Data Protection

As of: October 2026

Protecting your personal data is important to us. On this page, you can find out what data we collect, how we use it, the legal basis for doing so, and what rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Sprezzi Fashion
Owner: Pascal Gehrlein
Grabengasse 17
76761 Rülzheim
Germany
Email: shop@sprezzi-fashion.com

We have not appointed a data protection officer because the legal requirements for doing so do not apply. If you have any questions about data protection, please contact us directly at the address above.

2. Basic information about data processing

What is personal data?

Personal data is any information that relates to you or can be linked to you – for example, your name, address, email address, or IP address.

What is the legal basis for processing data?

We only process your data when permitted by law. The following legal bases may apply:

  • Art. 6(1)(a) GDPR – consent: You have expressly allowed us to process certain data, for example, for the newsletter or marketing cookies. You can withdraw your consent at any time, effective for the future.
  • Art. 6(1)(b) GDPR – contract: Processing is necessary to handle your order or respond to pre-contractual inquiries.
  • Art. 6(1)(c) GDPR – legal obligation: We must process data, for example, to comply with statutory retention obligations under commercial and tax law.
  • Art. 6(1)(f) GDPR – legitimate interest: We have a legitimate interest in processing that does not override your interests – for example, in the secure operation of our website or the prevention of fraud.

Who receives your data?

We only share data when necessary for the relevant purpose. Recipients are primarily service providers we use – for example, for hosting, payment processing, shipping, or sending emails. Where these service providers process data solely on our instructions, we have entered into a data processing agreement with them under Art. 28 GDPR.

Transfers to third countries

Some of the services we use are based outside the European Union, particularly in the United States. In these cases, it cannot be ruled out that authorities in the destination country may access the data. Where available, we rely on an adequacy decision by the European Commission (such as the EU-US Data Privacy Framework) or on standard contractual clauses under Art. 46(2)(c) GDPR for the transfer. We specifically note this for the relevant services below.

How long do we store your data?

We store personal data only for as long as necessary for the relevant purpose. We then delete it unless we are subject to a statutory retention obligation. We generally retain order and invoice data for ten years due to commercial and tax requirements (Section 147 AO, Section 257 HGB). During this period, processing is restricted: the data is retained solely to fulfill these obligations.

3. Website Hosting and Provision

Shopify

Our online shop is operated on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Shopify processes on our behalf all data generated when you visit and use the shop – that is, order, customer, and usage data. We have entered into a data processing agreement with Shopify. Data may be transferred to the United States to its parent company, Shopify Inc.; any such transfer is based on standard contractual clauses.

The legal basis is Article 6(1)(b) GDPR (contract processing) and Article 6(1)(f) GDPR (legitimate interest in secure and efficient shop operations).

Further information: shopify.com/legal/privacy

Server log files

Each time you access our website, information automatically transmitted by your browser is collected. This includes:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the page accessed
  • Website from which access is made (referrer)
  • Browser used, operating system, and device type

This data is technically necessary to display the website to you, ensure its stability, and defend against attacks. The legal basis is Article 6(1)(f) GDPR. This data is not combined with data from other sources.

4. Cookies and Consent Management

We use cookies and comparable technologies on our website (such as pixels and local storage in your browser).

Technically necessary cookies are required for the shop to work – for example, to keep items in your shopping cart or keep you logged in. The legal basis is Section 25(2)(2) TDDDG in conjunction with Article 6(1)(f) GDPR.

All other cookies – particularly those for statistics, personalization, and marketing – are only set if you have given us your consent. The legal basis is Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.

You can manage your consent using the cookie banner that appears on your first visit. You can change or withdraw your selection at any time. You can also delete or block cookies in your browser settings; if you do, some features of the shop may not be available to you.

5. Orders and Customer Account

Order Processing

When you place an order with us, we process the data needed to fulfill it: first and last name, billing and shipping address, email address, telephone number if applicable, and information about the order and selected payment method.

We share this data with the payment service provider you selected, our shipping provider, and our inventory management system, insofar as this is necessary for delivery and billing. The legal basis is Art. 6(1)(b) GDPR.

Customer account

You can create a customer account with us. We store your login details, order history, and saved addresses there. The account is optional – you can also place an order as a guest. The legal basis is Art. 6(1)(b) GDPR. You can have your customer account deleted at any time; statutory retention obligations for order data remain unaffected.

Credit checks and fraud prevention

To protect against payment defaults and fraudulent orders, we use screening procedures. Shopify automatically analyzes orders for fraud risks. We also use the Blockify service, which can detect and block suspicious access based on IP address, location, and device characteristics.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing fraud and payment defaults.

If you choose a payment method with a payment term (such as purchase on invoice through Klarna), the payment service provider may also carry out its own credit check. You can find more information in the privacy notices of the respective provider.

6. Payment methods

We offer various payment methods. Depending on which one you choose, your payment data will be transmitted to the respective provider. We do not receive your complete payment details – such as credit card numbers; they are processed directly by the payment service provider.

The legal basis in each case is Art. 6(1)(b) GDPR.

  • Shopify Payments – Shopify International Limited, Dublin, Ireland. Privacy Notice
  • PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. Privacy Notice
  • Klarna – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Privacy Notice
  • Apple Pay – Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland.
  • Google Pay – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Amazon Pay – Amazon Payments Europe s.c.a., 38 avenue John F. Kennedy, L-1855 Luxembourg.
  • Shop Pay – Shopify International Limited, Dublin, Ireland.
  • Payment in advance by bank transfer – we only process information about receipt of payment.

7. Shipping and logistics

Shipping providers

To deliver your order, we share your name and delivery address and – if required for delivery or notification – your email address and phone number with:

  • DHL – Deutsche Post AG / DHL Group, Charles-de-Gaulle-Straße 20, 53113 Bonn
  • UPS – United Parcel Service Deutschland S.àr.l. & Co. OHG, Görlitzer Straße 1, 41460 Neuss

The legal basis is Art. 6(1)(b) GDPR. For shipments to countries outside the EU, we also transfer the information required for customs clearance; the legal basis for this is Art. 6(1)(c) GDPR.

Inventory management and order processing

We use Billbee (Billbee GmbH, Paulinenstraße 54, 32756 Detmold, Germany) to process orders, shipping, and invoicing. Billbee processes order and customer data on our behalf. A data processing agreement is in place. The legal basis is Art. 6(1)(b) and (f) GDPR.

Address verification

To avoid delivery errors, we use AddressHero (HeroSoftware GmbH, Germany) to check delivery addresses for completeness and plausibility. The address details you enter are processed for this purpose. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to prevent failed deliveries and returned shipments.

Delivery time display

To display estimated delivery dates on our product pages, we use Delivery Timer (LAUNCHTIP). Device and location information (derived from the IP address) is processed to display the appropriate delivery time. The legal basis is Art. 6(1)(f) GDPR.

8. Returns

We use the returns portal from 8returns to process returns and exchanges. If you register a return, your order number, email address, the items concerned, and the reason you provide for the return are processed.

A data processing agreement is in place. The legal basis is Art. 6(1)(b) GDPR.

9. Contact and Customer Service

Contact form

You can send us a message using our contact form. Your name and email address are required so we can reply to you; your phone number and order number are optional. We process this data solely to handle your request.

The legal basis is Art. 6(1)(b) GDPR if your request is related to a contract; otherwise, it is Art. 6(1)(f) GDPR. We delete your request once it has been fully processed, unless we are subject to retention obligations.

Chat

We offer a chat on our website. Your inquiry is initially answered by an AI-powered assistant. If it can’t help, a ticket is created for our team.

The chat is provided by Jotform (Jotform Inc., 4 Embarcadero Center, Suite 780, San Francisco, CA 94111, USA). The content of your messages, the email address you provide, and technical connection data are processed. Data is transferred to the United States; we rely on Standard Contractual Clauses or the provider’s certification under the EU-US Data Privacy Framework.

Please don’t enter particularly sensitive data in the chat – such as payment or health data.

The legal basis is Art. 6(1)(a) GDPR (consent, which you give by opening the chat) and Art. 6(1)(b) GDPR for contract-related inquiries.

We also use Shopify Inbox (Shopify International Limited, Dublin, Ireland) to manage customer inquiries.

Jotform privacy notice: jotform.com/privacy

Back-in-stock notification

If an item is sold out, you can sign up to be notified when it’s back in stock. This service is provided by Ordersify. Your email address and the item in question are processed. The legal basis is Art. 6(1)(a) GDPR. We delete your sign-up after sending the notification.

10. Newsletter and email marketing

Klaviyo

We use Klaviyo (Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA) to send our newsletter and other marketing messages.

Sign-up uses the double opt-in process: after signing up, you’ll receive an email with a confirmation link. We’ll add you to the mailing list only after you click this link. We log sign-ups and confirmations, including the time and IP address, so we can demonstrate consent.

Klaviyo analyzes whether and when you open our emails and which links you click. We use this analysis to tailor our content to your interests. Klaviyo also processes your purchase and browsing behavior in the shop to send you relevant recommendations – such as a reminder about an incomplete shopping cart.

The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time by using the unsubscribe link at the end of any email or by sending us a short message. The lawfulness of processing carried out before withdrawal remains unaffected.

The data is processed in the United States. The legal basis is Standard Contractual Clauses. A data processing agreement is in place.

Privacy notice: klaviyo.com/legal/privacy

Transactional and service emails

Separate from the newsletter, you will receive emails related to processing your contract, such as order confirmations, shipping notifications, or information about your return. We also use WorkflowMail to create and send these messages. The legal basis is Art. 6(1)(b) GDPR. You cannot unsubscribe from these messages because they are part of processing your contract.

Signup forms

We use Shopify Forms and TA Banner & Pop-up to integrate signup forms and pop-ups. The data you enter and technical information required to display the form are processed.

11. Web analytics and audience measurement

Google Tag Manager

We use Google Tag Manager (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The Tag Manager itself does not store personal data, but is used to integrate and control other services. However, when it loads, your IP address is transmitted to Google and may be transferred to the United States.

The Tag Manager is only loaded after you have given consent through the cookie banner, unless it controls services that are strictly necessary for technical reasons. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Google Analytics

We use Google Analytics 4 (Google Ireland Limited, Dublin, Ireland) to analyze how our website is used. The service uses cookies that enable analysis of your use. Data collected includes pages visited, time spent on the site, approximate location, device and browser information, and interactions with the shop.

The IP address is truncated before it is stored. Data is transferred to the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework.

The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Analyzify and server-side tracking via Stape

Our tracking services are technically integrated through Analyzify. We also use Stape for server-side tracking (server-side tagging): events such as page views or purchases are not sent directly from your browser to the destination systems, but first to a server operated on our behalf and then forwarded from there.

This process handles the same data as browser-based tracking, but gives us better control over which information is shared with each provider. The legal basis is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

Shopify Analytics

Shopify provides us with aggregated analyses of visitor numbers and sales. The legal basis is Art. 6(1)(f) GDPR or, where cookies are used, your consent.

12. Advertising and conversion tracking

We advertise our products on various platforms and measure the effectiveness of these ads. The technologies used for this purpose are loaded only with your consent. The legal basis in each case is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

Google Ads and conversion tracking

We use Google Ads (Google Ireland Limited, Dublin, Ireland). If you visit our website via a Google ad, a cookie is set that shows us which ads led to a purchase. We also use remarketing to show you our products again when you visit other websites in the Google Network.

Google Customer Match

Through the Simprosys Customer Match Lists service, we transmit customer lists to Google Ads to target ads more effectively and exclude existing customers from campaigns. The transmitted data, particularly email addresses, is encrypted (hashed) before transmission.

This processing takes place only with your consent. You can object at any time by sending us a message.

Meta (Facebook and Instagram)

We use technologies from Meta (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) to measure the effectiveness of our ads on Facebook and Instagram and to show you relevant ads. Information about your visit may be transmitted to Meta. We and Meta are joint controllers for the collection and transmission of this data under Art. 26 GDPR.

Privacy notice: facebook.com/privacy/policy

Pinterest

We use the Pinterest Tag (Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland). This allows us to measure whether visitors came to our site via Pinterest and whether this resulted in a purchase. We can also show you ads on Pinterest that match your interests.

This involves processing information about pages visited, products viewed, completed orders, and a pseudonymous identifier. Data may be transferred to Pinterest Inc. in the USA; this is done on the basis of standard contractual clauses.

Privacy Notice: policy.pinterest.com

Product data feeds

We use multifeeds to transmit product data to advertising platforms and price comparison sites. Personal data is generally not involved; however, the service may also include conversion tracking.

13. Affiliate Marketing

We participate in the ADCELL affiliate network (Firstlead GmbH, Rosenfelder Straße 15-16, 10315 Berlin, Germany).

If you visit our store via an affiliate partner's link, a cookie is set. If you then make a purchase, the partner can use this cookie to calculate their commission. The data processed includes an affiliate ID, the time of the click, and order details – but not your name or address.

The legal basis is Art. 6(1)(a) GDPR.

Privacy Notice: adcell.de

14. Store Features

To improve your experience, we use additional services. If these are not technically necessary, we only load them after you have given your consent (Art. 6(1)(a) GDPR); otherwise, we rely on our legitimate interest in maintaining a functional, user-friendly store (Art. 6(1)(f) GDPR).

  • Wishlist King – wishlist feature. The items you save are stored and, for logged-in customers, linked to their customer account.
  • Candy Rack – displays relevant additional products in the shopping cart.
  • Orbe Geolocation – uses your IP address to identify your country and suggest the appropriate language and currency version.
  • Shopify Search & Discovery – search and product recommendations.
  • Instafeed – integration of our Instagram feed. Data may be transferred to Meta when it loads.
  • Shopify Flow – internal automation of order-related processes.

15. External Content and Fonts

Google Fonts

We use fonts from Google Fonts (Google Ireland Limited, Dublin, Ireland). When you visit a page, your browser loads the font from a Google server, transmitting your IP address to Google. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in ensuring our website is displayed consistently.

Google Libraries

We use Google's Content Delivery Network to provide program libraries (jQuery). Your IP address is also transferred to Google in this process. The legal basis is Art. 6(1)(f) GDPR.

16. Marketplaces

We also offer our products through Zalando Connected Retail (Zalando SE, Valeska-Gert-Straße 5, 10243 Berlin). If you place an order there, we receive the data required for delivery from Zalando. Zalando is responsible for processing on the platform itself. The legal basis is Art. 6(1)(b) GDPR.

17. Automation and Data Transfers

We use Zapier (Zapier Inc., USA) to link our systems. Order and customer data may be transferred between the applications we use. We have a data processing agreement in place; we rely on standard contractual clauses for transfers to the USA. The legal basis is Art. 6(1)(f) GDPR.

18. Multilingual Support

We offer our store in several languages. To do this, we use Shopify Translate & Adapt and T Lab. These services process store content, not customer data.

19. Social Networks

We are on Instagram, Pinterest, and WhatsApp. If you visit our profiles there, the privacy policies of the respective providers apply. We only link to these profiles on our website – clicking the link does not transmit any data to the networks.

20. Your Rights

Under the GDPR, you have the following rights:

  • Access (Art. 15 GDPR) – you can find out what data we process about you.
  • Rectification (Art. 16 GDPR) – we will correct inaccurate data.
  • Erasure (Art. 17 GDPR) – you can request erasure unless we are required to retain the data.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR) – you can receive your data in a commonly used format.
  • Right to object (Art. 21 GDPR) – you can object to processing based on our legitimate interests. You can object to processing for direct marketing purposes at any time and without giving a reason.
  • Withdrawal of consent (Art. 7(3) GDPR) – at any time, with effect for the future.

To exercise any of these rights, simply send an informal message to shop@sprezzi-fashion.com.

21. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
datenschutz.rlp.de

You can also contact the supervisory authority where you live.

22. Data Security

Our website uses SSL or TLS encryption. You can recognize this by the lock icon in your browser's address bar and by the address beginning with “https://”. This prevents third parties from reading data you send to us.

We also implement technical and organizational measures to protect your data against loss, destruction, tampering, and unauthorized access.

23. No Data from Children

Our services are not intended for children under 16. We do not knowingly collect data from children. If we learn that we have received a child's data without the consent of their legal guardians, we will delete it.

24. Updates to this Privacy Policy

This privacy policy is current as of the date stated above. As our store evolves or legal requirements change, we may need to update it. You can always find the latest version on this page.