Privacy Policy

This policy explains what personal data we process when you visit this shop or place an order, on what legal basis, and what rights you have. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (GDPR).

1. Controller

[FULL LEGAL NAME]
[STREET AND NUMBER], [POSTCODE] [CITY], Germany
Email: [EMAIL]

We have not appointed a data protection officer, as we are not required to do so under § 38 BDSG.

2. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR);
• withdraw any consent you have given, at any time, with effect for the future (Art. 7(3) GDPR);
• lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 27, 91522 Ansbach.

To exercise any of these, write to the address above. We respond within one month.

3. Visiting the website

When you open a page, your browser automatically transmits data that our hosting provider records in server log files: IP address, date and time, the page requested, referrer URL, browser type and version, and operating system.

Purpose: delivering the site, ensuring stability and security.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a functioning, secure website.
Retention: log data is deleted or anonymised after no more than 30 days.

4. Hosting and shop platform — Shopify

This shop runs on Shopify, operated by Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes all data arising from your use of the shop on our behalf as a processor under Art. 28 GDPR, on the basis of a data processing agreement.

Shopify may transfer data to its parent company in Canada and to service providers in the United States. Canada benefits from an EU adequacy decision; transfers to the United States are safeguarded by the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (legitimate interest in an efficient shop system).

5. Placing an order

To process your order we collect your name, billing and delivery address, email address, order details and payment information.

Purpose: concluding and performing the purchase contract, and meeting our legal obligations.
Legal basis: Art. 6(1)(b) GDPR; for the retention obligations below, Art. 6(1)(c) GDPR.
Retention: order and invoice data is retained for the statutory periods under commercial and tax law — generally 10 years under § 147 AO and § 257 HGB. During that period the data is restricted to that purpose.

6. Recipients of your data

We pass your data to the following categories of recipient, only to the extent necessary:

Legal basis: Art. 6(1)(b) GDPR for the performance of your order; Art. 6(1)(c) GDPR for tax obligations.

Update this table to name the exact providers you actually use, including your payment provider, before launch.

7. Production and fulfilment partner

Our items are produced by a fulfilment partner who receives your name, delivery address and the contents of your order in order to produce and dispatch it. Where that partner is located outside the European Economic Area, transfers are safeguarded by the EU Standard Contractual Clauses.

Legal basis: Art. 6(1)(b) GDPR — the transfer is necessary to perform your contract.

8. Payment processing

Payment is handled by the provider you select in the checkout. Your payment details are transmitted directly to that provider; we do not receive or store complete card numbers. The provider processes your data as an independent controller under its own privacy policy, and we receive only the information we need to allocate and confirm the payment.

Legal basis: Art. 6(1)(b) GDPR.

9. Contact and the withdrawal function

If you write to us, or use the online withdrawal function, we process the data you provide — name, email address, order number and your message — in order to deal with your request.

Legal basis: Art. 6(1)(b) GDPR where your request relates to a contract; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.
Retention: withdrawal declarations are retained for the statutory limitation period so that we can evidence when a declaration was received. Other enquiries are deleted once they are settled and no retention obligation applies.

10. Cookies

We use cookies that are strictly necessary to operate the shop — keeping your basket, maintaining your session and providing security. These are stored on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR and do not require your consent.

Any cookies that are not strictly necessary — for analytics, marketing or third-party embeds — are set only after you have given your consent through our cookie banner, on the basis of § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change or withdraw your choice at any time through the cookie settings, with effect for the future.

You can also configure your browser to refuse cookies. Blocking strictly necessary cookies may prevent parts of the shop from working.

11. Analytics and marketing

Currently we do not use analytics or marketing tools requiring consent. If you activate any — for example Google Analytics, Meta Pixel or an email marketing tool — you must add a section here naming the provider, the purpose, the legal basis, the retention period and any transfer outside the EEA, and route it through the consent banner. Leaving this section unamended while running such tools is one of the most frequently penalised errors.

12. Customer accounts

If you create a customer account, we store the data you enter there so that you can place orders more quickly and view your order history. You can view, change and delete your account at any time. Deleting your account does not affect order data we are legally required to retain.

Legal basis: Art. 6(1)(b) GDPR.

13. Transfers outside the EEA

Some of the providers above process data outside the European Economic Area. Such transfers take place only where the European Commission has found an adequate level of protection, or where appropriate safeguards under Art. 46 GDPR are in place — in particular the EU Standard Contractual Clauses — together with additional measures where required.

14. Is providing data mandatory?

Providing your data is neither legally nor contractually required. However, without the data marked as necessary in the checkout we cannot conclude or perform a contract with you.

15. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.

16. Data security

This site uses TLS encryption for all transmissions. You can recognise an encrypted connection by the padlock in your browser's address bar.

17. Changes to this policy

We may amend this policy to reflect changes in our processing or in the law. The version published here is always the current one.