Privacy policy

We host the contents of our website with external providers.

The personal data collected on this website is stored on the servers of the host. This may include IP addresses, contact requests, meta and communication data, contract data, contact data, names, website accesses and other data generated via a website.

External hosting takes place for the purpose of contract fulfilment with our potential and existing customers (Art. 6 (1) lit. b GDPR) and in the interest of secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) lit. f GDPR).

We use strictly necessary cookies and equivalent local storage (e.g. browser localStorage). These are required exclusively to provide the shop functions (e.g. cart, login, saved addresses) and are only set by your active use — no consent is required under § 25 (2) (2) TDDDG.

Additionally, with your consent we collect anonymised usage data (see section 8). A complete list of the local storage entries used, with their purpose and retention, can be found in our cookie settings.

We store your consent with a version number and a timestamp. If the cookie statement changes or 12 months elapse, you will be asked again.

If you subscribe to our newsletter we need your email address and — optionally — first and last name. Sign-up uses the double opt-in procedure: you first receive a confirmation email; only after you click the link in it are you added to the mailing list. The confirmation link is valid for 72 hours; if not confirmed we automatically delete the entry.

To prove your consent (Art. 7 (1) GDPR) we log: sign-up timestamp, IP address, user agent, version of the consent text (consentTextVersion) and the timestamp of confirmation. This data is not publicly visible and is only used as evidence in case of complaints.

You can revoke your newsletter consent at any time via the unsubscribe link in every newsletter email. After revocation we keep your email address on an internal suppression list for up to 12 months (Art. 17 (3) (e) GDPR) so that you are not accidentally contacted again. After that the record is fully deleted.

Confirmation and newsletter emails are sent through Resend (third-country notice see section 9). A daily clean-up job removes unconfirmed sign-ups and records whose revocation was more than 12 months ago.

You can request a complete copy of the data stored for your newsletter sign-up or its immediate deletion at any time: Start newsletter data request. The request is verified via a confirmation link; the action is then carried out automatically.

With your consent (cookie banner category "Analytics") we record anonymised click, search and order events to improve the shop. The following data is processed in particular: session identifier (sessionId), event type (e.g. product view, add to cart, search, order), product identifier, browser, device type, language.

Your IP address is hashed with a daily-rotating salt before storage and is no longer traceable to you afterwards. Processing takes place exclusively on our own servers; no transfer to Google Analytics, Meta, TikTok or any other third-party services takes place.

Raw data is automatically deleted after 90 days (clean-up job running daily); aggregated statistics remain in pseudonymised form and cannot be linked back to individuals.

Legal basis: consent under Art. 6 (1) (a) GDPR + § 25 (1) TDDDG. You can revoke your consent at any time via the cookie settings — no further events will then be recorded.

We do not transfer your data to third parties for purposes other than those listed here. We disclose data when:

• You have given your express consent
• Processing is necessary to perform a contract with you
• Processing is necessary to fulfil a legal obligation (e.g. accounting, tax law)
• Processing is necessary to protect legitimate interests

We use the following processors (Art. 28 GDPR):

• Resend Inc., USA — transactional emails and newsletter. Transfer to the USA on the basis of standard contractual clauses (Art. 46 (2) (c) GDPR). Data processed: email address, recipient name, email content.
• Stripe Payments Europe Ltd., Ireland — payment processing (if activated) for credit card, SEPA, Klarna, Apple Pay, Google Pay. Data processed: payment token, amount, order number; no full card data stored on our side.
• PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg — payment processing (if activated). Data processed: PayPal order ID, amount, recipient address.
• Shipping providers (e.g. UPS, DHL) — delivery of orders. Data processed: recipient name, delivery address, phone number for delivery notifications if applicable.

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR) — You can request information about your personal data processed by us.
• Right of rectification (Art. 16 GDPR) — You can request the correction of incorrect data.
• Right of erasure (Art. 17 GDPR) — You can request the deletion of your data, provided no retention obligations apply.
• Right of restriction (Art. 18 GDPR) — You can request the restriction of processing.
• Right of data portability (Art. 20 GDPR) — You can receive your data in a structured, commonly used, machine-readable format.
• Right of objection (Art. 21 GDPR) — You can object to the processing of your data, in particular if based on legitimate interests.

A self-service for data access and deletion is available for newsletter data. For all other requests please contact us using the contact details in the imprint.

You also have the right to lodge a complaint about the processing of your data with a data protection supervisory authority. The competent authority for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.