Privacy policy

1. Controller

2. Name of the register

User, customer and marketing register of the CIO Works GmbH website.

3. Purposes and legal bases of processing

Your data is processed for the following purposes and on the following legal bases:

• Performance of a contract and customer service: processing orders, delivering products and services, customer communication and maintaining the customer relationship (Art. 6(1)(b) GDPR).
• Legal obligations: compliance with accounting, tax and consumer protection law (Art. 6(1)(c) GDPR).
• Legitimate interest: securing the operation of the website, preventing misuse, analysing and developing the website, and B2B communication (Art. 6(1)(f) GDPR).
• Consent: sending newsletters, direct marketing and non-essential cookies (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time.

4. Personal data processed

The following categories of data may be processed:

• Basic data: name, address, email address, phone number, company name and business ID or VAT number where needed.
• Order and payment data: order history, products and services purchased, billing and payment information.
• Communication data: messages sent via contact forms, customer service correspondence and newsletter subscription data.
• Technical data: IP address, browser type and version, operating system, browsing data on the website and cookie data.

5. Regular sources of data

Personal data is collected primarily:

1. directly from the data subject in connection with website forms, orders, emails or other contact;
2. automatically through use of the website by means of cookies and similar technologies.

6. Disclosure and transfer of data

Data is disclosed to third parties only to the extent necessary to provide the service or where required by law:

• Service providers: web hosting services, payment providers, logistics and transport companies, IT support and newsletter service providers.
• Authorities: where required by law, for example tax or judicial authorities.

If data is transferred outside the EU or EEA, an adequate level of data protection is ensured by using the standard contractual clauses approved by the European Commission or another transfer mechanism permitted under the GDPR.

7. Retention period

Personal data is kept only for as long as necessary to fulfil the purposes set out in this policy:

• Customer and order data: for the duration of the customer relationship and thereafter in accordance with statutory retention periods – typically 6–10 years under German accounting and tax law.
• Marketing data: until the data subject withdraws consent or requests deletion.
• Website log data: for technical and security purposes for a limited period, usually 30–90 days.

8. Rights of the data subject

Under the GDPR you have the following rights:

1. Right of access (Art. 15): the right to know what data about you is stored.
2. Right to rectification (Art. 16): the right to have incorrect or incomplete data corrected.
3. Right to erasure (Art. 17): the right to have your data deleted if there is no longer a legal basis for processing it.
4. Right to restriction of processing (Art. 18): the right to have processing restricted in certain situations.
5. Right to object (Art. 21): the right to object to processing based on legitimate interest or for direct marketing.
6. Right to data portability (Art. 20): the right to receive the data you have provided in a machine-readable format and transfer it to another controller.
7. Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

To exercise your rights, please contact us by email at anna@scandimoments.com.

9. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent data protection authority. The competent authority at the controller’s registered office (Baden-Württemberg, Germany) is:

You can also contact the data protection authority in your own country of residence.

10. Cookies

Our website uses cookies to improve the user experience, analyse visitor numbers and target marketing.

The website has a cookie banner through which you can accept or reject non-essential cookies. You can also change your cookie settings at any time in your browser settings or via the cookie settings link on the website.

11. Data security

Personal data is protected by appropriate technical and organisational measures, including SSL/TLS encryption on the website, firewalls, access management and restricted access rights. Only persons who need the data for their work have access to it.

12. Changes to this privacy policy

We reserve the right to update this privacy policy if legislation or our activities change. The updated version is always published on our website.

This privacy policy was last updated on 22 September 2026.