Privacy policy

Status: 15 June 2026

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This applies only insofar as no other indication is made in the following processing operations.

"Personal data" means any information relating to an identified or identifiable natural person.

Server Log Files

You can visit our websites without providing any personal information.

Each time our website is accessed, usage data is transmitted to us or to our web host / IT service provider by your internet browser and stored in log data, known as server log files. This stored data includes, for example, the name of the page accessed, the date and time of access, the IP address, the amount of data transferred, and the requesting provider.

The processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in ensuring the trouble-free operation of our website and improving our offer.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the European Commission exists for Canada. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is carried out on the basis of contractual obligations comparable to the standard contractual clauses of the European Commission.

Contact

Controller

Please contact us if you wish. The controller responsible for data processing is: ACADEMIA STUDIO d.o.o., Radnička cesta 80, 10000 Zagreb, Croatia, +49 (0) 6461 7019410, sales@wo-we.shop

Customer Contact by Email on Their Own Initiative

If you contact us by email on your own initiative for business purposes, we collect your personal data (name, email address, message text) only to the extent provided by you. The data processing serves the purpose of handling and responding to your contact request.

If the contact serves the implementation of pre-contractual measures, for example advice in the event of purchase interest or preparation of an offer, or relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) lit. b GDPR.

If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in handling and responding to your request. In this case, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data based on Art. 6 (1) lit. f GDPR.

We use your email address only to process your request. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and Processing When Using the Contact Form

When you use the contact form, we collect your personal data (name, email address, message text) only to the extent provided by you. The data processing serves the purpose of establishing contact.

If the contact serves the implementation of pre-contractual measures, for example advice in the event of purchase interest or preparation of an offer, or relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) lit. b GDPR. If contact is made for other reasons, this data processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in handling and responding to your request. In this case, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data based on Art. 6 (1) lit. f GDPR. We use your email address only to process your request. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Collection and Processing When Using the Withdrawal Button

If you have concluded a contract via our online presence, we provide you with a withdrawal function (withdrawal button) through which you can submit your withdrawal declaration directly.

When using the withdrawal function, we collect your personal data (name, email address, information to identify the contract or part of the contract that you wish to withdraw from, as well as the time (date and time) of sending the withdrawal declaration) only to the extent provided by you. The data processing serves the purpose of providing you with the legally required option to withdraw from your contract and of properly processing your withdrawal.

If the contact relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6 (1) lit. b GDPR. Otherwise, the data processing is carried out on the basis of Art. 6 (1) lit. c GDPR, as we are legally obliged to provide you with a withdrawal function on our online presence.

We use your email address only to process your withdrawal declaration. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Disclosure to Third-Party Providers (Use of Plugins)

For the technical provision and management of the withdrawal function on our online presence, we use, within the framework of order processing, a software solution from the third-party provider euwiderrufsbutton.de. Your personal data collected when using the withdrawal function is transmitted to the servers of the above-mentioned third-party provider.

The processing of your personal data serves the purpose of fulfilling the legal requirements for the legally compliant design of the withdrawal function and is carried out on the basis of Art. 6 (1) lit. c GDPR. This data processing is also carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in being able to provide you with a user-friendly withdrawal option. In this case, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data based on Art. 6 (1) lit. f GDPR.

Customer Account Orders

Customer Account

When opening a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is carried out on the basis of Art. 6 (1) lit. a GDPR with your consent. You may withdraw your consent at any time by notifying us, without affecting the lawfulness of processing based on consent before its withdrawal. Your customer account will then be deleted.

Collection, Processing and Disclosure of Personal Data for Orders

When you place an order, we collect and process your personal data only to the extent necessary to fulfill and process your order and to handle your inquiries. The provision of the data is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded. The processing is carried out on the basis of Art. 6 (1) lit. b GDPR and is necessary for the performance of a contract with you.

Your data is disclosed, for example, to shipping companies, dropshipping or fulfillment providers, payment service providers, service providers for order processing, and IT service providers. In all cases, we strictly observe the legal requirements. The scope of data transmission is limited to the minimum necessary.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the European Commission exists for Canada. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is carried out on the basis of contractual obligations comparable to the standard contractual clauses of the European Commission.

Reviews Advertising

Use of Judge.me

We use the review system "Judge.me" from Judge.me Ltd (c/o Buckworths 2nd Floor, 1-3 Worship Street, London, England, EC2A 2AB; "Judge.me") on our website.

Judge.me enables us to obtain customer reviews and display them on our website in order to give you insight into the quality of our services.

After placing an order, you may receive an invitation from us or Judge.me to submit a review and may then submit a review. In doing so, the following data, among other data, may be processed by us or Judge.me: email address, name, telephone number, address, information about your device (IP address, information about your web browser and the operating system used), information about the purchased product or service used (order number, product details), the content of your review and the star rating you provided, your product photos or videos (if you have attached them to your product review). This data may also be used for the purpose of verifying your review.

Judge.me uses technologies such as cookies.

Your data may be transferred outside the EU to the United Kingdom. An adequacy decision of the European Commission exists for the United Kingdom.

Your data may be transferred to the USA. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Judge.me is not certified under the TADPF. This data transfer is carried out on the basis of special agreements approved for use in the United Kingdom that provide the same protection as personal data has in the United Kingdom.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25 (1) Sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6 (1) lit. a GDPR, provided that you have expressly consented to the disclosure of your data and receipt of the review request. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Further information on data protection when using Judge.me can be found at: https://judge.me/privacy (https://judge.me/privacy).

Use of the Email Address for Sending Newsletters

We use your email address to send you information and offers by newsletter, provided that you have expressly consented to this. The data processing serves exclusively the purpose of promotional contact. For this purpose, we process your email address and, where applicable, other data that you voluntarily provided when registering for our newsletter.

The processing is carried out on the basis of Art. 6 (1) lit. a GDPR with your consent. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You can unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the mailing list. Despite removal from the mailing list, we may continue to store your email address in a blacklist in order to prevent you from receiving future newsletter emails from us. This storage is carried out on the basis of Art. 6 (1) lit. f GDPR due to our and your legitimate interest in preventing the renewed use of your email address for sending our newsletter. You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data.

Use of the Email Address for Sending Direct Advertising

We use your email address, which we received in connection with the sale of a product or service, for the electronic sending of advertising for our own products or services that are similar to those you have already purchased from us, unless you have objected to this use. The provision of the email address is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded. The processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in direct advertising. You may object to this use of your email address at any time by notifying us. The contact details for exercising the objection can be found in the legal notice. You may also use the link provided for this purpose in the advertising email. No costs are incurred for this other than the transmission costs according to the basic rates.

Use of Klaviyo

We use the service of Klaviyo Inc. (125 Summer St Floor 7, Boston, MA 02111, USA; "Klaviyo") for sending newsletters within the framework of order processing.

We pass on to Klaviyo the information you provided during newsletter registration (email address, and where applicable first and last name). The data processing serves the purpose of sending newsletters and statistically evaluating them.

To evaluate newsletter campaigns, the newsletters sent contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This allows us to determine whether you opened the newsletter and whether you clicked any integrated links. In this context, we collect your personal data, such as IP address, browser type and device, and the time. Usage profiles may be created from this data under a pseudonym. The collected data is not used to identify you personally. The collected data is used solely for statistical evaluation to improve newsletter campaigns.

Your data is generally transferred to Klaviyo servers in the USA and stored there. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Klaviyo has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.

The processing of your personal data is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in a targeted, advertising-effective and user-friendly newsletter system. You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data.

Further information on data protection at Klaviyo can be found at https://www.klaviyo.com/legal/privacy-notice (https://www.klaviyo.com/legal/privacy-notice) and at https://www.klaviyo.com/legal/data-processing-agreement (https://www.klaviyo.com/legal/data-processing-agreement).

Use of the Email Address for Availability Notifications

We offer a product availability notification service on our website. If an item is temporarily unavailable, you have the option to enter your email address for the respective item and be informed by us by email when it becomes available, provided you have consented to this. You will receive a one-time email notification when the respective item becomes available. The processing is carried out on the basis of Art. 6 (1) lit. a GDPR with your consent. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can unsubscribe from the availability notification at any time by notifying us. Your email address will then be removed from the mailing list.

Shipping Service Providers

Disclosure of the email address to shipping companies for information about the shipping status

We pass on your email address to the transport company as part of contract processing, provided that you have expressly consented to this during the ordering process. The disclosure serves the purpose of informing you by email about the shipping status. The processing is carried out on the basis of Art. 6 (1) lit. a GDPR with your consent. You may withdraw your consent at any time by notifying us or the transport company, without affecting the lawfulness of processing based on consent before its withdrawal.

Payment Service Providers

Use of PayPal Express

We use the PayPal Express payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of being able to offer you payment via the PayPal Express payment service. To integrate this payment service, it is necessary for PayPal to collect, store and analyze data when the website is accessed (e.g. IP address, device type, operating system, browser type, location of your device). Cookies may also be used for this purpose. The cookies enable your browser to be recognized.

The processing of your personal data is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in offering various customer-oriented payment methods. You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data.

When selecting and using PayPal Express, the data required for payment processing is transmitted to PayPal in order to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) lit. b GDPR. Further information on data processing when using the PayPal Express payment service can be found in the corresponding privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS (http://www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS).

Use of PayPal Check-Out

We use the PayPal Check-Out payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of being able to offer you payment via the payment service. When selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) lit. b GDPR.

Cookies may be stored that enable your browser to be recognized. The data processing that takes place as a result is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in offering various customer-oriented payment methods. You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data.

Credit Card via PayPal, Direct Debit via PayPal & "Pay Later" via PayPal

For individual payment methods such as credit card via PayPal, direct debit via PayPal or "Pay Later" via PayPal, PayPal reserves the right, where applicable, to obtain a credit report on the basis of mathematical-statistical procedures using credit agencies. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received regarding the statistical probability of default for a balanced decision on the establishment, implementation or termination of the contractual relationship. The credit report may include probability values (score values), which are calculated on the basis of scientifically recognized mathematical-statistical procedures and whose calculation may include address data, among other things. Your legitimate interests are taken into account in accordance with statutory provisions. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in protection against payment default when PayPal makes advance payment.

You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data based on Art. 6 (1) lit. f GDPR by notifying PayPal. The provision of the data is necessary for the conclusion of the contract using your desired payment method. Failure to provide it means that the contract cannot be concluded using the payment method selected by you.

Third-Party Providers

When paying via the payment method of a third-party provider, the data required for payment processing is transmitted to PayPal. This processing is carried out on the basis of Art. 6 (1) lit. b GDPR. To carry out this payment method, the data may then be passed on by PayPal to the respective provider. This processing is carried out on the basis of Art. 6 (1) lit. b GDPR. Local third-party providers may include, for example:

- Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)

- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Purchase on Invoice via PayPal

When paying by purchase on invoice, the data required for payment processing is first transmitted to PayPal. To carry out this payment method, the data is then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) lit. b GDPR. Ratepay may, where applicable, carry out a credit report on the basis of mathematical-statistical procedures (probability or score values) using credit agencies according to the procedure already described above. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in protection against payment default when Ratepay makes advance payment. Further information on data protection and which credit agencies Ratepay uses can be found at https://www.ratepay.com/legal-payment-dataprivacy/ (https://www.ratepay.com/legal-payment-dataprivacy/) and https://www.ratepay.com/legal-payment-creditagencies/ (https://www.ratepay.com/legal-payment-creditagencies/).

Further information on data processing when using PayPal can be found in the corresponding privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full (https://www.paypal.com/de/webapps/mpp/ua/privacy-full).

Use of the Payment Service Provider Mollie

We use the payment service provider Mollie B.V. (Keizersgracht 313, 1016 EE Amsterdam, Netherlands; "Mollie") for payment processing on our website. The data processing serves the purpose of being able to offer you various payment methods through payment processing via the payment service provider Mollie. If you choose one of the payment options of the payment service provider Mollie, the data required for payment processing is transmitted to Mollie. This includes your payment data (for example bank account number or credit card number), your IP address, your internet browser and device type, and in some cases your first and last name, your address data and information about the product or service you purchased from us. This data processing is carried out on the basis of Art. 6 (1) lit. b GDPR. Further information on data processing when using the payment service provider Mollie can be found in the corresponding privacy policy https://www.mollie.com/de/legal/privacy (https://www.mollie.com/de/legal/privacy)

Use of Shopify Payments

We use the "Shopify Payments" payment service of Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website. In this case, payment processing is carried out by the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; "Stripe"). The data processing serves the purpose of being able to offer you payment via the Shopify Payments payment service. When selecting and using a corresponding "Shopify Payments" payment method, the data required for payment processing is transmitted to Stripe in order to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) lit. b GDPR. Stripe reserves the right, where applicable, to obtain a credit report on the basis of mathematical-statistical procedures using credit agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information received regarding the statistical probability of default for a balanced decision on the establishment, implementation or termination of the contractual relationship. The credit report may include probability values (score values), which are calculated on the basis of scientifically recognized mathematical-statistical procedures and whose calculation may include address data, among other things. Your legitimate interests are taken into account in accordance with statutory provisions. The data processing serves the purpose of credit assessment for the initiation of a contract. The processing is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in protection against payment default when Stripe makes advance payment. You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data based on Art. 6 (1) lit. f GDPR by notifying Stripe. The provision of the data is necessary for the conclusion of the contract using your desired payment method. Failure to provide it means that the contract cannot be concluded using the payment method selected by you. Further information on data processing when using the Shopify Payments payment service can be found in Shopify's privacy policy at: https://www.shopify.com/de/legal/datenschutz (https://www.shopify.com/de/legal/datenschutz). Further information on data processing in payment processing via the payment service provider Stripe can be found in Stripe's privacy policy at: https://stripe.com/de/privacy (https://stripe.com/de/privacy).

Klarna via Shopify Payments

Within the Shopify Payments payment service, we offer payment methods from Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; "Klarna") (e.g. purchase on invoice, installment purchase, instant payment). The data processing serves the purpose of being able to offer you payment via the payment methods offered by Klarna.

When selecting and using a Klarna payment method, the data required for payment processing (in particular name, address, email address, order data, invoice amount) is transmitted to Klarna via the payment service provider Stripe Payments Europe, Ltd. in order to fulfill the contract with you using the selected payment method. This processing is carried out on the basis of Art. 6 (1) lit. b GDPR. Klarna is an independent controller for the processing of your data.

For payment methods in which Klarna makes advance payment (e.g. purchase on invoice, installment purchase), Klarna reserves the right to obtain a credit report on the basis of mathematical-statistical procedures using credit agencies. For this purpose, Klarna transmits the personal data required for a credit check to a credit agency and uses the information received regarding the statistical probability of default for a balanced decision on the establishment, implementation or termination of the contractual relationship. The credit report may include probability values (score values), which are calculated on the basis of scientifically recognized mathematical-statistical procedures and whose calculation may include address data, among other things. Your legitimate interests are taken into account in accordance with statutory provisions.

The data processing for the credit check is carried out on the basis of Art. 6 (1) lit. f GDPR due to our or Klarna's overriding legitimate interest in protection against payment default. You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data based on Art. 6 (1) lit. f GDPR by notifying Klarna.

The provision of the data is necessary for the conclusion of the contract using your desired payment method. Failure to provide it means that the contract cannot be concluded using the payment method selected by you.

Your data may be transferred by Klarna to further recipients within the Klarna Group and to third countries outside the EEA. Klarna bases such transfers on appropriate safeguards, in particular the standard contractual clauses of the European Commission.

Further information on data processing when using Klarna can be found in Klarna's privacy policy at: https://www.klarna.com/de/datenschutz/

Cookies

Our website uses cookies. Cookies are small text files that are stored in the internet browser or by the internet browser on a user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide individually whether to accept them, as well as prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. However, we point out that you may then not be able to use all functions of this website to their full extent.

You can find information on how to manage cookies in the most important browsers, including how to disable them, under the following links:

Chrome: https://support.google.com/accounts/answer/61416?hl=de (https://support.google.com/accounts/answer/61416?hl=de)

Microsoft Edge: https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-lB6schen-63947406-40ac-c3b8-57b9-2a946a29ae09 (https://support.microsoft.com/de-de/microsoft-edge/cookies-in-microsoft-edge-lB6schen-63947406-40ac-c3b8-57b9-2a946a29ae09)

Mozilla Firefox: https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen (https://support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen)

Safari: https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac (https://support.apple.com/de-de/guide/safari/manage-cookies-and-website-data-sfri11471/mac)

Technically Necessary Cookies

Unless otherwise stated below in this privacy policy, we use only technically necessary cookies for the purpose of making our offer more user-friendly, effective and secure. Cookies also enable our systems to recognize your browser even after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these functions, it is necessary for the browser to be recognized again after a page change.

The use of cookies or comparable technologies is carried out on the basis of Section 25 (2) TDDDG. The processing of your personal data is carried out on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in ensuring the optimal functionality of the website as well as a user-friendly and effective design of our offer.

You have the right, on grounds relating to your particular situation, to object at any time to this processing of your personal data.

Use of the Shopify Consent Tool (Shopify Privacy & Compliance)

We use the consent tool "Shopify Privacy & Compliance" from Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website. Shopify is an affiliate of Shopify Inc. (151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The tool enables you to give consent to data processing via the website, in particular the setting of cookies, and to exercise your right to withdraw previously granted consent. The data processing serves the purpose of obtaining and documenting required consent to data processing and thereby complying with legal obligations. Cookies may be used for this purpose. User information, including your IP address, is collected and transmitted to Shopify.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the European Commission exists for Canada. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is carried out on the basis of contractual obligations comparable to the standard contractual clauses of the European Commission.

The data processing is carried out to fulfill a legal obligation on the basis of Art. 6 (1) lit. c GDPR.

Further information on data protection at Shopify can be found at https://www.shopify.com/de/legal/datenschutz (https://www.shopify.com/de/legal/datenschutz).

Analytics Advertising Tracking

Use of Google Analytics 4

We use the web analytics service Google Analytics from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website. The data processing serves the purpose of analyzing this website and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, compile reports on website activity and provide the website operator with other services related to website use and internet use. The following information, among other things, may be collected: IP address, date and time of page access, click path, information about the browser you use and the device you use, pages visited, referrer URL (website through which you accessed our website), location data, purchase activities. Your data may be linked by Google with other data, such as your search history, your personal accounts, your usage data from other devices, and any other data that Google has about you.

The IP address is previously shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area.

The processing of your personal data is carried out with your consent on the basis of Art. 6 (1) lit. a GDPR. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

The information generated about your use of this website is generally transferred to a Google server in the USA and stored there. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles. Both Google and US government authorities have access to your data.

Further information on terms of use and data protection can be found at https://policies.google.com/technologies/partner-sites (https://policies.google.com/technologies/partner-sites), at https://policies.google.com/privacy?hl=de&gl=de (https://policies.google.com/privacy?hl=de&gl=de), and at https://business.safety.google/privacy/ (https://business.safety.google/privacy/).

Use of the Meta Pixel

We use the Meta Pixel from Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; "Meta") on our website.

Meta and we are jointly responsible for the collection of your data that takes place when the service is integrated and for the transmission of this data to Meta. The basis for this is an agreement between us and Meta on the joint processing of personal data, in which the respective responsibilities are defined. The agreement is available at https://de-de.facebook.com/legal/terms/businesstools (https://de-de.facebook.com/legal/terms/businesstools). According to this agreement, we are particularly responsible for fulfilling the information obligations pursuant to Art. 13 and 14 GDPR, for complying with the security requirements of Art. 32 GDPR with regard to the correct technical implementation and configuration of the service, and for complying with the obligations under Art. 33 and 34 GDPR insofar as a personal data breach concerns our obligations under the joint processing agreement. Meta is responsible for enabling the rights of data subjects pursuant to Art. 15 to 20 GDPR, for complying with the security requirements of Art. 32 GDPR with regard to the security of the service, and for complying with the obligations under Art. 33 and 34 GDPR insofar as a personal data breach concerns Meta's obligations under the joint processing agreement.

The application serves the purpose of targeting website visitors with interest-based advertising on the social networks Facebook and Instagram. For this purpose, Meta's remarketing tag has been implemented on the website. This tag establishes a direct connection to Meta's servers when the website is visited. This transmits to the Meta server which of our pages you have visited. Meta assigns this information to your personal Facebook and/or Instagram user account. When you visit the social networks Facebook or Instagram, you will then be shown personalized, interest-based ads.

The application also serves the purpose of creating conversion statistics. We learn the total number of users who clicked on one of our advertisements and were redirected to a page equipped with a conversion tracking tag, as well as which actions were taken after the redirect to this website. However, we do not receive any information with which users can be personally identified.

Your data may be transferred to the USA. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.

The processing of your personal data is carried out with your consent on the basis of Art. 6 (1) lit. a GDPR. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You can deactivate the remarketing function "Custom Audiences" here. Further information on the collection and use of data by Meta, your related rights and options for protecting your privacy can be found in Meta's privacy notices at https://www.facebook.com/about/privacy/ (https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0).

Use of Google Ads Conversion Tracking

We use the online advertising program "Google Ads" on our website and, in this context, conversion tracking (visit action analysis). Google Conversion Tracking is an analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; Google).

When you click on an advertisement placed by Google, a cookie for conversion tracking is stored on your computer. These cookies have limited validity, contain no personal data, and therefore are not used for personal identification. If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognize that you clicked on the advertisement and were redirected to this page. Each Google Ads customer receives a different cookie. This means that there is no possibility that cookies can be tracked across the websites of Ads customers.

The information obtained using the conversion cookie serves the purpose of creating conversion statistics. We learn the total number of users who clicked on one of our advertisements and were redirected to a page equipped with a conversion tracking tag. However, we do not receive any information with which users can be personally identified.

Your data may be transferred to servers of Google LLC in the USA. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25 (1) Sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6 (1) lit. a GDPR. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Further information and Google's privacy policy can be found at: https://www.google.de/policies/privacy/ (https://www.google.de/policies/privacy/) or https://business.safety.google/privacy/ (https://business.safety.google/privacy/)

Plug-ins and Other Tools

Use of Google Invisible reCAPTCHA

We use the invisible reCAPTCHA service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.

This serves the purpose of distinguishing between input by a human and input by automated, machine processing. In the background, Google collects and analyzes usage data that Invisible reCAPTCHA uses to distinguish regular users from bots. For this purpose, your input is transmitted to Google and further used there. In addition, the IP address and, where applicable, other data required by Google for the Invisible reCAPTCHA service are transmitted to Google.

This data is processed by Google within the European Union and may also be transferred to servers of Google LLC in the USA. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25 (1) Sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6 (1) lit. a GDPR. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Further information on Google reCAPTCHA and the related privacy policy can be found at: https://www.google.com/recaptcha/intro/android.html (https://www.google.com/recaptcha/intro/android.html) and https://www.google.com/privacy (https://www.google.com/privacy)

Use of YouTube

We use the function for embedding YouTube videos from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "YouTube") on our website. YouTube is an affiliate of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; "Google").

The function displays videos stored on YouTube in an iFrame on the website. The "enhanced privacy mode" option is activated. As a result, YouTube does not store any information about visitors to the website. Only when you watch a video is information about this transmitted to YouTube and stored there. Your data may be transferred to the USA. For the USA, an adequacy decision of the European Commission is available, namely the Trans-Atlantic Data Privacy Framework (TADPF). YouTube has certified itself under the TADPF and has thereby undertaken to comply with European data protection principles.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25 (1) Sentence 1 TDDDG in conjunction with Art. 6 (1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6 (1) lit. a GDPR. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Use of the AI Product Advisor Quiz Kit (AI Shopping Assistant)

We use the AI-powered product advisor "Quiz Kit – AI Shopping Assistant" from Presidio Creative, LLC (USA; "Presidio") on our website. The data processing serves the purpose of offering you interactive product advice upon your request and suggesting suitable products from our range.

If you actively use the product advisor, your inputs (e.g. questions and information about your project, such as substrate, area or area of application) as well as technical session data are processed and evaluated with AI support in order to create product recommendations. Your email address or other contact details are not collected within the product advisor; the inputs are not passed on to marketing services. We ask you not to enter any personal data into the advice field that is not required for product advice.

The storage of or access to information in your terminal device takes place only insofar as this is necessary to provide the advice service expressly requested by you. The processing of your personal data is carried out for the implementation of pre-contractual measures at your request on the basis of Art. 6 (1) lit. b GDPR and on the basis of Art. 6 (1) lit. f GDPR due to our overriding legitimate interest in efficient product advice for visitors to our website.

Your data may be transferred to the USA. If the provider is not certified under the adequacy decision of the European Commission (Trans-Atlantic Data Privacy Framework, TADPF), the transfer is carried out on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the standard contractual clauses of the European Commission.

Further information on data processing when using Quiz Kit can be found in the provider's privacy policy at: https://www.quizkitapp.com/pages/privacy-policy

Further information on the collection and use of data by YouTube and Google, your related rights and options for protecting your privacy can be found in YouTube's privacy notices at https://www.youtube.com/t/privacy (https://www.youtube.com/t/privacy).

Rights of Data Subjects and Storage Period

Duration of Storage

After complete contract processing, the data will initially be stored for the duration of the warranty period, then taking into account statutory retention periods, in particular tax and commercial law retention periods, and then deleted after expiry of the period, unless you have consented to further processing and use.

Rights of the Data Subject

If the legal requirements are met, you have the following rights under Art. 15 to 20 GDPR: the right of access, rectification, erasure, restriction of processing, and data portability.

In addition, under Art. 21 (1) GDPR, you have the right to object to processing based on Art. 6 (1) lit. f GDPR, as well as to processing for the purpose of direct advertising.

Right to Lodge a Complaint with the Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.

You may lodge a complaint, among others, with the supervisory authority responsible for us, which you can contact using the following details:

Agencija za zaštitu osobnih podataka (AZOP)

Ulica Metela Ožegovića 16

HR-10000 Zagreb, Croatia

Tel.: +385 1 4609 000

Email: azop@azop.hr

Right to Object

If the personal data processing listed here is based on our legitimate interest pursuant to Art. 6 (1) lit. f GDPR, you have the right, on grounds relating to your particular situation, to object to this processing at any time with effect for the future.

After an objection has been made, the processing of the affected data will be stopped unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims.

If personal data is processed for the purposes of direct advertising, you may object to this processing at any time by notifying us. After an objection has been made, we will stop processing the affected data for the purpose of direct advertising.