Privacy policy
Note: This English version is a courtesy translation. Only the German version is legally binding.
1. Controller
Toni Gambino
Tonidental
Meldenweg 18, 12357 Berlin, Germany
Email: info@tonidental.de
Telephone: +49 30 68055975
2. Key points at a glance
We process personal data only to the extent that we need it to operate this website, to handle your order and to comply with legal obligations. We use no advertising or analytics cookies, do not embed any advertising networks or social networks and do not pass on your data for advertising purposes. This is also why there is no cookie banner on this website.
3. Hosting and server logs
This website runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in its Nuremberg data centre (Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.
Each time the website is accessed, the web server automatically stores a log entry containing the IP address, date and time, the address requested, the status code, the amount of data transferred, the previously visited page as well as the browser and operating system. We need this data to deliver the website, to identify errors and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website. The logs are automatically deleted after 14 days.
4. Audience measurement without cookies
To find out which pages are being read, we count page views using our own method on our own server – without cookies and without third-party services.
We use the same method on our product page inflamaya.de: the page reports the visit to our server at tonidental.de, and the same data is stored.
Using a one-way function, we generate an identifier from the IP address, the browser identifier and the current date; this identifier changes every day. We do not store the IP address itself. We store only the page requested, the domain of the previously visited website, whether you came via a Google product listing or a Google ad (only this fact – we do not store the identifier Google appends to the address), the device type (computer, tablet, phone), the time of access and whether the request originates from a search engine crawler. As the identifier changes daily, no profile spanning several days is created.
If you place an order, we note on the order only where your visit last came from that day – for example “Google product listing”, “Google search”, “direct” or the domain of a referring website. This shows us which routes lead to orders. We do not store the daily identifier itself with the order; this information is kept for as long as the order and is included in your data access report.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to improve our offering. We do not access your terminal equipment for this purpose. The entries are automatically deleted after 13 months.
5. Cookies and local storage
We only use cookies that are strictly necessary for the website to function (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), Art. 6(1)(b) and (f) GDPR):
| warenkorb | remembers the contents of your bag, 7 days |
|---|---|
| rabattcode | remembers a discount code you have entered, 7 days |
| avanton_shop_kunde | keeps you logged in to your customer account, 30 days or until you log out |
| theme (local storage) | remembers whether you have chosen the light or dark view, until you change it |
When you proceed to payment, our payment service provider Stripe sets its own cookies for fraud prevention (see section 7). Google may set cookies if you click on "Yes, rate on Google" after an order (see section 9). You can delete cookies in your browser at any time; your bag will then be empty.
6. Orders and customer account
For your order, we process your name, billing and delivery address, email address, the items ordered, the payment method selected and the payment status. Providing your company name, VAT ID and telephone number is optional. Without the mandatory information, we cannot conclude the contract. The legal basis is Art. 6(1)(b) GDPR and, for retention, Art. 6(1)(c) GDPR.
If you create a customer account, we additionally store your login credentials. We store your password only as an irreversible hash value; if you use a passkey, we store only its public key. In your account, you can see your addresses and orders. There you can also change your email address, download your data as a file and delete your account yourself at any time. After that, we keep orders and invoices only as required by statutory retention obligations.
If you are a business from another EU country, provide a VAT ID and have your order delivered to an EU country outside Germany, we verify the number using the European Commission's VIES (VAT Information Exchange System). In doing so, your VAT ID and our own VAT ID are transmitted; the system returns the validity status as well as the company name and address on record. We retain the result, including the consultation number, together with the order as proof of the tax-exempt supply. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 6a of the German VAT Act (UStG) and Section 18e UStG.
We transfer orders to our own inventory management system, which we likewise operate on servers in Germany, in order to handle invoicing, shipping and accounting. No data is passed on to third parties in this process.
7. Payment
Payments by card, Klarna, Apple Pay and Google Pay are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your card or account details directly with Stripe; we neither see nor store them. We receive only a payment reference, the payment method and the status from Stripe. Stripe sets cookies for fraud prevention when the payment form is loaded. The legal basis is Art. 6(1)(b) GDPR and, for fraud prevention, Art. 6(1)(f) GDPR. Privacy information: stripe.com/de/privacy
Depending on the payment method you choose, the following are also involved:
| Klarna | Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna checks your identity and ability to pay under its own responsibility. Information: klarna.com/de/datenschutz |
|---|---|
| Apple Pay | Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland. Information: apple.com/de/legal/privacy |
| Google Pay | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Information: policies.google.com/privacy |
| Link | a payment service provided by Stripe which, at your request, stores your payment details for future purchases. |
We offer PayPal directly, without Stripe as an intermediary. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. If you choose PayPal, we transmit the amount and an order reference to PayPal and, if you order via the checkout, also your name and delivery address. If you buy directly via the PayPal button without using the checkout form, we take your name, email address, delivery address and, if stored there, your telephone number from your PayPal account. You enter your payment details directly with PayPal; we neither see nor store them. We receive a payment reference, the status and the fee from PayPal. To display the PayPal button, your browser loads a script from PayPal on product, bag and checkout pages; in doing so, PayPal receives technical data such as your IP address and sets cookies for fraud prevention. The legal basis is Art. 6(1)(b) GDPR and, for fraud prevention, Art. 6(1)(f) GDPR. Information: paypal.com/de/legalhub/privacy-full
8. Shipping
For delivery, we pass on your name and delivery address to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, and your telephone number only if you have provided it. The legal basis is Art. 6(1)(b) GDPR.
9. Reviews via Google Customer Reviews
After an order, we offer you on the order confirmation page the option of rating your purchase via Google Customer Reviews. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. As long as you do not click on "Yes, rate on Google", the page does not load anything from Google. Only with this click does your browser load a program from Google; Google receives technical data such as your IP address and may set cookies. So that Google can ask you, your browser also transmits the order number, email address, delivery country, estimated delivery date and – where available – the article numbers (EAN) of the products ordered. In a Google window you then decide whether to take part. Only if you agree there does Google store this information and ask you by email after delivery to rate your purchase. Google publishes your review; it may appear in Google Search, Google Shopping and in ads. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw from Google at any time with effect for the future. Google may also transfer data to the USA (see section 15). Further information: policies.google.com/privacy
10. Emails
We send you emails relating to your order: order confirmation, payment and shipping information, messages concerning your customer account and confirmation of a withdrawal. To send them, we use the mail server of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, with which a data processing agreement is in place. The legal basis is Art. 6(1)(b) GDPR. We do not send advertising emails.
11. Contact by email or telephone
If you write to us or call us, we process the information you provide in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry concerns an order or a quotation, otherwise Art. 6(1)(f) GDPR. We delete your enquiry once it has been dealt with, unless a retention obligation applies.
12. Back-in-stock notification
If an item is out of stock, you can ask to be notified as soon as it is available again. For this purpose, we store your email address and the item concerned. You will receive one single email; the entry is then deleted. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time.
13. Withdrawal via the online form
If you use our withdrawal form, we process your name, email address, order number and your declaration in order to handle the withdrawal and to confirm its receipt to you. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB). We retain this information together with the order.
14. Retention periods
| Server logs | 14 days |
|---|---|
| Audience measurement | 13 months |
| Orders and invoices | up to 10 years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)) |
| Customer account | until deleted by you or by us |
| Back-in-stock notification | until the notification is sent or your consent is withdrawn |
| Enquiries by email or telephone | until dealt with, unless a retention obligation applies |
15. Transfers to countries outside the EU
Stripe, PayPal, Apple and Google may also transfer data to their parent companies in the USA. These companies are certified under the EU-US Data Privacy Framework; consequently, an adequacy decision of the European Commission exists for the USA (Art. 45 GDPR). All other recipients process your data within the EU.
16. Your rights
You have the right of access (Art. 15 GDPR), the right to rectification (Art. 16), the right to erasure (Art. 17), the right to restriction of processing (Art. 18) and the right to data portability (Art. 20). You can withdraw your consent at any time with effect for the future (Art. 7(3)). A short email to info@tonidental.de is sufficient. If you have a customer account, you can also obtain access to your data (as a downloadable file), correct your details and delete your account yourself in the account.
Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
We do not carry out automated decision-making, including profiling.
17. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority. The supervisory authority competent for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information)
Alt-Moabit 59–61, 10555 Berlin
www.datenschutz-berlin.de
18. Security
The connection to this website is encrypted throughout (TLS). Our servers are protected by a firewall, access restrictions and daily encrypted backups.
Last updated: September 2026
Version: 21/09/2026
← Back to home