Privacy policy
1) Introduction and Contact Details of the Controller
1.1
We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when using our website. Personal data refers to any information that can be used to personally identify you.
1.2
The controller responsible for data processing on this website under the General Data Protection Regulation (GDPR) is:
Rowka Hauke, Einherjar, Gutenbergstraße 14, 35037 Marburg, Germany, Tel.: +49 155 68030339, Email: info@einherjar.co.
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data.
2) Data Collection When Visiting Our Website
2.1
When you use our website purely for informational purposes, meaning without registering or otherwise transmitting information to us, we collect only the data transmitted by your browser to our server (so-called “server log files”). When you access our website, we collect the following information, which is technically necessary to display the site:
The website visited
Date and time of access
Amount of data sent (bytes)
Source/referral from which you accessed the page
Browser used
Operating system used
IP address used (if applicable, anonymised)
Processing occurs pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in improving the stability and functionality of our website. The data will neither be transferred to third parties nor used otherwise. However, we reserve the right to check the server log files retrospectively if concrete signs of unlawful use arise.
2.2
For security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or enquiries), this website uses SSL or TLS encryption. You can recognise an encrypted connection by “https://” and the padlock symbol in your browser.
3) Hosting & Content Delivery Network
3.1 Shopify
We use the system of the following provider for hosting and displaying website content:
Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)
Data is also processed by:
Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada
All data collected on our website is processed on Shopify’s servers. We have entered into a data processing agreement to ensure the protection of our visitors’ data and to prohibit unauthorised disclosure to third parties.
An adequate level of data protection for transfers to Canada is ensured through an adequacy decision of the European Commission.
3.2 Shopify (CDN Use)
We use a Content Delivery Network by:
Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland
Additionally, data may be transferred to:
Shopify Inc., Ottawa, Canada
Cloudflare Inc., San Francisco, USA
This service allows large media files (graphics, scripts, content) to be delivered faster via regionally distributed servers. Processing occurs based on our legitimate interest under Art. 6(1)(f) GDPR in improving the stability and performance of our website. We have concluded a data processing agreement to ensure protection of visitor data.
Transfers to Canada are protected via EU adequacy decision.
For transfers to the USA, the recipient participates in the EU-US Data Privacy Framework, ensuring adequate protection.
4) Cookies
To make our website attractive and enable certain functions, we use cookies — small text files stored on your device. Some are deleted after closing your browser (“session cookies”), while others remain to store settings (“persistent cookies”). Storage duration can be viewed in your browser settings.
If personal data is processed via cookies, this occurs pursuant to:
Art. 6(1)(b) GDPR for contract fulfilment
Art. 6(1)(a) GDPR for consent
Art. 6(1)(f) GDPR for legitimate interests in optimal function and usability of the site
You can configure your browser to notify you about cookies, allow them individually, or block them entirely. Please note: disabling cookies may restrict website functionality.
5) Contacting Us
When contacting us (e.g. via email or contact form), personal data is processed solely for responding to your enquiry.
Legal basis:
Art. 6(1)(f) GDPR — legitimate interest in answering enquiries
Art. 6(1)(b) GDPR — contract-related communication
Data is deleted when it is clear that the matter has been resolved, unless statutory retention applies.
6) Data Processing When Opening a Customer Account
Under Art. 6(1)(b) GDPR, personal data is collected and processed when you open a customer account. Required data is shown in the registration form.
You may request deletion of your account at any time by contacting the above controller. After deletion, data is removed unless contracts are fully completed, legal retention obligations apply, or legitimate storage interests remain.
7) Use of Customer Data for Direct Advertising
7.1 Subscribing to Our Email Newsletter
When registering for our newsletter, you receive regular updates on our offers. The only mandatory field is your email address; additional details are optional for personalisation.
We use a double-opt-in procedure, meaning you must confirm via a verification link before receiving emails.
Upon confirmation, you grant consent under Art. 6(1)(a) GDPR. We store your IP address, date, and time to track potential misuse. Newsletter data is used exclusively for this purpose.
You may unsubscribe anytime using the link in the email or by contacting us. After unsubscribing, your email is removed unless further use is authorised or legally permitted.
7.2 Email Newsletters to Existing Customers
If you provide your email when purchasing products/services, we may email you offers for similar items. This requires no separate consent under § 7(3) UWG.
Processing is based on our legitimate interest in personalised direct marketing (Art. 6(1)(f) GDPR). You may object at any time, incurring only basic transmission costs. After objection, email advertising will cease.
7.3 Stock Availability Notifications
For items temporarily unavailable, you may register for notification emails.
Only your email address is required. Double-opt-in applies.
Processing is based on consent under Art. 6(1)(a) GDPR.
You may unsubscribe anytime; your email will then be deleted from this list unless further use is authorised.
7.4 Cart Reminder Emails
If you abandon checkout, you may choose to receive a one-time reminder email.
Only your email is required; additional data may personalise messaging.
Double-opt-in applies.
Consent basis: Art. 6(1)(a) GDPR.
You may unsubscribe at any time; we will then delete your email for this purpose.
7.5 Advertising by Postal Mail
Based on our legitimate interest in postal advertising, we may store:
Your name
Postal address
(If provided) title, academic degree, birth year, profession or business type
Processing occurs under Art. 6(1)(f) GDPR. You may object at any time.
8) Data Processing for Order Handling
8.1
Where necessary for fulfilment, we transfer personal data to transport or payment service providers under Art. 6(1)(b) GDPR.
Where updates for digital products are contractually owed, we process contact data solely to fulfil legal notification obligations under Art. 6(1)(c) GDPR.
We also work with external service providers to support order processing; certain data is passed to them as required.
8.2 Use of Payment Service Providers (Payment Services)
PayPal Checkout
This website uses PayPal Checkout, an online payment system from PayPal that consists of PayPal’s own payment methods and local third-party payment options.
When paying via PayPal, credit card via PayPal, direct debit via PayPal, or — if offered — “Pay Later” via PayPal, we transfer your payment data to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”) for payment processing. The transfer is carried out pursuant to Art. 6(1)(b) GDPR and only to the extent necessary for payment processing.
For the payment methods credit card via PayPal, direct debit via PayPal or — if offered — “Pay Later” via PayPal, PayPal reserves the right to perform a credit check. For this purpose, your payment data may be passed on to credit agencies pursuant to Art. 6(1)(f) GDPR based on PayPal’s legitimate interest in assessing your creditworthiness. The result of the credit check regarding the statistical probability of default is used by PayPal to decide on the provision of the respective payment method. The credit report may contain probability values (so-called score values). Where score values are incorporated into the credit report, they are derived from a scientifically recognised mathematical-statistical process. Address data is included among the factors considered. You may object to this processing of your data at any time by notifying PayPal. However, PayPal may still be entitled to process your personal data if necessary for contractual payment processing.
If the PayPal payment option “Invoice Purchase” is available and selected, your payment data will be transferred to PayPal for payment preparation, after which PayPal forwards the data to Ratepay GmbH, Franklinstraße 28–29, 10587 Berlin (“Ratepay”) for payment execution. The legal basis in each case is Art. 6(1)(b) GDPR. In this scenario, Ratepay independently conducts an identity and credit check to determine creditworthiness as described above and transfers your payment data to credit agencies pursuant to Art. 6(1)(f) GDPR based on its legitimate interest in assessing creditworthiness. A list of credit agencies Ratepay may use can be found here: https://www.ratepay.com/legal-payment-creditagencies/
When using a local third-party payment method, your payment data is first transferred to PayPal pursuant to Art. 6(1)(b) GDPR for payment setup. Depending on your selection of a local payment type, PayPal will then forward your payment data for payment execution pursuant to Art. 6(1)(b) GDPR to the respective provider:
Apple Pay (Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
iDeal (Currence Holding BV, Beethovenstraat 300, Amsterdam, Netherlands)
Bancontact (Bancontact Payconiq Company, Rue d’Arlon 82, 1040 Brussels, Belgium)
blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2, 1200 Vienna, Austria)
MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland)
Further information on data protection can be found in PayPal’s privacy policy: https://www.paypal.com/de/legalhub/paypal/privacy-full
Shopify Payments
This website offers one or more online payment methods from the following provider:
Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.
When selecting a payment method offered by this provider where you make advance payment (such as credit card payment), the payment data you provide during the ordering process (including name, address, bank and card details, currency, and transaction number), along with information about your order contents, will be transferred to the provider pursuant to Art. 6(1)(b) GDPR. The data transfer occurs solely for payment processing with the provider and only to the extent necessary.
9) Website Features
9.1 Instagram Plugins
Our website uses plugins from the following social network provider:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
These plugins enable direct interactions with content on the social network.
To enhance the protection of your data when visiting our website, the plugins are initially deactivated using a “2-click” or “Shariff” solution.
This ensures that when accessing a page containing such plugins, no connection to the provider’s servers is established.
Only once you activate the plugins and thereby give consent to the data transfer pursuant to Art. 6(1)(a) GDPR, does your browser establish a direct connection to the provider’s servers. Regardless of whether you are logged into an existing user profile, certain information about your end device (including your IP address), your browser, and your browsing behaviour is transmitted and possibly processed further.
If you are logged into an existing user profile on the provider’s network, interactions performed via the plugins will also be published there and visible to your contacts.
You may revoke your consent at any time by clicking again to deactivate the plugin. The revocation does not affect data already transferred.
Data may additionally be transferred to Meta Platforms Inc., USA.
We have concluded a data processing agreement with the provider to ensure protection of visitor data and prevent unauthorised disclosure.
For transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with EU data protection standards based on an adequacy decision by the European Commission.
9.2 Google Translate
This website uses the Google Translate translation service via an API connection, provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”).
To automatically display translation based on your language selection, your browser connects to Google’s servers. Google uses cookies — text files stored on your device — allowing analysis of your website usage. Information generated by cookies about your use of the site (including truncated IP address) is generally transmitted to and stored on Google servers, including those operated by Google LLC in the USA.
All processing described above — including the placement of cookies for reading device information — is carried out only with your explicit consent pursuant to Art. 6(1)(a) GDPR. You may revoke consent at any time with future effect by disabling this service in our cookie-consent tool.
For data transfers to the USA, Google participates in the EU-US Data Privacy Framework ensuring compliance with EU protection standards.
Further privacy details can be found here: https://business.safety.google/intl/de/privacy/
9.3 ShopSync for Shopify
This website uses the Shopify app “ShopSync,” provided by ShopSync LLC, PO Box 252, Jefferson City, TN 37760, USA.
ShopSync synchronises the newsletter service “Mailchimp” with our Shopify account, so that updates to Mailchimp email lists (e.g. newsletter opt-outs) are automatically reflected in Shopify, and customer data generated through Shopify orders is automatically added to Mailchimp email lists.
In the first case, processing is based on Art. 6(1)(f) GDPR on our legitimate interest in efficient and system-wide management of subscriber records and compliance with legally relevant status changes.
In the second case, transmission to Mailchimp occurs exclusively on the basis of explicit user consent pursuant to Art. 6(1)(a) GDPR after contract conclusion on Shopify. Transferred data includes name, address, email address, and transaction-related data (purchase amount, time, date).
ShopSync does not store or retain transferred data after synchronisation. All information transferred between Shopify and Mailchimp is encrypted via SSL technology.
Synchronisation requires transmission through secure servers hosted by Amazon Web Services in the USA.
More information is available here: https://www.shop-sync.com/privacy-policy
10) Tools and Miscellaneous
10.1 Lexware Office
We use the cloud-based accounting service provided by:
Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany.
The provider processes incoming and outgoing invoices and possibly bank transactions to automatically capture invoices, match them to transactions, and generate financial accounting via a semi-automated process.
If personal data is processed in this context, it is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in efficient organisation and documentation of business processes.
10.2 Cookie Consent Tool
This website uses a cookie-consent tool to obtain valid user consent for cookies and cookie-based applications requiring consent.
The tool appears as an interactive user interface upon page access, where users may grant consent via checkboxes. Cookies/services requiring consent are only activated if the user opts in.
The tool sets technically necessary cookies to store your preferences. Personal data is generally not processed.
If personal data (such as IP address) is processed for logging or assignment of settings, processing occurs pursuant to Art. 6(1)(f) GDPR based on our legitimate interest in compliant, user-specific consent management.
Another legal basis is Art. 6(1)(c) GDPR, as we are legally required to depend on consent for non-essential cookies.
Where necessary, we have concluded a processor agreement to ensure protection of visitor data.
Further information appears in the relevant interface of the consent tool on our website.
11) Data Subject Rights
11.1 Under applicable data protection law, you are entitled to the following rights:
Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to notification (Art. 19 GDPR)
Right to data portability (Art. 20 GDPR)
Right to withdraw consent (Art. 7(3) GDPR)
Right to lodge a complaint (Art. 77 GDPR)
11.2 RIGHT TO OBJECT
IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR LEGITIMATE INTEREST UNDER A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE AFFECTED DATA. HOWEVER, PROCESSING MAY CONTINUE IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS THAT OVERRIDE YOUR INTERESTS, RIGHTS, OR FREEDOMS, OR IF PROCESSING SERVES THE ASSERTION, EXERCISE, OR DEFENCE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO PROCESSING OF YOUR DATA FOR SUCH PURPOSES.
IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING FOR DIRECT MARKETING PURPOSES.
12) Storage Duration of Personal Data
The storage duration depends on the legal basis, processing purpose, and applicable statutory retention periods (e.g., commercial or tax-related obligations).
Where processing is based on consent pursuant to Art. 6(1)(a) GDPR, data is stored until consent is withdrawn.
Where statutory retention obligations apply for data processed pursuant to Art. 6(1)(b) GDPR, data is deleted after expiration unless necessary for fulfilment of contract or unless legitimate interest justifies further storage.
Where processing occurs pursuant to Art. 6(1)(f) GDPR, data is stored until you exercise your right to object under Art. 21(1) GDPR unless overriding legitimate grounds apply or processing is required for legal claims.
Where processing occurs for direct marketing purposes pursuant to Art. 6(1)(f) GDPR, data is stored until you exercise your objection under Art. 21(2) GDPR.
Unless stated otherwise herein, personal data is deleted when it is no longer necessary for the purposes for which it was collected or processed.