Privacy Policy

1. Controller

The controller for data processing on this website is:

Matthias Ergün
PrivacyRoll (Sole Proprietorship)
Plantagenstr. 1
13347 Berlin

Phone: 0176 46786772
Email: privacyroll@gmail.com

2. General Information on Data Processing

We take the protection of your personal data seriously. Personal data is any information that can be used to identify you personally, such as your name, address, email address, IP address, order data, or payment information.

We process personal data only to the extent necessary to provide our online shop, process orders, communicate with customers, fulfill legal obligations, or based on consent. Processing is carried out in particular on the basis of the General Data Protection Regulation (GDPR).

3. Hosting and Shopify Shop System

Our online shop is operated via Shopify. The provider, depending on the contractual constellation, is in particular:

Shopify International Limited
2nd Floor, Victoria Buildings
1-2 Haddington Road
Dublin 4, D04 XN32, Ireland

Shopify provides us with the e-commerce platform through which we sell our goods. In doing so, Shopify processes personal data that arises in connection with visiting our shop, placing orders, payment processing, and the technical provision of the shop. This may include: name, address, email address, phone number, IP address, order data, payment information, device and browser information, and communication data.

Legal bases are Art. 6 para. 1 lit. b GDPR, insofar as processing is necessary for the performance of a contract, Art. 6 para. 1 lit. c GDPR, insofar as legal obligations exist, and Art. 6 para. 1 lit. f GDPR, insofar as there is a legitimate interest in a secure and functional online shop.

Shopify provides merchants with a Data Processing Addendum that regulates the processing of personal data within the scope of Shopify services.

4. Access Data and Server Log Files

When you visit our website, technical data that your browser transmits to Shopify is automatically processed. This may include: IP address, date and time of access, pages visited, browser used, operating system, referrer URL, and device information.

This data is processed to technically provide the website, ensure security and stability, and prevent misuse. The legal basis is Art. 6 para. 1 lit. f GDPR.

5. Orders in the Online Shop

When you place an order in our shop, we process the data necessary for processing and fulfilling your order: first name and last name, billing and delivery address, email address, phone number (if provided), ordered products, order number, payment status, shipping information, as well as return and complaint data.

The legal basis is Art. 6 para. 1 lit. b GDPR. Insofar as we have to store data due to tax or commercial law retention obligations, processing is additionally based on Art. 6 para. 1 lit. c GDPR.

6. Customer Account

If you create a customer account, we store the data you enter (name, email address, address, order history, login data) so that you can manage your orders and make future orders more easily. The legal basis is Art. 6 para. 1 lit. b GDPR. You can request the deletion of your customer account at any time, provided there are no legal retention obligations.

7. Contact

If you contact us by email or other communication channels, we process the data you provide to handle your request. The legal basis is Art. 6 para. 1 lit. b GDPR, if your request is related to an order, otherwise Art. 6 para. 1 lit. f GDPR.

8. Payment Providers

We use external payment service providers for payment processing. The payment methods available at checkout will be displayed to you during the ordering process. Depending on the chosen payment method, payment data may be transmitted to the respective payment provider (name, billing address, email address, order amount, order number, payment data, IP address). The legal basis is Art. 6 para. 1 lit. b GDPR.

Shopify Payments

If payment is made via Shopify Payments, processing takes place via Shopify Payments or the associated payment service providers.

PayPal

If paying with PayPal, payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

Klarna

If a Klarna payment method is chosen, payment data is transmitted to Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

Credit Card, Apple Pay, Google Pay

For payments by credit card, Apple Pay, or Google Pay, processing takes place via the respective integrated payment service provider.

9. Shipping Service Providers and Suppliers

For the delivery of your order, we pass on the necessary data to shipping service providers and, if necessary, to suppliers or fulfillment service providers. This may include: name, delivery address, email address, phone number (if required for delivery), order information, and tracking number.

Since our shop works with external suppliers and shipping partners, delivery is made directly by a supplier or fulfillment partner. Only the data necessary for processing and delivery of the order is transmitted. The transfer is based on Art. 6 para. 1 lit. b GDPR.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device.

Necessary Cookies

These cookies are required for the shop to function, for example, for the shopping cart, checkout, security, and language settings. The legal basis is Art. 6 para. 1 lit. f GDPR.

Analytics and Marketing Cookies

We only use analytics and marketing cookies if you have given your prior consent. The legal basis is Art. 6 para. 1 lit. a GDPR. You can change your cookie settings or withdraw a given consent at any time.

11. Cookie Banner and Consent Management

We use Shopify's privacy settings or cookie functions, or a comparable consent solution, to obtain and manage consent for non-essential cookies.

12. Social Media Profiles

We link from our website to our profiles on Instagram and TikTok. These are simple links, not embedded content. Only when you click on one of these links will data be transmitted to the respective provider.

The provider of Instagram is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The provider of TikTok is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

When visiting these profiles, the data protection provisions of the respective provider apply. We have no influence on the data processing there.

13. Data Transfer to Third Countries

When using Shopify, payment service providers, and apps, personal data may be processed outside the European Union or the European Economic Area. Insofar as data is transferred to countries without an adequacy decision by the EU Commission, the transfer will only take place if suitable safeguards are in place, for example, EU standard contractual clauses, or if a legal exception applies.

14. Storage Duration

We store personal data only as long as necessary for the respective purposes. We store order and invoice data for the legally prescribed duration, insofar as legal retention obligations exist. We store consents as long as necessary to prove the consent.

15. Your Rights

Under the GDPR, you have the following rights: access to your stored personal data, rectification of inaccurate data, erasure, restriction of processing, data portability, objection to certain processing, withdrawal of given consents, and complaint to a data protection supervisory authority.

16. Right to Object

If we process personal data on the basis of Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation. If your data is processed for direct marketing, you have the right to object at any time.

17. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. You can contact the supervisory authority of your place of residence, your federal state, or our company's registered office.

18. Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, or disclosure. The transmission of data in our shop is generally encrypted via SSL or TLS.

19. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy if legal requirements, technical functions, or deployed service providers change.

Status: 01.08.2026