Privacy policy

Welcome to our website! When you view our content, use the contact form or purchase products in our store, your personal data will be processed. The so-called General Data Protection Regulation (GDPR) obliges us to inform you about the general conditions of processing at the time of data collection. This privacy policy explains what happens to your personal data on our website. This privacy policy also applies accordingly to our social media profiles, unless a separate privacy policy exists there.

A. General information

1. Responsible for data protection processing

Nürnberger-Spielkarten-Verlag GmbH
Lehrberger Str. 12
D-90431 Nürnberg

Telefon: +49 (0)911 96967-0
Telefax: +49 (0)911 96967-25
E-Mail: info@nsv.de

2. Data protection officer

You can reach the data protection officer at: datenschutz@nsv.de

3. Your rights as a data subject

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR), provided that the respective statutory requirements are met and no derogation applies. We would like to point out that you can assert these rights at any time. However, legal requirements such as retention obligations may prevent their fulfillment.

If we process personal data to protect our legitimate interests in accordance with Art. 6 para. 1 f) GDPR, you have a general right to object (Art. 21 GDPR). If there are special reasons arising from your particular situation and we have no overriding interest in the processing, we will stop the processing in the event of your objection.

If we require your consent for the processing of your personal data, we will expressly request this from you in advance.

Consent given can be revoked at any time with effect for the future. However, this does not affect the data processing that has taken place up to that point. The revocation of consent can be declared to us e.g. by e-mail: info@nsv.de or by writing a letter to Nürnberger-Spielkarten-Verlag GmbH, Lehrberger Str. 12, D-90431 Nuremberg.

You also have the right to lodge a complaint with the competent data protection supervisory authority at any time.

4. Recipient of data

Your data will be acknowledged and used by the employees responsible in each case. As the data is stored in our systems, it cannot be ruled out that our IT service providers may take note of it in the course of troubleshooting.

If we disclose data to other persons and companies (processors or third parties) as part of our processing, transfer it to them or otherwise grant them access to the data, this will only be done on the basis of legal permission (e.g. if the transfer of data to third parties pursuant to Art. 6 para. 1 p. 1 b) GDPR is necessary for the performance of a contract), you have given your consent, a legal obligation provides for this or on the basis of our legitimate interests (e.g. when using agents, hosting providers, tax, business and legal advisors, customer care, accounting, billing and similar services that allow us to efficiently and effectively fulfill our contractual obligations, administrative tasks and duties).

4.1 Amazon Payments Europe s.c.a.

We enable payment via Amazon Pay. The provider of the payment service is Amazon Payments Europe s.c.a., 38 avenue J.F. Kennedy, L-1855 Luxembourg (“Amazon Payments”).

When paying with Amazon Pay, Amazon Payments collects various personal data from you. Details can be found in the Amazon Payments privacy policy at: https://pay.amazon.de/help/201212490.

The transmission of your data (name, address, payment data) to Amazon Payments is based on Art. 6 para. 1 sentence 1 a) GDPR (consent) and Art. 6 para. 1 sentence 1 b) GDPR (processing for the performance of a contract). You can withdraw your previously given consent at any time. Data processing operations carried out in the past remain effective in the event of revocation.

4.2 Stripe Payments Europe, Limited

The payment processing services are provided by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe” for short) and are subject to the Stripe ConnectAccount Agreement, which includes the Stripe Terms of Use. By making a payment on our website, you agree to be bound by the Stripe Services Agreement, which may be amended by Stripe at any time. As a condition of us enabling payment processing services through Stripe, you agree that we may provide accurate and complete information about you to Stripe, and you authorize us to use this and transaction information in connection with your use of the payment processing services provided by Stripe. However, as a payment service provider, Stripe is responsible for the actual payment transaction itself.

You can find more information on data processing at Stipe in Stripe’s privacy policy: https://stripe.com/de/privacy

The transmission of your data (name, address, payment data) to Stripe is based on Art. 6 para. 1 sentence 1 a) GDPR (consent) and Art. 6 para. 1 sentence 1 b) GDPR (processing for the performance of a contract). You can withdraw your previously given consent at any time. Data processing operations carried out in the past remain effective in the event of revocation.

5. Data transfer to a third country

As a matter of principle, we do not transfer or process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)). Should this nevertheless be necessary in exceptional cases to fulfill our obligations, the processing will only take place or take place in the context of the use of third-party services or disclosure or transfer of data to third parties if it is done to fulfill our (pre)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process or have the data processed in a third country only if the special requirements of Art. 44 et seq. GDPR are met. This means, for example, that the processing takes place on the basis of special guarantees, such as the officially recognized determination of a level of data protection corresponding to the EU (e.g. through an EU adequacy decision for the country concerned or through the agreement of officially recognized EU standard contractual clauses with the recipient of the data).

6. Storage duration

The duration of storage depends primarily on the statutory retention obligations and our legitimate interest in further storage.

B. Information about the website

1. Visiting the website

When you visit our website and view the content, certain usage data is automatically collected and stored in server log files. In particular, the browser type/version, operating system used, referrer URL (the previously visited website), IP address of your end device and time of the server request are processed.

The permissibility of this processing is based on Art. 6 para. 1 f) GDPR (legitimate interest). We are dependent on presenting our services on a website and enabling the ordering of goods. The internet is the most important communication medium and is of the utmost importance to us as a seller of goods. Without our own website, we would not be able to offer our services. The data processing described above is necessary in order to be able to access the website.

The server log files are automatically deleted or anonymized after 30 days at the latest.

2. Online forms

We have integrated various online forms into our website that you can use to send us an inquiry. We process the data you enter in order to respond to your message and send you a customized offer.

The permissibility of this processing is based on Art. 6 para. 1 b) GDPR (pre-contractual measure). Without providing your contact details, we will not be able to reply to you.

We store your request and the data it contains until the process has been completed. We will then delete the message history.

3. Ordering goods

You can order goods on our website. For this purpose, we request various details and guide you through the ordering process. We use your personal data to inform you of the current status of your order, to process your order, to dispatch it and to bill you for our services.

The permissibility of this processing is based on Art. 6 para. 1 b) GDPR (contract). The provision of the information requested by us is necessary in order to initiate and execute an order. Otherwise, for example, we would not be able to send you any goods or provide you with information on the status of your order.

We are subject to various retention obligations under the German Commercial Code (HGB) and the German Fiscal Code (AO) of 6 and 10 years. We store orders and billing documents initiated by you for this period. After these retention periods have expired, the process is deleted.

4. Essential cookies

We use cookies when operating our website in order to implement certain functions and to fulfill the requirements applicable to telemedia. This involves processing usage data (e.g. the IP address).

The permissibility of the data processing that takes place is based on Art. 6 para. 1 f) GDPR (legitimate interest). We want to improve user-friendliness, optimize the display (e.g. on mobile devices), prevent fraud and ensure security. We must also ensure that data collection requiring consent only takes place if you have actually given your consent. Therefore, certain technical settings must be logged. The necessary cookies are set automatically and cannot be deactivated.

Insofar as you have activated the automatic deletion of cookies in your browser settings,

some necessary cookies can be deleted after leaving the website. Others are stored for a later visit. You can find more information in our cookie policy at https://www.nsv.de/cookie-richtlinie-eu/ and in your browser settings.

5. Optional cookies

There are cookies that may only be set with your consent. They belong to analysis tools that we use to improve the content of our website. Among other things, they are used to evaluate which content is particularly popular, where users are located and from which websites they come to our site. Some cookies come from third-party providers who also receive the generated data and may merge it with other data.

The permissibility of the associated processing is based on Art. 6 para. 1 sentence 1 a) GDPR (consent). The optional cookies are only set if you consent to them.

You can do this by ticking a box in our Cookie Consent Tool. The provision of your data for the analysis of your user behavior is of course voluntary and has no effect on the use of the website.

The storage period for optional cookies depends on the existence of your consent. You can also view the purposes, storage duration and further information on the individual cookies directly in the Cookie Consent Tool.

You can find more information in our cookie policy at https://www.nsv.de/cookie-richtlinie-eu/.

6. Integration of third-party content and services

On the basis of our legitimate interests or your consent, we use content or service offers from third-party providers within our online offer in order to integrate their content and services, such as videos (hereinafter uniformly referred to as “content”). This always presupposes that the third-party providers of this content are aware of the IP address of the user, as they would not be able to send the content to their browser without the IP address. The IP address is therefore required to display this content. We endeavor to only use content whose respective providers only use the IP address to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as “web beacons”) for statistical or marketing purposes. Pixel tags can be used to analyze information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offer, as well as being linked to such information from other sources.

6.1 Google services

We use content or service offers from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google” for short) within our online content on the basis of your consent (Art. 6 para. 1 a) GDPR) and our legitimate interest (Art. 6 para. 1 f) GDPR). This presupposes that Google processes certain user data, as without this data either the content could not be sent to your browser or an analysis of your surfing behavior would not be possible. It would also not be possible to display targeted advertising. Google services are therefore mainly used to improve the quality of our website and its content.

It cannot be ruled out that data will be transferred to the USA. The transfer of data to the USA is permitted without further authorization, as there is an adequacy decision by the EU Commission for the transfer of data to the USA in accordance with Art. 45 para. 3 GDPR, the EU-U.S. Data Privacy Framework. Google has certified itself in accordance with the EU-U.S. Data Privacy Framework and is therefore obliged to comply with European data protection principles. This also applies toall Google subsidiaries,such as Google Ireland Limited. Further information on the Data Privacy Framework can be found here.

According to its own information (see “Legal framework for data transfers”), Google has also included standard data protection clauses to ensure an adequate level of data protection. If you are logged in with a Google account, data such as that collected by Google Analytics or AdWords can be assigned to your account. If you do not wish this to happen, you must log out before visiting our website.

If the processing of the data requires the storage of such information in your terminal equipment or access to information that is already stored in the terminal equipment, Section 25 (1) TDDDG is the legal basis for this.

You can delete the cookies set by Google yourself in the manner described above. If your personal data has been anonymized, we will retain this data indefinitely. Otherwise, the data is regularly deleted after 2 months.

You have the right to withdraw your consent to the use of these Google services with effect for the future. To declare your revocation, you can deactivate the services in the Cookie Consent Tool (under “Cookie settings” at the bottom of our homepage).

You will find more detailed information on the individual Google services below.

6.1.1 Google Analytics

The Google Analytics tool is integrated into the website. Cookies are also set which record and evaluate IP address, screen size, browser information, location (country), preferred language settings, subpages visited and the date and time of access. This allows us to see which content is particularly popular and improve our website in this respect. You can obtain further information directly from Google Ireland Ltd.

The admissibility of this processing depends on your consent (Art. 6 Para. 1 a) GDPR). You can consent to the analysis of your user behavior when you visit the website by clicking a box in the Cookie Consent Tool. The provision of your personal data for analysis purposes is voluntary. You can also revoke your consent at any time with effect for the future by changing the settings. The analysis of your user behavior carried out up to that point remains lawful. If you do not give your consent, this will otherwise have no disadvantages for you.

The data collected and the evaluations based on it are automatically anonymized so that no personal reference can be made. We save the results for 2 years. Since this is a service provided by Google Ireland Limited, the data is transferred and may be stored there.

6.1.2 Google AdWords with conversion tracking

We use the “Google Ads with Conversion Tracking” service to draw attention to our website by means of advertisements on third-party websites. The measurement data collected also enables us to better understand the needs of website visitors and the impact of our advertisements and, where appropriate, offer you a personalized experience and relevant advertising.

If you click on one of our Google ads, a cookie is stored in your browser that is valid for about 30 days. If you then visit our website, we and Google can use the cookie to evaluate whether you have visited our website and which page you have visited. Google creates statistics about this. This enables us to see how attractive the ads are and improve our offering.

This conversion tracking serves the purpose of analysis/success measurement, optimization and the economic operation of our advertising and website.

The legal basis for the processing of the data is Art. 6 Para. 1 a) GDPR. When you visit our website, you will be asked to give your consent to activate Google Ads in the cookie banner. If you do not give your consent, your usage behavior will not be analyzed and you will not see any personalized advertising from us. Your consent is voluntary. If you do not give your consent, this will otherwise have no disadvantages for you.

6.1.3 Google Tag Manager

The Google Tag Manager is used on the website. This allows code sections from various tools to be integrated and managed centrally via a user interface. The Google Tag Manager triggers other tags, which in turn may collect data. However, it does not access this data. In order for the whole thing to work, usage data such as the IP address is processed.

Data processing is permitted on the basis of Art. 6 Para. 1 f) GDPR (legitimate interest). Inserting source code separately is possible, but very time-consuming. With the Google Tag Manager we can save a lot of time, so it is used primarily from an economic point of view. Data processing takes place automatically when requested electronic consents are given or not given.

The storage of the data generated depends on the duration of the website visit. However, since this is a service provided by Google Ireland Limited, the data is transferred and may be stored there for a longer period. You can find further information on the processing of your data directly from Google Ireland Ltd.

6.1.4 Google Maps

We use the Google Maps service on the website. This allows us to show you interactive maps directly on the website and enables you to use the map function conveniently. In order to enable and improve this user experience, usage data such as IP address, screen size, browser information, location (country), preferred language setting, subpages visited and date and time of access are processed.

The legal basis for the integration of the Google Maps map service is your consent to its use (Article 6, Paragraph 1, a) of the GDPR). The user experience on our website must be as good as possible in order not to lose users. This requires the integration of interactive maps from Google, which we cannot provide on our own. You can consent to the use and thus the provision of your data when you visit the website by clicking a box in the Cookie Consent Tool. The provision of your personal data is voluntary. You can also revoke your consent at any time with effect for the future by changing the settings. The processing carried out up to that point remains lawful. If you do not give your consent, this will otherwise have no disadvantages for you. However, you cannot use the Google Maps map service on our website.

We do not store any personal data when integrating the Google Maps map service.

To ensure that your personal data is only transferred to Google after you have given your consent, we use a so-called two-click solution. This technically ensures that the website only transfers the data when you either consent when you visit our site by clicking a box in the Cookie Consent Tool or later click on the map and thus declare your consent. Technically, this works in such a way that the area on which the map is placed is represented by a graphic that serves as a placeholder. Since this graphic belongs to the actual website, no data is transmitted to Google when the page is simply accessed. After clicking and thus activating the map, Google receives the information that you have accessed the corresponding subpage of our website. This happens regardless of whether Google provides a user account through which you are logged in or whether there is no user account. If you are logged in to Google, your data is assigned directly to your account. If you do not want to be assigned to your Google profile, you must log out before activating the button. Google saves your data as user profiles and uses them for the purposes of advertising, market research and/or tailoring its website to your needs. Such an evaluation is carried out in particular (even for users who are not logged in) to provide needs-based advertising and to inform other users about your activities on our website. You have the right to object to the creation of these user profiles, and you must contact Google to exercise this right.

Further information on data processing and data protection when integrating Google Maps can be found directly at Google Ireland Ltd.

6.1.5 YouTube

We use videos from YouTube on our website. YouTube is a service provided by YouTube LLC (“YouTube”), 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit our website, YouTube receives the information that you have accessed the corresponding subpage of our website. In addition, further information on the use of the website (e.g. date and time of access, IP address, etc.) may be transmitted to Google servers (possibly in a third country such as the USA) and stored there. This occurs regardless of whether YouTube provides a user account through which you are logged in or whether no user account exists.

When using YouTube, data is transferred to third countries. The transfer of data to the USA is permitted without further authorization, as there is an adequacy decision by the EU Commission for the transfer of data to the USA in accordance with Art. 45 para. 3 GDPR, the EU-U.S. Data Privacy Framework. Google has certified itself in accordance with the Data Privacy Framework and has therefore undertaken to comply with European data protection principles. This also applies to all Google subsidiaries. Further information on the Data Privacy Framework is available here.

According to its own information (see “Legal framework for data transfers”), the provider has also included standard data protection clauses to ensure an adequate level of data protection.

Google does not use the data to personalize your browsing experience on YouTube – neither in the embedded privacy mode nor when you use YouTube later, because we have embedded the videos in the so-called enhanced privacy mode. If ads are delivered in a video that is played in the embedded player’s enhanced privacy mode, these ads are also not personalized. In addition, playing a video in the embedded player’s enhanced privacy mode will not be used to personalize advertising that is shown to you outside of our website.

We use YouTube videos to provide you with videos on various topics from Nürnberger-Spielkarten-Verlag GmbH. The admissibility of this processing is governed by Art. 6 Para. 1 a) GDPR. Before the video starts, you will be asked to give your consent to activate the YouTube integration. If you do not give your consent, the YouTube services will not be activated and your data will not be transmitted to Google. Your consent is voluntary.

The provision of data is neither required by law nor necessary for the conclusion of a contract. Failure to provide the data means that you cannot access the video directly from our website. Alternatively, you can watch the video directly on YouTube.

Further information on the purpose and scope of data collection and processing by YouTube can be found in Google’s privacy policy and terms of use.

6.2 Facebook pixel

Within our online offer on the website, we use the so-called “Facebook pixel” of the social network Facebook, which is operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”).

Data processing is permitted on the basis of our legitimate interest in accordance with Art. 6 para. 1 sentence 1 f) GDPR. This is because we need to understand what users of our website are interested in for the purposes of analyzing and optimizing the website and its economic operation and to draw the attention of interested parties to our offer.

With the help of the Facebook pixel, Meta is able to determine the visitors to our website as a target group for the display of advertisements (so-called “Facebook ads”). Accordingly, we use the Facebook pixel to only display the Facebook ads we place to Facebook users who have also shown an interest in our online offering or who have certain characteristics (e.g. interests in certain topics or products determined based on the websites visited) that we transmit to Facebook (so-called “custom audiences”). With the help of the Facebook pixel, we also want to ensure that our Facebook ads correspond to the potential interests of users and do not appear annoying. With the help of the Facebook pixel, we can also track the effectiveness of Facebook advertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook advertisement (so-called “conversion”). Meta (Facebook) processes the data in accordance with Meta’s data usage policy. Accordingly, general information on the display of Facebook ads can be found in Meta’s data usage policy: https://www.facebook.com/policy.php. Specific information and details on the Facebook pixel and how it works can be found in the Facebook help section: https://www.facebook.com/business/help/651294705016616. You can object to the collection by the Facebook pixel and the use of your data to display Facebook ads. To set which types of advertisements are displayed to you within Facebook, you can visit the page set up by Facebook and follow the instructions on the usage-based advertising settings there: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.

7. Newsletter

You can subscribe to a free newsletter via our website. When you register for the newsletter, the data from the input screen (email address) is transmitted to us. Usage data is also processed, such as the IP address and the date and time of registration.

By registering for the newsletter, you consent to the processing of data in accordance with Art. 6 Paragraph 1 Clause 1 a) GDPR. The legal basis for sending the newsletter as a result of the sale of goods or services is Section 7 Paragraph 3 of the German Act Against Unfair Competition (UWG).

If you purchase goods or services on our website and provide your email address, we may subsequently use this to send you a newsletter. In such a case, the newsletter will only be used to send direct advertising for our own similar goods or services.

In connection with data processing for sending newsletters, no data will be passed on to third parties. The data will be used exclusively for sending the newsletter.

The purpose of collecting the user’s email address is to deliver the newsletter. The collection of other personal data during the registration process serves to prevent misuse of the services or the email address used.

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. The user’s data mentioned above will therefore be stored as long as the newsletter subscription is active.

You can cancel your newsletter subscription at any time. There is a link for this purpose in every newsletter. This also allows you to revoke your consent to the storage of the personal data collected during the registration process.

8. Online appearance on Facebook and Instagram

Based on our legitimate interests within the meaning of Art. 6 Para. 1 sentence 1 f) GDPR, we maintain online presences within the social networks Facebook and Instagram in order to communicate with customers, interested parties and users active there and to inform them about our services. When you access the respective network, the terms and conditions and data processing guidelines of the operator Meta Platforms Ireland Limited apply.

Unless otherwise stated in our privacy policy, we process users’ data if they communicate with us within the social networks and platforms, e.g. by writing posts on our online presence or sending us messages.

Further information on data protection at Facebook and Instagram can be found in our separate data protection declaration at https://nsv.de/datenschutzerklarung-meta/.

9. Participation in competitions

Occasionally we run competitions in which you can win a package of games and promotional items from us. If you register for the respective competition, we process the following personal data from you:

Title, last name, first name
Address
Email address
Phone number

We process your personal data to conduct the competition, to select and notify the winners and to deliver the corresponding prizes.

Providing your data is voluntary. In order for us to carry out the competition and take you into account, we need information about you and your contact details. If you do not provide us with this information, we will not be able to consider you for participation in the competition.

Further information on the applicable contractual conditions can be found in the separate competition terms and conditions in the announcement of the respective competition.

The processing of your personal data is carried out on the basis of Art. 6 para. 1 b) GDPR (contract processing).

We process and store your personal data as long as it is necessary to conduct the competition and/or for legal retention obligations and until all mutual claims have been met. Once the purpose for which the data was collected has been fulfilled, the data is regularly deleted unless it is necessary to continue processing it for a limited period.

Legal retention periods of up to 10 years arise, for example, from the German Commercial Code, the Tax Code and the Money Laundering Act. In certain cases, there may also be statutory limitation periods of up to 30 years, which make it necessary to retain your data for the purpose of preserving evidence.

C. Essential information on joint responsibility, Art. 26 GDPR

With the information below, we provide you with the essential content that Nürnberger-Spielkarten-Verlag GmbH and Cartamundi Deutschland GmbH have contractually agreed upon as part of a joint responsibility pursuant to Art. 26 GDPR for the processing of personal data in the context of the provision of marketing services to promote the sale of NSV products.

1. Jointly responsible are

Nürnberger-Spielkarten-Verlag GmbH (NSV), Lehrberger Straße 12, D-90431 Nürnberg and
Cartamundi Deutschland GmbH (CMD), Leipziger Straße 7, 04600 Altenburg.

2. The nature and purpose of the joint controllership are related to the provision of marketing services to promote the sale of NSV products.

In order for CMD to be able to independently carry out advertising and sales promotion measures and to specifically address interested parties and customers of NSV, it is granted access to and processes the following data categories:

Contact details (e.g. first name, last name, email address)
Content data (e.g. texts, photos, videos)
Usage data (e.g. access times, log files)

data subjects of the following categories:

Interested parties of the NSV (e.g. newsletter subscribers, visitors to this website and social media profiles of the NSV)
NSV customers

3. Functions and relationships of the jointly responsible persons towards data subjects

Procedure for Data Protection Violations

The NSV is responsible for examining and processing all violations of the protection of personal data in relation to personal prospect and customer data processed in the course of carrying out marketing measures, including the fulfillment of any reporting and notification obligations. CMD provides appropriate support in this regard and immediately provides any information that may be required.

Data protection information

The NSV provides data protection information for users of social media platforms on which the NSV appears on the website www.nsv.de and links this to their respective social media profiles. This takes into account the joint responsibility of the contracting parties with regard to the implementation of related advertising and sales promotion campaigns and contains the essential content of this contract.

On a CMD landing page set up for newsletter or competition registrations, the data protection information is linked to the NSV website www.nsv.de.

The contractual partners bear joint responsibility for the data protection information, particularly in terms of accuracy, completeness and transparency.

Further rights of data subjects

The NSV is responsible for answering and implementing requests from data subjects for information, correction, deletion, restriction, data transfer and objection.

Effective date: February 2025