We take the protection of your personal data seriously. This policy explains what data we process when you visit our online shop, why we process it, and what rights you have. It follows the EU General Data Protection Regulation (GDPR).
1. Controller
[Company or full name]
[Street and house number]
[Postal code and city], Germany
Email: [Email address]
Phone: [Phone number]
2. General information and legal bases
We process personal data only where a legal basis under Art. 6 GDPR applies — in particular to perform a contract with you (Art. 6 (1)(b)), to comply with legal obligations (Art. 6 (1)(c)), on the basis of your consent (Art. 6 (1)(a)), or to protect our legitimate interests such as the secure operation of our shop (Art. 6 (1)(f)).
3. Hosting and shop platform (Shopify)
Our shop is operated on the platform of Shopify International Limited (Ireland), part of Shopify Inc. (Canada). Shopify processes data on our behalf to host the shop and handle orders and payments. Where data is transferred outside the EU/EEA, this is safeguarded by standard contractual clauses and/or an adequacy mechanism. A data processing agreement is in place with Shopify.
4. Server log files
When you access our website, your browser automatically transmits technical information (e.g. IP address, date and time, browser type, referring page), processed to display the site securely (Art. 6 (1)(f)) and stored only as long as necessary.
5. Cookies and consent
We use cookies and similar technologies. Technically necessary cookies (e.g. cart and checkout) are used on the basis of Art. 6 (1)(f) and § 25 (2) TDDDG. Non-essential cookies and scripts — e.g. analytics, marketing, or third-party review widgets — are only set after you give consent via our cookie banner (Art. 6 (1)(a), § 25 (1) TDDDG). You can withdraw consent at any time with effect for the future.
(Important: ensure a consent banner is installed and that non-essential scripts — including the Loox reviews widget — load only after consent.)
6. Processing your order
To process your purchase we collect the data required for the contract (name, delivery and billing address, email, order details) on the basis of Art. 6 (1)(b), passing it on only as necessary (e.g. to payment and shipping providers). We retain order data as required by commercial and tax law.
7. Payment providers
Depending on the payment method you choose, your payment data is processed by the relevant provider. [List your active payment providers, e.g. PayPal, Klarna, Shopify Payments.]
8. Shipping
To deliver your order, we share the necessary address data with the shipping provider we use. [Name your shipping provider(s), e.g. DHL, DPD.]
9. Customer account
If you create a customer account, we store the data you provide to make future orders easier. You can view, change, or delete it at any time.
10. Contact form / email
If you contact us via the form or by email, we process the data you provide to handle your enquiry (Art. 6 (1)(b) or (f)) and delete it once no longer needed.
11. Product reviews (Loox)
We use the Loox app to collect and display product reviews. When you submit a review or interact with the widget, Loox may process data such as your name, email, and any photos you upload, on our behalf. [Adjust to your actual Loox settings.]
12. Newsletter
(Only if you send a newsletter — otherwise delete.) If you subscribe, we process your email address on the basis of consent (Art. 6 (1)(a)) using double opt-in. You can unsubscribe at any time. [Name your email tool.]
13. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time. Contact us using the details in Section 1.
14. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority in the EU member state of your residence, workplace, or the place of the alleged infringement.
15. Data security and updates
We use appropriate technical and organisational measures to protect your data and may update this policy. Current version: [Month/Year].
Template with placeholders, not legal advice. Complete the bracketed sections, ensure a working cookie-consent banner is in place, and have the text reviewed. Provide a German-language version if you sell to consumers in Germany.