Privacy Policy
1. General information
Protecting your personal data is important to us. We process your personal data only in accordance with applicable data protection provisions, particularly the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable statutory provisions.
This Privacy Policy explains which personal data we collect when you visit our website and use our online shop, the purposes of processing, its legal basis and your rights as a data subject.
Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, addresses, email addresses, telephone numbers, payment information, order details and technical information such as IP addresses or device identifiers where these can be associated with a person.
Personal data is processed only where necessary to provide a functioning website, take pre-contractual steps or fulfil contractual obligations, to comply with legal obligations, or on the basis of your consent or our legitimate interests under Article 6 GDPR.
This Privacy Policy applies solely to our website and online shop. Links to external websites or third-party services are governed exclusively by the respective providers' privacy policies.
2. Controller
The controller responsible for processing personal data within the meaning of the GDPR is:
[Company name] UG (limited liability)
[Street and house number]
[Postcode, town/city]
Germany
Email: [privacy@deinefirma.de]
Unless expressly stated otherwise in this Privacy Policy, the company named above is the controller for all processing operations connected with this website and our online shop.
Data protection officer
Our company is currently not legally required to appoint a data protection officer.
You can contact us at the email address above at any time with questions about data protection or the processing of your personal data.
3. Hosting and content delivery
Our website and online shop operate on Shopify. The platform provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Depending on the type of processing, other Shopify group companies may also process data.
When you visit our website, we process technical information necessary to provide, secure and operate our shop. This includes your IP address, browser and device information, access date and time, pages visited and other technically necessary log data.
These data are processed to provide a secure, functioning website, ensure system security, analyse errors and prevent abusive access.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient provision of our online offering.
For certain services, Shopify may process personal data outside the European Union. Transfers take place only in accordance with GDPR requirements, particularly on the basis of a European Commission adequacy decision or appropriate safeguards under Articles 45 or 46 GDPR.
Content delivery and security
We also use services of Cloudflare, Inc. to improve our website's security, stability and loading speed. Cloudflare processes technical connection data, including IP addresses, browser information and security-related log data, to detect and prevent attacks and deliver content efficiently.
Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and effective operation of our online shop.
4. Cookies, consent management and Consent Mode
Our website uses cookies and comparable technologies to operate our online shop, improve usability, analyse website performance and, where you have consented, enable marketing activities.
Cookies are small text files stored on your device. Some are technically necessary for the website to function correctly. Others serve statistical, functional or marketing purposes and are used only with your prior consent.
Consent management
We use a Consent Management Platform (CMP) together with the Shopify Customer Privacy API to manage your privacy settings. The consent banner lets you decide which categories of cookies and comparable technologies you wish to allow.
Your selection is stored and can be changed or withdrawn at any time with future effect through the cookie settings on our website.
Google Consent Mode v2
We use Google Consent Mode v2 to control our analytics and marketing services in accordance with data protection requirements.
Connected services, particularly Google Analytics, Google Ads and other marketing and analytics platforms, are activated or restricted according to your consent. Without your consent, no cookies or comparable technologies requiring consent are used.
Legal bases
Technically necessary cookies are processed on the basis of Article 6(1)(f) GDPR because they are required for the secure and proper operation of our shop.
All other cookies and comparable technologies are used solely on the basis of your consent under Article 6(1)(a) GDPR.
5. Google Analytics 4
Where you have consented, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics allows us to evaluate website use and continuously improve our offering. It may process website usage information, pages visited, interactions, technical device information, browser data, shortened IP addresses and other online identifiers.
Google Analytics 4 does not log or store complete IP addresses by default. IP addresses are shortened before further processing. Google may also process collected data on servers outside the EU. Such transfers are subject to GDPR requirements, particularly Articles 45 and 46.
Information collected through Google Analytics helps us:
better understand website use;
identify technical errors;
optimise content and functions; and
continuously improve our shop's usability.
Processing is based solely on your consent under Article 6(1)(a) GDPR.
You may withdraw consent at any time with future effect through our website's cookie settings.
6. Google Tag Manager
Where you have consented, we use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Tag Manager serves solely to manage and integrate website tags through a central interface. The service itself does not create usage profiles and generally does not store personal data for analytics or marketing purposes.
It can, however, integrate and control other services that process personal data. Those services are described in the relevant sections of this Privacy Policy.
Where use of Google Tag Manager establishes technically necessary connections to Google servers, processing is based on your consent under Article 6(1)(a) GDPR, unless it is used solely to provide technically necessary functions.
Any transfer of personal data to third countries takes place only in accordance with GDPR requirements.
7. Meta Pixel
Where you have consented, we use Meta Pixel, a service provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Meta Pixel lets us understand visitors' behaviour after they reach our website through an advertisement on Meta platforms, particularly Facebook or Instagram. This allows us to measure advertising effectiveness, optimise marketing and deliver interest-based advertising.
It may process website visits, pages accessed, products viewed, interactions, orders, device information, browser data and online identifiers. If Advanced Matching is used, information supplied by you, such as an email address, may also be sent to Meta in hashed form to match events more reliably.
The collected data may enable Meta to recognise you on its platforms and display personalised advertising. We receive only aggregated, anonymised reports about advertising effectiveness and no information allowing direct identification of individuals.
Processing is based solely on your consent under Article 6(1)(a) GDPR.
You may withdraw consent at any time with future effect through our cookie settings.
Further information about Meta's processing is available in Meta's privacy policies.
8. TikTok Pixel
Where you have consented, we use TikTok Pixel, a service provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland, and TikTok Information Technologies UK Limited, One London Wall, London EC2Y 5EB, United Kingdom.
TikTok Pixel lets us understand website use, measure the success of TikTok advertising campaigns and optimise marketing. It may also be used to deliver interest-based advertising and create audiences for future campaigns.
It may process website visits, pages accessed, products viewed, interactions, orders, device information, browser data, online identifiers and event data.
The collected data may enable TikTok to recognise website visitors and display personalised advertising on its platforms. We receive only statistical and aggregated reports about our advertising performance.
Processing is based solely on your consent under Article 6(1)(a) GDPR.
You may withdraw consent at any time with future effect through our cookie settings.
Further information about TikTok's processing of personal data is available in its privacy policies.
9. Pinterest Tag
Where you have consented, we use Pinterest Tag, a service of Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.
Pinterest Tag lets us understand website use, measure the effectiveness of Pinterest advertising campaigns and optimise marketing. It may also be used to deliver interest-based advertising and create audiences for future campaigns.
It may process website visits, pages accessed, products viewed, interactions, orders, device information, browser data, online identifiers and event data.
The collected data may enable Pinterest to recognise website visitors and display personalised advertising on Pinterest. We receive only aggregated and statistical advertising performance reports that do not allow direct identification of individuals.
Processing is based solely on your consent under Article 6(1)(a) GDPR.
You may withdraw consent at any time with future effect through our cookie settings.
Further information about Pinterest's processing of personal data is available in its privacy policies.
10. Shopify Payments
We use Shopify Payments to process payments in our online shop. This service is provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Depending on the payment method, other Shopify group companies and possibly further payment providers participate in processing.
When you place an order and select a method offered through Shopify Payments, personal data necessary for payment processing is processed. This includes:
name;
billing and delivery addresses;
email address;
order details;
payment information;
transaction data; and
IP address and other technical information required for fraud prevention and security.
Processing serves to perform the purchase contract, process payments, prevent fraud, meet legal obligations and handle possible refunds or complaints.
The legal bases are Article 6(1)(b) GDPR (contract performance), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interest in secure payment processing without abuse).
Where necessary, personal data may be transferred to participating banks, credit card companies, payment providers and fraud prevention services. Transfers outside the EU or EEA take place only in accordance with GDPR requirements.
Further information about Shopify's processing is available in Shopify's privacy policies.
11. PayPal
If you choose to pay through PayPal, payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
Personal data necessary to process payment is transferred to PayPal, including:
name;
billing and delivery addresses;
email address;
order details;
payment amount;
currency;
transaction data; and
IP address and further information required for payment processing and fraud prevention.
PayPal processes these data particularly to perform payment, prevent fraud, assess identity and risk, meet legal obligations and handle refunds or payment disputes.
Depending on the chosen payment method, PayPal may itself collect further personal data and process it as an independent controller. We have no influence over the nature, scope or duration of that processing.
The legal basis for transfer is Article 6(1)(b) GDPR (contract performance). Where statutory retention or verification duties apply, processing is also based on Article 6(1)(c) GDPR. Processing may additionally be based on Article 6(1)(f) GDPR where it serves fraud prevention or payment security.
Processing outside the EU or EEA takes place only in accordance with GDPR requirements.
Further information about PayPal's processing is available in its privacy policies.
12. Klarna
If you choose a payment method offered by Klarna, payment is processed by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
We transfer personal data necessary to process payment to Klarna, including:
name;
billing and delivery addresses;
email address;
telephone number, if provided;
date of birth, where required for the chosen payment method;
order details;
payment amount;
transaction data; and
IP address and other technically necessary information.
Depending on the payment method, Klarna may assess identity, creditworthiness or risk to decide whether to provide that method. These assessments are solely Klarna's responsibility. We have no influence over their nature, scope or outcome.
Personal data is processed to perform the purchase contract, process payments, prevent fraud, meet legal obligations and, where necessary, assess creditworthiness and risk.
The legal basis for transfer is Article 6(1)(b) GDPR (contract performance). Where legal obligations apply, processing is also based on Article 6(1)(c) GDPR. Processing may additionally be based on Article 6(1)(f) GDPR where it serves fraud prevention or payment security.
Klarna processes personal data as an independent controller. Its privacy policies provide further information about processing, credit reference agencies used and your rights.
13. Stripe
If you choose a payment method offered through Stripe, payment is processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland.
Personal data necessary to process payment is transferred to Stripe, including:
name;
billing and delivery addresses;
email address;
order details;
payment amount;
payment information;
transaction data; and
IP address and other technical information required for fraud prevention and security.
Stripe processes these data particularly to perform payment, prevent fraud, detect abusive transactions, meet legal obligations and handle refunds and payment disputes.
Processing is based on contract performance under Article 6(1)(b) GDPR. Where legal obligations apply, it is also based on Article 6(1)(c) GDPR. Processing may additionally be based on Article 6(1)(f) GDPR where it serves payment security and fraud prevention.
Stripe processes personal data as an independent controller insofar as necessary to provide payment services.
Processing outside the EU or EEA takes place only in accordance with GDPR requirements.
Further information about Stripe's processing is available in its privacy policies.
14. Carriers
We work with various carriers to meet our contractual obligations and deliver your orders. Depending on the destination country, shipping method and availability, we may use in particular:
DHL;
Hermes;
UPS; and
FedEx.
Where necessary for delivery, we transfer the required personal data to the appointed carrier, including:
name;
delivery address;
email address, if necessary for shipping information;
telephone number, if necessary for delivery; and
order and shipment information.
These data are transferred solely to process, perform and track your order and, where applicable, contact you concerning delivery.
The legal basis is Article 6(1)(b) GDPR because processing is necessary to perform our purchase contract with you.
Where we or the carrier must retain certain information by law, processing is also based on Article 6(1)(c) GDPR.
Depending on the destination, personal data may be processed outside the EU or EEA. Such processing takes place only in accordance with GDPR requirements and only insofar as necessary for delivery.
Further information is available in the relevant carrier's privacy policies.
15. Email communication and Shopify Email
Where you have expressly consented, we use Shopify Email, a service of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, to email you information about our products, offers, new releases and other promotional content.
For newsletter distribution, we process in particular:
email address;
name, if provided;
information about your consent;
technical information about sending and delivering the email; and
information about whether and when an email was opened or a link clicked, where such tracking is enabled.
Processing is based solely on your consent under Article 6(1)(a) GDPR.
You may withdraw consent at any time with future effect through the unsubscribe link in each newsletter email or by contacting us using the details in this Privacy Policy.
This does not affect emails necessary to process your order or fulfil contractual or statutory obligations, such as order confirmations, shipping information or customer account notifications. Those emails are processed on the basis of Articles 6(1)(b) or 6(1)(c) GDPR.
Processing outside the EU or EEA takes place only in accordance with GDPR requirements.
Further information about Shopify's processing is available in Shopify's privacy policies.
16. WhatsApp Business
You can contact our customer service through WhatsApp Business, provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
If you contact us through WhatsApp, we process the personal data you send insofar as necessary to handle your enquiry, including:
name, if provided;
telephone number;
message content;
attachments, images or documents you voluntarily send; and
communication date and time.
Processing serves solely to handle your enquiry, provide customer support and, where necessary, take pre-contractual steps or perform an existing contract.
The legal basis is Article 6(1)(b) GDPR if your enquiry concerns an order or contract. In other cases, processing is based on our legitimate interest in efficient, contemporary customer communication under Article 6(1)(f) GDPR.
WhatsApp may also process personal data as an independent controller. We have no influence over that processing.
Processing outside the EU or EEA takes place only in accordance with GDPR requirements.
Further information about WhatsApp's processing is available in its privacy policies.
17. Cloudflare and security measures
We use Cloudflare, Inc. services to ensure our shop's security, stability and performance.
Cloudflare assists particularly with website delivery, loading speed optimisation, protection from abusive access and detection and prevention of attacks on our IT systems.
It may process technical information including:
IP address;
browser and device information;
access date and time;
pages accessed;
log and connection data; and
other technical information required to secure our website.
Processing is based on our legitimate interest under Article 6(1)(f) GDPR in providing a secure, reliable and efficient online offering and protecting against fraud, abuse and cyberattacks.
Cloudflare Turnstile
We use Cloudflare Turnstile to protect forms and other interactive website areas. It detects and prevents automated access by bots without collecting unnecessary personal data.
It may process IP addresses, browser and device information and other security-related signals insofar as necessary to distinguish human users from automated requests.
Processing is based on our legitimate interest under Article 6(1)(f) GDPR in ensuring website security and functionality and protecting our systems and users.
Processing outside the EU or EEA takes place only in accordance with GDPR requirements.
Further information about Cloudflare's processing is available in its privacy policies.
17a. Contacting us
If you contact us by email, contact form, telephone or another available communication method, we process the personal data you provide solely to handle your enquiry and communicate with you.
Depending on your enquiry, this may include:
name;
email address;
telephone number;
message content; and
other information you voluntarily provide.
Processing serves to handle your enquiry, take pre-contractual steps or fulfil an existing contract.
The legal basis is Article 6(1)(b) GDPR if your enquiry concerns the establishment or performance of a contract. In other cases, processing is based on our legitimate interest in efficiently handling customer enquiries under Article 6(1)(f) GDPR.
Data collected when you contact us is deleted once your enquiry has been fully resolved and no statutory retention duties or other legitimate interests prevent deletion.
17b. Customer account
You can create a customer account on our website. This is voluntary and serves to simplify future orders and provide information about your orders and account.
When registering and using an account, we process in particular:
name;
email address;
billing and delivery addresses;
order history;
account settings; and
other information you voluntarily save in your account.
Processing serves to provide and manage your customer account and perform our contract with you.
The legal basis is Article 6(1)(b) GDPR.
You may have your account deleted or request its deletion at any time. Statutory retention obligations, particularly for completed orders, remain unaffected.
18. Data subject rights
Where we process your personal data, the GDPR gives you in particular the following rights:
Right of access
You may request information about whether and which personal data we process about you.
Right to rectification
You may request correction of inaccurate data or completion of incomplete personal data.
Right to erasure
You may request deletion of your personal data where statutory requirements are met.
Right to restriction of processing
You may request restriction of processing where statutory requirements are met.
Right to data portability
Where statutory requirements are met, you may receive your personal data in a structured, commonly used, machine-readable format or request its transfer to another controller.
Right to object
Where we process personal data on the basis of Article 6(1)(e) or 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.
Where personal data is processed for direct marketing, you may object at any time. Once your objection is received, your personal data will no longer be processed for direct marketing.
Right to withdraw consent
You may withdraw consent at any time with future effect. This does not affect the lawfulness of processing before withdrawal.
Right to complain to a supervisory authority
You may also complain to a data protection supervisory authority if you believe processing of your personal data violates data protection provisions.
19. Retention periods
We retain personal data only for as long as necessary for the relevant purposes or as required by law.
Retention periods depend particularly on:
performance and processing of existing contractual relationships;
statutory retention periods, especially under commercial and tax law;
handling possible warranty claims, complaints or legal claims; and
legitimate interests that justify further retention under Article 6(1)(f) GDPR.
Once the processing purpose no longer applies and no statutory retention obligations or other legal reasons prevent deletion, personal data is deleted or anonymised.
Unless individual sections of this Privacy Policy specify different retention periods, these rules apply.
20. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy where required by changes in law, official requirements, technical developments or changes to our website, online shop or services used.
The current version is available on our website at any time and applies from publication.
Where changes require consent or materially affect personal data processing, we will inform you to the extent required by law.