Datenschutzerklärung

 

This Privacy Policy explains how info@stevemaddena.shop (“we,” “us,” or “our”) collects, uses, stores, shares, and protects personal data when you visit our Shopify store, make a purchase, create or use an account, contact us, subscribe to marketing communications, or otherwise interact with our services.

We respect your privacy and are committed to processing personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable German data protection requirements.

1. Data Controller

For the purposes of applicable data protection law, the controller responsible for the processing described in this Privacy Policy is:

info@stevemaddena.shop
Email: info@info@stevemaddena.shop

If you have questions about this Privacy Policy or wish to exercise your privacy rights, you may contact us using the email address above.

2. Personal Data We Collect

Depending on how you interact with our store, we may collect and process the following categories of personal data.

Information You Provide Directly

When you place an order, create an account, contact us, subscribe to communications, or otherwise provide information to us, we may collect:

• Full name;

• Billing address;

• Shipping address;

• Email address;

• Telephone number, when provided;

• Account login and profile information;

• Order information;

• Products purchased or returned;

• Customer service communications;

• Return and refund information;

• Marketing preferences;

• Information you provide when contacting us;

• Other information reasonably necessary to provide the services you request.

Payment Information

Payments are processed through Shopify and the payment providers made available during checkout.

Depending on the payment method selected, payment information may be processed by Shopify, banks, credit card networks, payment processors, or other payment service providers.

We do not require customers to send full payment card details to us by email.

Information Collected Automatically

When you visit or use our website, certain technical information may be collected automatically, including:

• IP address;

• Browser type and version;

• Device type;

• Operating system;

• Device identifiers;

• Language preferences;

• Referring website or URL;

• Pages viewed;

• Date and time of access;

• Website interactions;

• Shopping cart activity;

• Checkout activity;

• Cookie and similar technology information;

• Diagnostic, security, and fraud-prevention information.

3. How We Use Personal Data

We may process personal data for the following purposes:

Processing and Fulfilling Orders

We use personal data to:

• Process purchases;

• Confirm orders;

• Arrange payment;

• Prepare and deliver products;

• Provide shipping and delivery information;

• Handle returns, cancellations, exchanges, and refunds;

• Communicate with you regarding your order.

Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract, we rely on Article 6(1)(b) GDPR.

Customer Service

We use personal data to respond to questions, resolve complaints, provide support, and communicate with customers concerning our products and services.

Depending on the circumstances, this processing may be necessary for performance of a contract or based on our legitimate interest in providing effective customer service.

Legal and Regulatory Compliance

We may process personal data where necessary to comply with legal obligations, including obligations relating to:

• Accounting;

• Taxation;

• Commercial records;

• Consumer protection;

• Fraud prevention;

• Regulatory requests;

• Court orders and other legally binding requirements.

Where processing is necessary to comply with a legal obligation, we rely on Article 6(1)(c) GDPR.

Fraud Prevention and Security

We may process information to protect our store, customers, systems, transactions, and business against fraud, unauthorized access, abuse, cyberattacks, and other unlawful or harmful activities.

Where appropriate, this processing is based on our legitimate interests under Article 6(1)(f) GDPR, including our legitimate interest in protecting our business and customers.

Website Operation and Improvement

We may use information to:

• Operate and maintain our website;

• Diagnose technical problems;

• Improve website functionality;

• Understand how our services are used;

• Improve products and customer experience;

• Maintain website security.

Where required by law, non-essential technologies will only be used after obtaining the necessary consent.

Marketing

If you have provided valid consent where consent is required, we may use your contact information to send you promotional communications relating to products, offers, or other commercial information.

You may withdraw your consent or unsubscribe from marketing communications at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Legal Bases for Processing

Depending on the specific processing activity, we rely on one or more of the following legal bases under Article 6 GDPR:

• Contractual necessity – Article 6(1)(b): when processing is necessary to process or fulfill an order or provide requested services;

• Legal obligation – Article 6(1)(c): when processing is required to comply with applicable law;

• Legitimate interests – Article 6(1)(f): when necessary for legitimate business purposes and those interests are not overridden by your fundamental rights and freedoms;

• Consent – Article 6(1)(a): when you have voluntarily provided consent for a particular processing activity, such as certain marketing or non-essential tracking technologies.

Where processing is based on consent, you may withdraw that consent at any time for future processing.

5. Shopify

Our online store is powered and hosted by Shopify.

Shopify provides the e-commerce infrastructure that enables us to operate our store, process transactions, manage orders, provide checkout functionality, and provide other store-related services.

When you visit or make a purchase through our store, personal data may therefore be processed through Shopify's systems.

Depending on the Shopify services and features being used, Shopify may process customer personal data on our behalf and may, in certain circumstances, process personal data for its own purposes in accordance with its applicable privacy terms.

Your use of our Shopify-powered store may therefore involve processing by Shopify in connection with providing, securing, developing, and improving its services.

6. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage, tags, scripts, and similar technologies.

These technologies may be used for purposes including:

• Keeping the website functioning;

• Remembering shopping cart contents;

• Maintaining checkout functionality;

• Security and fraud prevention;

• Remembering preferences;

• Measuring website performance;

• Understanding website usage;

• Analytics;

• Advertising and marketing, where applicable.

Necessary Cookies

Certain cookies and similar technologies may be necessary for the operation, security, checkout functionality, or other essential functions of the website.

Optional Cookies

Where required by applicable law, analytics, advertising, personalization, and other non-essential cookies or technologies will not be activated until the required consent has been obtained.

You may be able to manage your cookie choices through the cookie consent tools displayed on our website.

You may withdraw or modify consent for optional cookies through the available privacy or cookie settings.

Blocking certain necessary technologies through your browser may affect the functionality of the website.

7. Sharing Personal Data

We do not disclose personal data without a legitimate purpose.

We may share personal data with service providers and other recipients where necessary to operate our business, including:

• Shopify and its affiliated service providers;

• Payment processors;

• Banks and payment networks;

• Shipping and logistics providers;

• Warehousing and fulfillment providers;

• Customer service providers;

• IT and hosting providers;

• Security and fraud-prevention providers;

• Analytics providers, where lawfully used;

• Marketing service providers, where lawfully used;

• Professional advisers such as accountants, auditors, and legal advisers;

• Government agencies, regulators, courts, or law enforcement authorities where disclosure is legally required.

Service providers may only receive information that is reasonably necessary for the relevant service and are subject to applicable contractual and legal data protection obligations.

8. International Data Transfers

Some of the service providers involved in operating our Shopify store may process personal data outside Germany or outside the European Economic Area (“EEA”).

Where personal data is transferred to a country outside the EEA and that country does not benefit from an applicable adequacy decision, appropriate safeguards will be used where required by law.

Such safeguards may include approved Standard Contractual Clauses or other legally recognized transfer mechanisms.

Where applicable, additional technical, contractual, or organizational safeguards may also be implemented.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and as required by applicable law.

The applicable retention period depends on factors including:

• The type of personal data;

• The purpose for which it was collected;

• The duration of our relationship with you;

• Contractual obligations;

• Accounting and tax obligations;

• Statutory retention requirements;

• Fraud prevention and security requirements;

• Potential legal claims or disputes.

When personal data is no longer required and there is no lawful reason to retain it, it will be deleted, anonymized, or otherwise handled in accordance with applicable law.

10. Your Rights Under the GDPR

If the GDPR applies to the processing of your personal data, you may have the following rights, subject to applicable legal requirements and limitations.

Right of Access

You may request confirmation as to whether we process personal data relating to you and request access to that personal data.

Right to Rectification

You may request correction of inaccurate personal data and completion of incomplete personal data.

Right to Erasure

You may request deletion of personal data in circumstances provided by applicable law.

The right to erasure is not absolute. We may retain certain information where processing remains necessary to comply with legal obligations or establish, exercise, or defend legal claims.

Right to Restriction of Processing

You may request restriction of processing where the requirements of applicable law are satisfied.

Right to Data Portability

Where processing is based on consent or a contract and carried out by automated means, you may have the right to receive certain personal data in a structured, commonly used, and machine-readable format and, where technically feasible, have that information transmitted to another controller.

Right to Object

Where personal data is processed on the basis of legitimate interests, you may have the right to object to such processing based on your particular situation.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal will apply to future processing and will not affect the lawfulness of processing based on consent before withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

You may contact a supervisory authority in Germany or another competent supervisory authority in accordance with applicable law.

11. How to Exercise Your Rights

To exercise your applicable privacy rights, contact:

info@info@stevemaddena.shop

Please describe the right you wish to exercise and provide sufficient information for us to identify the relevant customer account or transaction.

To protect personal data against unauthorized disclosure, we may request reasonable information to verify your identity before completing certain requests.

We will respond to valid requests within the time required by applicable law.

12. Direct Marketing

Where required by law, we will only send electronic direct marketing communications when we have an appropriate legal basis.

Marketing messages will include a method for withdrawing from future marketing communications.

You may also request to stop receiving marketing communications at any time by contacting:

info@info@stevemaddena.shop

Your decision to stop receiving marketing communications will not prevent us from sending non-marketing communications that are necessary in connection with an existing order, transaction, customer service matter, legal obligation, or account.

13. Automated Decision-Making

We do not intend to make decisions producing legal or similarly significant effects concerning customers solely through automated processing unless such processing is permitted under applicable law and the required safeguards are provided.

Automated systems may nevertheless be used for operational purposes such as fraud detection, risk assessment, website security, or transaction monitoring.

14. Security

We use reasonable technical and organizational measures designed to protect personal data from unauthorized access, loss, misuse, alteration, disclosure, or destruction.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

Customers should take appropriate measures to protect their passwords, devices, and account credentials and should not disclose login information to unauthorized persons.

15. Children's Privacy

Our store is not intended to knowingly collect personal data from children who are not legally permitted to provide the relevant data or enter into transactions without the required consent or authorization.

If we learn that personal data relating to a child has been collected unlawfully, we will take appropriate steps to delete or otherwise lawfully process that information.

If you believe that a child has provided personal data to us improperly, please contact:

info@info@stevemaddena.shop

16. Third-Party Websites and Services

Our website may contain links to websites, applications, payment providers, social media services, or other services operated by third parties.

When you leave our website or interact directly with a third-party service, that third party may process personal data according to its own privacy policy and terms.

We are not responsible for the privacy practices of independent third parties. We encourage you to review the applicable privacy information before providing personal data to third-party services.

17. Changes to This Privacy Policy

We may update this Privacy Policy when necessary to reflect changes in our business practices, technologies, services, legal obligations, or regulatory requirements.

The current version will be published on our website together with the applicable “Last Updated” date.

Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes affecting the way personal data is processed.

18. Contact Us

If you have questions about this Privacy Policy, our handling of personal data, or your privacy rights, please contact:

info@stevemaddena.shop
Email: info@info@stevemaddena.shop

We will handle privacy inquiries and requests in accordance with applicable data protection law.

19. Governing Privacy Requirements

This Privacy Policy is intended to operate in accordance with applicable German and European Union data protection requirements, including the GDPR.

If any provision of this Privacy Policy conflicts with a mandatory data protection right that cannot lawfully be excluded or restricted, the applicable mandatory legal requirement will prevail.