Privacy policy

We take the protection of your personal data seriously. This policy explains which data we process when you visit matnext.com and when you place an order, for which purposes, on which legal basis and which rights you have.

1. Controller

Pankoke & Hellmich GbR
Fosse Bredde 25
33758 Schloß Holte-Stukenbrock
Germany
Phone: +49 5207 925 6959
Email: info@matnext.com

We are not required to appoint a data protection officer. For all questions about data protection, please contact us at the email address above.

2. Hosting and server log files

The website matnext.com is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, on servers in Frankfurt am Main. The shop system with cart and checkout runs on servers of Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany. We have concluded data processing agreements with both providers.

When you visit the website, the servers automatically process technical data that your browser transmits: IP address, date and time, the page requested, the referring page, browser and operating system. This is necessary to deliver the website securely and to detect attacks. The legal basis is Art. 6 (1) (f) GDPR. The data are deleted as soon as they are no longer needed for these purposes.

Vercel is certified under the EU-U.S. Data Privacy Framework. For any transfer to the USA, the adequacy decision of the European Commission applies, and in addition the EU standard contractual clauses.

3. Cookies and similar technologies

We store information on your device or read it from there only if this is strictly necessary to provide the shop you requested, or if you have consented (§ 25 TDDDG). When you first visit, you choose in the cookie banner which categories you allow. You can change or withdraw your choice at any time with the link "Cookie settings" at the bottom of every page.

Necessary (always active, legal basis § 25 (2) no. 2 TDDDG and Art. 6 (1) (b) and (f) GDPR):

mn_consent: stores your cookie choice, 6 months
mn_lang: stores your language, session
mn_cart_token and mn_cart_meta (local storage of your browser): keep your cart, until you empty it
mn_attr: origin of the visit, 90 days. Without marketing consent it only contains country, language and the domain of the referring website. See section 9.
Cookies of the shop system and of the payment providers during checkout: session, cart and fraud prevention

Statistics (only with consent): Google Analytics, see section 5.

Marketing (only with consent): Google Ads and Meta, see sections 6 and 7. With marketing consent, mn_attr additionally stores the advertising click ID and the campaign parameters of the link you arrived with.

The legal basis for statistics and marketing is your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

4. Google Tag Manager and Consent Mode

We use Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Tag Manager itself does not set cookies. It loads the Google services described below and controls them according to your choice (Google Consent Mode). As long as you have not consented, Google does not set or read any cookies. Google may then receive information without cookies, for example that a page was viewed or an order was placed, without identifiers that relate to you. Google uses this to estimate the success of advertising in aggregated form. If you arrive via a Google ad, the click ID may be passed on in the page address. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in measuring the success of our advertising in a privacy friendly way.

5. Google Analytics

With your consent, we use Google Analytics 4 of Google Ireland Limited to understand how visitors use our shop. Google processes information about your device, the pages you view and your interactions with the shop, using cookies such as _ga. IP addresses are not stored in Google Analytics 4. Google Analytics deletes the event data after the retention period we have set, at most 14 months. Legal basis: Art. 6 (1) (a) GDPR.

6. Google Ads

With your consent, we use conversion tracking and remarketing of Google Ads (Google Ireland Limited). This lets us see whether a visit via our ad led to an order and show our ads to people who have already visited our shop. Google uses cookies such as _gcl_aw for this. Legal basis: Art. 6 (1) (a) GDPR.

7. Meta

With your consent, we may use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, to measure and optimise ads on Facebook and Instagram. Meta then processes information about your visit and, when you order, hashed contact data so that the order can be matched to an ad. We are jointly responsible with Meta for collecting and transmitting the data (Art. 26 GDPR). Legal basis: Art. 6 (1) (a) GDPR.

8. Orders

To process your order we need your name, billing and delivery address, email address, the ordered products and the payment method; your phone number is optional. The legal basis is Art. 6 (1) (b) GDPR. We store order and invoice data for the retention periods required by commercial and tax law, generally 10 years (§ 257 HGB, § 147 AO).

For processing, we pass on the necessary data to the following recipients:

Billbee GmbH, Germany: order processing and invoicing (data processor)
DHL (Deutsche Post AG and DHL Paket GmbH), Bonn, Germany: name and delivery address for delivery
STRATO, Berlin, Germany: sending emails about your order (data processor)
the payment provider you choose, see section 10

9. Origin of an order

With every order we store how you came to our shop: country, language and the domain of the referring website. If you have given marketing consent, we also store the advertising click ID (for example gclid or fbclid), the campaign parameters of the link and the landing page. We use this to evaluate which advertising leads to orders. Legal basis for the data without consent: Art. 6 (1) (f) GDPR; for the advertising data: Art. 6 (1) (a) GDPR. The data are stored with the order.

10. Payment providers

Depending on the payment method you choose, the payment data are processed by:

Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland: card payments, Apple Pay, Google Pay, SEPA direct debit, iDEAL, Wero, Bancontact, EPS, Multibanco, Link
Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, if you choose Klarna. Klarna may carry out an identity and credit check for this purpose.
Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg, if you choose Amazon Pay
PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, if you choose PayPal

Legal basis: Art. 6 (1) (b) GDPR and, for fraud prevention, Art. 6 (1) (f) GDPR. The providers are independently responsible for their processing; their privacy policies apply.

11. Contact

If you contact us by email, we process your details to answer your enquiry. Legal basis: Art. 6 (1) (b) GDPR if your enquiry relates to a contract, otherwise Art. 6 (1) (f) GDPR. We delete the data when your enquiry has been dealt with, unless retention periods apply.

12. Product reviews

If you write a review, we publish your review, the rating and the name you enter. Your email address is not published. Legal basis: Art. 6 (1) (a) GDPR. You can ask us at any time to delete your review.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time with effect for the future (Art. 7 (3)).

Right to object: Where we process data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Düsseldorf, Germany.

14. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. If you choose Klarna, Klarna decides on the payment method on its own responsibility.

Status: September 2026