent through the WebSocket (the visitor performs an action that Hotjar records). |
Statistics |
Session |
_hjTLDTest |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This is done so that cookies can be shared across subdomains (where applicable). To determine this, we try to store the _hjTLDTest cookie for different URL substring alternatives until it fails. After this check, the cookie is removed. |
Statistics |
Session |
_hjUserAttributesHash |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
User Attributes sent through the Hotjar Identify API are cached for the duration of the session in order to know when an attribute has changed and needs to be updated. |
Statistics |
Session |
_hjCachedUserAttributes |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This cookie stores User Attributes which are sent through the Hotjar Identify API, whenever the user is not in the sample. These attributes will only be saved if the user interacts with a Hotjar Feedback tool. |
Statistics |
Session |
_hjLocalStorageTest |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This cookie is used to check if the Hotjar Tracking Script can use local storage. If it can, a value of 1 is set in this cookie. The data stored in_hjLocalStorageTest has no expiration time, but it is deleted almost immediately after it is created. |
Statistics |
Under 100ms |
_hjIncludedInPageviewSample |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This cookie is set to let Hotjar know whether that visitor is included in the data sampling defined by your site's pageview limit. |
Statistics |
30 minutes |
_hjIncludedInSessionSample |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This cookie is set to let Hotjar know whether that visitor is included in the data sampling defined by your site's daily session limit. |
Statistics |
30 minutes |
_hjAbsoluteSessionInProgress |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This cookie is used to detect the first pageview session of a user. This is a True/False flag set by the cookie. |
Statistics |
30 minutes |
_hjFirstSeen |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
It is used by Recording filters to identify new user sessions. |
Statistics |
Session |
hjViewportId |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
This stores information about the user viewport such as size and dimensions. |
Statistics |
Session |
_hjRecordingEnabled |
Hotjar |
tonies.com/en-gb/, us.tonies.com, tonies.com/fr-fr/, my.tonies.com |
It is used to see if the user is already in a recording in a particular session. |
Statistics |
Session |
__kla_id |
Klaviyo |
us.tonies.com, tonies.com/en-gb/, tonies.de |
Collects data about the user's behaviour on the website to optimise and personalise newsletter frequency and content |
Marketing |
2 years |
GPS |
YouTube |
us.tonies.com, support.tonies.de, tonies.com/en-gb/, tonies.de |
Registers a unique ID on mobile devices to enable tracking based on the geographical GPS location |
Marketing |
1 day |
test_cookie |
YouTube |
us.tonies.com, support.tonies.de, tonies.com/en-gb/, tonies.de |
Used to check whether the user's browser supports cookies |
Marketing |
1 day |
VISITOR_INFO_LIVE |
YouTube |
us.tonies.com, support.tonies.de, tonies.com/en-gb/, tonies.de |
Attempts to estimate the user bandwidth on pages with integrated YouTube videos |
Marketing |
179 days |
YSC |
YouTube |
us.tonies.com, support.tonies.de, tonies.com/en-gb/, tonies.de |
Registers a unique ID to maintain statistics for YouTube videos that the user has watched |
Marketing |
Session |
_cfduid |
Zendesk |
us.tonies.com, support.tonies.de, my.tonies.com |
Enables contact and usage of a website's help function |
technically necessary |
1 year |
__zlcmid |
Zendesk |
us.tonies.com |
store visitor's ID for widget's authentication |
Technologically necessary |
365 days |
_derived_epik |
us.tonies.com |
Used by Pinterest to evaluate the use of services. |
Statistics |
1 year |
|
_ga_56MY7NWFBL |
Google Analytics |
us.tonies.com |
This cookie is installed by Google Analytics. |
Statistics |
2 years |
_ga_6B1DN9YBN6 |
Google Analytics |
us.tonies.com |
This cookie is installed by Google Analytics. |
Statistics |
2 years |
_ga_KNZTRNFKJT |
Google Analytics |
us.tonies.com |
This cookie is installed by Google Analytics. |
Statistics |
2 years |
_ga_QKGTFR3JQP |
Google Analytics |
us.tonies.com |
This cookie is installed by Google Analytics. |
Statistics |
2 years |
_ga_ZC3J7696X4 |
Google Analytics |
us.tonies.com |
This cookie is installed by Google Analytics. |
Statistics |
2 years |
_gcl_au |
us.tonies.com |
Website statistics and optimisation of the website's functionality |
Statistics |
3 months |
|
_pin_unauth |
us.tonies.com |
Used by Pinterest to evaluate the use of services |
Statistics |
1 year |
|
_sp_id.c26c |
Snowplow |
us.tonies.com |
Stores a unique user ID to enable product reviews |
Statistics |
2 years |
_uetvid |
Bing Ads |
us.tonies.com |
To store and track visits across websites |
Marketing |
16 days |
FPID |
Google Analytics |
us.tonies.com |
When using this particular Client for proxying Google Analytics requests, the Server container introduces a new cookie that is only accessible to the webserver and not to browser JavaScript. This cookie is named FPID (First Party Identifier) by default. The value stored in FPID will be used for setting the Client ID in the request to Google’s servers |
Statistics |
2 years |
ku1-sid |
Klarna |
us.tonies.com |
This cookie is used for the payment method Klarna to function. ku1-sid contains a session id for the communication with Klarna. |
Technologically necessary |
Session |
ku1-vid |
Klarna |
us.tonies.com |
This cookie is used for the payment method Klarna to function. ku1-vid contains a visitor identifier for the communication with Klarna. |
Technologically necessary |
1 year 4 months 27 days |
sas_m_awin |
Share A Sale (AWIN) |
us.tonies.com |
Set when a user visits the website via an affiliate link |
Statistics |
1 week |
tatari-session-cookie |
Tatari |
us.tonies.com |
Used to track performance of marketing campaigns |
Statistics |
3650 days |
tatari-user-cookie |
Tatari |
us.tonies.com |
Used to track performance of marketing campaigns |
Statistics |
3650 days |
_pin_unauth |
us.tonies.com |
A first party cookie which groups actions for users who cannot be identified by Pinterest. |
Statistics |
1 year |
|
swym-cu_ct |
Swym |
us.tonies.com |
Enables user to store items in a wishlist. |
Performance |
364 days |
swym-currentFilter |
Swym |
us.tonies.com |
Enables user to store items in a wishlist. |
Performance |
364 days |
swym-email |
Swym |
us.tonies.com |
Enables user to store items in a wishlist. |
Performance |
364 days |
swym-instrumentMap |
Swym |
us.tonies.com |
Enables user to store items in a wishlist. |
Performance |
364 days |
swym-ninfo |
Swym |
us.tonies.com |
Enables user to store items in a wishlist. |
Performance |
364 days |
swym-pid |
Swym |
us.tonies.com |
Enables user to store items in a wishlist. |
Performance |
364 days |
swym-swymRegid |
Swym |
us.tonies.com |
Enables user to store items in a wishlist. |
Performance |
364 days |
_shopify_ga |
Shopify |
us.tonies.com |
We use Google Analytics cookies embedded on our site to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. |
Statistics |
Session |
_sp_id.333e |
Snowplow |
us.tonies.com |
to store a unique user ID |
Statistics |
2 years |
bis_id |
Back In Stock |
us.tonies.com |
used in the online store to register conversions for Back in Stock |
Statistics |
30 days |
checkout_one_experiment |
Shopify |
us.tonies.com |
This cookie is necessary for the operation of the payment functionality. |
Technologically necessary |
2 weeks |
KL_FORMS_MODAL |
Klaviyo |
us.tonies.com |
Tracks when someone subscribes (opts in) to a form |
Technologically necessary |
2 years |
klaClosedPopup |
Klaviyo |
us.tonies.com |
Stores if a message has been dismissed |
Technologically necessary |
1 year |
smsbump_form_pages_session63039 |
Yotpo (SMS Bump) |
us.tonies.com |
Facilitates and optimizes our SMS and email marketing campaigns |
Marketing |
365 days |
tatari-cookie-test |
Tatari |
us.tonies.com |
Used to track performance of marketing campaigns |
Statistics |
3650 days |
KEYCLOAK_IDENTITY / KEYCLOAK_IDENTITY_LEGACY |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
authenticates the User |
Technologically necessary |
Session |
KEYCLOAK_LOCALE / KEYCLOAK_LOCALE_LEGACY |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
stores language settings |
Technologically necessary |
Session |
KC_RESTART / KC_RESTART_LEGACY |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
authenticates the user |
Technologically necessary |
Session |
KEYCLOAK_SESSION / KEYCLOAK_SESSION_LEGACY |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Maintaining the active session in Single Sign-On |
Technologically necessary |
30 days |
_cfduid |
Boxine |
support.tonies.de, my.tonies.com |
Option of contacting or using the help centre on a website |
Technologically necessary |
1 year |
lang |
Boxine |
my.tonies.com, meine.tonies.de |
stores language preferences of the user |
Technologically necessary |
never |
setup_domainfix_base_url |
Boxine |
my.tonies.com, meine.tonies.de |
Ensures the correct URL throughout the entire Toniebox set-up |
Technologically necessary |
1 hour |
ZD-buid |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Unique ID that identifies the user during repeat visits |
Technologically necessary |
Never |
ZD-currentTime |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Registers date and time of the user's last visit to the website |
Technologically necessary |
Never |
ZD-store |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Registers whether the 'Zendesk Answer Bot' self-service assistant has been displayed to the user |
Technologically necessary |
Never |
ZD-suid |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Unique ID that identifies the user's session |
Technologically necessary |
Never |
_zlcmid |
Boxine |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Preserves states of the user during all page requests |
Technologically necessary |
1 year |
_zlcstore |
Boxine |
my.tonies.com, tonies.de, meine.tonies.de |
Ensures the chat box function's functionality on the website |
Technologically necessary |
Never |
zte# |
Boxine |
my.tonies.com, meine.tonies.de |
Stores a live chat ID that recognises a device between visits during a chat session |
Technologically necessary |
Session |
ads/ga-audiences |
support.tonies.de, tonies.com, tonies.de |
Website statistics and optimisation of the website's functionality |
Statistics |
Session |
|
AWSALB |
Zendesk |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Registers which server cluster is serving the visitor. Used in connection with load balancing to optimise the user experience |
Technologically necessary |
6 days |
AWSALBCORS |
Zendesk |
tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Registers which server cluster is serving the visitor. Used in connection with load balancing to optimise the user experience |
Technologically necessary |
6 days |
_cfruid |
Zendesk |
support.tonies.de, tonies.com/en-gb/, my.tonies.com, tonies.de, meine.tonies.de |
Load distribution, provision of website content and provision of a DNS connection for website operators |
Technologically necessary |
Session |
__adroll_fpc |
Boxine |
us.tonies.com |
Used for real-time bidding by advertisers to present relevant advertisements |
Marketing |
365 days |
_ajs%3Acookies |
Boxine |
us.tonies.com |
Supports use, service performance, and functionality of our website |
Technologically neccessary |
364 days |
__ar_v4 |
Boxine |
us.tonies.com |
Associated with the DoubleClick advertising service from Google. Helps with tracking conversion rates for ads |
Statistics |
364 days |
_attrb |
Boxine |
us.tonies.com |
Used to track performance of ads and marketing campaigns |
Statistics |
364 days |
_attrg |
Boxine |
us.tonies.com |
Used to track performance of ads and marketing campaigns |
Statistics |
364 days |
_attru |
Boxine |
us.tonies.com |
Used to track performance of ads and marketing campaigns |
Statistics |
364 days |
cart |
Boxine |
us.tonies.com |
Used in connection with our shopping cart |
Technologically necessary |
13 days |
cart_currency |
Boxine |
us.tonies.com |
Used in connection with our shopping cart |
Technologically necessary |
13 days |
cart_sig |
Boxine |
us.tonies.com |
Used in connection with checkout |
Technologically necessary |
13 days |
cart_ts |
Boxine |
us.tonies.de |
Used in connection with checkout |
Technologically necessary |
13 days |
cart_ver |
Boxine |
us.tonies.com |
Used in connection with checkout |
Technologically necessary |
13 days |
_landing_page |
Boxine |
us.tonies.com |
Used for tracking on landing pages |
Statistics |
13 days |
_orig_referrer |
Boxine |
us.tonies.com |
Used for tracking on landing pages |
Statistics |
13 days |
secure_customer_sig |
Boxine |
us.tonies.com |
Used in connection with a customer login |
Technologically necessary |
7304 days |
_secure_session_id |
Boxine |
us.tonies.de |
Used in connection with navigation through a storefront |
Technologically necessary |
1 day |
_shg_user_id |
Boxine |
us.tonies.com |
Collects data on userbehaviour from multiple websites, in order to present more relevant advertisements and limit the number of times that the visitor is shown the same advertisement |
Marketing |
1824 days |
_shopify_fs |
Boxine |
us.tonies.com |
used for Shopify analytics |
Statistics |
719 days |
“Do Not Track”. Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers.
Third-party systems on our website and in our apps
Data protection policy for use of Bing
We place Microsoft Bing for the purposes of personalized online ads based on interests and location. Advertisements are displayed based on search requests on websites in theMicrosoft Ad Network. Bing is provided by Microsoft Ireland Operations Limited, Attn: Data Protection Officer, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
When a user clicks on an ad, Bing places a cookie on the user’s device. For more information on the cookie technology used, please see theirMicrosoft Bing Ads privacy policy.
With the use of this technology, Bing, and we as their customer, receive the information that a user has clicked on an ad and was redirected to our websites. The information acquired this way is solely used for statistical analysis related to ad optimization. We do not receive any information that would allow us to personally identify a visitor. The statistics provided to us by Bing include the total number of users who have clicked on one of our ads and, where applicable, whether they were redirected to a page on our website that has a conversation tag. These statistics allow us to track which search terms most often lead to our ads receiving clicks, and which ads lead to the user contacting us via the contact form.
If you do not want this, you can prevent the storage of the cookies required for this technology by, for example, using the settings in your browser or your App. Should you do so, your visit will not be incorporated into user statistics.
You also have the option to choose the types of Bing Ads or deactivate interest-based ads on Bing throughAd settings. Alternatively, you can deactivate third-party use of cookies by using the Network Advertising Initiative’sopt-out tool.
Data protection policy for the use of Facebook plug-ins (Like button)
Plug-ins for the Facebook social network provided by Facebook Inc., 1 Hacker Way, Menlo Park, California 94025, United States, are integrated into our website. You can identify a Facebook plug-in on our website through the Facebook logo or ‘Like’ button. You can find an overview of Facebook plug-inshere. If you do not live in the United States or Canada, the controller for the processing of personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Central Harbour, Dublin 2, Ireland.
A direct connection between your browser and the Facebook server is established through the plug-in when you visit our website. This provides Facebook with the information that you have visited our website with your IP address. If you click on the Facebook ‘Like’ button while logged in to your Facebook account, you can link to the content on our website from your Facebook profile. Facebook will be able to match your visit of our website with your user account as a result. We would like to point out that we as the website provider have no knowledge of the content of transferred data nor the way in which Facebook uses it. Further information about the collection, processing and use of personal data by Facebook and possible settings for protecting your privacy can be found inFacebook’s privacy policy.
If you do not wish for Facebook to be able to match your visit of our website with your Facebook account, please log out of your Facebook account before visiting our website.
Data protection policy for the use of Facebook Website Custom Audiences
Also used on our website is the ‘Website Custom Audiences’ beacon from the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, United States. It involves the use of a Web beacon to identify website visitors.
A direct connection between your browser and the Facebook server is established through this Web beacon when visiting our website. This provides Facebook with the information that you have visited our website with your IP address. Facebook can then match the visit to our website with your user account and will use this information to personalise the display of Facebook advertisements (the legitimate interest here within the meaning of GDPR Article 6(1)(f) is the optimisation of the shopping experience). We as the website provider have no knowledge of the content of transferred data nor the way in which Facebook uses it.
For further information, please look atFacebook’s privacy policy. You can of course opt out from the collection of data through Custom Audiences. To do this, clickon this link. If you do not live in the United States or Canada, the controller for the processing of personal data is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Central Harbour, Dublin 2, Ireland.
Data Protection Policy for the use of Google AdWords
We place Google AdWords display advertisements and use Google conversion tracking for the purposes of personalized online ads based on interests and location. Advertisements are displayed based on search requests on websites in theGoogle ad network. Google AdWords is provided by Google LLC, Gordon House, Barrow Street, Dublin 4, Ireland.
When a user clicks on an ad, Google places a cookie on the user’s device. For more information on the cookie technology used, please see Google’s statements onwebsite statistics and theirdata privacy policy.
With the use of this technology, Google, and we as their customer, receive the information that a user has clicked on an ad and was redirected to our websites. The information acquired this way is solely used for statistical analysis related to ad optimization. We do not receive any information that would allow us to personally identify a visitor. The statistics provided to us by Google include the total number of users who have clicked on one of our ads and, where applicable, whether they were redirected to a page on our website that has a conversation tag. These statistics allow us to track which search terms most often lead to our ads receiving clicks, and which ads lead to the user contacting us via the contact form.
If you do not want this, you can prevent the storage of the cookies required for this technology by, for example, using the settings in your browser or your App. Should you do so, your visit will not be incorporated into user statistics.
You also have the option to choose the types of Google ads or deactivate interest-based ads on Google throughad settings. Alternatively, you can deactivate third-party use of cookies by using the Network Advertising Initiative’sopt-out tool.
Data protection policy for use of Google Web analytics services
We use the functions of the Google Analytics service (Google Tag Manager, Firebase, Google Analytics) on our website and in the apps. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States. Google Analytics uses cookies. Cookies are small text files that are stored on your computer to enable an analysis of your use of this website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the United States and stored there.
However, if IP anonymisation is enabled on this website, Google will truncate your IP address within member states of the European Union or in other countries party to the Agreement on the European Economic Area beforehand. Only in exceptional cases is the full IP address transferred to a Google server in the United States and truncated there. Google uses this information on behalf of the operator of this website to analyse your use of the website, compile reports on website activity and perform other services associated with website activity and Internet usage for the website operator. The IP address transmitted from your browser through Google Analytics will not be merged with other Google data.
You can stop cookies being stored by choosing the relevant settings in your browser, though you should be aware that you may not be able to use all of this website’s functions fully in this case. Furthermore, you can stop Google from storing and processing the cookie-generated data relating to your usage of this website (including your IP address) by downloading and installing the browser plug-in available overthe following link.
Further information and Google’s applicable data protection provisions (with information about the collection, processing and use of personal data by Google and your options for protection in relation to it) can be viewed in theprivacy policy andterms of service. Google Analytics is explained in more detailhere.
Data protection policy for use of Google Optimize
We use Google Optimize from Google LLC, Gordon House, Barrow Street, Dublin 4, Ireland, to carry out so-called A/B tests on our online offering. This involves various versions of our online offering being published and measured simultaneously.
When testing different versions, data such as the operating system used, the browser’s user agent and the time of viewing may be collected to measure the success of a version. Web-tracking technologies are used to connect the aforementioned data with the version of our online offering undergoing testing.
The use of Google Optimize is based on our legitimate interests, i.e. our interest in optimising our online offering pursuant to GDPR Article 6(1)(f).
We cannot influence the actual duration of time for which processed data is stored, as this is determined by Google LLC. More information can be found in theGoogle Optimize privacy policy.
Data protection policy for use of Hotjar
Type and scope of processing
We have integrated Hotjar Behavior Analytics on our website. Hotjar Behavior Analytics is a service of Hotjar Ltd. and provides optimization tools that analyze the behavior and feedback of users of our website through analysis and feedback tools.
We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.
For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.
Hotjar Behavior Analytics uses cookies and other browser technologies to evaluate user behavior and recognize users. This information is used, among other things, to compile reports on website activity and to statistically analyze visitor data. Furthermore, Hotjar Behavior Analytics records clicks, mouse movements and scroll heights in order to create so-called heat maps and session replays. In this case, your data is passed on to the operator of Hotjar Behavior Analytics, Hotjar Ltd, Hotjar Ltd, Level 2, St Julians Business Centre 3 Elia Zammit Street St Julians STJ 3155 Malta.
Purpose and legal basis
We process your data with the help of Hotjar Behavior Analytics for the purpose of optimizing our website and for marketing purposes based on your consent pursuant to Art. 6 para. 1 lit. a. GDPR.
Storage period
The concrete storage period of the processed data cannot be influenced by us, but is determined by Hotjar Ltd. Further information can be found in the privacy policy for Hotjar Behavior Analytics:Hotjar privacy policy.
Data protection policy for use of Instagram
Our website uses plug-ins from the Instagram social network operated by Instagram LLC, 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, United States. You can recognise the Instagram plug-in on our website through the Instagram button. When you click on the Instagram button while logged in to your Instagram account, links to the content on our website may be published on your Instagram profile. Instagram will be able to match your visit of our website with your user account as a result. We as the website provider have no knowledge of the content of transferred data nor the way in which Instagram uses it. If you do not wish for this information to be transferred to Instagram in the described manner, you can stop it being transferred by logging out of your Instagram account before visiting our website. Further information about this and about the collection, processing and use of personal data by Instagram can be found in theInstagram privacy policy.
Data protection policy for use of Klaviyo
We have integrated components of Klaviyo into our website. Klaviyo is a service provided by Klaviyo, Inc. and offers marketing automation software for marketing services and products, including SEO, content creation, lead management, newsletters, marketing via email and SMS; and Web analytics.
Klaviyo uses cookies and other browser technologies to analyse usage patterns and recognise users. This information is used for purposes including the compilation of reports about activity on the website. Furthermore, Klaviyo is used to store and transfer data entered in forms using cookies and to store and transfer your IP address. In this case, your data is disclosed to the operator of Klaviyo, Klaviyo, Inc., 125 Summer Street, Boston, Massachusetts, 02111, United States.
We process your data with the help of Klaviyo for the purpose of optimising our website and for marketing purposes, based on your consent within the meaning of GDPR Article 6(1)(a).
We cannot influence the actual duration of time for which processed data is stored, as this is determined by Klaviyo, Inc. More information can be found in theKlaviyo privacy policy.
Data protection policy for use of Outbrain
A visitor pixel provided by Outbrain Inc., 39 West 13th Street, 3rd floor, New York, NY 10011, United States, is used on our website to measure conversion rates.
Doing this allows us to track the actions of users after they have been redirected to our website by clicking on an Outbrain advertisement. This process serves to analyse the effectiveness of our Outbrain advertisements for statistical and market research purposes and can contribute to the optimisation of future marketing activities. The collected data is anonymous for us and therefore cannot be used by us to infer user identities.
Further information about data protection at Outbrain can be foundhere. You can object at any time to tracking for the purpose of displaying interest-based recommendations; to do this, click on the ‘Opt Out’ field in the Outbrain privacy policy available to read athttps://www.outbrain.com/legal/privacy#privacy-policy.
Data protection policy for use of Pinterest
We use social plug-ins from the social network Pinterest, operated by Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, United States (‘Pinterest’), on our website. When you visit a page that contains such a plug-in, your browser establishes a direct connection with the Pinterest servers. The plug-in transfers log data to the Pinterest server in the United States when it does this. This log data can potentially include your IP address, the addresses of pages visited that also contain Pinterest functions, the browser’s type and settings; the date and time of the request; the way you use Pinterest and cookies.
Further information about the collection, processing and use of personal data by Pinterest and your rights and options for protecting your privacy in relation to it can be found in thePinterest privacy policy.
Data protection policy for use of Twitter
Functions for the Twitter service are integrated into our website. These functions are offered by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, United States. By using Twitter and the ‘retweet’ function, the websites you visit will be linked with your Twitter account and shared with other users. Data will also be transferred to Twitter as part of this. We would like to point out that we as the website provider have no knowledge of the content of transferred data nor the way in which Twitter uses it. Further information about the collection, processing and use of personal data by Twitter can be found in theTwitter privacy policy.
You can change your privacy settings for Twitter in yourTwitter account settings. You can also stop information being transferred to Twitter by logging out of your Twitter account before visiting our website.
Data protection policy for use of Yotpo
We use the SMS Bump service provided by Yotpo, Inc. and SMSBump Ltd. to send marketing text/SMS messages to those who opt in. Yotpo may collect your phone number and text communications to provide this service. You can contact Yotpo at Yotpo, Inc., 400 Lafayette Street, 4th Floor, New York, NY 10003. Further information about the processing of data by Yotpo/SMS Bump can be found in the Yotpoprivacy policy. If you have questions, you can also contact the SMS Bump data protection officer directly:privacy@yotpo.com.
Data protection policy for use of Zendesk
To process customer enquiries, we use the Zendesk ticket system, a customer service platform provided by Zendesk Inc., 989 Market Street #300, San Francisco, CA 94102. The required data, such as your name and email address, is collected through our website for this purpose.
Further information about the processing of data by Zendesk can be found in theZendesk privacy policy. If you have questions, you can also contact the Zendesk data protection officer directly: privacy@zendesk.com.
By sending the form, the data is transferred to our section at Zendesk and serves the sole purpose of processing the relevant enquiry. The collected data is stored on servers located within the EU and treated as confidential in accordance with the GDPR. The data is archived at Zendesk for documentation purposes after the relevant enquiry has been processed. Data is not forwarded to third parties for marketing purposes.
Disclosure of personal data to outside of our company when shopping in our online shops or Audio Library
The personal data collected by us is disclosed to the delivery company contracted for delivery as part of the performance of the contract, provided this is necessary for the delivery of the goods. We forward your payment data to the contracted financial institution for the purpose of processing payments.
When paying with PayPal in our DE/UK online shops or Audio Library, we forward your payment data to PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (PayPal), for the purpose of processing payments. By selecting the ‘PayPal’ payment option, you give your consent to the transfer of personal data required to process payment. This personal data usually includes your forename, surname, address, email address, IP address, telephone number, mobile number and other data required to process payment and fulfil the order. The data is transferred for the purpose of processing payment and preventing fraud. Further information related to privacy law, including the credit agencies used by PayPal and your rights as a data subject, can be found inthe PayPal privacy policy.
If you have decided to pay in our online shops with credit/debit cards issued by Visa or Mastercard, the payment will be processed by HUELLEMANN & STRAUSS ONLINESERVICES S.à.r.l., 1, Place du Marché, L-6755 Grevenmacher, R.C.S. Luxembourg B 144133. By selecting this payment option, you give your consent to the transfer of personal data required to process payment. The data is transferred for the purpose of processing payment.
Duration of storage of your data
We only process and store your personal data for as long as it is required to fulfil our contractual and legal obligations. If the reason for storage ceases to apply, your personal data will be erased by us on a regular basis unless it is necessary to keep processing it for a further, limited period of time in order to satisfy retention obligations under commercial and tax laws or to preserve evidence in accordance with statutes of limitation.
Protection of your personal data
We endeavour to implement appropriate protective measures to ensure the security, integrity and confidentiality of the information that you provide. For this reason, we have established technological security strategies that are intended to protect the personal information that we draw from you. Furthermore, we uphold security measures that require compliance with applicable data protection regulations. Your personal data is transferred over the Internet via SSL in an encrypted format during the order process and in mytonies. We secure our website and other systems against loss, destruction, access, modification and dissemination of your data by unauthorised persons using technical and organisational measures.
It is only possible to access your Tonie-Account after entering your personal password. The same applies to the app. You should always treat your log-in details as confidential and close your browser window when you have finished communicating with us, especially if you share your computer, tablet or smartphone with others.
Job applications
You can also apply for a job within our company by electronic means. We have contracted Personio GmbH, Rundfunkplatz 4, 80335 Munich, to support us with IT services for the application and recruitment processes. Detailed information about data protection at Personio can be foundhere. Your details are of course only ever used to process your application and generally are not shared with third parties. Please note that emails sent without encryption are transferred in a manner that is not protected against unauthorised access. For this reason, you should use the application form provided by us for the purpose attonies.de and consider the dedicatedprivacy policy applicable to applications sent to us. This policy contains extensive information about data protection in connection with job applications.
Children’s Information
Although our services are intended to be enjoyed by users of all ages, we only collect personal information from adult users, and do not knowingly collect personal information from children under 13 (or other age as required under applicable law) as part of our services. Users may not upload audio of a child or other personal information that may identify a child without first obtaining the explicit consent of that child’s parent or guardian. Parents or guardians should supervise their children’s use of our services at all times.
If you are a parent or guardian and learn that your child has provided us with personal information without your consent, you may contact us as set forth below. If we learn that we have collected any personal information from a child in violation of applicable law, we will promptly take steps to delete such information, unless we have a legal obligation to retain it, and terminate the child’s account as applicable.
Supplemental notice for US residents
The following section applies to our US customers.
Your Choices regarding Cookies.
You may stop or restrict the placement of cookies and similar technologies on your device or remove them by adjusting your preferences as your browser or device permits. The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy, at www.networkadvertising.org/managing/opt_out.asp,http://www.youronlinechoices.eu/,https://youradchoices.ca/choices/, and www.aboutads.info/choices/. To separately make choices for mobile apps on a mobile device, you can download DAA’s AppChoices application from your device’s app store. Alternatively, for some devices you may use your device’s platform controls in your settings to exercise choice.
Information for residents of California
This section only applies to our processing of personal information that is subject to the California Consumer Privacy Act of 2018 (“CCPA”).
Personal data collected and shared.
The CCPA provides California residents with the right to know what categories of personal information Boxine has collected about them and whether Boxine disclosed that personal information for a business purpose (e.g., to a service provider) in the preceding 12 months. California residents can find this information below:
Category of Personal Information Collected |
Examples |
Category of Third Parties to Whom We Disclose Information |
A. Identifiers. |
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers. |
• Service Providers • Data analytics providers • Advertising networks |
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). |
A name, phone number, or address. |
• Service Providers |
C. Protected classification characteristics under California or federal law. |
Age (40 years or older) |
• Service Providers • Data analytics providers |
D. Commercial information. |
Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
• Service Providers • Data analytics providers • Advertising networks |
E. Internet or other electronic network activity. |
Profile reflecting a consumer’s preferences. |
• Service Providers • Data analytics providers • Advertising networks |
F. Inferences drawn from other personal information to create a profile about a consumer. |
Profile reflecting a consumer’s preferences. |
• Service Providers • Data analytics providers • Advertising networks |
For purposes of the CCPA, Boxine does not “sell” personal information, nor do we have actual knowledge of any “sale” of personal information of minors under 16 years of age.
Additional Privacy Rights for California Residents.
In addition to the rights described in the section titled “Your privacy rights” above, California residents have the following rights:
- Non-Discrimination. California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.
- Authorized Agent. You, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. To designate an authorized agent, please contact us as set forth in the section “Controller’s name and address and whom you can contact” above and provide written authorization signed by you and your designated agent.
- Verification. To protect your privacy when you make a request, we will ask you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include asking you to answer questions regarding your use of our services.
- Refer-a-Friend and Similar Incentive Programs. We may offer referral programs or other incentivized data collection programs. For example, we may offer incentives to you such as discounts or promotional items or credit in connection with these programs, wherein you provide your personal information in exchange for a reward, or provide personal information regarding your friends or colleagues (such as their email address) and receive rewards when they sign up to use our Services. (The referred party may also receive rewards for signing up via your referral.) These programs are entirely voluntary and allow us to grow our business and provide additional benefits to you. The value of your data to us depends on how you ultimately use our Services, whereas the value of the referred party’s data to us depends on whether the referred party ultimately becomes a User of our Services. Said value will be reflected in the incentive offered in connection with each program.
If you are a California resident and would like to exercise any of your rights under the CCPA, please contact us as set forth in the section “Controller’s name and address and whom you can contact” above. We will process such requests in accordance with applicable laws.
Information for residents of Nevada
If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Information to third parties who intend to license or sell that Personal Information. You can exercise this right by contacting us at privacy.us@tonies.com with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account. Please note that we do not currently sell your Personal Information as sales are defined in Nevada Revised Statutes Chapter 603A
Updated March 2022