Datenschutzerklärung

Last updated: 2 November 2026

Contents
1. Who is responsible for your personal data
2. Principles governing our processing
3. Shop operation, Shopify and technical logs
4. Cookies, consent management and your settings
5. Orders, customer accounts, wishlists and returns
6. Logistics, ROXDEN, merchandise management and shipping
7. Payment processing
8. Customer service and contacting us
9. Klaviyo: newsletters, messages and personalised marketing
10. WhatsApp marketing through Chatarmin
11. Other notifications, reviews and direct marketing
12. Our tracking infrastructure and Google Tag Manager
13. Google Analytics 4
14. Google BigQuery, data analysis and our own shop tracking
15. Meta Pixel, Conversions API and advanced matching
16. Google Ads, conversion measurement and enhanced conversions
17. Other analytics functions
18. A/B testing with ABLyft and Varify
19. Other services and forms
20. Accounting, legal obligations and job applications
21. Recipients, roles and international transfers
22. How long data is retained
23. Overview of storage technologies
24. Your rights
25. Changes to this policy

1. Who is responsible for your personal data

The controller responsible for the processing carried out by SASSYCLASSY as described in this Privacy Policy is:

RODEBO-Lifestyle GmbH
Kirschstraße 14
80999 Munich, Germany
Email: info@sassyclassy.de
Telephone: +49 89 628 26030

You can use these contact details for privacy enquiries and to exercise your rights. Please address postal correspondence for our Data Protection Officer to the address above, marked "Data Protection Officer - personal/confidential".

This policy applies to the SASSYCLASSY online shops operated by RODEBO-Lifestyle GmbH and their associated ordering and customer account functions. For individual services and forms, you may receive additional privacy information specific to the relevant activity.

2. Principles governing our processing

Personal data is information that relates to you or can be linked to you. This also includes identifiers and usage data where they can be linked to an individual. A hashed email address or a randomly generated user identifier is therefore not anonymous merely because of this technical transformation.

We process data for the purposes described in each section, on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract or steps prior to entering into a contract: Article 6(1)(b) GDPR, for example to process and deliver your order.
• Legal obligations: Article 6(1)(c) GDPR, for example to retain invoices as required by tax law.
• Consent: Article 6(1)(a) GDPR, in particular for the optional analytics and marketing activities described below.
• Legitimate interests: Article 6(1)(f) GDPR, where the processing is necessary and is not overridden by your interests and rights. We specify the relevant interest in the section describing that processing.

Storing information on your device and accessing information already stored there are also assessed under section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG). We obtain your consent for storage and access that are not strictly necessary. The exception for a strictly necessary service that you have expressly requested covers, for example, essential shopping cart functions, rather than the mere commercial usefulness of a marketing service.

We obtain data directly from you, through your use of our services and, where necessary for the purposes described below, from payment, delivery and other integrated service providers, for example information about payment and delivery status.

Mandatory information is identified in the relevant input forms. Without the information necessary for a contract, we cannot provide the relevant service. Providing optional information or consenting to marketing or optional analytics is generally not a condition for placing an order.

3. Shop operation, Shopify and technical logs

3.1 Shopify as our shop system

We operate our online shop using Shopify. Shopify provides, in particular, shop pages, the shopping cart, checkout, order management and customer account functions. This involves processing the contact, order, account, payment status and technical connection data required for these functions. The Shopify group includes, in particular, Shopify International Limited in Ireland and Shopify Inc. in Canada.

Processing necessary to provide a shop function you have requested or to fulfil an order is based on Article 6(1)(b) GDPR. Where technical measures for the secure and reliable provision of our services are not already necessary for the performance of a contract, we rely on Article 6(1)(f) GDPR. Our interest is to protect the shop and ensure its reliable operation.

Where Shopify acts on our behalf for these purposes, it does so as a processor. Information about international transfers is provided in section 21. Further information is available in Shopify's Privacy Policy.

3.2 Additional Shopify services

When you use Shopify's own services, such as Shop or Shop Pay, Shopify also processes data arising from your relationship with Shopify as a controller in its own right. This may include, in particular, account, contact, payment and transaction data.

Shopify may also act as a controller in its own right for enhanced services relating to personalisation, analytics or the improvement of commerce functions. This applies in particular to Enhanced Services and Shopify Network Intelligence, where those services are integrated. In this context, contact, transaction, device and usage data may be processed and combined with data from other interactions with Shopify.

Shopify's Consumer Privacy Policy applies in addition. Where we provide such data for optional personalisation, analytics or advertising and consent is required, we do so only with that consent. Merely using our shop does not constitute blanket agreement to advertising across different shops.

3.3 Technical connection data and security logs

When you access our services, technical data is processed to establish the connection and deliver the content requested. This includes, in particular, your IP address, access time, the resource requested, status information and information about your browser.

Security and error logs help us identify and resolve technical problems and abusive access. The legal basis is Article 6(1)(f) GDPR; our interest is to protect our systems and our customers' data. These logs are retained for technical fault analysis and security monitoring and deleted once they are no longer necessary for those purposes.

Where there are specific indications of a security incident, the log data needed to investigate it and pursue legal claims may be retained for those specific purposes until the relevant proceedings and any necessary evidential retention period have ended. Additional use for marketing is not covered by this technical operating purpose and is subject to the separately described requirements.

4. Cookies, consent management and your settings

We use cookies and similar storage technologies for essential shop functions and, following the relevant consent, for analytics and marketing.

We use Pandectes to manage your choices. This involves processing your selection, the time of that selection and the information required to associate and demonstrate it. This includes a consent identifier and information about the scope of the consent you have given or refused.

Storing your choice is necessary so that we can respect it. Access to the storage required for this purpose is based on section 25(2), point 2 TDDDG. Where personal data is processed to fulfil our obligations concerning consent and its documentation, the legal basis is Article 6(1)(c) GDPR in conjunction with Articles 5(2) and 7(1) GDPR.

You can reject non-essential services and later change your choice through the cookie or privacy settings available on our website. You can place an order without agreeing to optional analytics and marketing services.

Withdrawal takes effect for the future. It does not affect the lawfulness of processing previously based on valid consent. Once consent has been withdrawn, the processing dependent on that consent is stopped; data already stored is subject to the applicable legal rules on erasure and restriction. Records required by law may be retained to the extent necessary for that purpose.

Unsubscribing from a newsletter, withdrawing consent to website tracking and deleting a customer account are separate actions. You can also contact us with a comprehensive privacy request. Additional information about storage technologies is provided in section 23.

5. Orders, customer accounts, wishlists and returns

When you place an order, we process your contact and delivery details, the items ordered, quantities and prices, payment and shipping status, and the communications necessary to fulfil the contract. For returns, we also process the return status, any reasons for return you provide and refund information.

This processing is necessary to enter into, perform and complete the sales contract under Article 6(1)(b) GDPR. Where we must retain records or fulfil legal obligations, Article 6(1)(c) GDPR applies.

A customer account enables you to use the order and account functions offered within it. We process the account and login data necessary to provide this service. You can request deletion of your account by contacting us. Order records subject to legal retention requirements are not deleted prematurely as a result.

When you use a wishlist, we store your selected items and the information needed to associate them with your account or browser so that they can be displayed again. Where this storage is strictly necessary to provide the function you expressly requested, it is based on Article 6(1)(b) GDPR and section 25(2), point 2 TDDDG. Additional analysis of wishlist actions for advertising or analytics is subject to the consent requirements described for those purposes.

Retention of account, wishlist and return data depends on the relevant functional or fulfilment purpose and the criteria described in section 22.

6. Logistics, ROXDEN, merchandise management and shipping

6.1 Logistics handled by ROXDEN

ROXDEN handles warehousing, dispatch and returns on our behalf.

ROXDEN receives the data necessary for the relevant logistics service. This includes, in particular, your name, delivery address, order or shipment reference, items and quantities, and the shipping and return information needed to handle the process. Contact details such as your email address or telephone number are provided only where necessary for a specifically agreed logistics or delivery process.

ROXDEN processes this data to organise warehousing, pick and pack orders, hand shipments over to carriers and process returns. Data transferred as part of our engagement of ROXDEN is not used for ROXDEN's own advertising.

The legal basis for our processing and the necessary provision of data is Article 6(1)(b) GDPR. Where ROXDEN processes data on our behalf and in accordance with our instructions, the requirements for processing under Article 28 GDPR apply. Marketing consent is not required for the necessary fulfilment of your order.

6.2 Merchandise management and logistics software

pixi / Descartes is used to manage orders, inventory and returns. This involves processing the customer master data, delivery details, order items, shipping status and return status required for the relevant order and logistics processes.

The applicable purpose is contract fulfilment under Article 6(1)(b) GDPR; Article 6(1)(c) GDPR applies to necessary statutory retention. Processing may take place within our merchandise management system and the logistics organisation acting on our behalf.

6.3 Carriers

Your name, delivery address and the shipment information needed for transport are transferred to the carrier appointed for the shipment. The carrier may report delivery and shipment status to us and to our logistics provider.

Where your delivery is handled by DHL, DPD, Hermes or Austrian Post, the relevant company receives this information necessary for transport. The information provided for your delivery identifies the carrier handling your shipment.

The legal basis is Article 6(1)(b) GDPR. We transfer an email address or telephone number for additional delivery notifications only where there is a valid legal basis. Where the additional service is not necessary for the contract and consent is required, the data is transferred only with that consent.

Carriers may act as controllers in their own right for transport-related and statutory processing that they determine independently. The privacy information of the carrier concerned applies in addition.

7. Payment processing

When you select a payment method offered at checkout, the information necessary to carry out that payment is transferred to the payment service providers involved. This may include your name, billing address, order reference, amount, currency and the payment information required for the chosen method. In particular, the transaction reference and payment status are reported back to us.

The legal basis is Article 6(1)(b) GDPR. Statutory retention and verification obligations are based on Article 6(1)(c) GDPR.

For payments using PayPal or PayPal Checkout, the information required for the chosen method is transferred to PayPal and the other parties involved in the payment. For Amazon Pay, the relevant payment and order information is processed using your Amazon Pay account. For methods processed through Stripe or Shopify Payments, the necessary transaction data is processed by the relevant payment processor and the banks or payment networks involved.

When you use an available digital wallet such as Apple Pay or Google Pay, the payment information necessary for authorisation and processing is handled with the involvement of the wallet provider and the relevant payment service providers. The payment method you actually select and the provider information shown during that payment process determine which providers are involved.

Payment service providers may process data as controllers in their own right to fulfil their own legal obligations, prevent fraud or assess creditworthiness for credit-based payment methods. Information about their use and retention of data and any automated decisions is provided in the privacy information of the selected payment service provider. Selecting a payment method does not constitute consent to non-essential advertising activities.

8. Customer service and contacting us

8.1 Contact by email or form

When you contact us, we process your contact details, the content of your message and the associated case information to deal with your enquiry. Article 6(1)(b) GDPR is the legal basis for order-related enquiries. We handle other enquiries on the basis of our legitimate interest in reliable communication under Article 6(1)(f) GDPR.

8.2 Zendesk

We use Zendesk to manage customer enquiries. This involves processing contact information, messages, necessary attachments and references to orders in a ticketing system. Access is provided to the people handling the enquiry and the service providers engaged for that purpose.

Zendesk is used to handle your enquiry on the legal basis described in section 8.1. Where Zendesk processes data on our behalf, it acts as a processor. Retention depends on resolution of the enquiry, any continuing claims and legal obligations; further details are provided in section 22.

8.3 WhatsApp for service enquiries

When you use our WhatsApp contact option, we process your telephone number, your profile name where applicable, message content and necessary order references to handle your enquiry. WhatsApp Ireland Limited and the services used for technical message handling are involved. Information about Chatarmin is provided in section 10.

The legal basis for our handling of the enquiry depends on whether it relates to a contract or is general in nature, as described in section 8.1. WhatsApp also processes data to operate its communications service under its own Privacy Policy.

Using WhatsApp to contact us is voluntary; you can contact us by email instead. A service enquiry does not subscribe you to advertising messages.

9. Klaviyo: newsletters, messages and personalised marketing

We use Klaviyo, Inc., USA for the communications and marketing functions described below. Where Klaviyo processes data on our behalf, our relationship is governed by a data processing agreement.

9.1 Newsletters and evidence of consent

When you subscribe to our newsletter, we use the information requested for delivery and the personalisation you have agreed to. We document the subscription and its confirmation so that we can demonstrate our permission to send the newsletter.

The legal basis for sending based on consent is Article 6(1)(a) GDPR. You can unsubscribe through the unsubscribe link in every promotional email or by contacting us. Your address will then no longer be used for this advertising.

A necessary suppression record may be retained to respect the unsubscribe request. Evidence of consent and objections is retained only for as long as necessary for those purposes. This does not mean that all associated marketing profiles are retained indefinitely.

9.2 Measuring opens and clicks

With your consent for this purpose, we measure whether messages are opened and which links are clicked. This may involve processing an individual message or link reference, the time of the interaction and technical connection information.

This information may be associated with your Klaviyo profile. It helps us tailor content and sending frequency to your interests and assess the effectiveness of our messages. Where open and click information is combined with website activity or order data, this is done only within the scope of the applicable legal basis and consent.

The legal basis is Article 6(1)(a) GDPR; section 25(1) TDDDG also applies where access to your device requires consent.

You can withdraw consent to individual newsletter tracking by contacting us. You can also unsubscribe from the newsletter entirely using the unsubscribe link in each promotional email. Website tracking can be stopped separately through the privacy settings.

9.3 Website activity: Klaviyo app pixel and our own server-side events

With your consent to the relevant website marketing, we collect information about your use of our shop and transfer it to Klaviyo. We use two technically distinct routes: the Klaviyo Shopify app pixel in Shopify Customer Events and our own server-side tracking infrastructure. Consent requirements apply to both routes; authorising one pixel does not replace consent controls for the other integration.

The events and categories of data processed include, in particular:

Technical event names may differ depending on the source. The table describes types of processing, not the number of transfers. In addition to these marketing events, the direct Shopify data synchronisation explained in section 9.6 takes place.

Where your email address or another identifiable profile identifier is known in a permitted context of use, events may be linked to your Klaviyo profile. Viewed products, searches, cart contents and previous orders can then be analysed together for the personalisation covered by your consent.

Technical information includes, in particular, online identifiers, IP address, browser or user-agent information, device information, and the current and previously visited page. This information may be forwarded to Klaviyo through the server-side route; using our own server does not make the data anonymous.

The purposes are interest-based product recommendations, segmentation, triggering permitted marketing workflows and measuring their effectiveness. We rely on Article 6(1)(a) GDPR for collecting personal website activity and combining it for these purposes. Section 25(1) TDDDG also applies to the relevant storage on and access to your device.

A newsletter subscription or an email address supplied for a purchase does not replace the website tracking consent required for these purposes. Conversely, consent to website marketing does not automatically authorise promotional emails.

9.4 Recognition and association with a Klaviyo profile

Profile and linking identifiers are stored or accessed to associate further permitted events with a known Klaviyo profile. In the server-side route, the stape_klaviyo_kx cookie containing a technical linking identifier may be used for this purpose. Its configured maximum lifespan is two years from being set or lawfully updated; earlier withdrawal of consent or an erasure obligation remains decisive.

Our current server-side Klaviyo tracking does not additionally store the email address in a dedicated email cookie. An email address may nevertheless be transferred to Klaviyo and associated with a profile as part of the processing described. Storage and use of identifiers by the Klaviyo Shopify app are separate from this server-side route of our own.

Recognition serves the personalised marketing association described above, not the essential shopping cart function. It therefore takes place only with the relevant consent. If you withdraw consent, further use for this marketing stops. An identifier's lifespan is not the same as the retention period for event or profile data already generated from it.

9.5 Automated messages and transactional messages

Marketing workflows may trigger, for example, product recommendations or reminders about an unfinished purchase. We send promotional messages only where the necessary consent or a specifically applicable statutory exception permits this.

Merely entering an email address during a checkout that has been started is not sufficient for this purpose. The narrow conditions in section 11.1 also apply to advertising to existing customers.

Advertising must be distinguished from messages necessary for contract fulfilment, such as order or shipping notifications. Merely labelling a message "transactional" does not allow it to be combined with advertising or additional marketing tracking that requires consent.

Separate criteria in section 22 apply to retention of messaging profiles, interaction events and evidence of consent. The technical lifespan of recognition information is a separate matter. Further information is available in Klaviyo's Privacy Notice.

9.6 Direct Shopify integration: customer, checkout and order data

In addition to the app pixel and our own server-side events, we use the direct Shopify-Klaviyo integration. It can synchronise shop data directly between the server systems. This includes customer and profile identifiers, contact details, subscription and unsubscribe status, and checkout and order information, in particular items, quantities, values, currencies and fulfilment, cancellation or refund status. Billing and delivery details may also be included where the relevant fields are provided for the particular process.

This data synchronisation is technically distinct from a browser cookie and is not governed solely by the app pixel's consent controls. In particular, the presence of a record in Klaviyo does not mean that the person has subscribed to promotional messages or consented to website tracking.

We use the data for the relevant permitted communications, managing messaging permissions and personalisation covered by the appropriate consent. Where Klaviyo is used for a specifically necessary contractual message, Article 6(1)(b) GDPR applies. Information necessary to respect and evidence consent and unsubscribe requests is processed under Article 6(1)(c) GDPR in conjunction with Articles 5(2) and 7(1) GDPR. Individual-level marketing profiling and association with website activity are governed by Article 6(1)(a) GDPR; limited marketing to existing customers is governed by section 11.1 where applicable.

The necessity of an individual contractual message does not provide blanket permission to import and use all customer or checkout data for advertising. Consent-dependent purposes cease upon withdrawal; necessary contractual and evidential data is handled separately. Erasure must be addressed in the respective systems and is not triggered merely by deleting a cookie. Section 22 applies to retention.

10. WhatsApp marketing through Chatarmin

We use Chatarmin and the associated WhatsApp services to send WhatsApp advertising messages to which you have subscribed.

We process your telephone number, the documented subscription, your name where applicable, messages and the profile and interaction data used to the extent disclosed to you. Chatarmin assists us with the technical management and delivery of these messages.

The legal basis for consent-dependent sending and any agreed individual measurement of effectiveness is Article 6(1)(a) GDPR. Further combination with order or website activity takes place only where covered by the relevant information and legal basis.

You can unsubscribe from advertising messages at any time by contacting us. You can also unsubscribe by replying directly to our WhatsApp messages. Service communications remain separate. General information about WhatsApp is provided in section 8.3; section 22 applies to retention of messaging profiles and records.

11. Other notifications, reviews and direct marketing

11.1 Offers to existing customers

Subject to the conditions in section 7(3) of the German Act Against Unfair Competition (UWG), we may use an email address obtained in connection with a sale to advertise our own similar products or services, provided you have not objected and you are clearly informed, when your address is collected and in each message, of the opportunity to object without charge. At most, transmission costs at basic rates may arise.

The data protection legal basis is Article 6(1)(f) GDPR. Our interest is to communicate with existing customers within the limits permitted by law. An objection stops this use. The exception does not automatically permit individual website tracking, a comprehensive marketing profile or advertising by other companies.

11.2 Product availability and expressly requested reminders

When you expressly request a product availability notification or a specific reminder, we process the email address needed for that purpose and the reference to the relevant product or cart.

Article 6(1)(a) GDPR is the legal basis for the notification you request. You can withdraw your request at any time by contacting us. The information used for this purpose is deleted once the requested notification has been completed, unless it is needed for a separate permitted purpose or necessary evidence. Requesting such a message is not a blanket subscription to a newsletter or consent to tracking.

11.3 Review requests and Google Customer Reviews

We use your contact details for promotional review requests only where we have the required permission.

If you voluntarily participate in Google Customer Reviews, we transfer the data specified for the invitation and review function, in particular your email address and information about the order or delivery, to Google Ireland Limited. The legal basis for the transfer for the invitation is your consent under Article 6(1)(a) GDPR.

11.4 Postal advertising

We may use your name and postal address for our own postal advertising on the basis of Article 6(1)(f) GDPR where justified by the necessary balancing of interests. Our interest is to promote our own products and services. You can object to this use at any time.

12. Our tracking infrastructure and Google Tag Manager

To technically manage the analytics and marketing services described below, we use Shopify Customer Events, a browser-side Google Tag Manager and a server-side Google Tag Manager.

Permitted events are first forwarded through our own tracking domains to a server environment operated for us. There, they are processed according to the relevant purpose and consent and transferred to the services named in this policy. The server environment operates using Google Cloud Run.

The server-side approach is used to manage and attribute events, avoid double counting and control recipients and data fields. It does not change the purpose of processing or create an additional legal basis.

Transferring an event through our own domain or a server in the EU does not mean that the event is anonymous or processed exclusively within the EU. Any onward transfer to the relevant recipient remains a separate consideration.

Article 6(1)(a) GDPR and, where the relevant device access takes place, section 25(1) TDDDG apply to consent-dependent analytics and marketing. Technical consent controls, such as Consent Mode, do not replace your consent. Necessary security logs are covered by section 3.3; international transfers are covered by section 21.

13. Google Analytics 4

We use Google Analytics 4 to analyse how our shop is used and to improve our services. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

With your consent, we process, in particular, page and product views, cart actions, order events, timestamps, online and session identifiers, technical device information and information about the source of a visit. Events may be associated with an identifier within a session or across multiple visits.

Processing takes place through the infrastructure described in section 12. The legal basis is Article 6(1)(a) GDPR; section 25(1) TDDDG also applies to non-essential access to your device.

13.1 User identifiers and data linking

Technical user and session identifiers enable related events to be analysed together. Any additional linking to advertising services, advertising audiences or a known profile must be covered by the consent required for that purpose. The information in section 16 also applies to Google Ads.

If you additionally consent to the "Targeting/Marketing" category, we use Google Signals. Google may link usage data with information about signed-in Google users who have enabled ad personalisation. We only receive aggregated information on demographics and interests and use it to analyse and improve our offering and our advertising. The legal basis is your consent (Article 6(1)(a) GDPR, section 25(1) TDDDG).

With your consent to "Targeting/Marketing", when you place an order we also transfer your email address in hashed form (SHA-256) to Google Analytics. Google uses this value for matching and to support our advertising audiences in Google Ads. The hash is a personal matching identifier and not anonymisation. The legal basis is your consent (Article 6(1)(a) GDPR).

Consent to analytics and to personalised advertising is distinguished according to the respective purposes. Using one Google service does not mean that all other processing by Google has also been authorised.

13.2 Retention and withdrawal of consent

Retention of personal user and event data depends on the period during which the data is necessary to analyse shop usage and the events described. The association with individual identifiers is deleted or removed once it is no longer necessary for that analysis or a legal erasure obligation applies. The relevant criteria are described in section 22.

Google Analytics retention settings do not automatically cover every dataset. In particular, data exported separately to BigQuery is handled as described in section 14. Genuinely anonymised aggregate statistics may be used for longer.

You can stop future consent-dependent collection through the privacy settings. Your statutory rights to erasure and restriction remain unaffected.

Further information: Google - information from websites and apps and Google's Privacy Policy.

14. Google BigQuery, data analysis and our own shop tracking

14.1 BigQuery as a separate dataset

We use Google BigQuery as a data platform to analyse shop usage, order trends and the effectiveness of our marketing activities. We distinguish between event data exported from Google Analytics, data from our own shop tracking functions and order and business data necessary for operational analysis.

We export the Google Analytics event data of our shops sassyclassy.de and sassyclassy.com.

Depending on the data flow, we process event information and timestamps, product and order references and pseudonymous user or session identifiers. Where identifiers can be linked to order or customer data, these records remain personal data. Storing data in a data platform does not anonymise it.

Article 6(1)(a) GDPR applies to analysis of website activity collected on the basis of consent and its individual-level combination with other marketing data. Necessary operational analysis of orders, revenue and returns serves the management of our business and may be based on Article 6(1)(f) GDPR where justified by the required balancing of interests. The interest is to plan our product range, inventory and operating processes. Retention required by law is based on Article 6(1)(c) GDPR.

These operational purposes do not automatically permit the use of all order data for personalised advertising tracking. Data is combined only to the extent necessary for the relevant purpose.

The recipient for technical provision of the service is Google Cloud; further access is by the people responsible for processing and the service providers engaged for that purpose. Information about international transfers is provided in section 21.

BigQuery data forms a separate dataset. A retention setting or deletion within Google Analytics does not automatically delete this data. Raw data, linked personal-data tables and exports generated from them are subject to the purpose-specific storage and erasure criteria in section 22. Exporting data does not justify retaining it without a continuing lawful purpose.

14.2 Our own shop tracking and analysis using Grafana

In addition to Google Analytics, we use our own shop tracking application to analyse use of our services and trends in shop activity. It processes, in particular, information about page and product views, timestamps and events, and the technical identifiers used to associate them.

This application is separate from Google Analytics. Data is forwarded through our technical infrastructure to the relevant data stores, in particular BigQuery. Grafana is used to display and analyse the resulting reports.

Where this involves collecting personal website activity for analytics or non-essential storage or access, processing is based on your relevant consent under Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG. Consent can be withdrawn through the privacy settings. The purpose-specific criteria in section 22 apply to retention.

15. Meta Pixel, Conversions API and advanced matching

We use Meta Pixel and the Meta Conversions API to measure the effectiveness of our advertising on Facebook and Instagram, optimise advertising campaigns and, with your consent, create interest-based audiences.

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

15.1 Browser-side and server-side transfers

Meta Pixel collects permitted events in the browser. Related events can also be transferred from our server infrastructure to Meta through the Conversions API. Event identifiers help prevent the same action from being counted more than once.

The types of events transferred include, in particular:

Depending on the event, the data processed includes, in particular, the time, page or product reference, order value and currency, event and browser identifiers, advertising click information and technical details such as IP address and browser information.

15.2 Matching with known users

Where the necessary consent and information are available, we also transfer a SHA-256 hash generated from your email address. Meta can match this value against corresponding values associated with its user accounts.

Technical recognition identifiers may also be used, in particular Facebook browser and click identifiers and an external pseudonymous identifier. The external identifier may be derived from the analytics client identifier used in our tracking infrastructure; using it for Meta remains subject to the relevant marketing consent.

We also use the Meta Pixel's automatic advanced matching. With your consent to "Targeting/Marketing", information that is present on our pages and technically detected may be transferred to Meta in hashed form for matching: email address, phone number, first and last name, gender, date of birth, city, state, postcode and country. A pseudonymous customer identifier may also be used.

If a Meta browser identifier is missing, our server infrastructure may generate one and store it in the browser. The server-set _fbp and _fbc cookies and the _gtmeec cookie for hashed matching data have a configured maximum lifespan of 90 days from being set or lawfully updated. _gtmeec is set as an HttpOnly cookie and may contain hashed email or other matching identifiers to associate subsequent permitted events. These storage operations and further use for Meta also require the relevant consent.

Hashing is not anonymisation. The possibility of matching the information to a user account is precisely the purpose of this processing. Technical data such as IP address and browser information is not automatically hashed merely because an email address is transferred in hashed form.

Meta may associate the data with a user account and process it further as a controller in its own right. Details are available in Meta's Privacy Policy.

15.3 Legal basis and withdrawal of consent

Our consent-dependent collection, association and transfer is based on Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to non-essential storage on and access to your device.

An order, newsletter subscription or knowledge of your email address alone does not constitute agreement to this matching. You can withdraw the relevant consent through the privacy settings.

15.4 Joint controllership under Article 26 GDPR and transfers

Where we and Meta jointly decide on particular collection and transfer operations, we act as joint controllers for those operations within the meaning of Article 26 GDPR. The agreed allocation of responsibilities is described in Meta's Controller Addendum.

For the integration on our website and the transfers we initiate, we provide the necessary information and consent options. Meta is responsible for operations within its systems within the scope of its respective responsibilities. You may also direct requests concerning processing by Meta to Meta itself; we handle requests addressed to us within the scope of our responsibility and involve Meta where necessary.

Joint responsibility does not automatically extend to all subsequent processing by Meta. You can exercise your statutory rights against each controller responsible for the relevant joint processing.

Processing in the United States by Meta Platforms, Inc. is possible. The information in section 21 applies to international transfers.

Our event logs and audience associations are subject to the purpose-specific storage and erasure criteria in section 22. Further retention by Meta as a controller in its own right is governed by the linked Meta Privacy Policy. Withdrawing consent with us stops future consent-dependent collection and transfer by us; you may also exercise your rights in relation to data already held by Meta.

16. Google Ads, conversion measurement and enhanced conversions

We use Google Ads to display advertising and measure whether it leads to shop visits or purchases.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

With your relevant consent, we process advertising click and browser identifiers, event and order references, timestamps, order values, currencies and item information. Data may be transferred to Google through our server infrastructure.

Enhanced conversions: A hash generated from your email address may be transferred to Google to match a permitted event. This enables matching with users known to Google. The hash is not anonymous.

Remarketing: Where enabled and covered by your consent, information about shop activity is used to create advertising audiences. Where your consent covers this, information about shop activity collected using Google Analytics may also be used for this purpose.

The legal basis for the consent-dependent processing described here is Article 6(1)(a) GDPR; section 25(1) TDDDG also applies to non-essential access to your device. You can withdraw consent through the privacy settings.

Further information: Google - information from websites and apps.

Our storage and erasure criteria for events and audience associations are provided in section 22. Further processing by Google is also governed by the linked privacy information. International transfers are explained in section 21.

17. Other analytics functions

17.1 Shopify Analytics

We use Shopify reports to analyse, in particular, orders, revenue, product trends and returns. Where this uses data already necessary for contract fulfilment, the analysis serves the planning and management of our business. Article 6(1)(f) GDPR may provide the legal basis where the analysis is necessary and there are no overriding interests to the contrary.

Additional collection of individual browsing behaviour for analytics takes place only on the basis of the required consent under Article 6(1)(a) GDPR and, where the relevant device access takes place, section 25(1) TDDDG. The use of Shopify reports is separate from the Shopify services described in section 3.2 for which Shopify acts independently.

17.2 Klar

We use Klar to analyse order, revenue, return and marketing data. The purpose is to assess the development of our business and the effectiveness of marketing activities. This may involve processing information from the shop and marketing datasets connected for that analysis.

Where personal website activity is collected or combined for individual-level cross-channel marketing analysis, this takes place only within the scope of your consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG also applies to device access requiring consent. Necessary operational analysis is governed by the separate purposes and legal bases described in section 14.1.

Retention depends on what is necessary for the particular analysis. Data is deleted or the association with individuals is removed once it is no longer needed; the additional criteria in section 22 also apply.

18. A/B testing with ABLyft and Varify

We run A/B tests for limited periods. We use A/B tests to compare different designs or functions of our shop. Visitors are assigned to different test variants, and their responses to those variants are analysed. Where this involves personal website activity or non-essential storage access, processing takes place with your consent under Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG.

18.1 ABLyft: base script and Shopify pixel

We use ABLyft, provided by Conversion Expert GmbH, Zeppelinring 52c, 24146 Kiel, Germany, for A/B testing. The analysis helps us improve the usability and design of our shop and compare the effects of test variants on cart actions, completed orders and revenue. Where the provider processes personal data on our behalf, it acts as a processor.

18.1.1 Displaying test variants and recognition within the shop

An ABLyft script integrated into our shop assigns visits to test variants and displays the corresponding content. Test and variant identifiers and information used to recognise a visit are stored or accessed for this purpose. These associations may be held in cookies or comparable local storage. Connection and device information is also processed during technical communication with ABLyft. While a test is running, the script is loaded when a page is opened. However, we only display test variants and collect measurement data once you have consented to "Performance/Analytics".

The test and variant association is also stored as a Shopify cart attribute, together with project, device and measurement-goal information. At purchase, this information may be included in the order record in our shop and then also appears in downstream order systems. This storage route exists alongside cookies. The information is only stored if a test variant was displayed to you on the basis of your consent.

18.1.2 Shopify Customer Event pixel

We also use an ABLyft custom pixel in Shopify Customer Events. It processes events from the cart and ordering process and associates them with tests previously displayed. This includes, in particular, adding an item to the cart and the start, individual steps and completion of checkout.

The data processed includes event type and time, test and variant identifiers, the page visited, device type, browser information and classification as a new or returning visit. When an order is completed, the order value, the number of items ordered and product identifiers with associated revenue values are added. The pixel does not transfer contact, billing or delivery details. Identifiers in checkout and order addresses (URLs) are removed before the transfer. The data is transferred to ABLyft. Events are assigned to the measurement goals configured for the relevant test.

The name of a checkout event, for example the submission of contact or shipping information, initially identifies the relevant step in the ordering process. That name does not in itself mean that the pixel transfers the contents of every form field completed at that step.

18.1.3 Consent, links to analytics and withdrawal

We rely on your relevant consent under Article 6(1)(a) GDPR for individual-level test attribution and performance measurement, including the pixel transfers initiated for those purposes. We do not send order messages to ABLyft via a Shopify webhook for this purpose. Section 25(1) TDDDG also applies to non-essential storage on your device and access to information already stored there. Consent requirements also apply where an event is transferred server-side.

Where test and variant information is also analysed with Google Analytics or exported to BigQuery, the information and consent requirements in sections 13 and 14 apply. Consent to one service does not automatically cover every further recipient of the data.

You can withdraw the relevant consent for the future through the privacy settings or by contacting us. This applies both to further consent-dependent collection and to the transfers and associations initiated for that purpose. Necessary processing of your order remains separate. Deleting a cookie alone does not remove data already stored server-side.

Further information about the provider is available in ABLyft's Privacy Notice. The information in section 21 also applies to recipients and international transfers.

18.2 Varify

When tests use Varify, test assignments and events are processed to assess test variants. This may also include transferring the order revenue through a separate checkout integration. Test information may be linked to the relevant analytics events within the scope of the consent given.

18.3 Retention of test data

Individual-level associations are retained only for as long as necessary to conduct and analyse the relevant test. The data concerned is then deleted or genuinely anonymised. Technical transfer logs are separate from the test metrics; their retention depends on the necessary processing, troubleshooting and security purpose. The same applies to order copies that ABLyft previously received via a Shopify webhook. A legal obligation to retain our invoices does not justify retaining an order copy sent to a testing provider for analytics for the same length of time.

The information about retention and storage technologies in sections 22 and 23 applies in addition. You can withdraw consent through the privacy settings; statutory rights to erasure and restriction remain unaffected.

19. Other services and forms

19.1 Pinterest

Where Pinterest tracking is integrated into our shop, events such as page views and purchases and the associated online and advertising identifiers are processed with your relevant marketing consent. The purposes are to measure advertising effectiveness and create interest-based audiences. Pinterest receives the data, which may be linked to a Pinterest account.

The legal basis is Article 6(1)(a) GDPR and, where the relevant device access takes place, section 25(1) TDDDG. You can withdraw consent through the privacy settings. Further information is available in Pinterest's Privacy Policy.

19.2 Embedded videos

When we embed videos from an external provider, in particular YouTube, loading the video may establish a connection to that provider. Your IP address, the page accessed and other technical data may be processed, and storage technologies may be used. YouTube belongs to Google; Google Ireland Limited is involved in particular for users in the European Economic Area.

For integrations that require consent, we obtain the relevant consent under Article 6(1)(a) GDPR and, where applicable, section 25(1) TDDDG before loading the content. You can withdraw it through the privacy settings. Google's Privacy Policy also applies to processing by Google.

19.3 Fonts

Font files delivered through our own shop infrastructure are part of the technical provision of our website under section 3. Where external font services such as Google Fonts are loaded, a connection may be established to the relevant provider, involving the processing of your IP address and technical connection data in particular.

Where such external integration requires consent, it is loaded only after that consent, on the basis of Article 6(1)(a) GDPR and, where relevant storage access takes place, section 25(1) TDDDG. You can withdraw consent through the privacy settings.

19.4 Typeform and online forms

When we provide a form using Typeform, we process your entries for the purpose stated on the form. Technical data relating to access to and submission of the form may also be processed. The individual form indicates which information is required and which is optional.

Article 6(1)(b) GDPR applies to contract-related enquiries. We handle general enquiries under Article 6(1)(f) GDPR on the basis of our interest in responding to your enquiry. Article 6(1)(a) GDPR provides the legal basis for voluntary surveys and consent-dependent analysis; consent can be withdrawn at any time.

Information from a form is not used for newsletters or personalised advertising tracking merely because you complete the form. It is retained to process and analyse the stated purpose of the form; after that, the erasure criteria in section 22 apply.

19.5 Make and process automation

Where we use Make to technically connect business processes, the data necessary for the relevant activity is transferred between the systems involved. This may include, in particular, contact, order or case data and technical status information. Make carries out the relevant transfer and processing step.

The legal basis depends on the main purpose, for example Article 6(1)(b) GDPR for contract fulfilment, Article 6(1)(c) GDPR for legal obligations or Article 6(1)(f) GDPR for the necessary handling of general enquiries. The relevant consent remains necessary for consent-dependent marketing activities. Technical automation does not provide an additional entitlement to use your data.

19.6 Channable and sales interfaces

Channable can be used to provide product information to sales and advertising channels. Transferring product catalogue data alone must be distinguished from processing personal data.

Where Channable is used to fulfil your order through a connected sales channel, it processes the necessary order and delivery data on the basis of Article 6(1)(b) GDPR. Additional individual-level use for marketing takes place only with the required legal basis and information.

19.7 Electronic signatures with PandaDoc

When we provide a document for you to sign electronically through PandaDoc, the service processes the document content, contact and signature data and the technical information necessary to evidence the signing process.

The legal basis is Article 6(1)(b) GDPR where the activity relates to entering into or performing a contract. Necessary documentation of a declaration and its receipt may be based on Article 6(1)(f) GDPR; our interest is to maintain reliable evidence of the declarations made. Statutory retention obligations are based on Article 6(1)(c) GDPR. Retention is determined by the contractual and evidential purpose and the applicable retention requirements.

The information about recipients, international transfers and retention in sections 21 and 22 also applies to all services named in this section.

19.8 GoAffPro: affiliate and partner programme

We use GoAffPro to attribute referrals made by our advertising and sales partners, measure the effectiveness of those referrals, and calculate and settle the resulting commissions. The provider is GoAffPro, 16, Sector 20, Part 1, HUDA, Sirsa, Haryana 125055, India.

19.8.1 Data routes and categories

The integration comprises a GoAffPro app pixel in Shopify Customer Events and additional scripts embedded in the shop. These may process information from a partner link, website events and order references. Technical connection data also arises when communicating with the service. Attribution and commission management may additionally take place through the app's direct connection with Shopify.

Depending on the process, the data includes, in particular, partner, referral, click and session identifiers, the source and time of a visit, page and product references, IP address and browser information, as well as order reference, items, quantities, order value, currency, discount or partner codes used and the order status relevant to calculating commission. Depending on the Shopify interface used and the process, customer identifiers, name, email address, billing and delivery address and telephone number may also be provided. Such information may be processed only to the extent necessary for the relevant permitted purpose.

GoAffPro processes the data provided for the service to support our partner programme. Where it acts on our instructions, the requirements for processing on behalf of a controller under Article 28 GDPR apply. As part of commission settlement, partners receive the sales and commission information necessary for their respective attribution and settlement. Any further disclosure of customer contact details for the partners' own advertising is not covered by this purpose.

19.8.2 Referral cookie and attribution period

If you reach our shop through a partner link and give the relevant consent, a referral identifier may be stored in a cookie. Its configured lifespan is seven days each time it is set. A subsequent purchase within this period may be attributed to the referral. Where there are multiple valid partner referrals, link attribution generally follows the last-touch principle: the most recently recognised referral is decisive. A further authorised partner click may trigger a new attribution and restart the corresponding lifespan.

Expiry of the referral cookie does not mean that an order or commission record already created is deleted. Such data is handled separately according to its purpose and the criteria in section 22. The seven-day period applies to referral attribution and is not a blanket lifespan for every storage mechanism technically involved.

19.8.3 Legal bases and withdrawal of consent

We rely on your relevant marketing consent under Article 6(1)(a) GDPR for optional collection and recognition of your visit for individual-level affiliate attribution and the associated transfers. Section 25(1) TDDDG also applies to non-essential storage on and access to your device. These requirements apply both to the app pixel and to the corresponding functions of the additional shop scripts. Consent is not a requirement for placing an order.

You can withdraw consent for the future through the cookie or privacy settings described in section 4. Further consent-dependent affiliate collection and attribution then stops. Withdrawal does not automatically require deletion of accounting evidence already lawfully created that remains necessary.

Where existing commission records remain necessary to settle accounts with our partners or address specific claims, their limited further processing may be based on Article 6(1)(f) GDPR. Our interest is in accurate, verifiable commission settlement and establishing or defending claims. Statutory retention obligations are governed by Article 6(1)(c) GDPR. These purposes do not authorise additional website tracking without the required consent. Your rights to object are set out in section 24.

19.8.4 International processing

GoAffPro is a provider based in India. Its own privacy information states that it uses data centres in Germany, the United States and Singapore. Processing or access outside the European Economic Area may therefore take place. In that information, GoAffPro refers in particular to the European Commission's Standard Contractual Clauses as a safeguard for international transfers. Section 21 explains the requirements and how to request information on the safeguards applicable to our use. Consent to affiliate tracking is not blanket consent to unrestricted transfers to third countries.

Further information is available in GoAffPro's Privacy Policy.

19.8.5 Participating as a partner

If you register for our partner programme yourself, we process your registration and contact details, partner identifier and the information necessary for the relationship, commission settlement and payment. Article 6(1)(b) GDPR applies to entering into and performing the partner agreement; statutory retention is based on Article 6(1)(c) GDPR. This processing of your partner data is separate from the consent-dependent tracking of shop visitors.

20. Accounting, legal obligations and job applications

20.1 Accounting and tax advisers

Order, invoice and payment data is processed where necessary for our accounting and compliance with tax obligations. Our tax adviser and DATEV eG, Paumgartnerstraße 6–14, 90429 Nuremberg, Germany may be involved.

The legal basis is, in particular, Article 6(1)(c) GDPR in conjunction with the applicable commercial and tax obligations. The specific allocation of roles between us, our tax adviser and a software provider depends on the actual service and the applicable requirements.

A legal obligation to retain invoices does not justify retaining all website activity or marketing profiles for the same period.

20.2 Job applications

If you apply for a job with us, our careers section provides separate information about the processing of your application data and the service providers used. Please refer to the privacy information supplied there for the relevant application procedure.

Application data is not used for the shop marketing described in this policy.

21. Recipients, roles and international transfers

Within our company, access is limited to the people who need the data to perform their duties. External service providers are engaged according to their respective functions: as processors acting on our instructions, as controllers in their own right or, for specifically defined processing operations, as joint controllers.

Recipients or categories of recipients include the shop and hosting providers, logistics providers and carriers, payment service providers, customer service and communications providers, analytics and marketing services including GoAffPro and the affiliate partners entitled to the relevant commission settlement, interface providers, and tax and accounting advisers described in this policy. Transfers take place only to the extent necessary for the relevant purpose and permitted by law.

For services with international group and subprocessor structures, data may be processed outside the European Economic Area. This may also involve remote access from a third country. In particular, Klaviyo and services within the Google, Meta, Shopify and Zendesk groups may involve processing in the United States; Shopify may also involve processing in Canada in particular. For GoAffPro, its location in India and the processing locations in the United States and Singapore named by the provider must also be considered; see section 19.8 for details. A European server location does not automatically rule out such access.

Where an applicable adequacy decision of the European Commission exists and the particular recipient falls within its scope, a transfer may be based on Article 45 GDPR. For transfers to US companies, the EU-US Data Privacy Framework may provide this basis where the actual receiving company participates validly and the data concerned is covered.

Where there is no applicable adequacy decision, transfers are based on appropriate safeguards under Article 46 GDPR. These include, in particular, the Standard Contractual Clauses adopted by the European Commission and, where applicable, approved Binding Corporate Rules. Supplementary safeguards are implemented where required. Ordinary consent to website tracking is not a blanket exemption from these requirements.

You can request information about the safeguards used for a particular transfer, and a corresponding copy, using the contact details in section 1. Information requiring protection may be redacted where necessary. The providers' privacy information linked in the relevant sections also applies.

22. How long data is retained

We retain personal data only for as long as necessary for the relevant purpose or required by law. When there is no longer a lawful basis for retaining it, the data is deleted or genuinely anonymised. Merely removing a name or hashing data is not sufficient if an individual can still be identified.

Retention depends on the following criteria applicable to the relevant dataset:

Records subject to statutory retention are deleted once the applicable retention requirement expires unless there is a separate lawful ground for continued retention. Retention limited to the necessary scope may be required for the establishment, exercise or defence of legal claims. In that case, further use is restricted to that purpose.

The lifespan of a cookie is not the same as the retention period of an event generated from it. A copy exported from a service must also be considered separately for erasure. You can contact us at any time about retention of your particular data and to exercise your privacy rights.

23. Overview of storage technologies

Cookies and comparable storage may be set and accessed directly by a website function or in connection with a server-side response. Storage under the shop's own domain is not strictly necessary merely for that reason.

Session cookies become invalid when the relevant session ends. Persistent cookies have a technical expiry time that can be viewed in your browser's cookie information. Other local storage may technically exist without its own expiry date; this does not authorise processing for an unlimited period. The stated purpose, your choices and the erasure criteria in section 22 remain decisive.

You can also delete stored cookies and local website data in your browser or restrict their use. Doing so may cause essential shop functions and saved settings to be lost. Deleting data in the browser does not automatically remove data already transferred to a server. You can manage your consent through the privacy settings described in section 4.

24. Your rights

Subject to the applicable legal conditions, you have, in particular, rights of access to your data, rectification of inaccurate information, erasure, restriction of processing and data portability. Where the conditions are met, you can also ask to be informed of the recipients of a rectification, erasure or restriction.

You can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing previously based on valid consent.

Objection to processing based on legitimate interests: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will then assess whether compelling legitimate grounds or the establishment, exercise or defence of legal claims permit further processing.

Objection to direct marketing: You may object at any time to processing for direct marketing. This also applies to profiling to the extent that it relates to such direct marketing. Your data will then no longer be processed for these purposes.

You can exercise your rights by contacting us. Where we have reasonable doubts about your identity, we may request additional information to the extent necessary to confirm it. This does not impose a blanket requirement to submit a copy of an identity document.

You may also lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence or place of work, or where a suspected infringement occurred. In particular, the Bavarian State Office for Data Protection Supervision (BayLDA) may be the relevant authority for our company: www.lda.bayern.de.

Profiling and automated decisions

The marketing functions described in this policy may create profiles of interests and behaviour. This does not automatically amount to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

Where a decision based solely on automated processing produces legal effects concerning you or similarly significantly affects you, the specific conditions and safeguards in Article 22 GDPR apply. These may include, in particular, human review, the opportunity to express your point of view and the right to contest the decision. The information of a payment service provider you select also applies to decisions for which that provider is independently responsible.

25. Changes to this policy

We update this policy when our processing activities or the applicable requirements change. We provide appropriate information about material changes. Where new or changed processing requires consent, amending this policy does not replace obtaining that consent.