Privacy Policy

Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither required by law or contract nor necessary to conclude a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This applies only insofar as no other statement is made regarding the subsequent processing operations.
"Personal data" means all information relating to an identified or identifiable natural person.

If applicable, your data is transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. An adequacy decision by the EU Commission exists for Canada. For the USA, an adequacy decision by the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission's standard contractual clauses.

Contact

Data Controller
Feel free to contact us. The data controller is: KGP Commerce UG, BELZIGER STRAßE 69-71, 10823 Berlin Germany, info@kgpack.de

Customer Initiating Contact via Email
If you initiate business contact with us via email, we only collect your personal data (name, email address, message text) to the extent you provide it. The data processing is used to process and respond to your contact request.
If the contact is used to carry out pre-contractual measures (e.g., advice on purchase interest, creation of an offer) or concerns a contract already concluded between you and us, this data processing is based on Art. 6(1)(b) GDPR.
If the contact is made for other reasons, this data processing is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in processing and responding to your request. In this case, you have the right to object at any time to this processing of personal data based on Art. 6(1)(f) GDPR for reasons arising from your particular situation.
We only use your email address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have agreed to further processing and use.

Collection and Processing When Using the Contact Form
When using the contact form, we only collect your personal data (name, email address, message text) to the extent you provide it. The data processing serves the purpose of contacting you.
If the contact is used to carry out pre-contractual measures (e.g., advice on purchase interest, creation of an offer) or concerns a contract already concluded between you and us, this data processing is based on Art. 6(1)(b) GDPR.
If the contact is made for other reasons, this data processing is based on Art. 6(1)(f) GDPR due to our overriding legitimate interest in processing and responding to your request. In this case, you have the right to object at any time to this processing of personal data based on Art. 6(1)(f) GDPR for reasons arising from your particular situation.
We only use your email address to process your request. Your data will then be deleted in compliance with statutory retention periods, unless you have agreed to further processing and use.

Disclosure to Third-Party Providers (Plugin Use)
To technically provide and manage the revocation function on our online presence, we use a software solution from the third-party provider Händlerbund Legal GmbH, Kohlgartenstraße 11-13, 04315 Leipzig, within the framework of data processing on behalf. The plugin allows you to submit your declaration of revocation immediately via the revocation button if you have concluded a contract with us via our website. For this purpose, technically necessary cookies are used and the following information is collected: encrypted session ID.

If applicable, your data is transferred to third countries such as the USA. An adequacy decision by the EU Commission exists for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). If the providers are not certified under the TADPF, the data transfer to the USA is based on standard contractual clauses as suitable safeguards for the protection of personal data, viewable at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de.

Your collected personal data is transferred to the servers of the third-party providers mentioned above when using the revocation function.

The use of cookies or comparable technologies is based on § 25(2) TDDDG. Further information on data protection can be found at: https://www.haendlerbund.de/de/datenschutzerklaerung

Collection and Processing When Sending Images via Email
You have the option to send us images via email in connection with ordering a personalized product.
By submitting your images, we may collect your personal data (depiction of an identifiable person) only to the extent you provide it. The data processing serves the purpose of creating personalized products. The submitted image serves as a template for the product and is used for this purpose (e.g., T-shirt printing). The processing is based on Art. 6(1)(b) GDPR and is required to fulfill a contract with you.
Your data is not disclosed.
We only use the image you submitted within the scope of providing the service. Your data will then be deleted in compliance with statutory retention periods, unless you have agreed to further processing and use.

Customer Account Orders

Customer Account
When opening a customer account, we collect your personal data to the extent stated therein. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is based on Art. 6(1)(a) GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out based on consent up to the point of revocation. Your customer account will then be deleted.

If applicable, your data is transferred to third countries outside the EU, in particular to Canada and the USA, and processed there. An adequacy decision by the EU Commission exists for Canada. For the USA, an adequacy decision by the EU Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission's standard contractual clauses.

Reviews Advertising

Use of email address to send newsletters
We use your email address to send you information and offers via newsletter, provided you have expressly consented to this. The data processing is solely for the purpose of direct marketing. For this purpose, we process your email address and, if applicable, other data that you have voluntarily provided when signing up for our newsletter.
Processing is based on Art. 6(1)(a) GDPR and your consent. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out based on consent up to the time of withdrawal.
You can unsubscribe from the newsletter at any time by using the appropriate link in the newsletter or by notifying us. Your email address will then be removed from the mailing list. Despite removal from the mailing list, we may continue to store your email address in a so-called blacklist to prevent you from receiving newsletter emails from us in the future. This storage is based on Art. 6(1)(f) GDPR and our and your legitimate interest in preventing the repeated use of your email address to send you our newsletter. You have the right to object to this processing of personal data affecting you at any time for reasons arising from your particular situation.

Use of Klaviyo
We use the service of Klaviyo Inc. (125 Summer St Floor 7, Boston, MA 02111, USA; “Klaviyo”) for sending newsletters under a data processing agreement.
We pass on the information you provided when signing up for the newsletter (email address, first and last name, if applicable) to Klaviyo. The data processing serves the purpose of sending newsletters and evaluating them statistically.
To evaluate newsletter campaigns, the sent newsletters contain a 1x1 pixel graphic (tracking pixel) or a tracking link. This allows us to determine whether you have opened the newsletter and whether you have clicked any embedded links. In this context, we collect your personal data, such as your IP address, browser type, device, and the time. Usage profiles can be created from this data using a pseudonym. The collected data is not used to personally identify you. The collected data is used solely for statistical evaluation to improve newsletter campaigns.
Your data is generally transmitted to and stored on Klaviyo servers in the USA. An adequacy decision by the European Commission exists for the USA, namely the Trans-Atlantic Data Privacy Framework (TADPF). Klaviyo has certified itself under the TADPF and thus committed to complying with European data protection principles.
The processing of your personal data is based on Art. 6(1)(f) GDPR and our overriding legitimate interest in a targeted, advertising-effective, and user-friendly newsletter system. You have the right to object to this processing of personal data affecting you at any time for reasons arising from your particular situation.
More information about data protection at Klaviyo can be found at https://www.klaviyo.com/legal/privacy-notice as well as at https://www.klaviyo.com/legal/data-processing-agreement.

Payment service provider

Use of PayPal
We use the PayPal payment service provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of being able to offer you payment via the payment service. By selecting and using payment via PayPal, the data required to process the payment is transmitted to PayPal so that we can fulfill the contract with you using the selected payment method. This processing is based on Art. 6(1)(b) GDPR.

All PayPal transactions are subject to the PayPal Privacy Statement. You can find it at https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Use of Shopify Payments
We use the "Shopify Payments" payment service provided by Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website. In this case, payment processing is carried out by the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; "Stripe"). The data processing serves the purpose of being able to offer you payment via the Shopify Payments payment service. By selecting and using a corresponding "Shopify Payments" payment method, the data required to process the payment is transmitted to Stripe so that we can fulfill the contract with you using the selected payment method. This processing is based on Art. 6(1)(b) GDPR.
Stripe reserves the right, if applicable, to obtain a credit report based on mathematical-statistical methods using credit reporting agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit reporting agency and uses the information received about the statistical probability of a payment default to make a balanced decision on establishing, carrying out, or terminating the contractual relationship. The credit report may contain probability values (scores) calculated based on scientifically recognized mathematical-statistical methods, and address data is among other things included in their calculation. Your legitimate interests will be taken into account in accordance with legal provisions. The data processing serves the purpose of a credit check for initiating a contract. The processing is based on Art. 6(1)(f) GDPR and our overriding legitimate interest in protection against payment default when Stripe provides credit.
You have the right to object to this processing of personal data affecting you based on Art. 6(1)(f) GDPR at any time by notifying Stripe. The provision of data is required to conclude the contract with the payment method you request. Failure to provide it will result in the contract not being concluded with the payment method you have chosen.
More information about data processing when using the Shopify Payments payment service can be found in the Shopify Privacy Statement at: https://www.shopify.com/de/legal/datenschutz.
More information about data processing when payment is processed via the payment service provider Stripe can be found in the Stripe Privacy Statement at: https://stripe.com/de/privacy.

Use of the Shopify Consent Tool (Shopify Privacy & Compliance)
We use the “Shopify Privacy & Compliance” consent tool from Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website. Shopify is a company affiliated with Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).
The tool allows you to grant consent to data processing on the website, in particular the setting of cookies, as well as to exercise your right of withdrawal for consents already granted. The data processing serves the purpose of obtaining and documenting necessary consents to data processing and thus complying with legal obligations. Cookies may be used for this purpose. User information, including your IP address, is collected and transmitted to Shopify.
Your data may be transmitted to and processed in third countries outside the EU, in particular to Canada and the USA. An adequacy decision by the European Commission exists for Canada. An adequacy decision by the European Commission exists for the USA, namely the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transmission is based on contractual obligations comparable to those of the European Commission's Standard Contractual Clauses.
The data processing is based on Art. 6(1)(c) GDPR to fulfill a legal obligation.
More information about data protection at Shopify can be found at https://www.shopify.com/de/legal/datenschutz.

Analysis Advertising Tracking Communication

Use of Google Analytics 4
We use the Google Analytics web analysis service from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”) on our website.
The data processing serves the purpose of analyzing this website and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the collected information on behalf of the operator of this website to evaluate your use of the website, to compile reports on website activities, and to provide further services related to website and internet use to the website operator.
Among other things, the following information may be collected: IP address, date and time of the page visit, click path, information about the browser and device you use, visited pages, referrer URL (the website through which you accessed our website), location data, purchasing activities. Google may combine your data with other data, such as your search history, your personal accounts, your usage data from other devices, and all other data Google has about you.

The IP address is truncated by Google within the member states of the European Union or in other member states of the Agreement on the European Economic Area beforehand.

The processing of your personal data is based on Art. 6(1)(a) GDPR and your consent. You can withdraw your consent at any time without affecting the lawfulness of the processing carried out based on consent up to the time of withdrawal.

The information generated thereby about your use of this website is generally transmitted to a Google server in the USA and stored there. An adequacy decision by the European Commission exists for the USA, namely the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and thus committed to complying with European data protection principles. Both Google and US government authorities have access to your data.

More information about terms of use and data protection can be found at https://policies.google.com/technologies/partner-sites, https://policies.google.com/privacy?hl=de&gl=de, and https://business.safety.google/privacy/.

Plugins and Other Items

Use of YouTube
We use the YouTube video embedding feature provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “YouTube”) on our website. YouTube is a company affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
The feature displays videos hosted on YouTube in an iFrame on the website. The “Enhanced Privacy Mode” option is activated. Therefore, YouTube does not store any information about the visitors to the website. Only when you watch a video is information about it transmitted to YouTube and stored there. If applicable, your data will be transmitted to the USA. There is an adequacy decision by the European Commission for the USA, the Trans-Atlantic Data Privacy Framework (TADPF). YouTube has certified itself under the TADPF and thus committed to complying with European data protection principles.
The use of cookies or similar technologies is carried out with your consent on the basis of Section 25(1) Sentence 1 of the TDDDG in conjunction with Art. 6(1) lit. a GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1) lit. a GDPR. You can revoke your consent at any time without affecting the lawfulness of the processing carried out based on the consent up to the time of revocation.
Further information on the collection and use of data by YouTube and Google, your rights in this regard, and options to protect your privacy can be found in YouTube's privacy notices at https://www.youtube.com/t/privacy.

Data Subject Rights and Retention Period

Retention Period
After the contract has been fully fulfilled, the data will initially be stored for the duration of the warranty period, and then, taking into account statutory, in particular tax and commercial law retention periods, and then deleted after the expiry of the period, unless you have agreed to further processing and use.

Rights of the Data Subject
Subject to the statutory requirements, you have the following rights under Art. 15 to 20 GDPR: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability.
In addition, under Art. 21(1) GDPR, you have the right to object to processing based on Art. 6(1) lit. f GDPR, as well as to processing for direct marketing purposes.

Right to Complain to the Supervisory Authority
Pursuant to Art. 77 GDPR, you have the right to complain to the supervisory authority if you believe that the processing of your personal data is not lawful.

You can file a complaint, among others, with the supervisory authority responsible for us, which you can contact using the following contact details:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Friedrichstr. 219
Visitor entrance: Puttkamerstr. 16 – 18 (5th Floor)
10969 Berlin
Tel.: +49 30 138890
Fax: +49 30 2155050
E-mail: mailbox@datenschutz-berlin.de

Right to Object
If the personal data processing listed here is based on our legitimate interest under Art. 6(1) lit. f GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation, with effect for the future.
Once an objection has been raised, the processing of the data concerned will cease, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.