Privacy Policy

Privacy Policy

(English convenience translation – the German version is legally binding.)

1. Controller

The controller responsible for data processing on this website is:

Dave Geigle – Yo-Shop.de
Lichtenhainer Str. 13
12627 Berlin
Germany

Phone: +49 30 26031449
E-mail: kontakt@yo-shop.de

Unless stated otherwise below, the provision of your personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. However, if you do not provide certain data, some functions of this website or an order process may not be possible or only in a limited way.

“Personal data” means any information relating to an identified or identifiable natural person.

2. Hosting

Our website is hosted by an external service provider (hosting provider) within the EU. The hosting provider provides the technical infrastructure and services necessary for the operation of this website (servers, databases, security, etc.).

Data processing by the hosting provider is based on Art. 6 (1) f GDPR (legitimate interest in a secure and stable operation of the website) and Art. 28 GDPR (data processing agreement).

3. Server log files

You can visit our website without having to provide any personal information. Each time you access our website, usage data is transmitted by your browser and stored in server log files. This data includes for example:

• name of the accessed page

• date and time of access

• amount of data transferred

• message about successful retrieval

• browser type and version

• operating system used

• referrer URL (previously visited page)

• IP address (possibly shortened)

• requesting provider

Processing is based on Art. 6 (1) f GDPR on the basis of our legitimate interest in ensuring the trouble-free operation of the website and improving our services. This data is not assigned to a specific person.

4. Contact (contact form / e-mail)

When you contact us (e.g. by contact form or e-mail), we process the personal data you provide (e.g. name, e-mail address, phone number, message text).

The purpose of processing is to handle and answer your request.
The legal basis is Art. 6 (1) b GDPR, where the request is related to (pre-)contractual obligations, and otherwise Art. 6 (1) f GDPR (our legitimate interest in proper handling of enquiries).

Your data will be deleted when it is no longer required for the purpose for which it was collected, unless legal retention obligations prevent deletion.

5. Customer account

When you create a customer account in our online shop, we process the data you provide (e.g. name, address, e-mail address, password).

The purpose is to improve your shopping experience and to simplify order processing (e.g. viewing past orders, faster checkout).

The legal basis is Art. 6 (1) b GDPR (performance of a contract).
You can request deletion of your customer account at any time. In that case, the data will be deleted unless legal retention obligations require further storage.

6. Data processing for orders in the online shop

When you place an order in our online shop, we process your personal data to the extent necessary to process and fulfil your order. This includes in particular:

• name

• billing and shipping address

• e-mail address

• phone number (if provided)

• ordered products

• prices, payment details

Providing this data is necessary to conclude and perform the contract. If you do not provide the data, we cannot conclude the contract.

The legal basis is Art. 6 (1) b GDPR (performance of a contract).

We share data with the following categories of recipients, where necessary for contract fulfilment:

• shipping providers (see below)

• payment service providers (see below)

• IT and hosting service providers (e.g. for operating the online shop)

The scope of data transfer is limited to the minimum necessary.

7. Payment service providers

7.1 PayPal

If you choose PayPal as your payment method, you will be redirected to the pages of PayPal. Payment processing is carried out by:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

PayPal processes your data under its own responsibility. PayPal’s privacy policy applies:
https://www.paypal.com/de/webapps/mpp/ua/privacy-full

The legal basis for the integration of PayPal is Art. 6 (1) b GDPR (performance of a contract).

7.2 Bank transfer (prepayment)

If you pay by bank transfer (prepayment), we only process the data necessary to handle the payment (e.g. bank details, payment reference, amount), which we receive from your bank.

The legal basis is Art. 6 (1) b GDPR.

7.3 Apple Pay / Google Pay

If you use Apple Pay or Google Pay, payment processing is carried out via the corresponding service of the provider (Apple or Google) and the payment method you have stored there (e.g. credit card, bank account).

Data processing is carried out under the responsibility of these providers. Their privacy policies apply:

• Apple: https://www.apple.com/legal/privacy/

• Google (Google Pay): https://policies.google.com/privacy

The legal basis for the integration is Art. 6 (1) b GDPR (performance of a contract).

8. Shipping providers (DHL / Deutsche Post) & automated shipment information

Shipping of orders is carried out by service providers within Deutsche Post DHL Group, in particular:

• DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

• Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

For the purpose of delivering the goods and, where applicable, for shipment tracking, we transmit the following data to these shipping providers:

• name

• shipping address

• any alternative delivery details

• phone number (if provided, e.g. for delivery notifications)

• your e-mail address for shipment notifications (tracking e-mails)

This data processing is based on Art. 6 (1) b GDPR (performance of the contract) and our legitimate interest in providing you with shipment and tracking information (Art. 6 (1) f GDPR).

DHL / Deutsche Post use your e-mail address to send you information about the shipment status (e.g. delivery announcement, delivery confirmation).

You may object to this use of your contact data for shipment and tracking information at any time with effect for the future, by contacting us or the respective shipping provider. The delivery of your goods will not be affected; however, shipment tracking may then be limited or unavailable.

9. E-mail communication & automated system e-mails

For communication related to the contract (e.g. order confirmation, payment status, shipping confirmation, information about your customer account), we use the e-mail address you provide.

These e-mails are generated automatically by our shop system. E-mail dispatch is handled via an external e-mail service of Google (e.g. Google Workspace / Gmail).

The legal basis is Art. 6 (1) b GDPR, as this communication is necessary for proper contract fulfilment.

10. Cookies and similar technologies

Our website uses cookies and similar technologies (e.g. local storage). Cookies are small text files stored on your device.

We distinguish between:

10.1 Technically necessary cookies

These cookies are required for basic functions of the website and shop (e.g. shopping cart, login, language settings). Without them, use of the website and the ordering process is not possible or only to a limited extent.

The legal basis is Section 25 (2) TTDSG in conjunction with Art. 6 (1) b and/or f GDPR.

10.2 Statistics, marketing and comfort cookies

With your consent, we also use cookies for statistical and marketing purposes (e.g. for web analytics and advertising tracking – see below: Google Analytics, Meta Pixel, Google Ads).

These cookies are only set if you agree via our cookie/consent tool.
You can withdraw your consent at any time with effect for the future by changing your settings in our cookie/consent tool.

Details on the cookies used (provider, purpose, storage duration) and your options for changing or withdrawing consent can be found in our cookie/consent tool, which you can access at any time via the “Cookie settings” link on our website.

You can also delete or block cookies in your browser settings. In that case, some functions of our website may no longer be available in full.

11. Web analytics and marketing

11.1 Google Analytics

We use Google Analytics on our website. Provider:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

Google Analytics uses cookies to analyze how you use our website. The information generated by the cookie is usually transferred to a server of Google and stored there.

We use Google Analytics with IP anonymisation. Your IP address is usually shortened by Google within the EU/EEA.

The legal basis is your consent under Art. 6 (1) a GDPR in conjunction with Section 25 (1) TTDSG.
You can withdraw your consent at any time via our cookie/consent tool.

For more information see:
https://policies.google.com/privacy
and:
https://support.google.com/analytics/answer/6004245

11.2 Google Tag Manager

We use Google Tag Manager to manage and trigger analytics and marketing tools (e.g. Google Analytics, Google Ads). The Tag Manager itself usually does not process personal data; it simply manages and triggers other tools.

The legal basis is Art. 6 (1) f GDPR (our legitimate interest in efficient administration of tracking tools) and, where applicable, your consent where it serves to activate consent-based tools.

11.3 Google Ads Conversion Tracking

We use Google Ads Conversion Tracking to measure the success of our advertising campaigns. If you reach our website via a Google ad, a cookie may be placed which allows us to see whether a specific action (e.g. order) was carried out.

The legal basis is your consent under Art. 6 (1) a GDPR in conjunction with Section 25 (1) TTDSG.
You can withdraw your consent at any time via our cookie/consent tool.

More information: https://policies.google.com/privacy

11.4 Meta Pixel (Facebook/Instagram)

We use the Meta Pixel of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, to analyse user behaviour after they click one of our ads on Facebook/Instagram (conversion tracking, remarketing).

This enables Meta to understand that a user has visited our website or performed a certain action. We do not receive any personal data; we only get anonymised statistical reports. Meta may link the data to your Meta account and use it for its own advertising purposes.

The legal basis is your consent under Art. 6 (1) a GDPR in conjunction with Section 25 (1) TTDSG.
You can withdraw your consent at any time via our cookie/consent tool.

More information:
https://www.facebook.com/privacy/policy
Meta Pixel details:
https://www.facebook.com/business/help/742478679120153

12. Embedded YouTube videos

We embed videos from YouTube on some pages. Provider:

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland

We usually use YouTube’s extended privacy mode, so that no cookies are set until you play the video. When you play a video, YouTube may set cookies and process usage data (IP address, device data, visited pages, etc.).

The legal basis is your consent under Art. 6 (1) a GDPR in conjunction with Section 25 (1) TTDSG.
You can withdraw your consent at any time via our cookie/consent tool.

Further information:
https://policies.google.com/privacy

13. Google Fonts

We use Google Fonts to display fonts in a uniform and visually appealing way. When you access a page, your browser loads the required web fonts into its cache.

In this process, your IP address may be transmitted to Google servers.

The legal basis is Art. 6 (1) f GDPR, our legitimate interest in a consistent and attractive presentation of our online offering.

14. Storage period

Unless otherwise specified for the individual processing activities, the following applies:

• Contract-related data (e.g. order data, invoices) are stored for the duration of contract performance and subsequently for the period required by statutory retention obligations (usually 6–10 years under commercial and tax law).

• Server log files are typically stored for a limited period (e.g. a few weeks) and then deleted.

• Data from web analytics and marketing tools is deleted or anonymised when it is no longer required for its purpose and no legal retention obligations apply.

15. Rights of data subjects

You have the following rights under the GDPR, subject to the applicable legal requirements:

• right of access (Art. 15 GDPR)

• right to rectification (Art. 16 GDPR)

• right to erasure (Art. 17 GDPR)

• right to restriction of processing (Art. 18 GDPR)

• right to data portability (Art. 20 GDPR)

You also have the right to object under Art. 21 GDPR to processing based on Art. 6 (1) f GDPR (legitimate interest) and to processing for direct marketing purposes.

Where processing is based on your consent (Art. 6 (1) a GDPR), you have the right to withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, you can contact us at any time using the contact details provided in the imprint or at the beginning of this Privacy Policy.

16. Right to lodge a complaint with a supervisory authority

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.