Privacy policy

1. Purpose of this policy

This Privacy Policy explains how personal data is processed when customers:

• Visit baublebary.shop;
• Browse products;
• Use the shopping cart;
• Place an order;
• Make a payment;
• Create or use an account;
• Contact customer service;
• Request a return or refund;
• Exercise privacy rights;
• Interact with Shopify-supported store functionality.

This policy is intended to provide information required under the General Data Protection Regulation.

2. Data controller

The store responsible for the processing described in this policy is:

baublebary.shop
Email: info@baublebary.shop

3. Shopify platform

baublebary.shop is operated through Shopify.

Shopify provides ecommerce infrastructure that may include:

• Store hosting;
• Product presentation;
• Shopping-cart functions;
• Checkout;
• Payment-related infrastructure;
• Order management;
• Customer-account functions;
• Security;
• Fraud prevention;
• Store analytics;
• Privacy-management tools.

Shopify may process personal data on behalf of baublebary.shop and may also process certain information for its own purposes as described in Shopify’s privacy documentation.

4. Categories of personal data

Depending on customer interaction, the store may process:

Identity data

• Name;
• Account identifier;
• Customer identifier.

Contact data

• Email address;
• Delivery address;
• Billing address;
• Telephone number where provided during checkout.

Order data

• Products viewed;
• Products ordered;
• Product variations;
• Quantity;
• Order number;
• Order value;
• Discount information;
• Order status;
• Delivery status;
• Return and refund history.

Payment-related data

• Selected payment method;
• Payment status;
• Transaction reference;
• Limited payment details provided by the payment processor;
• Fraud-prevention results.

Full payment-card information is generally processed directly by the relevant payment provider.

Device and technical data

• IP address;
• Browser type;
• Device type;
• Operating system;
• Language settings;
• Time zone;
• Cookie identifiers;
• Session information;
• Log data;
• Error information.

Usage data

• Pages visited;
• Products viewed;
• Links selected;
• Cart activity;
• Checkout activity;
• Interaction with store features.

Communication data

• Emails;
• Customer-service messages;
• Return requests;
• Withdrawal notices;
• Complaints;
• Feedback;
• Supporting photographs or videos.

Preference data

• Cookie choices;
• Marketing choices;
• Communication preferences;
• Account settings.

5. Order and contract processing

Personal data is processed to:

• Receive orders;
• Verify order information;
• Process payment;
• Confirm purchases;
• Prepare goods for delivery;
• Arrange shipping;
• Provide tracking information;
• Handle cancellations;
• Process withdrawals;
• Manage returns;
• Issue refunds;
• Respond to customer questions;
• Enforce contractual rights.

The legal basis is Article 6(1)(b) GDPR because the processing is necessary to perform a contract or take steps requested before entering into a contract.

6. Legal compliance

Personal data may be processed and retained to comply with:

• Tax laws;
• Commercial-record obligations;
• Accounting requirements;
• Consumer-protection obligations;
• Product-safety obligations;
• Regulatory requests;
• Court orders;
• Lawful government requests.

The legal basis is Article 6(1)(c) GDPR.

7. Legitimate interests

Personal data may be processed where necessary for legitimate interests, including:

• Protecting the store from fraud;
• Securing customer accounts;
• Preventing payment abuse;
• Detecting suspicious activity;
• Maintaining technical stability;
• Defending legal claims;
• Improving internal business operations;
• Understanding aggregate store performance.

The legal basis is Article 6(1)(f) GDPR.

Where processing is based on legitimate interests, those interests are balanced against the rights and freedoms of the affected person.

8. Consent

Consent may be requested for:

• Non-essential analytics cookies;
• Advertising technologies;
• Personalised advertising;
• Certain marketing messages;
• Other optional data processing.

The legal basis is Article 6(1)(a) GDPR.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

9. Payment processing

Payment information is transmitted to the payment provider selected during checkout.

Payment providers may process data to:

• Authorise payment;
• Authenticate the customer;
• Prevent fraud;
• Comply with financial regulations;
• Process refunds;
• Resolve payment disputes.

Payment providers may act as independent controllers for parts of their processing. Their own privacy notices apply to such processing.

10. Order fulfilment and delivery

Personal data necessary for delivery may be shared with fulfilment providers, warehouses, postal operators and carriers.

Shared information may include:

• Recipient name;
• Delivery address;
• Telephone number where needed;
• Email address where needed;
• Order or parcel reference;
• Customs information where required.

The legal basis is normally Article 6(1)(b) GDPR.

11. Customer service

When a customer contacts info@baublebary.shop, the information provided is used to:

• Identify the customer or order;
• Respond to questions;
• Investigate delivery issues;
• Process returns or refunds;
• Handle complaints;
• Maintain a record of the communication.

The legal basis may be Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR, depending on the purpose.

12. Cookies

Cookies and similar technologies may be used to:

• Keep the store operational;
• Maintain the shopping cart;
• Maintain checkout sessions;
• Remember privacy choices;
• Secure customer accounts;
• Prevent fraud;
• Analyse store usage;
• Measure marketing performance;
• Personalise content where permitted.

13. Necessary cookies

Necessary cookies support essential store functions and may be used without consent where legally permitted.

Such functions may include:

• Shopping-cart operation;
• Checkout;
• Security;
• Authentication;
• Fraud prevention;
• Load balancing;
• Privacy-choice storage.

Blocking necessary cookies may prevent parts of the store from functioning correctly.

14. Optional cookies

Analytics, advertising and personalisation cookies are used only after legally valid consent where consent is required.

Customers may:

• Accept optional cookies;
• Reject optional cookies;
• Select cookie categories;
• Withdraw consent;
• Change their settings later.

Withdrawing cookie consent does not affect processing completed before withdrawal.

15. Marketing

Marketing communications will be sent only where legally permitted.

Customers can unsubscribe by:

• Using the unsubscribe link in a marketing email; or
• Contacting info@baublebary.shop.

Unsubscribing from marketing does not prevent essential transactional communications concerning orders, payments, shipping, security, returns or refunds.

16. Data recipients

Personal data may be disclosed where necessary to:

• Shopify;
• Payment providers;
• Fulfilment providers;
• Shipping carriers;
• Postal operators;
• Customer-support systems;
• Hosting and IT providers;
• Security and fraud-prevention providers;
• Professional advisers;
• Accountants;
• Auditors;
• Insurers;
• Courts;
• Regulators;
• Law-enforcement authorities.

Only data reasonably necessary for the relevant purpose will be shared.

17. International data transfers

Shopify or another service provider may process personal data outside Germany or the European Economic Area.

Where required, international transfers are protected by a legally recognised safeguard, such as:

• An adequacy decision;
• Standard contractual clauses;
• Binding corporate rules;
• Another mechanism permitted under the GDPR.

Information about applicable safeguards may be requested through info@baublebary.shop.

18. Data security

Reasonable technical and organisational measures are used to protect personal data against:

• Unauthorised access;
• Accidental loss;
• Unlawful alteration;
• Improper disclosure;
• Destruction;
• Misuse.

No internet transmission or electronic storage system can guarantee absolute security.

Customers should protect account credentials and notify info@baublebary.shop if they suspect unauthorised account use.

19. Data retention

Personal data is retained only for as long as necessary for:

• Contract performance;
• Customer service;
• Legal compliance;
• Tax and accounting obligations;
• Fraud prevention;
• Dispute resolution;
• Establishment, exercise or defence of legal claims.

When information is no longer required, it will be deleted, anonymised or otherwise handled according to applicable law.

Mandatory German commercial and tax retention periods may require certain transaction records to be retained after the customer relationship ends.

20. Right of access

Customers may request confirmation as to whether their personal data is being processed.

Where applicable, they may request:

• A copy of their personal data;
• Information about processing purposes;
• Categories of data;
• Recipients;
• Retention periods;
• Data sources;
• Applicable automated decision-making;
• International transfer safeguards.

21. Right to rectification

Customers may request correction of inaccurate personal data and completion of incomplete personal data.

22. Right to erasure

Customers may request deletion where:

• Data is no longer necessary;
• Consent is withdrawn and there is no other legal basis;
• A valid objection is made;
• Data was processed unlawfully;
• Deletion is required by law.

The right to erasure may be restricted where data must be retained for legal compliance or legal claims.

23. Right to restriction

Customers may request restriction of processing where:

• Data accuracy is disputed;
• Processing is unlawful but deletion is opposed;
• Data is required for legal claims;
• An objection is under review.

24. Right to data portability

Where processing is based on consent or contract and performed by automated means, customers may request relevant personal data in a structured, commonly used and machine-readable format.

Where technically feasible, customers may request direct transmission to another controller.

25. Right to object

Customers may object to processing based on legitimate interests for reasons relating to their particular situation.

Processing will stop unless compelling legitimate grounds override the customer’s interests, rights and freedoms, or the processing is required for legal claims.

Customers may object to direct marketing at any time without giving a reason.

26. Right to withdraw consent

Consent may be withdrawn at any time by changing cookie settings, using an unsubscribe function or contacting info@baublebary.shop.

Withdrawal does not affect the lawfulness of earlier processing.

27. Right to complain

Customers may lodge a complaint with a competent data protection supervisory authority in Germany or another EU Member State.

Before submitting a complaint, customers may contact info@baublebary.shop so that the issue can be reviewed.

28. Identity verification

Before responding to a privacy request, additional information may be requested where reasonably necessary to confirm the requester’s identity.

This protects personal data from unauthorised disclosure.

Only information necessary for verification will be requested.

29. Automated decisions

baublebary.shop does not intentionally make decisions producing legal or similarly significant effects based solely on automated processing unless permitted by law.

Payment and fraud-prevention providers may conduct automated checks under their own responsibility and according to their privacy notices.

30. Children’s privacy

The store is not intended specifically for children.

Personal data relating to children will not knowingly be collected or used without an appropriate legal basis and any legally required parental authorisation.

31. Policy updates

This Privacy Policy may be updated where:

• Store functionality changes;
• Shopify services change;
• New providers are introduced;
• Data-processing practices change;
• Legal requirements change.

The current version will be published on baublebary.shop.