Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

Dave Geigle – Yo-Shop.de
Lichtenhainer Str. 13
12627 Berlin
Germany

Phone: +49 30 26031449
Email: kontakt@yo-shop.de

Unless otherwise stated below, the provision of your personal data is neither required by law nor by contract, nor is it necessary for the conclusion of a contract. You are not obliged to provide your data. However, failure to provide certain data may result in some functions of this website or the ordering process not being available or only being available to a limited extent.

“Personal data” means any information relating to an identified or identifiable natural person.

2. Hosting

Our website is hosted by an external service provider. This provider is established in the European Union and provides the technical infrastructure and operation of the website, including servers, databases and security systems.

Processing by the hosting provider is based on Art. 6(1)(f) GDPR, due to our legitimate interest in the secure and stable operation of the website, as well as Art. 28 GDPR concerning processing on behalf of the controller.

3. Server Log Files

You may visit our website without providing any personal information.

Whenever our website is accessed, your internet browser automatically transmits usage data, which is stored in server log files. This may include:

• name of the page accessed;
• date and time of access;
• amount of data transferred;
• notification of successful retrieval;
• browser type and browser version;
• operating system used;
• referrer URL;
• IP address, where applicable in shortened form;
• requesting internet service provider.

Processing is based on Art. 6(1)(f) GDPR due to our legitimate interest in ensuring the proper operation of the website and improving our services.

We do not normally use these data to identify individual persons.

4. Contacting Us by Contact Form or Email

When you contact us, for example via our contact form or by email, we process the personal data you provide, such as:

• name;
• email address;
• telephone number;
• message content.

The purpose of processing is to handle and respond to your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns pre-contractual measures or an existing contract. In all other cases, processing is based on Art. 6(1)(f) GDPR due to our legitimate interest in properly handling enquiries.

Your data will be deleted once they are no longer required for the purpose for which they were collected, provided that no statutory retention obligations apply.

5. Customer Account

When you create a customer account in our online shop, we process the data you provide, such as:

• name;
• address;
• email address;
• password.

Processing serves to improve your shopping experience and simplify order processing, for example by allowing you to view previous orders or place repeat orders more quickly.

The legal basis is Art. 6(1)(b) GDPR.

You may request the deletion of your customer account at any time. In this case, the data will be deleted unless statutory retention obligations require us to retain them.

6. Processing of Data in Connection with Orders

When you place an order in our online shop, we process your personal data to the extent necessary to process and fulfil your order.

This includes in particular:

• name;
• billing and delivery address;
• email address;
• telephone number, where applicable;
• products ordered;
• prices and payment information.

Providing these data is necessary for the conclusion of the contract. Without them, a contract cannot be concluded.

Processing is based on Art. 6(1)(b) GDPR.

Where necessary for the performance of the contract, data may be disclosed to the following categories of recipients:

• shipping providers;
• payment service providers;
• IT and hosting service providers.

The scope of the data transfer is limited to what is necessary.

7. Payment Service Providers

7.1 PayPal

If you choose PayPal as your payment method, you will be redirected to PayPal’s website.

The payment service provider is:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

PayPal processes your data under its own responsibility in accordance with its privacy policy:

https://www.paypal.com/de/webapps/mpp/ua/privacy-full

The legal basis for integrating PayPal into our website is Art. 6(1)(b) GDPR.

7.2 Bank Transfer / Advance Payment

If you pay by bank transfer or advance payment, we process only the data necessary for payment processing, such as:

• bank details;
• payment reference;
• payment amount.

These data are transmitted to us by your bank.

Processing is based on Art. 6(1)(b) GDPR.

7.3 Apple Pay / Google Pay

If you use Apple Pay or Google Pay, the payment is processed through the relevant provider and the payment method stored with that provider, such as a credit card or bank account.

The respective providers process the data under their own responsibility.

The relevant privacy policies are available at:

Apple:
https://www.apple.com/legal/privacy/de-ww/

Google Pay:
https://policies.google.com/privacy

The legal basis for the integration of these payment methods is Art. 6(1)(b) GDPR.

8. DHL / Deutsche Post Shipping and Automated Shipment Notifications

Orders are shipped using service providers belonging to Deutsche Post DHL Group, in particular:

DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany

Deutsche Post AG
Charles-de-Gaulle-Straße 20
53113 Bonn
Germany

For delivery and, where applicable, shipment tracking, we transmit the data required for this purpose to the relevant shipping provider.

These data may include:

• name;
• delivery address;
• alternative recipient details, where applicable;
• telephone number, where applicable, for example for delivery notifications;
• email address for automated shipment and tracking notifications.

The transfer of data for delivery is based on Art. 6(1)(b) GDPR.

The transmission of your contact details for automated shipment and tracking information is also based on Art. 6(1)(f) GDPR due to our legitimate interest in keeping you informed about the status of your shipment.

DHL or Deutsche Post may use your email address to send information such as:

• shipment announcements;
• delivery updates;
• delivery confirmations.

You may object to the use of your contact details for shipment and tracking information at any time with effect for the future by contacting us or the relevant shipping provider.

This will not affect delivery of the goods, although shipment tracking may then be limited or unavailable.

9. Email Communication and Automated System Emails

We use the email address you provide for communications connected with the performance of the contract, for example:

• order confirmations;
• payment status notifications;
• shipping confirmations;
• information relating to your customer account.

These emails are generated automatically by our shop system.

Email delivery is handled through an external email service provided by Google, for example Google Workspace or Gmail.

Processing is based on Art. 6(1)(b) GDPR because this communication is necessary for the proper performance of the contract.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies, such as local storage.

Cookies are small text files stored on your device.

We distinguish between the following categories.

10.1 Technically Necessary Cookies

These cookies are required to provide essential website and shop functions, such as:

• shopping cart functions;
• login functions;
• language settings.

Without these cookies, the website or ordering process may not function properly or may only be available to a limited extent.

The legal basis is Section 25(2) TDDDG together with Art. 6(1)(b) and/or Art. 6(1)(f) GDPR.

10.2 Statistics, Marketing and Convenience Cookies

With your consent, we also use cookies for statistical and marketing purposes, including web analytics and advertising tracking.

These cookies are only placed if you consent through our cookie consent tool.

You may withdraw or change your consent at any time with effect for the future via the settings in our cookie consent tool.

Details regarding the specific cookies used, including provider, purpose and storage period, as well as your settings and withdrawal options, are available in our cookie consent tool.

You can access the tool at any time via the “Cookie Settings” link on our website.

You may also delete or block cookies in your browser settings. In this case, some functions of the website may no longer be fully available.

11. Web Analytics and Marketing

11.1 Google Analytics

We use the Google Analytics web analytics service.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Analytics uses cookies and similar technologies to analyse your use of the website.

The information generated may be transmitted to and stored on Google servers.

We use Google Analytics with IP anonymisation. Your IP address is generally shortened by Google within the European Union or European Economic Area.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

You may withdraw your consent at any time via our cookie consent tool.

Further information is available at:

https://policies.google.com/privacy

https://support.google.com/analytics/answer/6004245

11.2 Google Tag Manager

We use Google Tag Manager to centrally manage and activate analytics and marketing services, including Google Analytics and Google Ads.

Google Tag Manager generally does not itself set analytics cookies, but serves as a technical system for integrating and managing other services.

The legal basis is Art. 6(1)(f) GDPR due to our legitimate interest in efficiently managing the services integrated into the website.

Where Google Tag Manager is used to activate services that require consent, processing is based on your consent.

11.3 Google Ads Conversion Tracking and Enhanced Conversions

We use Google Ads Conversion Tracking and the “Enhanced Conversions” function.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Google Ads Conversion Tracking allows us to measure whether users perform certain actions on our website after clicking on a Google advertisement, such as completing an order.

This allows us to evaluate the effectiveness of our advertising and optimise our advertising campaigns.

When Enhanced Conversions are used, additional personal data that you have provided to us in connection with an order or another conversion may be processed.

These data may include:

• email address;
• telephone number;
• first and last name;
• postal address.

Before being transmitted to Google, these data are converted using a one-way encryption process known as SHA-256 hashing.

The hashed data are then transmitted to Google.

Google uses the hashed data to compare them with correspondingly hashed data associated with signed-in Google users and to attribute a conversion to a previous interaction with a Google advertisement.

This is intended to improve the accuracy of conversion measurement.

We receive only aggregated reports from Google and do not receive information indicating which specific Google account was associated with a conversion.

Processing and transmission take place only if you have previously consented through our cookie consent tool to the use of Google Ads and the processing of your data for advertising and measurement purposes.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG.

You may withdraw your consent at any time with effect for the future through the settings in our cookie consent tool.

In connection with this processing, data may also be transferred to Google LLC and other affiliated companies or service providers in third countries, particularly the United States.

Google relies, among other mechanisms, on the EU-US Data Privacy Framework and, where applicable, other suitable safeguards for such transfers.

Further information is available at:

https://support.google.com/google-ads/answer/9888656

https://policies.google.com/privacy

11.4 Meta Pixel – Facebook and Instagram

We use the Meta Pixel provided by:

Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland

The Meta Pixel allows us to track the behaviour of visitors after they have clicked on an advertisement displayed on Facebook or Instagram.

It may be used for:

• conversion tracking;
• measuring advertising performance;
• remarketing;
• creating advertising audiences.

Meta may recognise that a user has visited our website or performed a particular action.

We generally receive only aggregated statistical reports. However, Meta may associate the data with the user’s Meta account and use them for its own advertising purposes.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

You may withdraw your consent at any time through our cookie consent tool.

Further information is available at:

https://www.facebook.com/privacy/policy

https://www.facebook.com/business/help/742478679120153

12. Embedded YouTube Videos

We embed videos from YouTube on certain pages.

The provider is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

YouTube videos are generally embedded using privacy-enhanced mode.

However, when you play a video, YouTube may place cookies or use similar technologies and process data relating to your use of the website, including:

• IP address;
• device information;
• browser information;
• pages visited;
• interaction with the video.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

You may withdraw your consent at any time via our cookie consent tool.

Further information is available at:

https://policies.google.com/privacy

13. Google Fonts

This website uses Google Fonts to ensure a consistent and visually appealing display of fonts.

When you visit a page, your browser may load the required fonts from Google servers and store them in the browser cache.

In this process, your IP address may be transmitted to Google.

Processing is based on Art. 6(1)(f) GDPR due to our legitimate interest in the consistent and visually appealing presentation of our website.

14. Storage Period

Unless otherwise stated for a specific processing activity, the following principles apply.

Contract-related data, such as order information and invoices, are stored for the duration of the contractual relationship and subsequently for the applicable statutory retention periods.

Under German commercial and tax law, these retention periods are generally between six and ten years.

Server log files are generally stored for a limited period, for example several weeks, and are then deleted.

Data processed by analytics and marketing services are deleted or anonymised once they are no longer required for their respective purposes, unless statutory retention obligations apply.

15. Rights of Data Subjects

Subject to the applicable legal requirements, you have the following rights:

• right of access pursuant to Art. 15 GDPR;
• right to rectification pursuant to Art. 16 GDPR;
• right to erasure pursuant to Art. 17 GDPR;
• right to restriction of processing pursuant to Art. 18 GDPR;
• right to data portability pursuant to Art. 20 GDPR.

Under Art. 21 GDPR, you also have the right to object to processing based on Art. 6(1)(f) GDPR, including processing based on legitimate interests.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

Where processing is based on consent pursuant to Art. 6(1)(a) GDPR, you may withdraw your consent at any time with effect for the future.

The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, you may contact us using the contact details provided above or in our legal notice.

16. Right to Lodge a Complaint

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is unlawful.