feat: Rechtstexte nennen alle Empfaenger, denen tatsaechlich Daten zugehen

Die Datenschutzerklaerung beschrieb Hosting, Bestellung, Konto, Newsletter,
Kontaktformular und Google-Rezensionen — drei Empfaenger fehlten, obwohl
Daten an sie gehen. Abgeglichen wurde gegen die Content-Security-Policy in
next.config.ts: sie listet abschliessend, wohin der Browser ueberhaupt
Verbindungen aufbauen darf, und ist damit ein belastbares Inventar.

Neu aufgenommen:

- Cloudflare Turnstile als eigener Abschnitt 8. Das Skript laedt auf jeder
  Seite mit Formular aus dem Browser des Besuchers nach; IP-Adresse und
  Geraetemerkmale gehen dabei an Cloudflare in den USA. Bisher stand davon
  nirgends etwas — weder in der Datenschutzerklaerung noch unter "Externe
  Inhalte" in der Cookie-Richtlinie, wo Stripe bereits korrekt beschrieben
  ist. Rechtsgrundlage Art. 6 Abs. 1 lit. f DSGVO, Drittlandtransfer ueber
  EU-US Data Privacy Framework.
- DHL in Abschnitt 4: Name und Lieferanschrift, bei Packstationen zusaetzlich
  die Standortnummer, und bei der Packstationssuche im Bestellvorgang der
  eingegebene Ort.
- Microsoft Entra ID in Abschnitt 5. Die Anmeldung damit ist kundenseitig auf
  /konto verlinkt, tauchte aber in keinem Rechtstext auf.

Die bisherigen Abschnitte 8 bis 10 ruecken auf 9 bis 11.

Ausserdem zwei Korrekturen am Bestand:

- Der Verweis auf die EU-Plattform zur Online-Streitbeilegung entfaellt in
  Impressum UND AGB. Die ODR-Verordnung ist aufgehoben, die Plattform
  eingestellt; ein Link auf einen abgeschalteten Dienst ist schlechter als
  keiner. Die Erklaerung nach § 36 Abs. 1 Nr. 1 VSBG bleibt und ist jetzt
  ausdruecklich als solche benannt.
- Die Cookie-Richtlinie zitierte das TTDSG. Das Gesetz heisst seit Mai 2024
  TDDDG.

Unveraendert bleibt der Cookie-Banner: er bietet eine Auswahl, die derzeit
nichts schaltet, weil keine einwilligungspflichtigen Cookies gesetzt werden —
das ist Absicht, damit spaeter hinzukommende Cookies den Mechanismus schon
vorfinden.

Alle Texte auch auf Englisch. Kein Ersatz fuer eine anwaltliche Pruefung.

tsc: 0 Fehler. vitest: 359/359 gruen. eslint: 0 Warnungen. next build: gruen.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

src/i18n/dictionaries/en.ts

@@ -225,7 +225,9 @@ export const en: Dictionary = {
       {
         heading: "Dispute Resolution",
         paragraphs: [
-          "The European Commission provides a platform for online dispute resolution (ODR): https://ec.europa.eu/consumers/odr. We are not obligated, and not willing, to participate in dispute resolution proceedings before a consumer arbitration board.",
+          // Siehe Begründung in de.ts: die EU-Plattform zur Online-Streit-
+          // beilegung wurde eingestellt, der Verweis darauf ist entfallen.
+          "We are not obligated, and not willing, to participate in dispute resolution proceedings before a consumer arbitration board (Section 36(1) No. 1 VSBG).",
         ],
       },
     ],
@@ -254,6 +256,7 @@ export const en: Dictionary = {
       {
         heading: "4. Order and Contract Processing",
         paragraphs: [
+          "For shipping, we pass your name and delivery address to our shipping provider DHL (DHL Paket GmbH, Bonn, Germany). If you choose delivery to a Packstation or branch, the location number you selected is added. If you search for a Packstation during checkout, the town or postcode you enter is sent to DHL to perform that search. Legal basis: Art. 6(1)(b) GDPR.",
           "When you place an order, we collect the data necessary for contract, payment, and shipping processing (name, address, email, phone number if provided, and the items ordered). The legal basis is Art. 6(1)(b) GDPR (contract performance).",
           "Payments are processed by our payment provider, Stripe Payments Europe, Ltd. The data necessary for payment processing is transmitted to Stripe for this purpose. Stripe's privacy policy also applies (stripe.com/privacy). Where this involves transferring data to Stripe-affiliated companies outside the EU/EEA (in particular Stripe, Inc. in the USA), this is done on the basis of EU Standard Contractual Clauses pursuant to Art. 46 GDPR.",
           "Order and invoice data is retained for the legally required period due to commercial and tax record-keeping obligations (§ 257 HGB, § 147 AO of German law).",
@@ -262,6 +265,7 @@ export const en: Dictionary = {
       {
         heading: "5. Customer Account",
         paragraphs: [
+          "You can alternatively sign in with a Microsoft account (Microsoft Entra ID). You are redirected to Microsoft and sign in there; we never receive a password, only your email address and name in order to match your customer account. Which data Microsoft itself processes during sign-in is governed by Microsoft's privacy notice. The provider is Microsoft Ireland Operations Limited; a transfer to Microsoft Corporation in the USA may take place. Microsoft is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR.",
           "If you create a customer account, we store the data you provide (name, email, password encrypted as a hash) as well as any delivery addresses you optionally save, to give you access to your order history, invoices, and a faster checkout. The legal basis is Art. 6(1)(b) GDPR. You can have your account and associated data deleted at any time via an informal request to us.",
           "A technically necessary cookie is set for login; see our Cookie Policy.",
         ],
@@ -279,17 +283,26 @@ export const en: Dictionary = {
         ],
       },
       {
-        heading: "8. Google Reviews",
+        heading: "8. Protecting Our Forms Against Abuse (Cloudflare Turnstile)",
+        paragraphs: [
+          "To protect our forms against automated bulk access, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. This affects sign-in, registration, password reset, two-factor confirmation, checkout, newsletter sign-up, business enquiries and back-in-stock notifications.",
+          "When you open a page containing one of these forms, your browser loads a script from challenges.cloudflare.com. Your IP address and technical characteristics of your browser and device are transmitted to Cloudflare and evaluated there to distinguish whether the input comes from a human or a program. According to the provider, Turnstile sets no advertising cookies for this and builds no cross-site user profile.",
+          "Legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing sign-in attempts with stolen credentials, spam submitted through our forms, and fraudulent orders.",
+          "A transfer to the USA takes place. Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.",
+        ],
+      },
+      {
+        heading: "9. Google Reviews",
         paragraphs: [
           "On our homepage, we display reviews from our Google Business Profile. The review text is retrieved server-side via the Google Places API for this purpose; your browser does not establish its own connection to Google. Provider: Google Ireland Limited, though a transfer to Google LLC (USA) cannot be ruled out. Google's privacy policy applies (policies.google.com/privacy).",
         ],
       },
       {
-        heading: "9. Cookies",
+        heading: "10. Cookies",
         paragraphs: ["Details on the cookies used on this website can be found in our Cookie Policy."],
       },
       {
-        heading: "10. Your Rights",
+        heading: "11. Your Rights",
         paragraphs: [
           "You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and objection to processing (Art. 21 GDPR) of your personal data.",
           "You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Bavarian State Office for Data Protection Supervision.",
@@ -347,7 +360,8 @@ export const en: Dictionary = {
       {
         heading: "9. Dispute Resolution",
         paragraphs: [
-          "The European Commission provides a platform for online dispute resolution (ODR): https://ec.europa.eu/consumers/odr. We are not obligated, and not willing, to participate in dispute resolution proceedings before a consumer arbitration board.",
+          // Siehe gleichlautende Stelle im Impressum.
+          "We are not obligated, and not willing, to participate in dispute resolution proceedings before a consumer arbitration board (Section 36(1) No. 1 VSBG).",
         ],
       },
       {
@@ -420,7 +434,7 @@ export const en: Dictionary = {
         heading: "Technically necessary cookies",
         paragraphs: [
           "These cookies are required for the website to function and cannot be disabled. They are only set if you actively trigger them through your actions (e.g. logging into your customer account).",
-          "wabenhain_session: keeps you logged into your customer account after signing in. Expires automatically after 30 days. Legal basis: Art. 6(1)(b) GDPR / § 25(2) No. 2 TTDSG.",
+          "wabenhain_session: keeps you logged into your customer account after signing in. Expires automatically after 30 days. Legal basis: Art. 6(1)(b) GDPR / § 25(2) No. 2 TDDDG.",
         ],
       },
       {
@@ -440,6 +454,7 @@ export const en: Dictionary = {
         paragraphs: [
           "Google reviews on our homepage are retrieved and displayed server-side via the Google Places API. No cookie is set in your browser, and your browser does not connect directly to Google.",
           "Payments are processed via Stripe. During the payment process, Stripe may set its own cookies necessary for fraud prevention. Stripe's privacy policy applies.",
+          "On pages with forms (sign-in, registration, password reset, checkout, newsletter, business enquiry), your browser loads a script from Cloudflare Turnstile. The service distinguishes input made by humans from input made by automated programs. Your IP address is transmitted to Cloudflare in the process. According to the provider, Turnstile sets no advertising cookies and builds no cross-site user profile. Details are in our privacy policy.",
         ],
       },
       {