Privacy Policy
1. Data Controller
The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
4 Kings GmbH
Osterstr. 33
31134 Hildesheim
Email: kontakt@nordpaneele.de
Phone: +49 176 28367959
2. Collection and Processing of Personal Data
We collect personal data when you voluntarily provide it to us in the context of an order, inquiry, or sample request. This includes in particular:
- Name and address
- Email address
- Phone number
- Payment information (processed by Stripe)
- Order history
The legal basis for processing is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).
3. Cookies
Our website uses cookies. These are small text files stored on your device. Some cookies are technically necessary (e.g., shopping cart session), while others help us improve the user experience (analytics cookies).
Technically necessary cookies are set on the basis of Art. 6(1)(f) GDPR. We only set analytics cookies with your explicit consent pursuant to Art. 6(1)(a) GDPR. You may revoke your consent at any time.
4. Payment Service Provider (Stripe)
We use the service of Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, for processing payments. Your payment data (e.g., credit card number) is transmitted directly to Stripe and is not stored by us. Stripe is PCI DSS Level 1 certified. As Stripe Payments Europe is based in the EU, processing takes place within the scope of the GDPR. Data may also be transferred to Stripe, Inc. in the USA; such transfers are based on the EU-US Data Privacy Framework, under which Stripe is certified (Art. 45 GDPR). The legal basis is Art. 6(1)(b) GDPR.
Stripe's Privacy Policy: https://stripe.com/en-de/privacy
5. Email Delivery (Resend)
We use the service Resend, Inc. for sending transactional emails (order confirmations, shipping notifications). Your email address is transmitted to Resend insofar as this is necessary for sending the messages. The legal basis is Art. 6(1)(b) GDPR.
6. Hosting (Hetzner)
Our website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes access data (IP address, time of access, pages visited) in server log files on our behalf. Processing is based on Art. 6(1)(f) GDPR. The servers are located exclusively in Germany.
7. Web Analytics with Google Analytics 4
Where you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse how our website is used (e.g. pages visited, time spent, approximate location based on your truncated IP address). This information is generally transmitted to and stored on Google servers; a transfer to the USA may occur. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future via our cookie settings.
8. Meta Pixel with advanced matching and Conversions API
Where you have consented to the “Marketing” category, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).
Purpose: we measure how well our advertising works (e.g. whether a sample request or purchase follows an ad) and build audiences in order to show ads on Facebook and Instagram to you and to people with similar interests.
Advanced matching: when you submit a form on our website (e.g. sample request, contact, newsletter, order, customer account), we store the details you entered – email address, phone number, first and last name, city, postcode and country – and a random visitor ID in your browser and pass them to the Meta Pixel. The Pixel converts these details into hash values (SHA-256) in your browser before they are sent to Meta. Meta matches the hash values against user accounts to link events on our website to a Facebook or Instagram account. Meta also processes your IP address, browser and device information, the pages you visit, events (e.g. page view, sample request, purchase) and the cookies _fbp and _fbc.
Conversions API: we may also send selected events from our server to Meta; the details above are hashed on our server. This also happens only with your consent.
We and Meta are joint controllers for the collection and transmission to Meta (Art. 26 GDPR; agreement: https://www.facebook.com/legal/controller_addendum); Meta alone is responsible for any further processing. Meta may transfer data to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework, covered by an adequacy decision of the European Commission.
The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The details remain stored in your browser until you withdraw consent or clear your browser data.
You can withdraw consent at any time with effect for the future via “Cookie Settings” at the bottom of every page, by switching off “Marketing” or choosing “Necessary Only”. We then delete the details stored in your browser and the visitor ID.
Meta's privacy policy: https://www.facebook.com/privacy/policy
9. Microsoft Clarity
Where you have given your consent, we use Microsoft Clarity, an analytics service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Clarity helps us better understand and improve the use of our website through the pseudonymised recording of session activity (e.g. mouse movements, clicks and scrolling) and through heatmaps. Entries into form fields are masked by default. A transfer to the USA may occur. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.
10. Pinterest tag
Where you have consented to the “Marketing” category and the service is embedded, we use the Pinterest tag of Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (“Pinterest”). The tag collects your IP address, browser and device information, the pages you visit and events (e.g. product view, cart, sample request, purchase) as well as the cookie _pin_unauth, so that we can measure the effect of our Pinterest ads and show you matching products on Pinterest. Pinterest may transfer data to Pinterest, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); you can withdraw it at any time via “Cookie Settings”. Pinterest's privacy policy: https://policy.pinterest.com/en/privacy-policy
11. TikTok pixel
Where you have consented to the “Marketing” category and the service is embedded, we use the TikTok pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland, and TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom (“TikTok”). The pixel collects your IP address, browser and device information, the pages you visit and events (e.g. product view, cart, purchase) as well as the cookies _ttp and _tt_enable_cookie, so that we can measure the effect of our TikTok ads and build audiences. TikTok may transfer data to countries outside the EU (including the USA and Singapore) on the basis of the EU standard contractual clauses. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); you can withdraw it at any time via “Cookie Settings”. TikTok's privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en
12. Trusted Shops
Our website includes the Trusted Shops trust element (Trustbadge) of Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne, Germany, to display our trust mark and any customer reviews and to offer buyers Trusted Shops Buyer Protection. When the Trustbadge loads, Trusted Shops processes your IP address and technical browser information. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure and trustworthy presentation of our offering).
13. Address Autocomplete (Google Places)
During the order process we offer address autocomplete based on the Google Places API of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. As soon as you start typing in the address field, your input is transmitted to Google in order to show you matching address suggestions. This makes data entry easier and reduces errors. A transfer to the USA may occur. The legal basis is Art. 6(1)(b) GDPR (taking steps prior to entering into a contract) as well as our legitimate interest in an error-free order process (Art. 6(1)(f) GDPR).
14. Data Subject Rights
You have the following rights with regard to your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.
15. Currency and Amendments
This privacy policy is currently valid. Due to the further development of our website or changes in legal requirements, it may become necessary to amend this privacy policy. The current version can be accessed at any time on this page.
Last updated: October 13, 2026