Privacy Policy
1. Controller
The controller responsible for processing personal data within the meaning of the General Data Protection Regulation is:
Darwin Mix
trading as Ostsee-Folien
Am Markt 7
23743 Grömitz
Germany
Phone: 0176 31771479
Email: info@ostseefolien.com
2. General information on data processing
We process personal data only to the extent necessary for the provision of our online shop, for processing orders, for communication with customers, for fulfilling legal obligations, or based on effective consent.
Personal data means any information relating to an identified or identifiable natural person. This includes, in particular, name, address, email address, telephone number, order information, payment information, IP address, and technical usage data.
Processing takes place in particular on the basis of:
• Art. 6 para. 1 lit. a GDPR for consent,
• Art. 6 para. 1 lit. b GDPR for the performance of pre-contractual measures and for the fulfillment of contracts,
• Art. 6 para. 1 lit. c GDPR for compliance with legal obligations, and
• Art. 6 para. 1 lit. f GDPR for the protection of legitimate interests.
3. Provision of the online shop and server log data
When you access our online shop, information is automatically processed by the servers and technical systems used.
This may include in particular:
• IP address,
• Date and time of access,
• Accessed page or file,
• Amount of data transferred,
• Browser type and browser version,
• Operating system,
• Previously visited website,
• Device information, and
• Technical error and security information.
Processing takes place to technically provide the online shop, ensure stability and security, prevent misuse, and detect technical errors.
The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, stable, and economic operation of our online shop.
4. Shopify
Our online shop is operated via the e-commerce platform Shopify.
The provider for customers and merchants in the European Economic Area is generally:
Shopify International Limited
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Shopify processes personal data in particular for the technical provision of the online shop, for processing orders, for payment processing, for fraud prevention, for error analysis, and for platform security.
The data processed may include in particular:
• Contact details,
• Delivery and billing address,
• Order and product data,
• Payment and transaction information,
• IP address,
• Device and browser information,
• Cookie and usage data, and
• Communication and support data.
Insofar as Shopify processes personal data on our behalf, this is done on the basis of a data processing agreement.
Shopify may also process data in Canada, the United States, or other countries outside the European Economic Area. Such transfers are made, according to Shopify, on the basis of the applicable legal requirements and appropriate safeguards.
The legal bases for processing are in particular Art. 6 para. 1 lit. b GDPR for the processing of orders, Art. 6 para. 1 lit. f GDPR for the secure operation of the shop, and Art. 6 para. 1 lit. a GDPR, insofar as optional technologies are only used with consent.
5. Orders and contract fulfillment
If you place an order via our online shop, we process the data you provide for the processing and fulfillment of the order.
This includes in particular:
• First and last name,
• Billing address,
• Delivery address,
• Email address,
• Telephone number, if provided or required,
• Products ordered,
• Order number,
• Payment method,
• Payment status,
• Shipping status, and
• Communication data.
Processing is necessary for the performance of the purchase contract. The legal basis is Art. 6 para. 1 lit. b GDPR.
Insofar as data must be retained due to commercial, tax, or other legal regulations, processing is additionally based on Art. 6 para. 1 lit. c GDPR.
6. Customer account
If our online shop allows the creation of a customer account, we process the data provided during registration and use of the account.
This may include name, email address, address, order history, and saved delivery information.
Processing is carried out to provide the customer account and to simplify future order processing on the basis of Art. 6 para. 1 lit. b GDPR.
You can request the deletion of your customer account at any time. Legal retention obligations for orders already placed remain unaffected.
7. Contacting us
If you contact us by email, telephone, or via a contact form, we process the data you provide to process your inquiry.
This may include in particular:
• Name,
• Email address,
• Telephone number,
• Content of the message,
• Order number, and
• Other voluntarily transmitted information.
If the inquiry relates to an existing or potential contract, Art. 6 para. 1 lit. b GDPR is the legal basis.
For other inquiries, processing is based on Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the proper answering of inquiries and communication with customers and interested parties.
8. Payment processing
For payment processing, the necessary data is transmitted to the payment service provider selected by the customer, participating banks, and, if applicable, other payment processing entities.
The transmitted data may include in particular:
• Name,
• Billing address,
• Order number,
• Invoice amount,
• Currency,
• Payment method,
• Email address,
• Transaction data, and
• Technical security information.
The specific payment service providers available are displayed at checkout. When a payment method is selected, the respective payment service provider may process personal data under its own data protection responsibility.
Processing is carried out for the performance of the contract in accordance with Art. 6 para. 1 lit. b GDPR, as well as for fraud and payment default prevention on the basis of Art. 6 para. 1 lit. f GDPR.
Depending on the activated shop configuration, Shopify Payments, Shop Pay, PayPal, Klarna, Apple Pay, Google Pay, or other payment services indicated at checkout may be used.
9. Shipping and delivery
To deliver an order, we transmit the necessary data to the shipping or logistics company commissioned with the delivery.
This includes in particular:
• Name,
• Delivery address,
• Order or shipment number, and
• If applicable, telephone number or email address for delivery notification.
Transmission takes place for the performance of the contract in accordance with Art. 6 para. 1 lit. b GDPR.
The email address or telephone number will only be passed on for parcel notification if this is necessary for delivery or if corresponding consent has been given.
10. Fraud prevention and security
To prevent fraud, abusive orders, payment defaults, and attacks, order, payment, device, network, and usage data may be evaluated.
The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in protecting our company, our customers, and the technical systems used from fraud, misuse, and security risks.
If a payment service provider carries out its own creditworthiness or risk assessment, its data protection information applies in addition.
11. Cookies and similar technologies
Our online shop uses cookies and similar technologies.
Cookies are small text files or information that can be stored or read on the user's end device.
Technically necessary cookies
Technically necessary cookies are used to provide essential functions of the online shop. These include in particular:
• Shopping cart functions,
• Checkout and payment processing,
• Security functions,
• Storage of language settings,
• Session management, and
• Cookie settings.
Insofar as access to the end device is absolutely necessary for the provision of an expressly requested service, this is done in accordance with § 25 para. 2 TDDDG.
The subsequent processing of personal data takes place in particular on the basis of Art. 6 para. 1 lit. b or f GDPR.
Optional cookies and technologies
Cookies and comparable technologies for analysis, statistics, personalization, or marketing purposes are only used if you have previously consented via our consent management.
The legal basis for storing or reading information on your end device is § 25 para. 1 TDDDG. The legal basis for the subsequent processing of personal data is Art. 6 para. 1 lit. a GDPR.
You can revoke or change your consent at any time with effect for the future via the cookie settings.
The legality of the processing carried out until the revocation remains unaffected.
12. Consent management
We use a consent management system to manage your cookie and privacy settings.
In particular, the following information may be stored:
• Date and time of consent,
• Selected settings,
• Consent status,
• Technical device information, and
• A pseudonymous consent ID.
Processing is necessary to document given or rejected consents and to fulfill legal proof obligations.
The legal basis is Art. 6 para. 1 lit. c GDPR in conjunction with legal proof obligations, and additionally Art. 6 para. 1 lit. f GDPR.
13. Shop and usage analysis
Shopify may generate statistical information about usage, orders, shopping carts, and technical processes as part of the technical provision.
Insofar as this processing is necessary for the function, security, or economic management of the shop, it is carried out on the basis of Art. 6 para. 1 lit. f GDPR.
Non-essential analysis and tracking technologies are only used after prior consent.
The specific optional providers used, their purposes, and storage periods are displayed in the cookie settings dialog.
14. Newsletter
If you subscribe to our newsletter, we process your email address to send you information about products, offers, news, and promotions from Ostsee-Folien.
Registration is exclusively based on your consent in accordance with Art. 6 para. 1 lit. a GDPR.
To secure the registration, we may use the so-called double opt-in procedure. In this case, you will receive an email after registration asking you to confirm your registration.
To document consent, the time of registration, the time of confirmation, the IP address, and technical log data may be stored.
You can revoke your consent at any time with effect for the future. For this purpose, you can use the unsubscribe link at the end of each newsletter or contact us at info@ostseefolien.com.
After unsubscribing, your email address will be removed from the active newsletter distribution list, unless there is another legal basis for further storage.
15. Newsletter discount
If a discount code is offered for newsletter registration, it will be provided after successful registration or confirmation according to the specified promotional conditions.
The granting of a discount does not change the fact that newsletter consent can be revoked at any time with effect for the future.
16. Links to social networks
Our online shop may contain links to profiles on social networks, such as Instagram.
With simple links, a connection to the respective provider is generally only established when you click the link.
After clicking, the data protection information and terms of use of the respective platform operator apply.
If, on the other hand, social media content, feeds, videos, or plugins are directly embedded in the online shop, these may only be loaded in accordance with legal requirements and, for non-essential technologies, generally only after your consent.
17. Recipients of personal data
Personal data may be transmitted to the following categories of recipients to the extent necessary:
• Shopify and technical hosting and IT service providers,
• Payment service providers and banks,
• Shipping and logistics companies,
• Newsletter and communication service providers,
• Tax advisors, accounting, and other professional advisors,
• Authorities and public bodies in case of a legal obligation, and
• Analysis or marketing service providers, if effective consent exists.
Data will only be disclosed for other purposes if there is a legal basis or if you have consented.
18. Transfer to third countries
Individual service providers may process personal data outside the European Union and the European Economic Area.
Such a transfer only takes place if the legal requirements are met. This can be based in particular on
• an adequacy decision by the European Commission,
• appropriate standard contractual clauses,
• additional safeguards, or
• another exception provided by law.
.
19. Storage Duration
We only store personal data for as long as necessary for the respective processing purpose or as required by legal retention obligations.
Order, invoice, and booking documents are generally stored in accordance with the legal commercial and tax retention periods. These periods are regularly eight years for certain booking and invoice documents and six years for certain business and commercial correspondence.
Contact inquiries without a contractual relationship are deleted once the inquiry has been fully processed and there are no legal or legitimate reasons for further storage.
Data based on consent will generally be processed until the consent is revoked. After revocation, individual proof data may still be stored until the expiry of statutory limitation periods.
20. Rights of Data Subjects
Within the framework of the legal requirements, you have the following rights in particular:
• Right to information about your stored personal data,
• Right to rectification of inaccurate data,
• Right to erasure of your data,
• Right to restriction of processing,
• Right to data portability,
• Right to object to certain processing operations, and
• Right to withdraw given consent.
Any given consent can be revoked at any time with effect for the future.
To exercise your rights, you can contact us at the following address:
21. Right to Object
If personal data is processed on the basis of Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing at any time for reasons arising from your particular situation.
If personal data is processed for the purpose of direct marketing, you can object to this processing at any time without stating any reasons.
22. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.
The data protection supervisory authority responsible for our company headquarters is:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein
Holstenstraße 98
24103 Kiel
Germany
Telephone: 0431 988-1200
Email: mail@datenschutzzentrum.de
Website: www.datenschutzzentrum.de
23. Obligation to Provide Data
The provision of certain personal data is necessary for the conclusion and performance of an order.
Without the required contact, delivery, and payment data, we cannot process the order and execute the contract.
The provision of additional or voluntary information is not mandatory.
24. Automated Decisions
We generally do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Payment service providers may carry out automated security, fraud, or credit checks under their own responsibility.
25. Data Security
We employ appropriate technical and organizational security measures to protect personal data against loss, manipulation, unauthorized access, and other risks.
Data transfer in the online shop generally takes place encrypted via an SSL or TLS connection.
26. Updates to this Privacy Policy
We may adapt this privacy policy if legal requirements, services used, or technical processes change.
The current version published in the online shop applies.
Status: July 2026