Privacy Policy
How we handle your personal data
We take the protection of your personal data seriously. This page explains, in general terms, what data we collect when you use this online store and for what purpose.
Data controller
The data controller responsible for this store is the store operator named on our page. Impressum
Data we collect
When you place an order we process your name, mobile number, your email address if provided, the delivery address and the order details in order to process and deliver your order. If you order with a customer account we additionally store your login and account data; if you order as a guest we store the details only for handling this order and for statutory retention obligations.
Purpose of processing
We process your data to fulfil your order, to communicate with you about your order, and — only with your consent — to send you marketing messages.
Legal bases
We process your data to perform the contract and take pre-contractual steps (Art. 6(1)(b) GDPR), to comply with legal obligations, in particular tax and commercial retention duties (Art. 6(1)(c) GDPR), on the basis of our legitimate interest in a secure and functioning shop, e.g. abuse prevention and error analysis (Art. 6(1)(f) GDPR), and – for example for push notifications or marketing – on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.
Hosting and technical service providers
The shop runs on servers of an external hosting provider that processes data solely on our behalf and according to our instructions (processing on behalf under Art. 28 GDPR). When you visit pages, technically necessary data such as IP address, time and requested page are processed in server log files and deleted after a short period. If an error-monitoring service is used for error analysis, only technical error data without order or payment contents is transmitted.
SMS and email
To sign in with a one-time code we send an SMS to your mobile number. We use the service Twilio (Twilio Inc., USA) for this; your mobile number and the message content are transmitted to Twilio. The transfer to the USA is based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. We send order confirmations and status updates by email via an email delivery provider acting as a processor.
Payment and financial data
To process payments we share the necessary order and payment amount data with our payment service provider (Stripe). Card and other payment details are handled directly by the payment provider and are not stored on our servers. See Stripe's own privacy policy for details on how it processes payment data.
Push notifications
If you enable notifications, your browser gives us a device address (endpoint) and a public encryption key so we can send you order status updates. We store them encrypted and delete or deactivate them when you switch notifications off, when we stop using the device or when the push service reports the subscription as expired. Notifications are transactional only (order status); we do not send advertising this way. You can switch notifications off at any time in your profile.
Cookies
This store does not use tracking cookies. Only strictly necessary storage is used: a login session cookie (HttpOnly, SameSite=Lax, sent only to /api) so you stay signed in, and local storage in your browser for the cart and the selected language. No analytics or marketing services are active, so no consent is required for them.
Retention of order and invoice data
Invoices and accounting records are retained for 8 years from the end of the calendar year of invoicing, pursuant to § 147 (3) AO and § 257 (4) HGB. Commercial and business letters relevant for taxation are retained for 10 years. Data without tax relevance – such as your customer account – is deleted once it is no longer needed to process your order, and at the latest upon your request, unless a statutory retention obligation applies.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR), as well as the right to withdraw any consent at any time. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the federal state of your residence or of our registered office. To exercise your rights, contact us using the details given in the . Impressum