Privacy police
PRIVACY POLICY
1) INFORMATION ON COLLECTION OF PERSONAL DATA & CONTROLLER CONTACT DETAILS
1.1 Thank you for visiting our website and for your interest. Below we explain how we handle your personal data when you use our website. Personal data refers to any information that can identify you personally.
1.2 The data controller responsible for processing on this site, under the GDPR, is [Shop Name]. The controller is the natural or legal person who alone, or jointly with others, determines the purposes and means of processing personal data.
1.3 For your security and to protect confidential data (e.g. orders or inquiries), this site uses SSL/TLS encryption. You can recognize a secure connection through the “https://” prefix and the lock symbol in your browser’s address bar.
⸻
2) DATA COLLECTION WHEN VISITING OUR WEBSITE
If you use our website purely for informational purposes (i.e., without registering or otherwise providing information), we only collect data automatically transmitted by your browser to our server (so-called “server log files”). These include:
• The page you visited
• Date and time of access
• Amount of data sent (in bytes)
• Referrer URL (i.e., where you came from)
• Browser type
• Operating system
• Your IP address (possibly anonymized)
Processing is necessary under GDPR Art. 6(1)(f) based on our legitimate interest in site stability and functionality. This data is not shared further, but we may review logs retrospectively if there is evidence of illegal activity.
⸻
3) COOKIES
To make our website more attractive and to enable functionality, we use “cookies”—small text files stored on your device. Some are session cookies (deleted when you close your browser), others are persistent (stay on your device so you can be recognized on later visits). Cookies may collect user info such as browser and location data, or IP address. Persistent cookies are automatically deleted after a set period.
Cookies may help simplify processes (e.g., remembering your shopping cart). If cookies process personal data, we rely on:
• Art. 6(1)(b) GDPR for contract performance, or
• Art. 6(1)(f) GDPR for legitimate interest in optimal site functionality.
We may work with advertising partners who also set cookies (third-party cookies). You will be informed separately about such cookies and data collected.
You can configure your browser to inform you about cookies, accept them case by case, or block them entirely. Please consult your browser’s help menu for details. For convenience, links for major browsers are included.
Note: blocking cookies may limit website functionality.
⸻
4) CONTACTING US
If you contact us (e.g., via form or email), we collect personal data as needed to answer your inquiry. Which data is collected depends on the contact form. We use your data solely to respond and for technical administration, based on our legitimate interest (Art. 6(1)(f) GDPR). If your contact aims to conclude a contract, processing is also lawful under Art. 6(1)(b) GDPR. Once your inquiry is resolved and no legal retention obligations exist, your data will be deleted.
⸻
5) ACCOUNT CREATION & CONTRACT EXECUTION
Under Art. 6(1)(b) GDPR, we process personal data you provide for order and account creation. Which data is collected depends on form fields. You can delete your account anytime by contacting us. Data is used for contract fulfilment. After completion or account deletion, your data is blocked and then deleted once legal retention periods expire, unless you have consented to further use.
⸻
6) USING YOUR DATA FOR DIRECT MARKETING
6.1 Newsletter Subscription
Signing up for our newsletter requires only your email. Other info is optional for personalization. We use a double opt‑in process. We store your IP address and signup timestamp to prevent misuse. Data is used only for the newsletter. You can unsubscribe anytime via link or by contacting us, and your email will be promptly removed unless you consent to further use.
6.2 Emails to Existing Customers
If you’ve provided your email when ordering, we may send you offers for similar products by email. No further consent is needed under our legitimate interest (Art. 6(1)(f) GDPR). If you object, we will stop sending marketing emails. You may object anytime—only standard transmission costs apply—and we’ll cease marketing use immediately.
⸻
7) PROCESSING FOR ORDER FULFILLMENT
7.1 Order-Related Data Sharing
We share your personal data with delivery services when necessary, and payment data with banks or payment service providers, as required to process payments. This is lawful under Art. 6(1)(b) GDPR.
7.2 Payment Providers
• PayPal: When you pay via PayPal (including credit card, direct debit, or invoice), we share your payment data with PayPal (Europe) S.a.r.l. et Cie, Luxembourg, under Art. 6(1)(b) GDPR. PayPal may perform a credit check under Art. 6(1)(f) GDPR. Further details are in PayPal’s privacy policy. You may object to the credit check, though PayPal may still need to process your data for contract performance.
• SOFORT: If you select SOFORT, we share payment/order data with SOFORT GmbH, Munich (part of Klarna Group), under Art. 6(1)(b) GDPR. More info in SOFORT’s privacy policy.
⸻
8) REVIEW REQUEST REMINDERS
If you consent during or after purchase, we may use your email once to remind you to leave an order review (Art. 6(1)(a) GDPR). You can withdraw consent anytime.
⸻
9) SOCIAL MEDIA PLUGINS (Shariff Implementation)
We use Facebook, Google+, and Instagram buttons via a secure “Shariff” approach—standard plugins are embedded as plain links, so no data is shared unless you click the link. These platforms are certified under the EU-US Privacy Shield. For details on data use and your rights, please refer to their respective privacy policies.
⸻
10) ONLINE MARKETING
10.1 DoubleClick by Google
We use Google DoubleClick to show relevant ads, improve campaign reporting, and avoid showing the same ads multiple times. Cookies record which ads are shown and track conversions. Processing is based on our legitimate interest (Art. 6(1)(f) GDPR). Cookies can be disabled via browser settings or Digital Advertising Alliance tools. DoubleClick is Privacy Shield–certified.
10.2 Google AdWords Conversion Tracking
We use Google AdWords with conversion tracking to measure ad effectiveness. Conversion cookies expire after 30 days and don’t identify individuals. Clicked ads followed by visits to our site generate aggregate conversion stats. You can disable tracking cookies via browser settings. Processing is based on our legitimate interest (Art. 6(1)(f) GDPR).
⸻
11) WEB ANALYTICS
We use Google Universal Analytics with anonymizeIp() to protect your identity. IP addresses are truncated within the EU/EEA. Data is processed under Art. 6(1)(f) GDPR. Google compiles usage reports for us, but doesn’t combine your data with other Google data. You can prevent data collection via browser settings, opt‑out plugins, or a one-click opt‑out link. Device‑spanning tracking uses an anonymous user-ID. You can opt-out anytime by disabling Google Analytics across your devices or via the provided plugin/link.
⸻
12) RETARGETING / REMARKETING
We use:
• Facebook Pixel: With your explicit consent, this tracks whether users clicked/viewed Facebook ads and visited our site, anonymously aiding ad campaign performance. Data may be linked to your Facebook profile. Use of this pixel is only with consent (Art. 6(1)(a) GDPR) and for users 13+. You may disable third-party cookies or use Digital Advertising Alliance tools.
• Google AdWords Remarketing: We tag your browser with a pseudonymous cookie to show interest-based ads. Processing relies on our legitimate interest (Art. 6(1)(f) GDPR). If you allow linking to your Google account, Google may combine the data with Analytics for cross-device remarketing. You can opt out via Google’s plugin, Digital Advertising Alliance, or browser settings.
⸻
13) YOUR RIGHTS
13.1 GDPR Rights
You have rights under the GDPR, including:
• Access (Art. 15): To view your data, its use, recipients, retention period, correction, deletion, and more.
• Rectification (Art. 16): To correct inaccurate data.
• Erasure (Art. 17): Right to have data erased, with exceptions (e.g., legal obligations).
• Restriction (Art. 18): To limit processing under certain conditions.
• Notification (Art. 19): We inform recipients of corrections or erasures.
• Portability (Art. 20): To receive your data in a structured, machine-readable format or transmit it elsewhere.
• Withdraw consent (Art. 7(3)): You may withdraw consent at any time, without affecting past processing.
• Complain (Art. 77): To a supervisory authority in your EU country if you believe your rights are violated.
13.2 Right to Object
If we process your data under legitimate interest, you may object at any time for reasons relating to your particular situation, effective for the future. We will cease processing unless we can prove compelling legitimate grounds or legal claims.
If you object to direct marketing, we will stop using your data for that purpose.
⸻
14) DATA RETENTION PERIOD
We retain personal data as required by law (e.g., commercial or tax retention). After expiry, we routinely delete data unless needed for contract fulfillment or we have a legitimate interest in continued retention.