Datenschutzerklärung

This Privacy Policy describes how staudj.shop collects, uses, stores, discloses, and otherwise processes personal data when customers and other users visit the website, create an account, place an order, contact customer service, subscribe to marketing communications, or otherwise interact with the store.

1. Data Controller

The website and online store are operated under the trading name:

staudj.shop

Privacy contact:

info@staudj.shop

The full legal identity and geographic address of the data controller must also be displayed in the store’s legally compliant Legal Notice.

2. Scope of This Policy

This Privacy Policy applies to personal data processed in connection with:

• Visits to staudj.shop;
• Product browsing;
• Checkout and purchases;
• Customer accounts;
• Order fulfilment;
• Delivery and returns;
• Customer service;
• Marketing communications;
• Fraud prevention;
• Website security;
• Analytics and advertising, where permitted;
• Legal and regulatory obligations.

This policy does not independently govern websites, applications, or services operated by third parties. Those third parties may process personal data under their own privacy policies.

3. Personal Data We Collect

Depending on how a person uses the store, we may collect the following categories of personal data.

3.1 Identity Information

This may include:

• First name;
• Last name;
• Account name;
• Order recipient name;
• Billing recipient name.

3.2 Contact Information

This may include:

• Email address;
• Telephone number;
• Billing address;
• Shipping address;
• Country or region;
• Communication preferences.

3.3 Order and Transaction Information

This may include:

• Products viewed or purchased;
• Product size and colour selections;
• Order number;
• Order date;
• Order value;
• Discounts and promotional codes;
• Shipping method;
• Delivery status;
• Return and refund information;
• Customer service history.

3.4 Payment Information

Payments are processed by Shopify and the payment providers made available at checkout.

Depending on the payment method, payment providers may process:

• Cardholder name;
• Payment card information;
• Bank or payment account information;
• Billing address;
• Payment authentication information;
• Transaction identifiers;
• Fraud risk indicators.

staudj.shop does not normally receive complete payment card numbers or security codes.

3.5 Device and Technical Information

This may include:

• Internet Protocol address;
• Device type;
• Browser type and version;
• Operating system;
• Language and region settings;
• Referring website;
• Pages viewed;
• Date and time of access;
• Session identifiers;
• Cookie identifiers;
• Shopping cart activity;
• Error and security logs.

3.6 Communications

When a person contacts us, we may process:

• Email messages;
• Customer service enquiries;
• Return requests;
• Product reviews;
• Complaint information;
• Attached photographs;
• Other information voluntarily submitted.

3.7 Marketing Information

Where applicable, we may process:

• Marketing consent;
• Newsletter subscriptions;
• Email interaction information;
• Product interests;
• Advertising identifiers;
• Marketing preferences;
• Consent withdrawal records.

4. Sources of Personal Data

We collect personal data:

• Directly from customers and website visitors;
• Automatically through the website and permitted technologies;
• From Shopify;
• From payment service providers;
• From shipping and logistics providers;
• From fraud prevention and security providers;
• From advertising or analytics providers where consent has been obtained;
• From customer service providers;
• From publicly available sources where legally permitted.

5. Purposes and Legal Bases

We process personal data only where a valid legal basis applies.

5.1 Contract Performance

We process personal data when necessary to enter into or perform a contract, including to:

• Operate the shopping cart and checkout;
• Process an order;
• Collect payment;
• Confirm an order;
• Arrange delivery;
• Provide tracking;
• Handle returns and refunds;
• Respond to order-related enquiries;
• Manage customer accounts;
• Provide products and customer service.

The legal basis is Article 6(1)(b) GDPR.

5.2 Legal Obligations

We may process personal data to:

• Maintain required transaction and accounting records;
• Comply with tax requirements;
• Respond to lawful authority requests;
• Meet consumer protection obligations;
• Document withdrawals, refunds, and complaints;
• Meet product safety and recall obligations where applicable;
• Establish compliance with applicable law.

The legal basis is Article 6(1)(c) GDPR.

5.3 Legitimate Interests

We may process personal data where necessary for legitimate interests, provided those interests are not overridden by the rights and freedoms of the affected person.

Legitimate interests may include:

• Securing the website;
• Preventing fraud and payment abuse;
• Protecting customers and the business;
• Investigating suspicious transactions;
• Improving website performance;
• Understanding general store usage;
• Managing and defending legal claims;
• Maintaining business records;
• Responding to non-contractual enquiries;
• Preventing misuse of promotions;
• Ensuring network and information security.

The legal basis is Article 6(1)(f) GDPR.

Individuals may object to processing based on legitimate interests in accordance with applicable law.

5.4 Consent

Where consent is required, we may process personal data for:

• Non-essential cookies;
• Analytics;
• Personalised advertising;
• Marketing emails;
• Marketing measurement;
• Certain third-party integrations.

The legal basis is Article 6(1)(a) GDPR.

Consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Shopify

staudj.shop is hosted and operated using Shopify’s e-commerce platform.

Shopify may process personal data to:

• Provide website hosting;
• Operate checkout;
• Process and secure transactions;
• Maintain store functionality;
• Provide technical support;
• Prevent fraud;
• Improve Shopify services;
• Comply with legal obligations.

Depending on the circumstances and applicable law, Shopify may act as a processor, service provider, independent controller, or joint participant in the processing operation.

Shopify and its service providers may process personal data in countries outside Germany or the European Economic Area. Appropriate transfer mechanisms are used where required by law.

7. Payment Providers

Available payment methods are displayed at checkout.

When a customer selects a payment method, the relevant payment provider processes the information needed to:

• Authorise the payment;
• Authenticate the customer;
• Prevent fraud;
• Complete the transaction;
• Process a refund;
• Handle a payment dispute;
• Comply with financial regulations.

Payment providers may act as independent data controllers for some processing activities. Their own privacy notices apply to their processing.

8. Shipping and Logistics Providers

We disclose necessary personal data to carriers, fulfilment providers, warehouses, customs service providers, and logistics partners for purposes such as:

• Preparing an order;
• Printing shipping labels;
• Delivering parcels;
• Providing delivery updates;
• Completing customs procedures;
• Investigating lost or damaged parcels;
• Processing returns.

The data disclosed may include the recipient’s name, address, telephone number, email address, order reference, and delivery information.

9. Service Providers and Other Recipients

Personal data may be disclosed to carefully selected recipients where necessary, including:

• Shopify and its affiliates;
• Payment processors;
• Shipping and fulfilment providers;
• Website and cloud service providers;
• Customer support providers;
• Email communication providers;
• Security and fraud prevention providers;
• Analytics providers where permitted;
• Advertising providers where consent has been obtained;
• Accountants, auditors, insurers, and professional advisers;
• Public authorities where disclosure is legally required;
• Courts, regulators, and law enforcement authorities;
• Purchasers or advisers involved in a lawful business transfer.

Recipients receive only the data reasonably necessary for the relevant purpose.

10. Cookies and Similar Technologies

The website may use cookies, pixels, local storage, tags, software development kits, and similar technologies.

10.1 Strictly Necessary Technologies

Strictly necessary technologies may be used to:

• Maintain the shopping cart;
• Operate checkout;
• Remember privacy choices;
• Authenticate users;
• Prevent fraud;
• Secure the website;
• Balance website traffic;
• Maintain essential store functions.

These technologies may be used without consent where they are strictly necessary to provide a service expressly requested by the user or otherwise permitted by law.

10.2 Optional Technologies

Optional technologies may be used for:

• Analytics;
• Performance measurement;
• Personalisation;
• Advertising;
• Retargeting;
• Social media functionality;
• Marketing attribution.

Where legally required, optional technologies will not be activated until the user provides consent through the cookie or privacy preference tool.

Users may change or withdraw their consent through the store’s privacy settings or cookie banner.

Browser settings may also permit users to block or delete cookies. Blocking strictly necessary cookies may prevent parts of the store from functioning correctly.

11. Email Marketing

We send marketing emails only where legally permitted.

Where consent is required, subscribers may be asked to confirm their subscription through a double opt-in process.

Marketing consent is voluntary and may be withdrawn at any time by:

• Using the unsubscribe link in a marketing email; or
• Contacting info@staudj.shop.

Withdrawal from marketing does not affect transactional emails relating to orders, payments, shipping, returns, security, or customer service.

12. Fraud Prevention and Security

We may use transaction, device, order, and payment information to identify and prevent:

• Fraudulent payments;
• Account misuse;
• Identity misuse;
• Unauthorised transactions;
• Promotion abuse;
• Security attacks;
• Other unlawful activity.

Shopify, payment providers, and fraud prevention providers may generate automated fraud indicators or risk scores.

An order may be held for review, additional verification may be requested, or a transaction may be rejected where there are lawful and reasonable fraud or security concerns.

13. Automated Decision-Making

staudj.shop does not intend to make decisions based solely on automated processing that produce legal effects or similarly significant effects on customers, except where permitted by law and necessary for entering into or performing a contract, authorised by law, or based on explicit consent.

Automated fraud tools may identify transactions for review. Where required by law, customers may request human review, express their point of view, and contest a qualifying automated decision.

14. International Data Transfers

Shopify and other service providers may process personal data outside Germany or the European Economic Area.

Where personal data are transferred to a country that does not benefit from an applicable adequacy decision, appropriate safeguards may include:

• European Commission standard contractual clauses;
• Supplementary technical and organisational measures;
• Binding corporate rules;
• Another legally recognised transfer mechanism.

Information regarding applicable safeguards may be requested by contacting info@staudj.shop, subject to legal and confidentiality restrictions.

15. Data Retention

Personal data are retained only for as long as reasonably necessary for the purpose for which they were collected and to meet legal obligations.

Retention periods are determined by considering:

• Whether an active customer account exists;
• Whether an order or contract remains active;
• Statutory accounting and tax retention obligations;
• Consumer warranty and limitation periods;
• The handling of returns, complaints, or disputes;
• Fraud prevention requirements;
• The establishment, exercise, or defence of legal claims;
• Consent status;
• Security requirements.

When personal data are no longer required, they are deleted, anonymised, or restricted where continued storage is legally required.

16. Data Security

We and our service providers use reasonable technical and organisational measures designed to protect personal data against:

• Unauthorised access;
• Accidental loss;
• Unlawful disclosure;
• Alteration;
• Destruction;
• Misuse.

No method of internet transmission or electronic storage can guarantee absolute security.

Customers should protect their account credentials and contact us promptly if they believe their account or personal data have been compromised.

17. Data Subject Rights

Subject to applicable conditions and exceptions, individuals may have the right to:

• Request access to personal data;
• Request correction of inaccurate data;
• Request completion of incomplete data;
• Request deletion of personal data;
• Request restriction of processing;
• Object to processing based on legitimate interests;
• Object at any time to direct marketing;
• Request data portability;
• Withdraw consent at any time;
• Lodge a complaint with a competent data protection supervisory authority;
• Request information concerning certain international transfer safeguards;
• Contest qualifying automated decisions.

Requests may be submitted to:

info@staudj.shop

We may request information reasonably necessary to verify identity before completing a request.

18. Right to Object

Where personal data are processed on the basis of legitimate interests, an individual may object at any time on grounds relating to their particular situation.

We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override the individual’s interests, rights, and freedoms, or the processing is required for the establishment, exercise, or defence of legal claims.

Where personal data are processed for direct marketing, the individual may object at any time. Following such an objection, the data will no longer be processed for direct marketing.

19. Right to Complain

Individuals have the right to lodge a complaint with a competent data protection supervisory authority.

A complaint may generally be submitted to the supervisory authority responsible for the individual’s habitual residence, place of work, the place of the alleged infringement, or the establishment of the controller.

Individuals are encouraged, but not required, to contact us first so that we have an opportunity to address the concern.

20. Children’s Data

The store is intended for adults who are legally capable of entering into purchase contracts.

We do not knowingly request personal data directly from children for independent marketing purposes.

If a parent or legal guardian believes a child has provided personal data without appropriate authorisation, they may contact info@staudj.shop.

21. Third-Party Links

The website may contain links to third-party websites or services.

staudj.shop is not responsible for the privacy practices of independent third parties. Users should review the privacy policy of each third-party service before submitting personal data.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes to store operations;
• Changes to service providers;
• New website functions;
• Legal or regulatory developments;
• Security and privacy improvements.

The updated version will be published with a revised effective date.

23. Contact

For privacy questions or data protection requests, contact:

staudj.shop
Email: info@staudj.shop