PRIVACY POLICY

1. Controller

The party responsible for processing personal data is:

Helene Galwas GmbH
Hans-Böckler-Allee 26, 4th floor
30173 Hannover
Germany

Email: shop@helenegalwas.de
Telephone: +49 163 2533594

2. General information

We process personal data only insofar as this is necessary to provide our online shop, process orders, communicate, fulfill legal obligations, or based on your consent.

Personal data is information relating to an identified or identifiable natural person.

3. Provision of the website and Shopify

Our online shop is operated via Shopify.

When the website is accessed, the following data in particular may be processed:

• IP address,

• Date and time of access,

• Pages accessed,

• Browser and device information,

• Referrer URL,

• Technical log and error data.

Technically necessary data is processed to provide the shop securely and reliably on the basis of Article 6(1)(f) GDPR.

Our legitimate interest is the secure and disruption-free operation of the online shop.

Shopify may also process data outside the European Economic Area. Where necessary, the transfer is carried out on the basis of an adequacy decision or appropriate safeguards, in particular the European Commission’s standard contractual clauses.

Further information can be found in Shopify’s privacy information.

4. Orders and customer account

When you place an order, we process in particular:

• Name,

• Billing and delivery address,

• Email address,

• Telephone number, if provided,

• Products ordered,

• Order and payment status,

• Shipping and returns information,

• Customer account data.

Processing is carried out to perform the contract and take pre-contractual measures on the basis of Article 6(1)(b) GDPR.

We store data required under tax and commercial law in accordance with the statutory retention periods. The legal basis is Article 6(1)(c) GDPR.

5. Payment providers

Depending on the payment method selected, the required payment and transaction data is transmitted to the respective payment provider.

These may include:

• Shopify Payments,

• PayPal,

• Klarna,

• Apple Pay,

• Google Pay,

• Shop Pay,

• iDEAL,

• Credit card providers and participating banks.

Processing is carried out to perform the contract on the basis of Article 6(1)(b) GDPR and, where necessary, for fraud prevention on the basis of Article 6(1)(f) GDPR.

The payment provider’s privacy information applies to processing carried out independently by the payment provider.

6. Shipping providers

For delivery, we transmit the necessary data, in particular your name, delivery address, and, where applicable, email address or telephone number, to the shipping service provider used.

We use DHL in particular.

Processing is carried out for the performance of the contract on the basis of Article 6(1)(b) GDPR.

7. Contact

If you contact us by email, telephone, or contact form, we process your information to handle your inquiry.

If the inquiry concerns a contract or an order, processing is based on Article 6(1)(b) GDPR.

For other inquiries, processing is based on our legitimate interest in appropriate communication pursuant to Article 6(1)(f) GDPR.

8. hCaptcha

Our contact form is protected by hCaptcha. The service is used to detect automated and abusive requests.

In particular, IP addresses, device information, and usage data may be processed.

[Anbieter, Rechtsgrundlage, Übermittlungsmechanismus und Speicherdauer anhand des aktuellen Vertrags und der Consent-Konfiguration ergänzen.]

9. Newsletter and Klaviyo

If you subscribe to our newsletter, we process your email address and, where applicable, other information you voluntarily provide.

Processing is based on your consent pursuant to Article 6(1)(a) GDPR.

We use the double opt-in procedure for confirmation. You can withdraw your consent at any time via the unsubscribe link in each newsletter email or by notifying us.

We use Klaviyo for our newsletter and related analytics.

Klaviyo may track opens, clicks, purchases, and other interactions if you have consented to this.

[Anbieteranschrift, Drittlandübermittlung und aktuelle Garantien anhand des Klaviyo-Vertrags ergänzen.]

10. Wish lists, product notifications, and reviews

The shop uses or loads extensions for:

• Wish lists,

• Back-in-stock notifications,

• Pre-orders,

• Product reviews,

• Product recommendations.

The providers identified include Swym and Growave.

When you use these functions, your email address, customer ID, selected products, and usage data in particular may be processed.

The specific legal basis depends on the function used. Processing that requires consent is carried out only with your consent.

[Nicht genutzte Dienste entfernen und aktive Anbieter vollständig ergänzen.]

11. Analytics and personalized advertising

We only use analytics and marketing technologies if you have consented via the consent banner.

The following data in particular may be processed:

• IP address,

• Device and browser information,

• Pages visited,

• Products in the shopping cart,

• Purchases,

• Campaign and interaction data,

• Pseudonymous identifiers.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR and, insofar as information is stored on or read from your device, Section 25(1) TDDDG.

You can change your selection at any time via the “Cookie settings” link in the footer.

[Aktive Google-, Meta-, Pinterest-, TikTok- oder andere Pixel einzeln ergänzen. Nicht aktive Dienste nicht aufführen.]

12. Instagram and social media content

Our website contains links to social networks and may display content from Instagram or other platforms.

With a mere link, data is not transferred to the respective platform until you open the link.

If external content is embedded directly, non-essential data transfers may take place only after you have given your consent.

[Den aktuell erkannten Instagram-Feed technisch und rechtlich prüfen.]

13. Cookies and similar technologies

We distinguish between:

• technically necessary technologies,

• functional technologies,

• Analytics technologies,

• Marketing technologies.

Technologies that are technically necessary are used to provide the shopping cart, checkout, language, security, and consent settings.

Analytics and marketing technologies are activated only with your consent.

Details of the technologies, providers, purposes, and durations used can be found in the cookie settings.

14. Retention period

We store personal data only for as long as necessary for the respective purpose.

We also store data where statutory retention obligations apply or where the data is required to assert, exercise, or defend legal claims.

Once the processing purpose no longer applies and the relevant retention periods have expired, the data is deleted or anonymized.

15. Transfers of data to third countries

Some service providers may process personal data outside the European Economic Area.

Data is transferred only if the statutory requirements are met. These include, in particular:

• European Commission adequacy decisions,

• valid certification under the EU-U.S. Data Privacy Framework,

• European Commission standard contractual clauses,

• other legally permitted safeguards.

16. Your rights

Subject to the statutory requirements, you have the following rights in particular:

• Right of access,

• Right to rectification,

• Right to erasure,

• Right to restriction of processing,

• Right to data portability,

• Right to object,

• Right to withdraw consent.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The following authority is generally responsible for our company:

The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hanover
Germany

Email: poststelle@lfd.niedersachsen.de
Website: https://lfd.niedersachsen.de

18. Changes

We may amend this privacy policy if legal requirements, our services, or the providers we use change.

As of August 2026