Privacy Policy

Last updated: [Month Year]

1. Who is responsible

[Company name, legal form], [Address], Email: [email], Phone: [phone]. [Data protection officer: none appointed / contact details]

2. What data we process and why

We process personal data only as needed to run our shop and fulfil orders. Our legal bases under the GDPR are contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)) and consent (Art. 6(1)(a)).

Website visit: Your browser sends technical data to our server, such as IP address, date and time, page, browser and device. We process it to keep the site secure and stable (legitimate interests) and delete it after [X days].
Orders: We process your name, address, email, [phone], order details and payment details to conclude and perform the contract, deliver your order and handle returns and support. We keep invoice and order data as long as tax and commercial law require, up to 10 years in Germany.
Contact: If you write to us, we use your details and message to answer your request.
Account [optional]: We store your account data and order history so you can order faster. You can ask us to delete your account at any time.
Newsletter [optional]: With your consent and a double opt-in, we send news and offers via [provider]. You can unsubscribe at any time.

3. Our service providers

Shop system: [Shopify, Shopify International Ltd., Ireland, and Shopify Inc., Canada; adjust to your system] hosts the shop and processes technical and order data on our behalf.
Payment: [payment providers, e.g. Shopify Payments, PayPal, Stripe, Klarna] process your payment. We do not store your full card details.
Shipping and fulfilment: We pass your name, delivery address and, where needed for delivery, your email and phone number to [carriers] and to [our fulfilment partner / supplier in [country]] who packs and ships your order.

Where data is transferred outside the EU/EEA, we rely on [an adequacy decision, the EU-US Data Privacy Framework or standard contractual clauses] or, where necessary to perform the contract, on Art. 49(1)(b) GDPR. We have data processing agreements with our processors where required.

4. Cookies and analytics

We use cookies that are technically necessary for the shop, such as for the cart and checkout (Art. 6(1)(f) GDPR, section 25(2) TDDDG). [Optional: Other cookies and tools, such as [analytics / marketing tools], are only used with your consent via our cookie banner (Art. 6(1)(a) GDPR, section 25(1) TDDDG). Describe each tool: provider, purpose, data and transfers. You can withdraw consent at any time via [link to cookie settings].]

5. Storage

We delete or anonymise your data once it is no longer needed for these purposes, unless a legal retention period applies. Newsletter data is stored until you unsubscribe.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability (Art. 15-18, 20 GDPR), and to withdraw consent at any time (Art. 7(3) GDPR). Contact us at [email] to exercise your rights.

Right to object: Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You may object at any time to the use of your data for direct marketing.

Complaint: You may lodge a complaint with a data protection authority, for example at your place of residence or our registered office. The authority responsible for us is [name and address].

7. Security and automated decisions

We protect your data with SSL/TLS encryption and appropriate technical and organisational measures. We do not use automated decision-making that produces legal effects for you.