Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary for the conclusion of a contract. You are under no obligation to provide such data. Failure to provide it will have no consequences.

"Personal data" refers to any information relating to an identified or identifiable natural person.

1. Server log files

You can visit our websites without providing any personal information.
Each time you access our site, your browser transmits usage data to us or our web host/IT service provider, which is then stored in server log files. This data includes, for example, the name of the page accessed, the date and time, the IP address, the volume of data transferred, and the requesting provider.

Processing is carried out on the basis of Art. 6(1)(f) GDPR, reflecting our legitimate interest in ensuring the trouble-free operation of our website and optimizing our services.

Your data may be transferred to third countries outside the EU (e.g., Canada, USA). An adequacy decision by the EU Commission exists for Canada. The Trans-Atlantic Data Privacy Framework (TADPF) applies to the USA. Shopify is not TADPF-certified. Data transfer takes place on the basis of contractual obligations comparable to EU Standard Contractual Clauses.

2. Contacting us via email or contact form

If you contact us via email or the contact form, we process your data (name, email address, message) solely for the purpose of handling your inquiry. Pre-contractual measures or existing contracts: Art. 6(1)(b) GDPR
Other inquiries: Art. 6(1)(f) GDPR (legitimate interest)

Your data is used solely for processing purposes and subsequently deleted in compliance with statutory retention periods, unless further processing has been agreed upon.

3. Address validation via Google Maps API

We use address validation services provided by Google (Google Ireland Limited, Dublin, Ireland).

Purpose: To verify and, if necessary, correct the information you enter into address forms in real time. Data transmitted includes, among other things, postal addresses, email addresses, and telephone numbers. Data may be transferred to the USA; Google is TADPF-certified.

Legal basis: Art. 6(1)(f) GDPR.
Further information: Google Maps Terms of Service, Google Privacy Policy

4. Customer account & orders

Customer account:
Your data is used to improve your shopping experience. Processing is based on your consent (Art. 6(1)(a) GDPR). Revoking consent results in the deletion of your account.

Orders:
We process only the data necessary for contract fulfillment and order processing. Legal basis: Art. 6(1)(b) GDPR.

Data sharing:
Data is shared with shipping service providers, fulfillment providers, payment service providers, and IT service providers—strictly to the extent required by law.

Data may be transferred to third countries (Canada, USA); please refer to the "Server log files" section. 5. Shipping Service Providers

Provided you have given your consent, your email address will be passed on to shipping companies for the purpose of shipping status notifications (Art. 6 para. 1 lit. a GDPR). You may revoke this consent at any time.

5. Payment Service Providers & Credit Checks

PayPal / PayPal Plus / PayPal Express / PayPal Check-Out:
Necessary data is transmitted to PayPal for payment processing (Art. 6 para. 1 lit. b GDPR). For certain payment methods, PayPal may conduct a credit check (Art. 6 para. 1 lit. f GDPR).

6. Cookies

We use cookies to ensure the functionality and security of our website.
Technically necessary cookies are set without consent; other cookies are set only with consent (Art. 6 para. 1 lit. a/f GDPR).

7. Rights of Data Subjects & Storage Duration

Storage Duration:
Following contract fulfillment, data is initially stored for the duration of the warranty period, then retained in compliance with statutory retention periods, and subsequently deleted.

Your Rights:
Art. 15–20 GDPR: Access, rectification, erasure, restriction of processing, data portability.
Art. 21 GDPR: Right to object to processing based on legitimate interests and to direct marketing.

Complaints:
State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen)
Prinzenstraße 5, 30159 Hannover
Tel.: +49 511 1204500, Email: poststelle@lfd.niedersachsen.de