Privacy policy
This privacy policy explains the type, scope and purpose of the processing of personal data (hereinafter referred to as “data”) within our online offer and the associated websites, functions and content as well as external online presences, such as our social media profiles (hereinafter collectively referred to as “online offer”). With regard to the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).
Responsible:
Buffalo Com Group LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States of America
Phone: +1 307 41 41 07 0
Email: news@holawuff.com
Original File-ID: 023-001326152
Tax ID: 36-5082083
Types of data processed:
– Inventory data
– Contact data
– Content data
– Contract data
– Payment data
– Usage data
– Meta/communication data
Processing of special categories of data (Art. 9 (1) GDPR):
No special categories of data are processed.
Categories of data subjects affected by the processing:
Customers, interested parties, visitors and users of the online offer, business partners.
In the following, we also refer to the data subjects collectively as “users”.
Purpose of processing:
– Provision of the online offer, its contents and functions
– Provision of contractual services, service and customer care
– Answering contact inquiries and communication with users
– Marketing, advertising and market research
– Security measures
Status: 04/2026
1. terms used
1.1. “Personal data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the data subject.
1.2. “Processing” means any operation or set of operations which is performed on personal data, whether or not by automated means.
1.3. The “controller” is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
2 Relevant legal bases
In accordance with Art. 13 GDPR, we inform you of the legal basis of our data processing. The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 GDPR, the legal basis for the processing for the fulfillment of our services and the implementation of contractual measures as well as answering inquiries is Art. 6 para. 1 lit. b GDPR, the legal basis for processing to fulfill our legal obligations is Art. 6 para. 1 lit. c GDPR, and the legal basis for processing to protect our legitimate interests is Art. 6 para. 1 lit. f GDPR.
3. changes and updates to the privacy policy
We ask you to inform yourself regularly about the content of our privacy policy. We will adapt the privacy policy as soon as changes to the data processing we carry out make this necessary.
4. safety measures
4.1. We take appropriate technical and organizational measures in accordance with Art. 32 GDPR to ensure a level of protection appropriate to the risk. The measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access, input, disclosure, safeguarding availability and separation of the data.
4.2. The security measures include in particular the encrypted transmission of data between your browser and our server.
5. disclosure and transmission of data
5.1. If we disclose data to other persons and companies as part of our processing or grant them access to the data, this is only done on the basis of legal permission, your consent, a legal obligation or on the basis of our legitimate interests.
5.2. If we commission third parties with the processing of data on the basis of a so-called “order processing contract”, this is done on the basis of Art. 28 GDPR.
6. transfers to third countries
If we process data in a third country (i.e. outside the European Union or the European Economic Area) or in the context of the use of third-party services, this will only be done to fulfill our contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of our legitimate interests, and only if the special requirements of Art. 44 et seq. GDPR, e.g. on the basis of officially recognized special contractual obligations (standard contractual clauses).
7 Rights of the data subjects
7.1. You have the right of access to data concerning you in accordance with Art. 15 GDPR.
7.2. You have the right to rectification of inaccurate data in accordance with Art. 16 GDPR.
7.3. You have the right to erasure or restriction of processing in accordance with Art. 17 and 18 GDPR.
7.4. You have the right to data portability in accordance with Art. 20 GDPR.
7.5. You have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR).
8. right of withdrawal
You have the right to withdraw your consent in accordance with. Art. 7 para. 3 GDPR with effect for the future.
9. right of objection
You can object to the future processing of data concerning you at any time in accordance with Art. 21 GDPR. The objection may be made in particular against processing for direct marketing purposes.
10. cookies and right to object to direct advertising
10.1. Cookies” are small files that are stored on users’ computers. We use temporary and permanent cookies. Temporary cookies are deleted after a user leaves the website and closes their browser. Permanent cookies remain stored even after the browser is closed.
10.2. If users do not want cookies to be stored on their computer, they can deactivate the corresponding option in the system settings of their browser. The exclusion of cookies can lead to functional restrictions of this online offer.
10.3. A general objection to the use of cookies for online marketing purposes can be declared via the EU website https://www.youronlinechoices.com/.
11. deletion of data
11.1. The data processed by us will be deleted or restricted in their processing in accordance with Art. 17 and 18 GDPR as soon as they are no longer required for their intended purpose and the deletion does not conflict with any statutory retention obligations.
11.2. According to legal requirements, the data is stored for 6 years in accordance with § 257 para. 1 HGB and for 10 years in accordance with § 147 para. 1 AO.
12. order processing and customer account
12.1. We process our customers’ data as part of the ordering process in order to enable them to select and order the services they have chosen and to pay for and execute them.
12.2. The processed data includes inventory data, communication data, contract data and payment data. Processing is carried out for the purpose of providing contractual services, billing and customer service.
12.3. Users can create a user account to view their bookings in particular. User accounts are not public and cannot be indexed by search engines. If the user account is terminated, the data will be deleted, subject to statutory retention obligations.
12.4. As part of the registration process, we store the IP address and the time of the respective user action on the basis of our legitimate interests.
13. business analyses and market research
For the economic operation of our offer, we analyze the data available to us on business transactions, contracts and inquiries on the basis of Art. 6 para. 1 lit. f GDPR. Where possible, anonymous analyses are summarized and not disclosed externally.
14. contact and customer service
14.1. When contacting us (via contact form or e-mail), the user’s details will be used to process the contact request in accordance with. Art. 6 para. 1 lit. b GDPR is processed.
14.2. We delete the requests if they are no longer required. We review the necessity every two years.
15. collection of access data and log files
15.1. Based on our legitimate interests (Art. 6 para. 1 lit. f GDPR), we collect data about every access to the server on which this service is located (server log files). The access data includes the name of the website accessed, date and time of access, amount of data transferred, browser type, operating system, referrer URL and IP address.
15.2. For security reasons, log file information is stored for a maximum of seven days and then deleted.
16. online presence in social media
We maintain online presences in social networks (Facebook, Instagram, Pinterest, Twitter/X) on the basis of our legitimate interests (Art. 6 para. 1 lit. f GDPR). When accessing the respective networks, the terms and conditions and privacy policies of the respective operators apply.
17. facebook social plugins
17.1 We use social plugins of the social network facebook.com, operated by Meta Platforms Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. By integrating the plugins, Facebook receives the information that a user has accessed the corresponding page.
17.2. The purpose and scope of data collection and further information can be found in Facebook’s privacy policy: https://www.facebook.com/about/privacy/
18. communication via e-mail and telephone
We use remote means of communication such as e-mail and telephone for business transactions and marketing purposes. The processing is carried out on the basis of Art. 6 para. 1 lit. a and lit. f GDPR. The data will be deleted as soon as it is no longer required.
19. newsletter
19.1. We only send newsletters with the consent of the recipient or on the basis of legal permission. Registration takes place using the double opt-in procedure.
19.2. We use “MailPoet”, a plugin from Wysija SARL, 6 rue Dieudé, 13006 Marseille, France, to send newsletters. Data protection information: https://www.mailpoet.com/privacy-notice/
19.3. Newsletter recipients can unsubscribe at any time. A link to unsubscribe can be found at the end of each newsletter.
20. paypal
20.1 We offer the option of processing the payment transaction via the payment service provider PayPal (PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) (Art. 6 para. 1 lit. f GDPR).
20.2. Further information can be found at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
21 Cloudflare
We use the Content Delivery Network (CDN) of Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich (Art. 6 para. 1 lit. f GDPR) to increase the security and delivery speed of our website. Cloudflare has implemented standard contractual clauses for international data transfers. Further information: https://www.cloudflare.com/privacypolicy/
22. integration of third-party services and content
22.1. We integrate content and services from the following third-party providers:
– OpenStreetMap (map display): https://wiki.openstreetmap.org/wiki/Privacy_Policy
– YouTube (Google Ireland Ltd.): https://policies.google.com/privacy
– Vimeo (Vimeo LLC, 555 West 18th Street, New York, NY 10011, USA): https://vimeo.com/privacy
– Instagram (Meta Platforms Ireland Ltd.): https://privacycenter.instagram.com/policy
– Pinterest (Pinterest Europe Ltd.): https://policy.pinterest.com/de/privacy-policy
– Twitter/X (X Corp.): https://twitter.com/de/privacy
22.2. If customers use third-party payment services, the data protection notices of the respective providers apply.
23. cookie management
We use the “Real Cookie Banner” consent tool to manage the cookies used and related consents. You can find details on how it works at: https://devowl.io/de/rcb/datenverarbeitung/
Legal basis: Art. 6 para. 1 lit. c and lit. f GDPR.