Privacy policy

1) Introduction and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data means all data that can be used to identify you personally.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Olaf Oberbremer, Mindener Str. 172, 32049 Herford, Deutschland, Tel.: 00491719518512, E-Mail: info@empathy-squad.com. The controller responsible for processing personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.

2) Data collection when you visit our website

2.1 When you use our website for information purposes only, that is, if you do not register or otherwise provide us with information, we collect only the data that your browser transmits to the website's server (so-called “server log files”). When you access our website, we collect the following data, which we require for technical reasons to display the website to you:

• The page of our website visited
• Date and time of access
• Amount of data sent in bytes
• Source/referral from which you reached the page
• Browser used
• Operating system used
• IP address used (where applicable, in anonymised form)

Processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. Technical processing is carried out in particular by our hosting provider, as explained in section 3. However, we reserve the right to review the server log files retrospectively if there are specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string “https://” and the padlock symbol in your browser's address bar.

3) Shopify: hosting and shop operation

Our shop uses Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Irland. Shopify processes, in particular, technical access data and contact, account, order and transaction data on our behalf to provide the website, shopping cart, checkout and order management. The legal bases are Art. 6(1)(b) GDPR for entering into and performing contracts and Art. 6(1)(f) GDPR for secure and reliable website operation.

Shopify generally processes these data as a processor. The data processing agreement forms part of Shopify's contractual terms. The hosting location shown for our shop is the European Union. Nevertheless, Shopify group companies and subprocessors may also process data outside the European Economic Area, particularly in Canada and the USA. Depending on the recipient, transfers are based on adequacy decisions, Binding Corporate Rules or EU Standard Contractual Clauses. Further information and the applicable safeguards: Shopify Data Processing Agreement.

For Shop Pay, Shop and additional Shopify services, Shopify may itself act as a controller under data protection law. The additional services are explained in section 9.

4) Cookies

To make visiting our website appealing and enable the use of certain functions, we use cookies, which are small text files stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your device for longer and allow website settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage period in the overview of cookie settings in your web browser.

Where individual cookies used by us also involve the processing of personal data, processing takes place pursuant to Art. 6(1)(b) GDPR to perform the contract, pursuant to Art. 6(1)(a) GDPR where consent has been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and in making visits to the website user-friendly and effective.

You can configure your browser to inform you when cookies are set and allow you to decide individually whether to accept them, or to refuse cookies in specific cases or altogether.

Please note that the functionality of our website may be restricted if you do not accept cookies.

The storage of information on your device or access to information on it is also governed by § 25 TDDDG: strictly necessary functions, such as the shopping cart, login and storage of your privacy choices, are based on § 25(2) No. 2 TDDDG. Your consent under § 25(1) TDDDG is required for non-essential analytics or marketing technologies; the associated processing of personal data is based on Art. 6(1)(a) GDPR. You can change your choices or withdraw consent with effect for the future using “Cookie settings” in the shop's footer.

5) Contacting us

When you contact us (e.g. via a contact form or email), personal data are processed exclusively for the purpose of handling and responding to your enquiry and only to the extent necessary for that purpose.

The legal basis for processing these data is our legitimate interest in responding to your enquiry pursuant to Art. 6(1)(f) GDPR. If you contact us with a view to entering into a contract, Art. 6(1)(b) GDPR provides an additional legal basis for processing. Your data will be deleted when the circumstances indicate that the matter in question has been conclusively resolved, provided that no statutory retention obligations prevent deletion.

6) Data processing when opening a customer account

Pursuant to Art. 6(1)(b) GDPR, personal data are also collected and processed to the extent necessary when you provide them to us when opening a customer account. The information required to open an account is shown in the input fields of the relevant form on our website.

You can delete your customer account at any time by sending a message to the controller's address given above. After your customer account has been deleted, your data will be deleted, provided that all contracts entered into through it have been fully performed, no statutory retention periods prevent deletion and we no longer have a legitimate interest in continued storage.

7) Use of customer data for direct marketing

Subscribing to our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only information required to send the newsletter is your email address. Providing further data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for newsletter subscriptions. This ensures that you receive newsletters only after you have expressly confirmed your consent to receiving the newsletter by clicking a verification link sent to the email address provided.

By activating the confirmation link, you give us your consent to use your personal data pursuant to Art. 6(1)(a) GDPR. We store the IP address recorded by your Internet Service Provider (ISP), together with the date and time of registration, so that any misuse of your email address can be traced at a later date. The data we collect when you subscribe to the newsletter are used strictly for the specified purpose.

You can unsubscribe from the newsletter at any time using the link provided in the newsletter or by sending a corresponding message to the controller named at the beginning of this policy. After you unsubscribe, your email address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to use your data further where permitted by law and inform you of this in this policy.

We use Shopify to manage our newsletter subscriptions and send marketing emails. This includes your email address, your consent and evidence of that consent and, where applicable, the association with your customer account. We send reminders about an incomplete checkout only to people who have given the relevant marketing consent. The legal basis is Art. 6(1)(a) GDPR. You can withdraw this consent at any time using the unsubscribe link or by sending us a message. We may retain necessary evidence of consent or unsubscribing separately to fulfil our accountability obligations and defend legal claims (Art. 6(1)(c) or (f) GDPR). The information about Shopify in section 3 applies accordingly.

8) Data processing for order fulfilment

8.1 Where necessary to perform the contract for delivery and payment purposes, the personal data collected by us are passed on to the commissioned transport company and the commissioned bank pursuant to Art. 6(1)(b) GDPR.

If, under a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided when ordering in order to inform you personally as part of our statutory information obligations pursuant to Art. 6(1)(c) GDPR. Your contact details are used strictly for notifications about updates owed by us and are processed by us for this purpose only to the extent necessary for the relevant notification.

We also work with the service providers listed below to process your order. They support us in performing concluded contracts, either wholly or in part. Certain personal data are transmitted to these service providers in accordance with the following information.

8.2 Printegy: production and shipping

We use Printegy GmbH, Herkulesstr. 9–11, 45127 Essen, Deutschland to produce and deliver the products you order. For this purpose, we transmit the necessary order and product data, your name and delivery address and any contact details necessary for shipping. Processing serves to perform your purchase contract pursuant to Art. 6(1)(b) GDPR. Printegy and the commissioned shipping service providers receive the data required for their respective services. Further information: Printegy privacy information.

8.3 Use of payment service providers (payment services)

- Paypal

One or more online payment methods from the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxemburg

If you select a payment method offered by the provider for which you pay in advance, the payment data you provide during the ordering process (including your name, address, bank and payment card information, currency and transaction number), together with information about the contents of your order, are passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data are transmitted exclusively for the purpose of processing payment with the provider and only to the extent necessary for that purpose.

If you select a payment method for which we perform our obligations before receiving payment, you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, postcode, town/city, date of birth, email address, telephone number and, where applicable, information about an alternative payment method).

In such cases, to safeguard our legitimate interest in establishing your ability to pay, we forward these data to the provider for a credit check pursuant to Art. 6(1)(f) GDPR. Based on the personal data you provide and further data (such as your shopping cart, invoice amount, order history and payment experience), the provider checks whether the payment option you have selected can be offered in view of the risk of payment and/or debt default.

The credit report may contain probability values (so-called scores). Where scores are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Address data, among other things but not exclusively, are used in calculating the scores.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may remain entitled to process your personal data where this is necessary to process payment in accordance with the contract.
- Paypal Checkout

This website uses PayPal Checkout, an online payment system provided by PayPal that combines PayPal's own payment methods with local payment methods from third-party providers.

When you pay via PayPal, credit card via PayPal, direct debit via PayPal or, if offered, “Pay Later” via PayPal, we pass your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxemburg (hereinafter “PayPal”) as part of payment processing. Data are passed on pursuant to Art. 6(1)(b) GDPR and only to the extent necessary for payment processing.

For the payment methods credit card via PayPal, direct debit via PayPal or, if offered, “Pay Later” via PayPal, PayPal reserves the right to obtain a credit report. For this purpose, your payment data may be passed on to credit reference agencies pursuant to Art. 6(1)(f) GDPR on the basis of PayPal's legitimate interest in establishing your ability to pay. PayPal uses the result of the credit check concerning the statistical probability of payment default to decide whether to provide the relevant payment method. The credit report may contain probability values (so-called scores). Where scores are included in the result of the credit report, they are based on a scientifically recognised mathematical-statistical procedure. Address data, among other things but not exclusively, are used in calculating the scores. You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may remain entitled to process your personal data where this is necessary to process payment in accordance with the contract.

If the PayPal “purchase on account” payment method is available and selected, your payment data are first transmitted to PayPal to prepare the payment. PayPal then forwards them to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin (“Ratepay”) to process the payment. In each case, the legal basis is Art. 6(1)(b) GDPR. In this case, RatePay carries out an identity and credit check in its own name to establish your ability to pay in accordance with the principle described above, and passes your payment data to credit reference agencies pursuant to Art. 6(1)(f) GDPR on the basis of its legitimate interest in establishing your ability to pay. A list of the credit reference agencies that Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/

If you use a payment method offered by a local third-party provider, your payment data are first passed on to PayPal to prepare the payment pursuant to Art. 6(1)(b) GDPR. Depending on the available local payment method you select, PayPal then transmits your payment data to the relevant provider to process the payment pursuant to Art. 6(1)(b) GDPR:

- Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Irland)
- Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Irland)
- iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Niederlande)
- bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brüssel, Belgien)
- blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warschau, Polen)
- eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2
1200 Wien, Österreich)
- MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, Frankreich)
- Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Polen)

For further information about data protection, please refer to PayPal's privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
- Shopify Payments

One or more online payment methods from the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Irland

If you select a payment method offered by the provider for which you pay in advance (such as payment by credit card), the payment data you provide during the ordering process (including your name, address, bank and payment card information, currency and transaction number), together with information about the contents of your order, are passed on to the provider pursuant to Art. 6(1)(b) GDPR. In this case, your data are transmitted exclusively for the purpose of processing payment with the provider and only to the extent necessary for that purpose.

8.4 Order Printer Pro: invoices and order documents

We use Order Printer Pro from Shop Circle Ltd, One Kingdom Street, Paddington Central, London W2 6BD, Vereinigtes Königreich to create and provide invoices and other order documents. The customer, billing, delivery, order and transaction data required for this purpose are processed. The legal bases are Art. 6(1)(b) GDPR for performing contracts and Art. 6(1)(c) GDPR for statutory documentation obligations. Technical access data may be generated when documents are retrieved. Transfers to the provider in the United Kingdom are covered by an adequacy decision of the European Commission pursuant to Art. 45 GDPR. The provider and its service providers may also process data in other countries outside the EEA. Information about recipients, international transfers, safeguards and retention periods can be found in the Shop Circle privacy policy and in the Data Processing Addendum.

8.5 Revoq: electronic withdrawal

Our electronic withdrawal function is provided by Revoq from Jonas Busch (sole trader), Deutschland. Contact: contact@revoq.buschbytes.com. If you use this function, your name, email address, contract or order number, timestamps and processing status are processed in order to receive, confirm and handle your withdrawal. The legal bases are Art. 6(1)(c) GDPR in conjunction with § 356a BGB and Art. 6(1)(b) GDPR for reversing the transaction.

Revoq processes these data on our behalf. Under the free plan we use, the provider generally deletes withdrawal data after 90 days. This does not affect our necessary retention of business records and evidence. The primary infrastructure is located in the EU; possible transfers to third countries by subprocessors and the associated safeguards are described in the Data Processing Agreement. Further information: Revoq privacy information.

9) Additional Shopify services and social networks

Shopify Network Intelligence is enabled in our shop. Shopify may combine data about your interaction with our shop with data from other Shopify services and interactions with merchants to improve services, personalisation, analytics and advertising. This may involve contact, device, usage and transaction data. Shopify itself acts as controller for this additional processing. Where consent is required, it is a prerequisite for the relevant processing; this applies in particular to non-essential analytics and marketing technologies. You can withdraw your consent using our cookie settings.

Shopify explains its respective legal bases, recipients, retention periods and data protection rights in its Consumer Privacy Policy. You can also exercise your rights in relation to Shopify and adjust personalised advertising settings through the privacy portal linked there.

Our links to Instagram and Facebook lead to services provided by Meta. Their own privacy notices apply only when you open these external services. The links are not embedded social media plugins.

Meta-Pixel and Conversions API

If you consent to processing for marketing and analytics, we use the Meta-Pixel with advanced matching and the Conversions API through the Shopify “Facebook & Instagram” channel. The recipient is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland. These methods are used to measure and improve the performance of our advertising, assign target audiences and display relevant advertising on Facebook and Instagram.

For this purpose, page and product views, searches, changes to the shopping cart, the start of checkout, payment information events and completed purchases, together with information about items, value and currency, may be transmitted to Meta. Available names, email addresses, telephone numbers, postal addresses or locations and technical identifiers may also be transmitted to Meta. Contact details used for advanced matching are used in hashed form to match them to Meta accounts; hashing does not make them anonymous. The Conversions API transmits purchase events in particular between Shopify and Meta servers.

Further information about Meta's processing, international transfers, retention information and your rights can be found in Meta's privacy information. Information about responsibility for Business Tools is provided in Meta's Controller Addendum.

You can change or withdraw your marketing consent at any time with effect for the future using “Cookie settings” in our shop's footer. You can also refuse marketing there. The general information about cookies and consent management in sections 4 and 10 applies accordingly.

10) Managing your cookie consent

We use Shopify's consent management functions. You can use the cookie banner to accept or reject non-essential processing or adjust your choices. You can reopen your choices later using “Cookie settings” in the footer. Your decision is stored together with technically necessary identifiers so that it can be taken into account during subsequent visits.

Processing serves to manage and provide evidence of your privacy choices. The legal bases are Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR for reliable and user-friendly consent management; the necessary storage on your device is governed by § 25(2) No. 2 TDDDG. Information about Shopify and international data transfers can be found in section 3. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11) Rights of the data subject

11.1 Applicable data protection law grants you the following rights as a data subject in relation to the controller's processing of your personal data (rights of access and intervention). The conditions for exercising each right are set out in the legal basis cited:

• Right of access pursuant to Art. 15 GDPR;
• Right to rectification pursuant to Art. 16 GDPR;
• Right to erasure pursuant to Art. 17 GDPR;
• Right to restriction of processing pursuant to Art. 18 GDPR;
• Right to be notified pursuant to Art. 19 GDPR;
• Right to data portability pursuant to Art. 20 GDPR;
• Right to withdraw consent given pursuant to Art. 7(3) GDPR;
• Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF PROCESSING SERVES TO ESTABLISH, EXERCISE OR DEFEND LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU CAN EXERCISE YOUR OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

12) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where applicable, the relevant statutory retention period (e.g. retention periods under commercial and tax law).

Where personal data are processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned are stored until you withdraw your consent.

Where statutory retention periods apply to data processed in the context of contractual obligations or obligations similar to contractual obligations on the basis of Art. 6(1)(b) GDPR, these data are routinely deleted after the retention periods expire, provided that they are no longer necessary to perform or enter into a contract and/or we no longer have a legitimate interest in continued storage.

Where personal data are processed on the basis of Art. 6(1)(f) GDPR, these data are stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or processing serves to establish, exercise or defend legal claims.

Where personal data are processed for direct marketing on the basis of Art. 6(1)(f) GDPR, these data are stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise indicated by the other information in this policy about specific processing situations, stored personal data are otherwise deleted when they are no longer necessary for the purposes for which they were collected or otherwise processed.