Privacy policy

Last updated: October 2026 · Version 2.0

Summary

This notice describes which personal data we process when you visit kbs-shop.com, order from us or contact us. The key points at a glance:

• The controller is Moritz Grunert, owner of “KBS – Welt der Steine” in Niederneisen (Germany).
• Orders and service: We process the data required for ordering, payment, shipping and customer service. Signing in to a customer account is optional; you can order as a guest.
• Cookies and tracking: Shopify analytics, Meta, the purchase tracking of the price comparison sites and other services integrated via Shopify only start once you consent in the cookie banner. Some services, however, load regardless of your choice, i.e. even without consent: session recording by Microsoft Clarity, cookieless measurements by Google, scripts from Triple Whale and Klaviyo, the UpPromote affiliate programme, performance tracking by Selleasy and content displayed by the shop (reviews, trust badges, pre-orders, product offers, instalment preview, express checkout). Section 6 lists them and also explains how you can change or withdraw your choice.
• Marketing emails are only sent to you with your consent. You can unsubscribe at any time.
• Data at Klaviyo: If you enter your email address at checkout or place an order, our email service provider Klaviyo (USA) receives your contact details and your cart or order, even if you have not subscribed to a newsletter (Section 12).
• AI chat: Our product advisor Blocky is an artificial intelligence, not a human. Your chat messages are processed by Cloudflare and Anthropic, including in the USA. Automatic deletion of the chat logs is currently not set up (Section 11).
• Service providers outside the EU: Some providers are based in third countries, mainly the USA. For each service we state whether data are transferred there and on what basis, such as an adequacy decision or standard contractual clauses; for the UpPromote affiliate programme no such basis exists (Section 18).
• Your rights: Access, rectification, erasure, restriction, data portability, withdrawal of consent, objection and complaint to a supervisory authority. Write to us at shop@kbs-shop.com.

Contents

1. Controller and contact
2. Your right to object
3. General information
4. Shop platform and hosting (Shopify)
5. Server logs
6. Cookies and consent
7. Customer account
8. Orders and shipping
9. Payment
10. Contact and forms
11. AI chat “Blocky”
12. Email marketing
13. Reviews
14. Pre-orders, back-in-stock alerts, product offers, wishlist, discount display
15. Analytics
16. Advertising and performance measurement
17. Price comparison sites
18. Affiliate programme
19. Embedded content
20. Social media
21. Other service providers and recipients
22. Your rights
23. Right to lodge a complaint
24. Obligation to provide data
25. Changes to this notice

1. Controller and contact

Moritz Grunert, sole trader, trading as “KBS – Welt der Steine”
Grundweg 13
65629 Niederneisen
Germany

Email, including for data protection enquiries: shop@kbs-shop.com
Phone: +49 1556 0002228

Further details can be found in our legal notice. In this notice, “we” and “KBS” refer to the controller.

2. Your right to object under Art. 21 GDPR

Objection on grounds relating to your particular situation Where we process data concerning you on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. This also applies to profiling based on those provisions. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We base the following processing operations on legitimate interests: provision and security of the shop, necessary cookies for secure operation, server logs, banner statistics and country redirection (Sections 4, 5 and 6) services that load regardless of your consent, including session recording with Microsoft Clarity, cookieless measurements by Google, scripts from Triple Whale and Klaviyo, performance tracking by Selleasy, and trust badges and review widgets (Section 6) fraud prevention, address validation, delivery to third parties, instalment preview and express checkout buttons (Sections 8 and 9) enquiries outside a contract, enquiries from businesses, replacement parts provided as a goodwill gesture and abuse protection in the missing parts form (Section 10) answering questions to Blocky outside of pre-purchase advice, logging and analysis of the chats and linking them to orders (Section 11) purchase data and checkout details without an order in Klaviyo, the suppression list and performance tracking in service emails (Section 12) display and publication of reviews, loading of the pre-order functions, product offers and discount display (Sections 13 and 14) order data at Triple Whale, affiliate tracking by UpPromote including affiliates’ Meta pixels, and attribution of affiliate discount codes (Sections 15 and 18) our pages on social networks (Section 20), internal analyses with AI assistance (Section 21) and the enforcement of legal claims (Section 3) Objection to direct marketing Where we use your data for direct marketing, you may object at any time without giving reasons. This also applies to profiling to the extent that it is related to direct marketing. We will then no longer use your data for direct marketing. You will incur no costs other than the transmission costs at the basic rates. How to object: informally by email to shop@kbs-shop.com, by post to the address in Section 1 or via the unsubscribe link in every marketing email.

3. General information

Legal bases

For each processing operation we state the specific legal basis. The following apply:

• Consent (Art. 6(1)(a) GDPR), e.g. in the cookie banner or for the newsletter. You may withdraw any consent at any time with effect for the future; processing carried out until then remains lawful.
• Contract (Art. 6(1)(b) GDPR): performance of a contract with you or steps taken at your request prior to entering into a contract, e.g. your order.
• Legal obligation (Art. 6(1)(c) GDPR), e.g. retention for tax purposes.
• Legitimate interests (Art. 6(1)(f) GDPR), unless your interests override them.
• Access to your terminal equipment (§ 25 TDDDG, the German Telecommunications Digital Services Data Protection Act): under § 25 Abs. 1 TDDDG, storing information in your browser or accessing it (cookies, local storage, pixels) is in principle only permitted with your consent, and without it only where strictly necessary for a service you have explicitly requested (§ 25 Abs. 2 Nr. 2 TDDDG). For each service we state whether we obtain consent; the services that load regardless of your consent are listed in Section 6. The subsequent processing of the data is additionally governed by one of the GDPR legal bases listed above.
• Email marketing only with consent (§ 7 Abs. 2 Nr. 2 UWG, the German Act against Unfair Competition).

If you live in Switzerland or the United Kingdom, the Swiss Federal Act on Data Protection or the UK GDPR respectively also apply; your rights under those laws remain unaffected.

Our legitimate interests

Where we rely on Art. 6(1)(f) GDPR, we state the interest in the relevant section. In summary, we want to:

• provide a secure, stable and fast shop and fend off attacks, bots and spam;
• show you the country version with the prices, shipping terms and legal texts that apply to you;
• avoid fraud, payment defaults and deliveries to incorrect addresses;
• identify the channels through which orders are generated and manage our advertising cost-effectively;
• find errors and obstacles in the shop using session recordings and usage measurements;
• attribute purchases to the referring affiliates and settle commissions correctly;
• check whether our emails are delivered and read;
• analyse order and shop data, including with the help of AI assistance, in order to improve our product range, advertising and processes;
• answer enquiries, maintain business relationships with companies and quickly obtain replacement parts, including as a goodwill gesture;
• ensure the quality of our AI chat, detect errors and misuse and improve the answers;
• reliably respect objections to advertising and unsubscriptions;
• show genuine customer reviews and trust badges and offer shop functions such as pre-orders, add-on offers, instalment preview and discount display;
• present our products on social networks and communicate with interested parties;
• establish, exercise or defend legal claims.

Information on our balancing of interests is available on request.

Recipients

We only disclose data where the respective purpose requires it, and for each processing operation we name the recipients with their company name and registered office:

• Processors process data only on our instructions and on the basis of a contract pursuant to Art. 28 GDPR, e.g. Shopify, Klaviyo or Cloudflare.
• Independent controllers decide on the processing themselves, e.g. payment providers, parcel carriers, price comparison sites, tax advisers and public authorities. Their own privacy notices apply to them.
• Joint controllers (Art. 26 GDPR) determine the purposes and means together with us: Meta, Kelkoo, Heureka and Trusted Shops (details in the respective sections).

Public authorities, such as tax and customs authorities, receive data where we are legally obliged to provide it (Art. 6(1)(c) GDPR). In order to enforce or defend claims, we may disclose data to lawyers and courts (Art. 6(1)(f) GDPR).

Transfers to third countries

Third countries are states outside the European Economic Area (EEA). For each processing operation we state whether data are transferred to a third country, to which one and on what basis:

• Adequacy decision (Art. 45 GDPR) of the European Commission, among others for Canada (for commercial organisations), Switzerland, the United Kingdom, Israel and Andorra (European Commission list).
• EU-US Data Privacy Framework (DPF): For certified US companies, adequacy decision (EU) 2023/1795 applies (DPF list). An action against the decision is pending before the Court of Justice of the EU. With the certified providers to which we transfer data ourselves, standard contractual clauses have additionally been agreed; should the certification lapse, we base the transfer on those clauses.
• Standard contractual clauses (Art. 46(2)(c) GDPR, Implementing Decision (EU) 2021/914). A copy of the clauses agreed with our service providers is available on request.
• Binding corporate rules (Art. 47 GDPR): group rules approved by supervisory authorities, e.g. at Shopify.
• Necessary for the contract (Art. 49(1)(b) GDPR): for deliveries to Monaco, San Marino and Vatican City (Section 8) and for replacement part enquiries to our supplier in China (Section 10).

For persons in Switzerland, the Swiss-US Data Privacy Framework and the standard contractual clauses recognised in Switzerland apply accordingly. Where none of these bases exists for a transfer, we say so for the relevant service (Section 18).

Storage period

We only store data for as long as the purpose requires or the law demands; we state the specific period for each processing operation. The following statutory retention periods apply to order and accounting data:

• 8 years: invoices and accounting vouchers, e.g. payment, credit note and refund vouchers (§ 14b Abs. 1 UStG [German VAT Act], § 147 Abs. 1 Nr. 4, Abs. 3 AO [German Fiscal Code], § 257 Abs. 1 Nr. 4, Abs. 4 HGB [German Commercial Code]). This period has applied since 2025, including to older vouchers whose period was still running at the end of 2024.
• 6 years: commercial and business letters, e.g. order confirmations, emails relating to contracts, complaints, withdrawals and their confirmation (§ 147 Abs. 1 Nr. 2, 3, Abs. 3 AO, § 257 Abs. 1 Nr. 2, 3, Abs. 4 HGB).
• 10 years: books, records and annual financial statements (§ 147 Abs. 1 Nr. 1 AO, § 257 Abs. 1 Nr. 1 HGB), records of distance sales to other EU countries under the OSS procedure (§ 22 Abs. 1 UStG in conjunction with § 18j UStG) and customs documents (§ 147 Abs. 1 Nr. 4a AO).

The periods begin at the end of the calendar year in which the document was created. They do not expire as long as the documents are relevant for a tax that is not yet time-barred (§ 147 Abs. 3 S. 5 AO). During this time we block the data: we only keep them and do not use them for anything else (Art. 17(3)(b), Art. 18 GDPR). After that we delete them.

Data we need to establish or defend claims are stored until the proceedings have been concluded, otherwise until the claims become time-barred (generally three years from the end of the year in which they arose, §§ 195, 199 BGB [German Civil Code]).

Automated decisions and profiling

Whether we cancel an order on suspicion of fraud is decided by a human at our company. Automated decisions can, however, be made by Shopify Payments, which can block payment attempts with a high fraud risk on our behalf, and by Klarna, Alma and PayPal under their own responsibility for their payment methods (Section 9). Profiling for advertising purposes takes place in email marketing (Section 12) and, with your consent, in advertising (Section 16).

Data we do not collect from you

We receive some data from third parties or generate them ourselves (Art. 14 GDPR):

• payment and risk information (payment status, fraud indicators, acceptance or rejection of a payment method) from Shopify and the payment providers; we do not receive data from credit reference agencies;
• delivery data (shipment status, delivery events) from our warehouse service provider and the parcel carriers;
• campaign and click identifiers from the link through which you reach us, e.g. gclid (Google), fbclid (Meta), identifiers from Kelkoo, Heureka, solute and UpPromote; we use them for the source channel of an order (Section 8) and in the analytics, advertising and affiliate services (Sections 15 to 18);
• name and address of gift recipients provided to us by the person placing the order;
• contact details of contact persons at companies, e.g. from their website, from trade fairs or business cards;
• application data from the respective job portal if you apply through it;
• self-generated data: customer segments and predictive values in Klaviyo (Section 12) and analyses of the chat logs (Section 11).

Change of purpose

If we wish to use data for a new purpose, we will inform you in advance. Already planned is the analysis of the chat logs in order to improve Blocky (Section 11).

Minors

Our offering is aimed at adults. If you are under 16, please ask your parents to order for you, to sign you up for the newsletter or to give consents.

4. Shop platform and hosting (Shopify)

Our shop runs on the Shopify platform. Shopify stores product, order and customer data and delivers pages, images and fonts to your browser.

• Provider: Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin, D02 E7K8, Ireland, as our processor.
• Data: all data you enter in the shop or that arise during use (see the following sections), plus IP address and device and browser information.
• Legal basis: for orders Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR, our interest being a secure, stable and fast shop.
• Third countries: Shopify transfers data to its parent company Shopify Inc. in Ottawa (Canada, adequacy decision) and to group companies and sub-processors in the USA and other countries. The basis is approved binding corporate rules (Art. 47 GDPR) and, for external sub-processors, standard contractual clauses (list of sub-processors).
• Storage period: as stated in the individual sections.
• Shopify’s own responsibility: Shopify is itself responsible for the Shop app, Shop Pay and signing in with Shop (Sections 7 and 9).
• Cross-merchant analyses: The Shopify Network Intelligence function is active. With it, Shopify uses customer data across merchants for its own services, for example for search, filters and product recommendations in our shop; Shopify itself is responsible for this.
• More information: Shopify privacy policy

Country and language version

If you access the German version without a country path, Shopify determines your approximate country on the basis of your IP address. If it is outside Germany, we redirect you to the appropriate country version (e.g. /fr-fr/), taking into account the language setting of your browser.

• Data: IP address (only for country detection at Shopify), detected country, browser language.
• Browser storage: In session storage (sessionStorage) we remember the detected country (kbs_geo_cc), the time of the redirect (kbs_geo_hop) and whether you have switched off the redirect (kbs_geo_off); without an identifier, deleted when the tab is closed. If you select a country or language yourself, we store this in the cookie kbs_loc_choice (value “1”, 12 months) and no longer redirect you automatically afterwards.
• Legal basis: Art. 6(1)(f) GDPR; our interest is to show you the prices, shipping terms and legal texts applicable in your country. For the entries in the browser § 25 Abs. 2 Nr. 2 TDDDG.
• Recipients: Shopify. You can switch at any time using the country and language selector.

5. Server logs

Every time a page is accessed, your browser, for technical reasons, transmits data to the servers from which the content is delivered.

• Data: IP address, date and time, requested address, referring page (referrer), browser, operating system, language and amount of data.
• Purpose and legal basis: delivery of the pages, error analysis and defence against attacks such as denial-of-service attacks or bots (Art. 6(1)(f) GDPR; interest: a secure and stable shop).
• Recipients: Shopify (Section 4). If you use our self-developed functions (AI chat, discount display, wishlist, missing parts form), Cloudflare (Section 21) also receives the data required for them, and in the case of direct access also your IP address.
• Storage period: Shopify retains the logs for as long as Shopify needs them for operating its services, for security and fraud prevention or due to legal obligations; Shopify does not specify a fixed period. We do not store access logs at Cloudflare; Cloudflare deletes error logs of our functions after no more than 7 days.

6. Cookies and consent

Cookies are small text files stored by your browser. The browser’s local storage and session storage (localStorage, sessionStorage) and tracking pixels work in a similar way.

The following subsections describe which of these are only set with your consent and which are set even without it.

Consent banner (Pandectes)

On your first visit, our banner shows the buttons “Ok” and “Preferences”. By clicking “Ok” you consent to all categories. Under “Preferences” you can reject all categories (“Reject all”), consent to all of them or select and save individual categories. Your choice is respected by Shopify and by the services we have integrated with a category via Shopify’s customer events (web pixels): they only start once you have consented to the respective category. We do not use a script blocker that blocks all other services until you consent; the services that therefore load regardless of your choice are listed below under “Services that load without consent”. The categories control:

• Necessary (always active): basic functions of the shop, see below.
• Preferences: currently no service; Trusted Shops trust badges and widgets load independently of this category (Section 13).
• Statistics: Shopify analytics (Section 15), the statistics pixels of Judge.me and STOQ (Sections 13 and 14) and the cookies of Google Analytics and Microsoft Clarity; both of these services, however, also load without your consent (Section 15).
• Marketing: Shopify’s marketing cookie (Section 15) and the advertising cookies of Google Ads (Section 16).
• Statistics or Marketing (either one is sufficient): attribution of the source channel of an order using the storage entry kbs_attr_v1 (Section 8).
• Statistics and Marketing (both required): Meta (Section 16), Klaviyo’s pixel for product views and carts (Section 12), Triple Whale’s pixel (Section 15) and the purchase tracking of Kelkoo, idealo, solute and Heureka (Section 17).

• Banner provider: Pandectes, Pudisoo küla, Männimäe/1, 74626 Kuusalu vald, Estonia, as our processor. Pandectes stores the data at Amazon Web Services in Ireland; according to its list of sub-processors, no other sub-processor processes data of our visitors.
• Data stored: your choice and a random consent ID in the cookie _pandectes_gdpr (12 months). Together with your choice, the banner also transmits the page accessed to Pandectes. In the consent log at Pandectes: ID, time, choice, country or region, device type and truncated IP address. Pandectes passes your choice on to Shopify so that Shopify and the web pixels integrated with a category respect it; Google and Microsoft Clarity only use it to determine whether they set cookies (Section 15).
• Legal basis: § 25 Abs. 2 Nr. 2 TDDDG for the cookies; Art. 6(1)(c) in conjunction with Art. 7(1) GDPR for the proof of your consent.
• Storage period: The banner asks again after 12 months, or earlier if we integrate new services. Pandectes keeps the consent log for 6 years as proof (Art. 7(1) GDPR); if we stop using Pandectes, it is deleted.
• Older browsers: In such browsers, the banner loads an additional file via the jsDelivr network, which is operated by the network partners Cloudflare and Fastly (USA, DPF); they receive your IP address in the process. The legal basis is Art. 6(1)(f) GDPR; our interest is to display the banner correctly in older browsers too.
• Requests via Pandectes: On the cookie declaration page, you can also submit data protection requests via a Pandectes form; in doing so, Pandectes processes your name, email address and the type of request on our behalf.
• Banner statistics: When the banner or its settings view opens, it reports to Pandectes the type of view, the page accessed and your country, without a consent ID; for technical reasons Pandectes receives your IP address in the process. This is how Pandectes counts for us how often the banner is displayed. The legal basis is Art. 6(1)(f) GDPR; our interest is to review the display and design of the banner. Pandectes keeps the counts in our account; if we stop using the service, Pandectes, according to its own information, deletes our account data within 30 days.

Changing or withdrawing consent

We do not currently offer a link or icon with which you can reopen the banner. To change your choice or withdraw your consent, delete the cookies of our website in your browser, at least the cookie _pandectes_gdpr. The banner will reappear the next time you load a page, and you can reject all categories or select individual ones under “Preferences”. You can also notify us of your withdrawal informally (Section 1); however, it can only be implemented in your browser in this way. The withdrawal takes effect for the future: the services that respect your choice (above) will then no longer set or read cookies; your choice has no effect on the services that load without consent.

On the cookie declaration page, Pandectes shows an automatically generated overview of the cookies that Pandectes has detected on our website, with provider, type and duration. This overview is not complete and does not state any purposes; the information in this notice is authoritative.

Necessary cookies and storage entries

We set these entries without consent because the shop or a function you use would otherwise not work (§ 25 Abs. 2 Nr. 2 TDDDG). We base the further processing on Art. 6(1)(b) GDPR (order or requested function) or Art. 6(1)(f) GDPR (secure operation).

• Shopify: cookies for session, security and checkout (_shopify_essential, 1 year), cart (cart, cart_currency, 2 weeks), country and language (localization, 1 year), discount code from a link (discount_code, until the end of the session) and for the customer account if you use it.
• kbs_loc_choice (cookie, 12 months): your manual choice of country or language (Section 4).
• kbs_geo_cc, kbs_geo_hop, kbs_geo_off (session storage): automatic country redirection (Section 4).
• kbs_favs_v1 (local storage, until you delete it): your wishlist, only after you click the heart (Section 14).
• kbs-dd-closed (local storage, until you delete it) and kbs-dd-reload:… and kbs-dd:… (session storage): closed discount notice, one-time reload after a discount code has been applied, and the conditions of the opened discount code (Section 14).
• kbs_chat_sid (session storage): random session ID for the AI chat, created when a product page with the chat is opened (Section 11).

Your browser deletes session storage entries when you close the tab. Entries created by services regardless of your consent are listed in the following subsection.

Services that load without consent

Our shop loads the following services regardless of your choice in the cookie banner, i.e. even if you do not consent or if you reject. In the process, your browser connects to servers of the respective provider, which receives your IP address and browser information; some services also store entries in your browser or read them. Details can be found in the sections referred to.

• Microsoft Clarity: records your visit on all pages and at checkout; without your consent without cookies (Section 15).
• Google Analytics and Google Ads: without your consent, send cookieless signals about page views and events up to the purchase to Google (Sections 15 and 16).
• Triple Whale: The script loads on all pages, creates in local storage a counter of your page views (TriplePixel) and a list of the pages accessed (TriplePixelU) and loads program code from Triple Whale servers (Section 15).
• Klaviyo: The script for forms and pop-ups loads on all pages; it only sets the cookie __kla_id after your consent (Section 12).
• UpPromote: affiliate ID in cookies and in local storage, transmission of page views and of checkout and purchase including your contact details, and where applicable affiliates’ Meta pixels (Section 18).
• Selleasy: entries lb-upsell-setup and lb-upsell-setupFetchedAt in local storage, lb-offer-viewed in session storage, after a click on an offer lb-offer-clicked, lb-track-ids and lb-offer-codes in local storage, and performance tracking of the offers displayed and clicked (Section 14).
• STOQ: pre-order and notification functions and the entries _stoq_pls and _stoq_sqe in session storage (Section 14).
• Judge.me: review widgets (Section 13).
• Trusted Shops: trust badge on all pages, review widgets on the “About us” page and the card on the order confirmation page; in the process, Trusted Shops may read its own login cookie (Section 13).
• Heureka: the entry script with the cookie hg_ocm_id if you come from Heureka (Section 17).
• idealo and billiger.de: the badges in the footer (Section 17).
• Alma: the instalment preview with program files via the jsDelivr network and the cache kbs-alma:… in session storage (Section 9).
• Shopify, PayPal, Google and Apple: express checkout buttons in the cart (Section 9).
• Pandectes: the banner statistics (above).

The legal basis for these processing operations is Art. 6(1)(f) GDPR with the interests described in the sections referred to; we do not obtain consent for them. You may object to the processing on grounds relating to your particular situation (Section 2). At present, loading can only be prevented technically by settings or extensions of your browser that block third-party content and scripts; some shop functions may then not work.

7. Customer account

Signing in to the customer account is optional. You can always order as a guest.

• Function: Using the email address of your order, you can sign in at any time with a one-time code that we send you by email; there is no password and no registration. In the account you can see your orders, manage addresses, use store credit and synchronise your wishlist.
• Data: email address, one-time code, name, saved addresses, phone number (if provided), orders, store credit, wishlist and sign-in times. Your customer record is created with your first order (Section 8) or your first sign-in.
• Legal basis: Art. 6(1)(b) GDPR (access to your orders and the account functions at your request); sign-in cookies § 25 Abs. 2 Nr. 2 TDDDG.
• Sign in with Shop: If you use “Sign in with Shop”, Shopify additionally processes your data under its own responsibility (privacy notice for Shop users).
• Recipients: Shopify (Section 4); for synchronising the wishlist Cloudflare (Section 14).
• Storage period: address book and wishlist until you request deletion; order data in accordance with the statutory periods (Section 3).

8. Orders and shipping

Order processing

• Data: name, delivery and billing address, email address, phone number (if provided), items, prices, discount codes, payment and shipping method, time, IP address and device information; after a chat with Blocky, an instalment plan or a pre-order also the related information (Sections 9, 11 and 14).
• Legal basis: conclusion and performance of the purchase contract, invoicing, communication about the order, warranty and reversal of the contract (Art. 6(1)(b) GDPR); retention under § 147 AO, § 257 HGB, § 14b UStG and § 22 UStG (Art. 6(1)(c) GDPR).
• Mandatory information: We need your name, delivery and billing address, email address and payment details for the contract; without them no order is possible. The phone number is optional unless the checkout requests it as a mandatory field.
• Order notifications: Shopify sends order and shipping confirmations by email or, if you choose your phone number as the contact at checkout, by SMS. They do not contain any advertising.
• Recipients: Shopify (Section 4), Fulfillment Europe and parcel carriers (below), AddressHero (below), payment providers (Section 9), Klaviyo (Section 12), Judge.me (Section 13), STOQ and Selleasy (Section 14), Triple Whale (Section 15), UpPromote (Section 18), Make and Google (Gmail account) for missing parts requests and withdrawals, Anthropic for internal analyses and our tax advisers (Section 21), Microsoft with the recording of the checkout (Clarity, Section 15), Google (Sections 15 and 16; without your consent only cookieless signals) and Trusted Shops for the card on the order confirmation page (Section 13); with your consent additionally Trusted Shops for review invitations (Section 13), Meta and price comparison sites (Sections 16 and 17).
• Storage period: invoices and accounting vouchers 8 years, business correspondence 6 years, OSS records and customs documents 10 years (Section 3). IP address and device information from the checkout remain stored with the order and are deleted together with it.

Fraud prevention

Shopify automatically assesses every order for fraud risks; for card payments, the payment processor also carries out checks (Section 9). For this purpose, order, payment, device and IP data and indicators such as differing billing and delivery addresses are analysed. We receive the risk rating from Shopify; whether we cancel an order is decided by a human at our company. The legal basis is Art. 6(1)(f) GDPR; our interest is to prevent fraud such as card misuse or identity theft, and payment defaults. We store the rating with the order.

Address validation (AddressHero)

• Provider: HeroSoftware GmbH, Idstein (Germany), as our processor.
• Purpose and data: AddressHero detects incorrect delivery addresses, such as a missing house number, and flags the order so that we can check with you. The app receives order number, order date, name, email address and delivery address from Shopify and stores them in a database at DigitalOcean, LLC (USA, DPF). Only street, house number, postcode, town and country are sent to validation services: to the Address Validation API of Google LLC (USA, DPF) and to the ADDRESSFACTORY service of Deutsche Post Direkt GmbH (Germany).
• Legal basis: Art. 6(1)(b) GDPR (delivery) and Art. 6(1)(f) GDPR; our interest is to avoid delivery errors and returns.
• Storage period: AddressHero deletes name, email address and delivery address from the order after 7 days, and error logs with order number and address after 30 days. AddressHero additionally stores validated addresses without names in caches of the validation results; according to its own information, AddressHero does not provide for a deletion period for these. If we stop using the service, AddressHero deletes our shop’s data within 48 hours of uninstallation.

Source channel

We automatically tag orders (Shopify Flow) with the channel through which you came to us, such as a search engine, price comparison site or advertisement. This allows us to attribute orders to our advertising channels and to review their effectiveness and billing. Shopify only records the referring page and the campaign parameters if you have consented to the Statistics category (Section 15). If you have consented to the Statistics category or the Marketing category, our shop stores in your browser’s local storage for 30 days, for your first and your last visit (kbs_attr_v1): the campaign parameters (utm_source, utm_medium, utm_campaign, utm_content and utm_term), the type of click identifier from the link (such as gclid from Google or fbclid from Meta) and, with consent to the Marketing category, also its value, the domain of the referring page and the landing page. If a cart exists, it takes over utm_source, utm_medium and utm_campaign of both visits as well as the referring domain, landing page and click identifier of the last visit as cart attributes (_kbs_ft_*, _kbs_lt_*, _kbs_referrer, _kbs_landing, _kbs_click_id); we receive them in Shopify with the order. The program checks your consent on every page view via Shopify’s consent interface, or alternatively via the banner cookie _pandectes_gdpr. Without consent it stores and sends nothing; if you withdraw consent, it deletes the entry. If you come from idealo, our shop adds campaign parameters to the link without sending any data to idealo. The legal basis is your consent (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR). We store the tag and the cart attributes with the order.

Warehouse and shipping

• Warehouse: Our warehousing and shipping service provider Fulfillment Europe, Volbedingstraße 2, 04357 Leipzig, takes over orders automatically, packs them and hands them over to the parcel carrier. It receives name, delivery address and items as well as your contact details insofar as it needs them for queries about the delivery, and is our processor.
• Parcel carriers: We ship with DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, and to certain countries with United Parcel Service Deutschland S.à r.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss. They receive name and delivery address and are independently responsible for delivery. We do not pass your email address on to the parcel carriers, and we pass on your phone number only if delivery or customs clearance in your country requires it. You receive the shipment status from us with the shipping confirmation (privacy notices of DHL and UPS).
• Legal basis: Art. 6(1)(b) GDPR, including for the customs information for deliveries outside the EU; where EU customs law requires an export declaration, Art. 6(1)(c) GDPR.
• Deliveries outside the EU: For deliveries to Switzerland, Liechtenstein, the United Kingdom, Andorra, Monaco, San Marino or Vatican City, the parcel carrier, its partners in the destination country and, where applicable, the customs authorities receive your delivery data and the customs information (description of goods, value). Liechtenstein is part of the EEA; an adequacy decision applies to Switzerland, the United Kingdom and Andorra. For Monaco, San Marino and Vatican City, the transfer is necessary for the performance of the contract (Art. 49(1)(b) GDPR).
• Special shipping: We send certain shipments, such as replacement parts, via the shipping platform Packlink PRO of Auctane, S.L.U., Paseo Imperial 14, 28005 Madrid, Spain. Packlink receives name and delivery address for this purpose and passes them on to the selected parcel carrier (Packlink privacy notice).
• Storage period: shipping data with the order; at the parcel carriers in accordance with their periods.

Delivery to another person

If you have an order delivered to another person, for example as a gift, we process that person’s name and address for delivery: in relation to the person placing the order under Art. 6(1)(b) GDPR, in relation to the recipient under Art. 6(1)(f) GDPR with our interest in delivering the order as requested. This notice applies accordingly to the recipient; the recipient may assert their rights against us. We store the data with the order.

9. Payment

Card numbers and bank details that you enter at checkout go directly to the payment provider; we do not receive them. We only receive what we need for accounting and customer service, e.g. payment method, amount, status and the last digits of a card.

Shopify Payments: cards, digital wallets and local payment methods

• Payment methods: credit and debit cards, Apple Pay, Google Pay, Shop Pay, Klarna and, depending on the country, e.g. iDEAL, Bancontact, TWINT, EPS, BLIK, MB WAY or MobilePay.
• Provider: Shopify International Limited (Section 4). Payments are processed by payment service providers determined by Shopify; according to Shopify’s list, the following are relevant for our shop: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, and Adyen N.V., Simon Carmiggeltstraat 5-60, 1011 DJ Amsterdam, Netherlands. For payment processing, Shopify and the respective payment service provider act as processors; for their own purposes such as fraud prevention and checks under anti-money laundering law, the payment service providers are independent controllers.
• Data: name, billing address, email address, amount, currency, payment method, card data (encrypted), IP address and device and browser information.
• Legal basis: Art. 6(1)(b) GDPR; for fraud prevention Art. 6(1)(f) GDPR, our interest being to prevent payment defaults and card misuse.
• Automatic block: Each time the checkout is submitted, Shopify Payments assesses the fraud risk and may automatically block high-risk payment attempts before an order is created. If, for example, many orders or failed payment attempts come from the same IP address within a short time, the fraud analysis may temporarily block this address; the block usually ends after one day, and further order attempts from this address may extend it. A new attempt with different payment or billing details may succeed. If you believe the block is wrong, write to us: a member of staff will review the case and can enable you to place the order in another way; you can express your point of view and contest the decision (Art. 22(3) GDPR).
• Third country: Stripe transfers data to Stripe, LLC in the USA (DPF, standard contractual clauses). PayPal bases transfers within its group on approved binding corporate rules, Adyen on standard contractual clauses.
• Storage period: payment vouchers at our company 8 years; at the payment service providers in accordance with their legal obligations (privacy policies of Stripe, PayPal and Adyen).
• Apple Pay and Google Pay: Here, Apple or Google process your data under their own responsibility, for persons in the EEA Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, or Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, respectively. We do not receive your actual card number (Apple Pay and privacy, Google Payments privacy notice).
• Shop Pay: Shop Pay stores your payment and address data for future purchases; Shopify is the independent controller for this (privacy notice for Shop users).

Express checkout buttons

In the cart we display buttons for PayPal, Apple Pay and Google Pay; you can choose Shop Pay at checkout. For the buttons to appear, your browser loads program code from Shopify in the cart and, depending on the button, also from PayPal, Google or Apple; the respective provider receives your IP address and browser information in the process, and Google may tell our page whether you have a Google payment profile with which you can pay with us. The respective provider only receives your order and contact details once you click a button. The legal basis is Art. 6(1)(f) GDPR; our interest is a fast payment process.

Klarna, Alma and PayPal: checks and automated decisions

• Klarna: If you choose Klarna (e.g. payment after 30 days or in three instalments), we redirect you to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna receives name, address, email address, where applicable phone number, and order data such as items and amount (Klarna privacy notice).
• Alma: If you choose instalment payment with Alma, we redirect you to Alma SAS, 176 Avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France. Alma receives name, address, email address, phone number, order data and your card data and may request further evidence such as bank statements (Alma privacy notice). Alma is the independent controller for this and may, under its own responsibility, also transfer data to service providers outside the EU.
• PayPal: If you choose PayPal, we redirect you to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal receives name, email address, delivery and billing address and order data (PayPal privacy statement).
• Checks by the provider: Klarna, Alma and PayPal check your identity and creditworthiness under their own responsibility, where applicable with the help of credit reference agencies (PayPal e.g. for direct debit or “Pay Later”), and decide whether you can use the selected payment method. This decision may be based solely on automated processing (Art. 22 GDPR). The providers explain in their privacy notices which data and procedures they use and what the consequences are.
• What we receive: only the result (accepted or rejected) and the payment status, no creditworthiness or credit reference data.
• Your rights: In the case of an automated decision, you may request human review of the decision, express your point of view and contest the decision (Art. 22(3) GDPR); to do so, please contact Klarna, Alma or PayPal respectively. If a payment method is rejected, you can choose another one, e.g. card.
• Scoring: From 20 November 2026, § 37a BDSG (German Federal Data Protection Act) additionally applies to probability values regarding your future payment behaviour, insofar as German data protection law applies to the provider or the credit reference agency. It excludes certain data from the calculation, such as name, address and data from social networks, and gives you a right to an explanation of the value and to contest it and obtain a decision by a human; these obligations lie with the respective provider or the credit reference agency.
• Legal basis: Art. 6(1)(b) GDPR (selected payment method) and Art. 6(1)(f) GDPR (fraud prevention).
• Third country: We transfer data to Klarna (Sweden), Alma (France) and PayPal (Luxembourg), i.e. within the EEA. Transfers to third countries are governed by the providers under their own responsibility.
• Storage period: payment vouchers at our company 8 years; at the providers in accordance with their periods.

Alma instalment preview

In countries where we offer Alma, product pages and product cards show possible instalment plans. For this purpose your browser queries Alma SAS (France) – on product pages when the page loads, on product cards only when you open the instalment view – as to which plans are possible for the price and country. Price, country, our merchant ID and, for technical reasons, your IP address and browser information are transmitted, but no customer data. Your browser loads the program files for the instalment view via the jsDelivr network, which is operated by the network partners Cloudflare and Fastly (USA, DPF); they receive your IP address and browser information in the process. We store the result of the query in your browser’s session storage until the tab is closed (kbs-alma:…), so that the page does not have to query again. All of this happens regardless of your choice in the cookie banner. The legal basis is Art. 6(1)(f) GDPR; our interest is to show the instalments transparently in advance.

Store credit and gift cards

If you redeem store credit or a gift card, we process the code, amount and remaining balance in Shopify (Art. 6(1)(b) GDPR) until the credit has been used up or has expired, and thereafter in accordance with the statutory periods (Section 3).

10. Contact and forms

Mandatory fields in our forms are marked. If your enquiry concerns a contract with us, the legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR with the interest of answering your enquiry, unless stated otherwise below.

Email and contact form

• Data: email address, name, where applicable phone and order number, your message and attachments. In the contact form we need at least your email address and message in order to be able to reply.
• Recipients: Our mailboxes are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, our processor. The contact form is provided by Shopify (Section 4), which forwards your message to this mailbox.
• Storage period: messages relating to orders and contracts 6 years as business correspondence; we delete other enquiries once they have been dealt with, at the latest 2 years after the last message.

Telephone

If you call us, we process your phone number and the content of the conversation in order to deal with your request. We store notes on this in the same way as emails.

WhatsApp

• You can write to us via the WhatsApp link in the footer, for example with questions or photos of your building projects. Only clicking the link opens WhatsApp; before that, no data are sent to WhatsApp.
• Provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. WhatsApp is the independent controller for the use of the messenger. For the contact details of our customers in our WhatsApp Business account (e.g. phone numbers), WhatsApp is our processor under its terms for the WhatsApp Business App.
• Data: phone number, profile name and picture, messages, photos and metadata such as the time.
• Third country: transfer to WhatsApp LLC in the USA (DPF, standard contractual clauses).
• Legal basis and storage period: as for emails. If you do not wish to use WhatsApp, you can reach us by email, phone or contact form.

Missing parts and replacement parts form

If a part is missing from your set or is damaged, you can report this via our form. Please only photograph the set and the parts, not people and not address labels.

• Procedure: First you enter your order number and email address. Our server service at Cloudflare has Make check in Shopify whether the order exists and belongs to this email address, and shows you the products ordered. It then forwards your request to Make; Make sends it via our Gmail account to our customer service mailbox at IONOS and to our supplier (below; Section 21).
• Data: order number, email address, product and item number, part number and type, type of problem, quantity, description, your files (photos of the instructions, the damage or the build, for electrical parts a video; together no more than 8 MB) and name, email address, delivery address and phone number for shipping the parts; the form requires the phone number as a mandatory field.
• Photos and metadata: We forward your files unchanged, including to our supplier (below). If a photo contains metadata, such as the location where it was taken (GPS data), the date it was taken or the device, these are passed on too. Please do not photograph people or address labels, and remove location data before uploading, for example by switching off location tagging in your camera or photo app or omitting it when sharing.
• Legal basis: Art. 6(1)(b) GDPR (your rights in respect of defects under §§ 437 ff. BGB); if we help as a goodwill gesture, Art. 6(1)(f) GDPR with the interest of quickly obtaining a replacement for you even without a legal entitlement.
• Disclosure to our supplier in China: We obtain replacement parts from our supplier in China. With each request, sent by email from our Gmail account, it receives all details of the request: order number, product, details of the part, your files (unchanged, including any metadata such as the location) as well as your name, email address, phone number and delivery address. The supplier is the independent controller for handling the replacement-part request; depending on the case, it sends the parts directly to you or to us, and we then send them to you. There is no adequacy decision of the European Commission for China; we have not agreed standard contractual clauses with the supplier. We base the transfer on Art. 49(1)(b) GDPR, because it is necessary for obtaining the replacement part, i.e. for fulfilling your claim or your wish for a replacement.
• Abuse protection: To protect against misuse, our server service counts requests per IP address; these counters are deleted after 2 hours. The legal basis is Art. 6(1)(f) GDPR; our interest is to protect the form against misuse.
• Storage period: We keep the request including the files as business correspondence for 6 years from the end of the calendar year.

Withdrawal form

• Purpose and data: Using our withdrawal function, you can withdraw from a purchase contract online. For this we process name and email address, optionally order number and message, as well as the language and address of the page from which you send the withdrawal.
• Procedure: Make receives the form and sends the acknowledgement of receipt from our Gmail account to you and a copy to the same account (Section 21).
• Legal basis: acknowledgement of receipt: Art. 6(1)(c) GDPR in conjunction with § 356a Abs. 4 BGB; handling of the withdrawal and reversal of the contract: Art. 6(1)(b) GDPR.
• Storage period: 6 years as business correspondence, from the end of the calendar year.

Enquiries from retailers and businesses

• Businesses can submit enquiries via our B2B form. The form is provided by Shopify’s Shopify Forms app; we store the information as a contact in Shopify (Section 4).
• Data: first and last name of the contact person, company, country, email address, phone number and your request, optionally website and VAT identification number. This is not linked to a newsletter subscription. We also obtain contact details of contact persons from company websites, trade fairs or business cards.
• Legal basis: Art. 6(1)(b) GDPR insofar as a contract with your company is concerned; otherwise Art. 6(1)(f) GDPR, our interest being to initiate and maintain business relationships with companies.
• Storage period: without a business relationship 2 years after the last contact, otherwise 6 years as business correspondence.

Job applications

• We accept applications by email to jobs@kbs-shop.com (mailbox at IONOS, processor). If you apply via a job portal, we receive your data from that portal.
• Data: contact details, cover letter, CV, certificates and other information you send us. Please only send information on health or religion, for example, if it is necessary for the position.
• Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into an employment relationship); for information on health or severe disability, insofar as we need it for obligations under employment law, Art. 9(2)(b) GDPR. We do not take into account other special categories of information that you provide unsolicited.
• Recipients: only the persons who decide on filling the position.
• Storage period: 6 months after the conclusion of the procedure, in order to be able to defend against any claims under the German General Equal Treatment Act (AGG). Longer, for example for future positions, only with your consent (Art. 6(1)(a) GDPR) and for no more than 2 years; you may withdraw it at any time. If you are hired, the documents are placed in your personnel file.

11. AI chat “Blocky”

On our product pages you can ask Blocky questions. Blocky is an AI assistant, not a human. It answers questions about products, shipping and payment on the basis of our shop data. AI can make mistakes; the information on the product page and in our general terms and conditions is binding. Blocky has no access to orders, shipment data or customer accounts. Use is voluntary.

• When data flow: only once you send a message. Before that, the chat field sends nothing to servers; when the product page is opened, it only creates a random session ID in your browser’s session storage (kbs_chat_sid).
• Data: your messages and Blocky’s answers, time, language and country of the shop version, the product of the page, a random session and conversation ID, the visitor ID from the Shopify cookie _shopify_y if your browser has stored it (Shopify only sets it with your consent to the Statistics category, Section 15), and, for technical reasons, your IP address; contact details only if you enter them yourself.
• Procedure: Our server service at Cloudflare forwards your message together with the previous course of the conversation unchanged to a language model from Anthropic, which generates the answer. Only for the conversation log (below) do we replace recognisable email addresses, phone numbers and long sequences of digits such as card or account numbers with placeholders; this filter does not recognise names and addresses. Please therefore do not enter any health, payment or identity document data.
• Handover to our team: If your request needs a human, for example for questions about an order or for complaints, Blocky asks for your order number and email address and hands over via Make by email to our Gmail account (Section 21): a summary, order number and email address (if given), language, country and the product of the page, depending on the case also your last message verbatim, the previous course of the conversation and the conversation ID. Alternatively, you can write to us directly at any time: shop@kbs-shop.com.
• Log and analysis: We store the conversations with the placeholders mentioned, the IDs and, where applicable, the Shopify visitor ID in a database at Cloudflare in order to find errors, detect misuse and improve Blocky. For this purpose we also have the conversations of the last few days summarised automatically by an AI model from Anthropic. We use the results for better answers and product information, not for advertising and not for decisions about you.
• Linking with orders: If you add something to the cart after a chat, we store the conversation ID and the product you asked about there. If you place an order, this information is carried over into the order, and we tag it with the note “Asked Blocky” (chat used). This is how we measure whether the advice helps. The ID allows the conversation to be linked to your order for as long as the log is stored. We only use this link for measuring performance and if you contact us about the conversation.
• Legal bases: answering: Art. 6(1)(b) GDPR (pre-purchase advice at your request), otherwise Art. 6(1)(f) GDPR with the interest of fast customer service. Log, analysis and linking: Art. 6(1)(f) GDPR; our interests are quality assurance, error analysis, prevention of misuse, better answers and performance measurement. Session ID in the browser (kbs_chat_sid): § 25 Abs. 2 Nr. 2 TDDDG.
• Recipients: Cloudflare, Inc. (Section 21) and Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, as processors, with the data being stored in the USA; Make and Google as provider of our Gmail account (Section 21) for handovers to our team; Shopify for the information in the cart and order.
• Third country: Anthropic stores the data in the USA; the answer may also be generated in data centres in other countries. The basis is standard contractual clauses. The database at Cloudflare is set up for Western Europe; Cloudflare does not commit to storage exclusively in the EU for it; Cloudflare may access it from the USA (DPF, standard contractual clauses).
• Storage period: We currently store conversation logs and analyses without a fixed period; automatic deletion is not set up. We delete them if you request it (below), and at the latest when we stop operating Blocky. Anthropic deletes inputs and outputs within 30 days, in the case of suspected violations of its usage policies after up to 2 years (classification results up to 7 years), and does not use the content to train its models. Counters for protection against misuse (per session, alternatively per IP address) are deleted after no more than 48 hours. We store handovers to our team in our Gmail account in the same way as emails (Section 10).
• No automated decisions: Blocky does not make any decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
• Your choice: If you would like a conversation to be deleted, tell us the approximate time and the product. You may object to the logging (Section 2).

12. Email marketing

For marketing emails we use Klaviyo: Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA, as our processor. Klaviyo stores the data in the USA (Amazon Web Services, North Virginia region). Group companies of Klaviyo, among others in Australia, Ireland, Canada, Singapore and the United Kingdom, as well as sub-processors, for example for customer support in the Philippines and Costa Rica, may also have access (list of sub-processors). The basis is the DPF, alternatively standard contractual clauses (Klaviyo privacy information). This applies to all of the following subsections.

Newsletter

• Sign-up: in Klaviyo forms on our pages (e.g. home page, product pages, “About us”, “Secret discount code” page or as a pop-up) or by ticking the box at checkout. You will then receive an email with a confirmation link; the sign-up only becomes effective once you click on it (double opt-in).
• Content: new products, offers and discounts, pre-orders and product recommendations and, if your consent covers this, reminders about incomplete purchases.
• Data: email address, optionally your first name, language and country of the shop version, time of sign-up and confirmation, form used and your IP address.
• Legal basis: your consent (Art. 6(1)(a) GDPR, § 7 Abs. 2 Nr. 2 UWG); we store the proof under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR.
• Klaviyo forms and pop-up are loaded by our shop on all pages regardless of your choice in the cookie banner; Klaviyo receives your IP address and browser information in the process (Section 6). The legal basis is Art. 6(1)(f) GDPR; our interest is to offer you the newsletter sign-up. Klaviyo protects its forms against bots using the service of DataDome SA, 10 rue de Penthièvre, 75008 Paris, France.
• Unsubscribing: at any time via the link in every email or by message to us, with effect for the future.
• Storage period: until you unsubscribe. After that we only store your email address, permanently, on a suppression list so that you no longer receive advertising (Art. 6(1)(f) GDPR; interest: permanently respecting your withdrawal). We keep the proof of consent for the duration of the consent and for 3 years thereafter.

Performance tracking in emails

In the emails that Klaviyo sends on our behalf, we measure whether you open an email (invisible pixel) and which links you click (personalised links). This applies to newsletters and promotional series as well as to service emails, such as messages about pre-orders, back-in-stock alerts and notices of delivery delays. The time of opening, links clicked, email client, device and approximate location derived from the IP address are recorded. This shows us which topics are of interest and whether important notices arrive, and we send fewer emails to recipients who do not read them.

• Legal basis for newsletters and promotional emails: your consent to the newsletter, which you give when signing up; the measurement is part of the newsletter as described here (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR). We do not mention the measurement in the sign-up forms themselves. You can withdraw it by message to us or by unsubscribing from the newsletter.
• Legal basis for service emails: Here we do not obtain consent and base the measurement on Art. 6(1)(f) GDPR; our interest is to check whether important notices about your order arrive. You may object to this at any time (Section 2).
• Your choice: Irrespective of this, you can prevent open tracking by switching off the automatic loading of images in your email client.
• Storage period: We store the measurement data with your profile in Klaviyo (storage period below).

Email marketing to existing customers

We do not send you advertising by email without your consent, not even after a purchase. In that case we only use the email address from your order for processing the order and for service information (below).

Reminders about cart, checkout and viewed products

Klaviyo sends you email reminders if you leave items in the cart, leave the checkout without ordering or have viewed products. These reminders are advertising. We only send them if you have subscribed to the newsletter with a consent that covers such reminders (Art. 6(1)(a) GDPR, § 7 Abs. 2 Nr. 2 UWG). Otherwise, we do not use an email address entered at checkout for reminders. If you enter your email address at checkout, Shopify transmits it together with the cart contents to Klaviyo, even if you do not place an order. If there is no consent, we do not use this information and delete it in Klaviyo after 30 days; the legal basis is Art. 6(1)(f) GDPR, our interest being to send reminders only to eligible recipients. Email address, cart contents, viewed products and times are processed. Klaviyo’s pixel only transmits viewed products and carts if you have consented to the Statistics and Marketing categories (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR). Klaviyo’s script for forms, by contrast, also loads without consent (above). However, the script only sets and reads the cookie __kla_id (up to 2 years), with which Klaviyo recognises visitors it already knows, for example after a click in one of our emails, and records their activity on our website, once Shopify reports your consent in the cookie banner to it; the basis is then this consent (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR). You can unsubscribe via the link in every email.

Other automated emails

• Promotional series: welcome series after signing up, offers after a purchase and a reminder if you have not ordered for some time; the basis is your newsletter consent, without which you will not receive these emails.
• Service information about your order, e.g. about customs delays, does not contain advertising; the basis is Art. 6(1)(b) GDPR.
• Order and shipping confirmations are sent by Shopify (Section 8).

SMS notifications

For certain notifications, for example when a product is available again, you can provide your mobile number and confirm the sign-up. We then store your number and the notifications you requested in Klaviyo on the basis of your consent (Art. 6(1)(a) GDPR). To date we have not sent any SMS. If we send SMS, this is done via Klaviyo through its sub-processors Twilio, Inc. (USA, DPF) and Infobip, Inc. (USA; processing also in other countries, among others Brazil, India, Mexico and the United Kingdom); the basis for the transfer to Klaviyo is the DPF or standard contractual clauses, and Klaviyo must impose equivalent data protection obligations on its sub-processors. You can unsubscribe at any time by message to us or, once you receive SMS from us, by replying STOP; until then we store the number.

Purchase data in Klaviyo and profiling

• Data: Via the connection to Shopify, Klaviyo receives the data of all customers, even without a newsletter subscription: name, email address, phone number, address, language, country as well as orders, products ordered, started checkouts and events relating to shipping, delivery, refund and cancellation.
• Purpose: advertising and reminders to newsletter subscribers, service information and matching against the suppression list so that you do not receive advertising after an objection or unsubscription.
• Profiling: We group recipients according to purchases, interests and their response to emails (opens and clicks, above). From the order data, Klaviyo calculates predictions, such as the expected date of the next purchase or the expected revenue. We do not use an estimate of gender. You may object to profiling for direct marketing at any time (Section 2).
• Legal basis: Art. 6(1)(f) GDPR; our interest is to send advertising in a targeted manner and only to recipients who may receive it. For newsletter subscribers, your consent (Art. 6(1)(a) GDPR).
• Storage period: We delete profiles of customers without newsletter consent in Klaviyo 3 years after the last order, profiles of subscribers after unsubscription (suppression list above), and information from a started checkout without an order after 30 days if we may not use it for reminders (above). After the end of our contract, Klaviyo deletes all data within 90 days.

13. Reviews

Product reviews (Judge.me)

• Provider: Judge.me Ltd, Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, United Kingdom; representative in the EU: Buckworths (Ireland) Limited, Dublin. For data from our shop, Judge.me is our processor; for persons who interact directly with Judge.me, it is an independent controller.
• Display: On home, product, collection and cart pages, your browser loads the reviews from Judge.me servers, which receive your IP address and browser information in the process. The legal basis is Art. 6(1)(f) GDPR; our interest is to show genuine customer opinions.
• Statistics: With your consent (Statistics category), Judge.me records events such as page views and purchases for analyses relating to the reviews (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR).
• Published reviews are displayed with the chosen display name, stars, text and, where applicable, photos. The legal basis is Art. 6(1)(f) GDPR; our interest is to show genuine customer opinions submitted for publication. If you object, we remove your review or display it without your name. We do not currently send review requests via Judge.me.
• Third country: United Kingdom (adequacy decision); sub-processors in the USA on the basis of standard contractual clauses (Judge.me privacy policy).
• Storage period: reviews until you object or until we stop using Judge.me. Judge.me processes statistics and customer data from the shop only on our behalf for the duration of our use; thereafter Judge.me deletes them or returns them to us, unless the law requires them to be retained.

Trusted Shops: trust badge and shop reviews

• Provider: Trusted Shops SE, Subbelrather Str. 15c, 50823 Köln.
• Trust badge and widgets: On all pages we display the Trusted Shops trust badge with our shop reviews, and on the “About us” page review widgets. Your browser loads them from Trusted Shops servers, regardless of your choice in the cookie banner. In the process, Trusted Shops processes your IP address (according to its own information, anonymised immediately), time, amount of data and internet service provider. If you are logged in to Trusted Shops, Trusted Shops recognises you by means of a cookie. The legal basis is Art. 6(1)(f) GDPR; our interest is to show our trust badge and our shop reviews.
• Trustcard: On the order confirmation page, Trusted Shops displays a card (Trustcard). It reads the order total, order number, where applicable the products purchased and your email address; the email address is converted into a check value (hash) using a one-way function before transmission. Trusted Shops uses this to check whether you are registered for its services and, where applicable, offers you buyer protection; via the card we also ask you whether you would like to receive a review invitation (below). If you do not register, Trusted Shops, according to its own information, deletes the transmitted data automatically; Trusted Shops does not specify a period. The card loads regardless of your choice in the cookie banner. The legal basis is Art. 6(1)(f) GDPR; our interest is to be able to offer you buyer protection and a review invitation.
• Joint controllership: Trusted Shops and we are joint controllers for the trust badge and widgets (Art. 26 GDPR). We inform you here about the integration; Trusted Shops informs you about its further processing (Trusted Shops privacy notice). Data protection enquiries are best addressed directly to Trusted Shops; you may also contact us, in which case we will forward your request.
• Third country: Trusted Shops delivers the content via a network service provider in the USA (DPF or standard contractual clauses) and uses service providers in Israel (adequacy decision).
• Storage period: According to its own information, Trusted Shops anonymises the IP address immediately; the login cookie remains stored for no more than 400 days after login.

Review invitations from Trusted Shops

After your order, we ask you on the order confirmation page with the Trustcard (above) whether you would like to receive an invitation to submit a review. Only if you agree do we transmit email address, name, order number, order date and products ordered to Trusted Shops for the invitation; after a waiting period, Trusted Shops sends you an email asking for a review. Without your agreement you will not receive a review request. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7 Abs. 2 Nr. 2 UWG), which you can withdraw at any time via the link in the invitation or by message to us. We store the information on the invitation with the order.

Trusted Shops publishes submitted reviews under its own responsibility in accordance with its terms.

14. Pre-orders, back-in-stock alerts, product offers, wishlist, discount display

Pre-orders and back-in-stock alerts (STOQ)

• Provider: Artos Software Inc., 1111B S Governors Ave STE 3617, Dover, DE 19904, USA (“STOQ” app), as our processor.
• Function: STOQ displays pre-order and notification options on product pages and, in the case of a pre-order, stores the pre-order data with the order. Confirmations and shipping information for pre-orders are sent by Klaviyo on our behalf (Section 12).
• Back-in-stock alert: You provide your email address or mobile number; depending on the product, sign-up takes place via STOQ or directly via Klaviyo, and the messages are sent by Klaviyo (Section 12).
• Data: email address or mobile number, product and variant, market and cart ID; when the page loads, STOQ servers receive your IP address and browser information.
• Legal basis: pre-order: Art. 6(1)(b) GDPR. Back-in-stock alert: your consent (Art. 6(1)(a) GDPR). Loading of the STOQ functions and entries in session storage: Art. 6(1)(f) GDPR, our interest being to offer pre-orders and back-in-stock alerts.
• Statistics: With your consent (Statistics category), STOQ analyses the use of the functions (session, cart and checkout ID, page, product, country); the data are held at ClickHouse Cloud on Amazon Web Services servers in the USA (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR). Irrespective of this, when loading, STOQ creates the entries _stoq_pls (all pages) and _stoq_sqe (product pages) in your browser’s session storage, even without your consent; your browser deletes them when the tab is closed.
• Third country: USA and Canada, on the basis of standard contractual clauses (STOQ privacy policy).
• Storage period: pre-order data with the order; notification requests until unsubscription; statistics data as long as our shop is connected to STOQ. If we disconnect, STOQ deletes all personal data within 48 hours.

Add-on product offers (Selleasy)

• Provider: Logbase Technologies LLP (“Selleasy” app), as our processor. Under its data processing agreement, Logbase does not use the data for its own purposes (Logbase data processing agreement).
• Function and data: Selleasy displays suitable add-ons in the cart and on product pages and tags orders that result from them. Cart contents, offers clicked and order data are processed, and when the offers are loaded your IP address and browser information.
• Integration: Selleasy loads regardless of your choice in the cookie banner. When loading, it creates the entries lb-upsell-setup and lb-upsell-setupFetchedAt in your browser’s local storage. If it shows you offers, it remembers this in session storage (lb-offer-viewed), and after a click on an offer in local storage (lb-offer-clicked, lb-track-ids, lb-offer-codes). The script reports offers displayed and clicked to Logbase via our shop (performance tracking).
• Legal basis: Art. 6(1)(f) GDPR; our interest is to offer you suitable add-ons and to measure whether they lead to purchases.
• Third country: Logbase processes and stores the data predominantly in data centres in the USA, among others at Amazon Web Services, and may also process them in other countries. The basis is the standard contractual clauses (Module 2), which form part of Logbase’s data processing agreement (Art. 46(2)(c) GDPR).
• Storage period: According to its own information, Logbase does not store contact details, addresses or order information of our customers, and of orders only an aggregated number for billing; Logbase keeps usage and technical data for a limited period in accordance with its privacy policy. If we stop using the service, Logbase deletes the data as soon as Shopify sends the deletion request 48 hours after uninstallation; residual data in backups are deleted or overwritten within 30 days (Logbase privacy policy).

Wishlist

If you click on the heart, we save the product in your wishlist in your browser’s local storage (kbs_favs_v1: product ID and time). If you are signed in, we synchronise the list with your customer account: for this purpose Shopify sends your customer number and the product IDs to our server service at Cloudflare (Section 21), which stores the list in your account. The legal basis is Art. 6(1)(b) GDPR (the function you requested), and for the storage in the browser § 25 Abs. 2 Nr. 2 TDDDG. The wishlist remains stored until you remove products, clear the browser storage or have your account deleted.

Discount display

If you open a discount code via a link or from an email, or if a promotion is running, we display the discounted prices in the shop. For this purpose your browser queries our server service at Cloudflare (Section 21) as to which products and conditions the code applies to, and adds it to your cart. The code and, for technical reasons, your IP address are transmitted; personal codes from emails can be attributed to you. Our server service does not store the queries. Shopify stores the code in the cookie discount_code; if you close the discount notice, we remember this in local storage (kbs-dd-closed); so that the page reloads only once after the code has been applied, we set an entry in session storage (kbs-dd-reload:…); and we remember the conditions of the code in session storage until the tab is closed (kbs-dd:…). The legal basis is Art. 6(1)(b) GDPR (application of the discount) and Art. 6(1)(f) GDPR with the interest of correctly displaying valid discounts; for the entries in the browser § 25 Abs. 2 Nr. 2 TDDDG.

15. Analytics

For each of the following services we state whether it only runs with your consent to the categories that Section 6 specifies for it, or also without it. Where a service runs with your consent, the legal basis is § 25 Abs. 1 TDDDG and Art. 6(1)(a) GDPR; how to withdraw consent is explained in Section 6.

Shopify analytics

Only with your consent (Statistics category) does Shopify (Section 4) record which pages you visit, what you search for, which products you view and add to the cart and which product recommendations you click. For this purpose Shopify uses an identifier in the cookie _shopify_analytics (1 year) as well as device, browser and approximate location. If you have also consented to the Marketing category, Shopify sets the cookie _shopify_marketing (1 year) for marketing purposes such as attributing purchases to advertising measures. We use the aggregated reports to improve our product range, navigation and recommendations. Shopify stores event data with a visitor identifier for the duration of our use of Shopify; Shopify does not specify a shorter fixed period. After the end of the contract, Shopify deletes or anonymises them. Aggregated reports without personal reference remain until our account is closed.

Google Analytics

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor.
• Purpose and data: We measure how visitors use the shop: page views, search terms, product and cart events, checkout steps and purchases with order value and products, plus an identifier in the cookies _ga and _ga_* (up to 2 years), device, browser and approximate location. According to its own information, Google uses your IP address only to determine location and does not store it for users from the EU.
• Consent: Google Analytics loads on all pages when the page is accessed, initially with the setting “denied” (Google Consent Mode). Without your consent it does not set or read any cookies, but sends cookieless signals about page views and events to Google; the legal basis for this is Art. 6(1)(f) GDPR, our interest being to measure the use of the shop. With your consent (Statistics category), Google Analytics sets the cookies mentioned.
• Access to the reports: Apart from us, read access to our reports in Google Analytics is currently also held by Kelkoo SAS (Section 17), Compare Group (Netherlands), a price comparison service with which we previously worked, and a service account for automated analyses. The reports show usage data without names or contact details.
• Third country: USA (Google LLC; DPF, standard contractual clauses).
• Storage period: user and event data in accordance with the retention period set in our account, no more than 14 months (Google privacy policy).

Microsoft Clarity

• Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. According to its own information, Microsoft acts as controller for Clarity (Clarity FAQ).
• Purpose: We see how visitors use our pages and thus find errors and obstacles. For this purpose, Clarity records individual visits (mouse movements, clicks, scrolling, page rendering) and creates heatmaps.
• Data: interactions, device, browser, approximate location derived from the IP address and attributes set by us: market, language, page type, source channel from campaign parameters, cart events and errors; at checkout, once you have entered it, your email address as a check value (hash). Clarity does not record entries in form fields. We do not release the data for advertising (Microsoft Advertising). Cookies: _clck (12 months) and _clsk (1 day).
• Consent: Clarity loads on all pages when the page is accessed and records your visit even without your consent, and via Clarity’s Shopify app also at checkout. Without your consent (Statistics category), Clarity does not set any cookies. The legal basis for the recording is Art. 6(1)(f) GDPR; our interest is to find errors and obstacles in the shop. Your consent applies to the cookies (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR).
• Third country: USA. Microsoft Ireland transfers data on the basis of standard contractual clauses to Microsoft Corporation, which is certified under the DPF.
• Storage period: recordings 30 days, heatmaps and flagged recordings 9 months (Microsoft privacy statement).

Triple Whale

• Provider: Triple Whale Inc., 266 N 5th Street, Columbus, OH 43215, USA, as our processor.
• Purpose: We measure which advertising channels lead to orders.
• Script: The Triple Whale script loads on all pages regardless of your choice in the cookie banner. On every page view it creates in your browser’s local storage a counter of your page views (TriplePixel) and a list of the pages accessed with address, referring page, time and a random identifier (TriplePixelU), and loads further program code from Triple Whale servers (config-security.com), which receive your IP address and browser information in the process. The legal basis is Art. 6(1)(f) GDPR; our interest is to measure the cost-effectiveness of our advertising. This program code only sends further data once Shopify reports your consent to it (next point).
• With consent: Only with your consent (for the pixel, to the Statistics and Marketing categories) do the Triple Whale pixel and script transmit page paths, referring page, times, device and cookie identifiers, including from cookies of other services such as Meta and Klaviyo, as well as checkout events including email address and phone number. The script then also writes an identifier (__ref_id) to your cart, which we receive with the order.
• Order data: Independently of the banner, Triple Whale receives order data (order value, products, source channel) and the customer data of the order (name, email address, phone number, address) via the connection to Shopify in order to attribute revenue to advertising channels and returning customers. The legal basis is Art. 6(1)(f) GDPR; our interest is to measure the cost-effectiveness of our advertising.
• Advertising platforms: Triple Whale does not pass these data on to advertising platforms.
• Third country: USA, also Israel (adequacy decision) and sub-processors in Ukraine and Australia. The basis is the standard contractual clauses agreed with Triple Whale; according to its own information, Triple Whale is additionally certified under the DPF.
• Storage period: order and event data for the duration of our contract with Triple Whale; after the end of the contract, Triple Whale deletes them within 60 days. Entries in local storage remain until you delete them in your browser (Triple Whale privacy policy).

16. Advertising and performance measurement

Meta only runs with your consent to the Statistics and Marketing categories, and Google Ads only sets advertising cookies with your consent to the Marketing category; without consent the Google tag sends cookieless signals (below). The legal basis for processing with consent is § 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR; how to withdraw consent is explained in Section 6.

Meta (Facebook and Instagram)

• Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
• Purpose: We show you advertising for our products on Facebook and Instagram, including for products you have viewed with us (catalogue advertising), and measure the success of our ads.
• Data: events such as page view, product view, add to cart, checkout and purchase with product identifiers and values; identifiers in the cookies _fbp and _fbc (90 days); IP address and browser information; at checkout and purchase also contact details converted into check values (hashes), such as email address, phone number, name and town, with which Meta can recognise your account. Shopify additionally transmits these events directly from server to server to Meta (Conversions API); in Shopify, the Meta integration is assigned, like the pixel, to the Statistics and Marketing categories.
• Joint controllership: Meta and we are joint controllers for the collection of these data on our website and their transmission to Meta (Art. 26 GDPR); Meta is solely responsible for the further processing, such as ad delivery and profiling. The essence of our arrangement (Controller Addendum): we obtain your consent and inform you about the joint processing; Meta informs you about its further processing and fulfils the data subject rights in that respect. You can exercise your rights with us and with Meta (Art. 26(3) GDPR); we forward requests concerning Meta to Meta.
• Third country: We transfer data to Meta Platforms Ireland. Meta transfers the data under its own responsibility to Meta Platforms, Inc. in the USA, which is certified under the DPF.
• Storage period: cookies up to 90 days; at Meta in accordance with its policies (Meta Privacy Policy, ad preferences).

Google Ads and Google Merchant Center

• Provider: Google Ireland Limited (Section 15), independent controller for conversion measurement and remarketing.
• Purpose: We measure whether ads and free product listings on Google lead to purchases, and may show ads to visitors to our shop (remarketing).
• Consent: The Google tag loads on all pages (Section 15). Without your consent it does not set any advertising cookies, but sends cookieless signals about events such as the purchase to Google (Google Consent Mode); the legal basis for this is Art. 6(1)(f) GDPR, our interest being to measure the success of our ads. Advertising cookies and remarketing only with your consent (Marketing category).
• Data: events such as page view, product view, search, add to cart, checkout started, payment method selected and purchase with order value, the click identifier gclid, identifiers in cookies such as _gcl_au (90 days), IP address and browser information. We do not transmit hashed customer data (enhanced conversions).
• Third country: USA (Google LLC; DPF, standard contractual clauses).
• Storage period: cookies up to 90 days; at Google in accordance with its policies (Google privacy policy, ad settings).

17. Price comparison sites

We list our offers on price comparison sites. If you come from there and make a purchase, the sites measure this in order to bill for their services and to check clicks. The measurement of visits and purchases only takes place with your consent to the Statistics and Marketing categories (§ 25 Abs. 1 TDDDG, Art. 6(1)(a) GDPR); how to withdraw consent is explained in Section 6. Without consent, only Heureka’s entry script and the badges in the footer load (below). The sites are based in the EU.

• Kelkoo: Kelkoo SAS, 64/66 rue des Archives, 75003 Paris, France. According to its own information, Kelkoo processes the data from sales tracking under its own responsibility. In our assessment, we and Kelkoo are joint controllers for the collection of the data on our website and their transmission to Kelkoo (Art. 26 GDPR); Kelkoo is solely responsible for the further processing. You can exercise your rights with us and with Kelkoo (dpo@kelkoogroup.com). The Kelkoo script records your visit on all pages (cookie kk_leadtag and further kk_ cookies and kelkooId, each 12 months; IP address, time, page, browser), and on purchase the order number, order value and products. According to its own information, Kelkoo alternatively also uses your browser’s local storage and session storage as well as cookies on kelkoogroup.net. Kelkoo stores the data in the EU (Netherlands), according to its own information without a fixed deletion period (Kelkoo privacy policy).
• idealo: idealo internet GmbH, Ritterstraße 11, 10969 Berlin. On purchase, our shop transmits order number, order value, currency and products to idealo.
• billiger.de: solute GmbH, Zeppelinstraße 15, 76185 Karlsruhe. If you come from billiger.de, we store the click identifier soluteclid with the landing page in local storage (30 days), report the landing page to solute and, on purchase, transmit order number, order value and landing page to solute. According to solute, reporting the landing page serves error analysis and the verification of clicks.
• Heureka (Czech Republic): Heureka Group a.s., Karolinská 706/3, 186 00 Praha 8 – Karlín, Czech Republic. If you come from Heureka, our shop loads Heureka’s entry script regardless of your choice in the cookie banner; it sets the cookie hg_ocm_id (30 days), and Heureka receives your IP address and browser information in the process (Art. 6(1)(f) GDPR; our interest is to correctly attribute clicks from Heureka). For purchases in Czech koruna, we transmit order number, products, prices, shipping costs and total with your consent. Heureka and we are joint controllers for this conversion measurement (Art. 26 GDPR); Heureka has concluded an arrangement with its partner shops for this purpose, the essence of which Heureka will provide on request. Heureka also obtains its own consent to conversion measurement in the consent settings of its portal. Heureka provides information about its processing (Heureka privacy notice), processes the data for 12 months from your consent and is the first point of contact for your rights; you may, however, also contact us.
• Badges in the footer: Your browser loads the idealo and billiger.de badges from servers of idealo internet GmbH and solute GmbH respectively, regardless of your choice in the cookie banner; these receive your IP address, browser information and the page accessed in the process. The legal basis is Art. 6(1)(f) GDPR; our interest is to show our awards on the sites. We serve the Geizhals logo ourselves. Only when you click on a badge or logo are you taken to the site.

18. Affiliate programme

Affiliates, such as content creators, recommend our shop and receive a commission for referred purchases. We manage the programme with the UpPromote app.

• Provider: UPPROMOTE TECHNOLOGY JOINT STOCK COMPANY, Regus Hanoi UDIC N04, Floor 2, UDIC Complex, Hoang Dao Thuy Street, Yen Hoa Ward, Hanoi, Vietnam. According to its terms of use, UpPromote processes our shop’s customer data as a processor.
• Tracking: UpPromote’s script and pixel load regardless of your choice in the cookie banner. If you arrive via an affiliate link, UpPromote stores an affiliate ID in cookies (up to 360 days) and in local storage and transmits page views, browser identifier (user agent) and cart ID. UpPromote receives events from checkout and purchase, including your contact details, for every order so that a purchase can, where applicable, be attributed to an affiliate. If you use an affiliate’s discount code, we attribute the purchase via the code. The legal basis is Art. 6(1)(f) GDPR; our interest is to attribute purchases to the referring affiliates and to settle commissions correctly.
• Affiliates’ Meta pixels: If an affiliate has stored its own Meta pixel in UpPromote, our shop loads this pixel, likewise regardless of your choice in the cookie banner, and transmits your page views and cart views with IP address and browser information to Meta Platforms Ireland Limited. Meta and the affiliate process these data under their own responsibility; Meta transfers them to the USA (DPF). The legal basis is Art. 6(1)(f) GDPR; our interest is to enable our affiliates to measure their recommendations.
• Data: affiliate ID, page views, order number, order value, discount code and customer data from the order (name, email address, phone number, address).
• Affiliates: If you become an affiliate, we process your contact and payout details, your channels and the revenue referred, in order to run the programme (Art. 6(1)(b) GDPR). Your name and your company are stored in cookies in the browser of visitors who arrive via your link.
• Third country: Vietnam (registered office) and USA (servers at DigitalOcean). There is no adequacy decision for Vietnam, and UpPromote is not certified under the EU-US Data Privacy Framework. No standard contractual clauses or other safeguards under Art. 46 GDPR are in place with UpPromote.
• Storage period: attributions for the duration of the programme, as billing records 8 years. After the end of our contract, UpPromote deletes the data within 30 days, and backups after a further 60 days (UpPromote privacy policy).

19. Embedded content

YouTube videos

On some product pages we show videos from YouTube. Initially you only see a preview image, and no data are sent to YouTube. Only when you click on the video does your browser load it from youtube.com.

• Provider: Google Ireland Limited (Section 15); Google is the independent controller for the processing on YouTube.
• Data: IP address, browser and device information, page accessed and playback data; YouTube may store or read information on your device in the process.
• Legal basis: Art. 6(1)(f) GDPR; our interest is to show you the video that you retrieve with your click. If you do not want YouTube to receive data, do not click on the video.
• Third country and storage period: USA (Google LLC, DPF); storage in accordance with Google’s policies (Google privacy policy).

We describe other third-party content elsewhere: reviews from Judge.me and Trusted Shops in Section 13, Alma’s instalment preview and express checkout buttons in Section 9.

20. Social media

• Links: In the footer we link to our Instagram profile. This is a simple link; data are only sent to Meta when you click on it.
• Our pages on Instagram and Facebook: If you visit our pages, Meta Platforms Ireland Limited (Section 16) processes your data under its own responsibility, for example via cookies on its platforms. Meta provides us with aggregated statistics on the use of our pages (Page Insights); Meta and we are joint controllers for this (Art. 26 GDPR). The essence of the arrangement (Page Insights Controller Addendum): Meta assumes primary responsibility for this processing, provides information about it and fulfils the data subject rights; we only receive aggregated data without reference to individual persons. You can contact us or Meta.
• Messages and comments that you write to us there are processed by us in order to reply (Art. 6(1)(b) or (f) GDPR).
• Legal basis: Art. 6(1)(f) GDPR; our interest is to present our products on social networks and to communicate with interested parties.
• Third country and storage period: Meta transfers data under its own responsibility to the USA (DPF) and stores Page Insights in accordance with its own periods; we store messages in the same way as emails (Section 10).

21. Other service providers and recipients

Cloudflare (our own server functions)

• Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as our processor.
• Function and data: Cloudflare runs server functions that we have developed ourselves: the AI chat with conversation log (Section 11), the checking and forwarding of missing parts requests (Section 10) and the discount display and wishlist (Section 14). The content of the respective request and, for technical reasons, your IP address are processed.
• Third country: Cloudflare processes data in a global network, including in the USA (DPF, standard contractual clauses; Cloudflare privacy policy).
• Storage period: see the respective sections; error logs no more than 7 days.

Make (automation)

• Provider: Celonis, Inc., One World Trade Center, 87th Floor, New York, NY 10007, USA (“Make” service), as our processor.
• Function and data: Make processes missing parts requests and withdrawals from our forms as well as handovers from the AI chat, and sends the related emails via our Gmail account (below). All form data including uploaded files, the order data required to check a missing parts request and the information in a handover from the AI chat (Section 11) are processed.
• Third country: Make stores the data in its EU data zone. The contracting party is Celonis, Inc. in the USA. Support is provided mainly by staff of Celonis s.r.o. in the Czech Republic; other Celonis group companies, among others in the USA, the United Kingdom, Switzerland, Canada, Japan, India and Kosovo, may also have access. The basis for the transfer to Celonis, Inc. is the DPF, alternatively standard contractual clauses; Celonis is liable for its group companies and sub-processors and must impose the same data protection obligations on them (Make privacy notice).
• Storage period: Make also stores the processed content, including uploaded files, in the execution logs of our account. Make keeps these for the period configured in our account and then deletes them automatically; after the end of our contract, Make deletes all data within 30 days.

Google Gmail (sending emails from forms and the AI chat)

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• Function and data: Via our Gmail account kbs.shop2005@gmail.com, Make sends missing parts requests to our customer service mailbox and to our supplier in China, acknowledgements of receipt of withdrawals to you and a copy of them to us, as well as handovers from the AI chat to our team. The account therefore holds all information of these operations, in the case of missing parts requests including your files (Sections 10 and 11).
• Role: This is a Gmail account for private users. Google does not offer a data processing agreement for it; Google processes the emails under its own responsibility in accordance with its terms of service and its privacy policy (Google privacy policy).
• Legal basis: that of the respective operation (Sections 10 and 11); for the use of Gmail as a sending and receiving account additionally Art. 6(1)(f) GDPR, our interest being simple and reliable sending of emails from our forms.
• Third country: Google also processes the data in the USA (Google LLC; DPF).
• Storage period: as for emails (Section 10).

IONOS (email and web space)

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, operates our email mailboxes (e.g. shop@ and jobs@kbs-shop.com) as our processor and stores data from our former shop system insofar as we still have to retain them. We ourselves do not transfer data to third countries in this context; according to its own information, IONOS only uses service providers outside the EU with appropriate safeguards (IONOS privacy policy). Storage period: see Section 10 and the statutory periods in Section 3.

Tax advice

For bookkeeping, annual financial statements and tax returns, we transmit invoices, payment vouchers and payment statements with names, addresses and amounts to Czech & Schütte Steuerberater Partnerschaft mbB, Robert-Bosch-Straße 22a, 65582 Diez. The firm is an independent controller and bound by professional secrecy. The legal basis is Art. 6(1)(c) GDPR in conjunction with our bookkeeping and filing obligations under tax and commercial law. The firm retains the documents in accordance with the statutory periods.

AI assistance for internal analyses

For analyses of order, campaign and shop data, for bookkeeping and to prepare replies to customers, we use the AI assistant Claude from the company Anthropic; order and contact data may be processed in the process. The legal basis is that of the respective purpose, for example Art. 6(1)(b) GDPR for handling your order or enquiry and Art. 6(1)(c) GDPR for bookkeeping; for analyses Art. 6(1)(f) GDPR, our interest being to improve our product range, advertising and processes. Anthropic processes the data in the USA (Anthropic privacy notice).

Warehouse, shipping and payment

We describe our warehouse service provider Fulfillment Europe as well as DHL and UPS in Section 8, and the payment providers in Section 9.

Customer service team

Your enquiries and orders are handled by our customer service team.

22. Your rights

Write to us informally at shop@kbs-shop.com or by post to the address in Section 1.

• Access (Art. 15 GDPR): whether and which data we process about you, for what purpose, to whom we disclose them and how long we store them, and a copy, insofar as the rights of other persons do not preclude this. The first copy is free of charge.
• Rectification (Art. 16 GDPR) of inaccurate data and completion of incomplete data.
• Erasure (Art. 17 GDPR), for example if we no longer need data or you withdraw a consent. If we have to retain data by law or need them for legal claims, we restrict the processing instead.
• Restriction (Art. 18 GDPR): we then only store data, for example while we check whether they are accurate or whether your objection is justified.
• Data portability (Art. 20 GDPR): data that you have provided to us and that we process by automated means on the basis of your consent or a contract will be provided to you in a commonly used, machine-readable format; on request, we transmit them directly to another controller, where technically feasible.
• Objection (Art. 21 GDPR): see Section 2.
• Withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future: for cookies as described in Section 6, for emails via the unsubscribe link, otherwise by message to us. Processing carried out until the withdrawal remains lawful.
• Automated decisions (Art. 22 GDPR): your rights in the case of an automatic block by Shopify Payments and vis-à-vis Klarna, Alma and PayPal are set out in Section 9.

How we handle your request: We respond within one month; in the case of complex or numerous requests, the period may be extended by two months, in which case we will inform you and give reasons. Handling is free of charge, except in the case of manifestly unfounded or excessive requests. If we have reasonable doubts about your identity, we will ask for information that allows us to identify you, such as an order number. In the case of joint controllership (Meta, Kelkoo, Heureka, Trusted Shops), you can contact any of the parties involved.

23. Right to lodge a complaint

You can lodge a complaint with any data protection supervisory authority, in particular in the EU or EEA member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR). A list of supervisory authorities is published by the European Data Protection Board. The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz (postal address: PO Box 30 40, 55020 Mainz), Germany, phone +49 6131 8920-0, email poststelle@datenschutz.rlp.de, www.datenschutz.rlp.de

If you live in Switzerland, you can contact the Federal Data Protection and Information Commissioner (www.edoeb.admin.ch), and in the United Kingdom the Information Commissioner's Office (ico.org.uk). If you live in the United Kingdom, you may also address your complaint to us first (shop@kbs-shop.com); we will acknowledge receipt within 30 days and inform you of the outcome.

24. Obligation to provide data

You are not legally obliged to provide us with data. For some services, however, we need certain information:

• Order: name, delivery and billing address, email address and payment details are required for the contract; without them we cannot accept the order. The phone number is optional unless the checkout requests it as a mandatory field.
• Withdrawal form: name and email address for the acknowledgement of receipt are mandatory fields; the order number helps us to match the withdrawal. Without name and email address you cannot use the form, but you can withdraw by email or letter.
• Missing parts form: order number and email address for verification, details of the part, and name, email address, delivery address and phone number for shipping. Without them we cannot process the request via the form; you can write to us instead.
• B2B form: name, company, country, email address, phone number and request are mandatory; without them you can write to us by email instead.
• Contact and applications: without a means of contact we cannot reply, and without application documents we cannot consider you.
• Optional are signing in to the customer account, the newsletter, the chat, reviews, notifications and all consents. If you choose not to use them, you will suffer no disadvantages other than not being able to use the respective function.

25. Changes to this notice

We adapt this notice when our processing operations or the legal situation change. We will actively inform you of material changes, such as new purposes, new recipients or transfers to further third countries, before they take effect: by email to customers with a customer account and to newsletter subscribers, and by means of a notice on our website. Earlier versions are available on request.

Last updated: October 2026 (Version 2.0)