Privacy policy

Personal data means any information relating to an identified or identifiable natural person.

3. Provision of Our Online Shop (Shopify)

Our online shop is operated using the e commerce platform Shopify.

Provider:
Shopify Inc.
151 O’Connor Street, Ground Floor
Ottawa, Ontario K2P 2L8
Canada

Shopify provides the technical infrastructure through which we offer our products and services. In this context, Shopify processes personal data on our behalf as a processor in accordance with Article 28 GDPR.

Further information on data processing by Shopify can be found at:
https://privacy.shopify.com/

4. What personal data do we process?

Depending on how you use our website and online shop, we may process the following categories of personal data:

a) Contact and Identification Data

• First and last name

• Billing and shipping address

• Telephone number

• Email address

b) Order and Contract Data

• Ordered products

• Order numbers

• Delivery status

• Return and exchange information

• Order history

c) Payment Data

Payment processing is carried out exclusively by external payment service providers.

We do not receive or store full payment details such as credit card numbers or bank account information.

d) Usage and Technical Data

• IP address

• Browser type and version

• Operating system

• Date and time of access

• Pages visited

This data is processed to ensure technical stability, IT security, and to optimize our services.

5. Purposes of Data Processing

Personal data is processed for the following purposes:

• Processing and fulfillment of orders and deliveries

• Payment processing

• Customer communication and support

• Handling inquiries and requests

• Managing customer accounts

• Improving and optimizing our online services

• Ensuring IT and data security

• Compliance with legal obligations

6. Legal Basis for Processing

Personal data is processed on the basis of the following legal grounds:

• Article 6 paragraph 1 lit. b GDPR (performance of a contract or pre contractual measures)

• Article 6 paragraph 1 lit. c GDPR (compliance with a legal obligation)

• Article 6 paragraph 1 lit. f GDPR (legitimate interests)

• Article 6 paragraph 1 lit. a GDPR (consent), where applicable

7. Payment Service Providers

To process payments, we use the following payment service providers:

Mollie

Provider:
Mollie B.V.
Keizersgracht 313
1016 EE Amsterdam
Netherlands

When selecting a payment method via Mollie, the data required for payment processing is transmitted to Mollie.

Further information: https://www.mollie.com/legal/privacy

Shopify Payments

Provider:
Shopify International Ltd.
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4
Ireland

When using Shopify Payments, the data required for payment processing is transmitted to Shopify.

Further information: https://www.shopify.com/legal/privacy

8. Data Transfers

Personal data is only disclosed to third parties where this is necessary for contract performance or required by law, in particular to:

• Payment service providers (Mollie, Shopify Payments)

• Shipping and logistics service providers

• IT and hosting service providers

• Shopify as the platform provider

Personal data is not transferred for advertising or marketing purposes without your explicit consent.

9. International Data Transfers

When using Shopify, personal data may be transferred to third countries, including Canada and the United States.

Shopify ensures an adequate level of data protection in accordance with Articles 44 et seq. GDPR, in particular through the use of the European Commission’s Standard Contractual Clauses.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies to ensure functionality, security, and analysis of website usage.

Further information about cookies and consent options can be found in our cookie banner and related notices.

11. Data Retention

Personal data is stored only for as long as necessary to fulfill the respective purposes or as required by statutory retention obligations.

12. Your Rights as a Data Subject

You have the right to:

• Access your personal data (Article 15 GDPR)

• Rectification of inaccurate data (Article 16 GDPR)

• Erasure of personal data (Article 17 GDPR)

• Restriction of processing (Article 18 GDPR)

• Data portability (Article 20 GDPR)

• Object to processing (Article 21 GDPR)

• Withdraw consent at any time, where processing is based on consent

To exercise your rights, please contact us at: cs@herzens.com

13. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority.

The competent authority is generally the supervisory authority of your place of residence or of our company’s registered office.

14. Data Security

We implement appropriate technical and organizational measures to protect personal data against loss, destruction, unauthorized access, alteration, or disclosure.

15. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy where necessary due to legal, technical, or organizational changes.

The current version of this Privacy Policy is always available on our website.