Privacy policy

1. Controller and contact details

The controller responsible for processing your personal data in connection with this online shop is eQuatorial GmbH, represented by its managing directors Daniel Krämer and Christoph Vollmer.

eQuatorial GmbH
Obere Hauptstraße 264
67363 Lustadt
Germany
Telephone: +49 6347 6060030
E-Mail: shop@drakensberg.de

2. General information and legal bases

Personal data means information relating to an identified or identifiable natural person. We process your data for the purposes described below. The main legal bases are your consent (Article 6(1)(a) GDPR), performance of a contract or pre-contractual steps (point (b)), legal obligations (point (c)) and legitimate interests (point (f)). The relevant interest is explained for each processing activity.

Unless stated otherwise, you are not required to provide data. We need the data required for an order to conclude and perform the contract; without it, we cannot process the order. Optional information, marketing consent and a customer account are not conditions of purchase.

3. Shop hosting and server logs

When you visit our website, technical data is processed, including your IP address, access time, requested page, data volume and browser, device and connection information. This processing serves website delivery, troubleshooting and security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is a secure, functioning shop.

Shopify hosts our shop. Shopify International Limited, Ireland, processes shop and order data primarily as a processor. For certain additional services, Shopify may act as a controller. See Shopify’s Consumer Privacy Policy and Data Processing Addendum. Shopify group companies and service providers may process data outside the EEA, particularly in Canada, the USA or Singapore. Shopify provides for binding corporate rules for intra-group EEA transfers; other transfers are protected under its DPA, notably through standard contractual clauses or applicable adequacy decisions.

4. Enquiries by email and contact form

When you contact us, we process the information you provide, such as your name, email address, message and attachments, to handle your enquiry. Contractual and pre-contractual enquiries are processed under Article 6(1)(b) GDPR; other enquiries under Article 6(1)(f) GDPR and our legitimate interest in responding. We delete the data once the enquiry is resolved unless retention duties or other legal grounds require continued storage.

5. Electronic withdrawal function

If you use the electronic withdrawal function, we process your name, information identifying the contract, your electronic contact address, and the content and time of your declaration. This allows us to receive, confirm and process the withdrawal. The legal bases are Article 6(1)(c) GDPR in conjunction with § 356a of the German Civil Code for the statutory function, and Article 6(1)(b) GDPR for reversing the contract. Marketing consent is not required. Data is retained as necessary for processing, statutory evidence or legal claims.

6. Data for personalised products

If we agree a personalised product with you individually and you send us text, images or other templates for that purpose, we process the personal data they contain to fulfil your order under Article 6(1)(b) GDPR. Please submit only content you are entitled to use for this purpose. We do not publish your templates for advertising without a separate legal basis. We retain them only as required to provide the service or meet legal duties.

7. Customer account

If you choose to create a customer account, we process the registration data to provide the account and manage your orders within it. The legal basis is Article 6(1)(b) GDPR for the account functionality you request. You may request deletion of the account at any time. Data required independently for order processing or statutory retention is retained for those purposes.

8. Orders, complaints and guarantee claims

We process your name, billing and delivery addresses, contact details, ordered items and payment and transaction information to conclude and perform purchase contracts. Complaints or guarantee claims may also involve your description of the defect and photographs supplied voluntarily. The legal bases are Article 6(1)(b) GDPR for contracts and guarantees, point (c) for legal obligations, and point (f) for asserting or defending legal claims.

Where necessary, carriers, payment providers, inventory management, IT and, where applicable, fulfilment providers receive the data needed for their tasks. Processors act under appropriate agreements; independent controllers process data under their own legal obligations.

9. Shipping information and inventory management

For separate shipping status emails, we share your email address with the carrier if you have consented. The basis is Article 6(1)(a) GDPR. You may withdraw consent with us or the carrier at any time. Address data needed for delivery is shared independently under Article 6(1)(b) GDPR to perform the contract.

We use plentysystems AG, Johanna-Waescher-Straße 7, 34131 Kassel, Germany, as a processor for inventory and order management. Order and customer data is processed to handle orders, manage inventory and perform contracts under Article 6(1)(b) GDPR.

10. Comments and reviews

If you submit a comment or review, we process your chosen name, email address, text, star rating and any images or videos supplied voluntarily. We publish your display name and review content, including media submitted for publication, but not your email address.

Processing and publication are based on your consent under Article 6(1)(a) GDPR, which you may withdraw at any time. Email addresses and order information may be compared to check whether a review can be linked to a purchase. Review data is retained until consent is withdrawn or the publication purpose ends; necessary evidence may be retained for a limited period to defend legal claims.

11. Judge.me

We use Judge.me Ltd, United Kingdom, to collect, display and verify reviews. Contact and order data, review content, media, and technical device and access data may be processed. Following an order, we automatically send an email review invitation through Judge.me. In particular, your email address and information about the products purchased are used for this purpose. You can object to further review requests at any time by contacting us. Where sending is based on your consent, the legal basis is Article 6(1)(a) GDPR; you can withdraw that consent at any time for the future. Non-essential cookies or similar technologies used by the review service also require consent.

Transfers to the United Kingdom may rely on the relevant adequacy decision. Further transfers, particularly to US subprocessors, are subject to the requirements in “International data transfers”. Information on recipients and safeguards is available in the Judge.me privacy policy.

12. Google Customer Reviews

When the Google Customer Reviews badge is embedded, loading it may transmit data such as IP addresses and browser and device information to Google LLC, USA. The badge displays our ratings. Cookies or further data used for advertising require your consent under § 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw consent at any time. See the international data transfers section for US transfers. Further information: Google Privacy Policy.

13. Newsletter and Klaviyo

If you subscribe to our newsletter, we use your email address and optional registration details to send it on the basis of your consent under Article 6(1)(a) GDPR. You may withdraw consent through the unsubscribe link or by contacting us. We may retain your address in a suppression list to prevent further marketing, based on our legitimate interest under Article 6(1)(f) GDPR. We retain registration and consent evidence where required by law or to defend legal claims.

We use Klaviyo Inc., USA, as a processor to send and manage newsletters. Personalised analysis of opens and clicks using tracking pixels or links takes place only with appropriate consent. Recipient addresses or identifiers, IP addresses, device data and the time and type of interaction may be linked to a profile. Pseudonymisation does not mean anonymisation. § 25(1) TDDDG also applies to device access requiring consent. You may withdraw this consent too. Transfer and safeguard information: Klaviyo Privacy Notice and Data Processing Agreement.

14. Marketing for similar products and postal advertising

We may use the email address obtained when you buy from us to advertise our own similar products, provided you have not objected and we inform you of your right to object when collecting your address and in every marketing email (§ 7(3) UWG). Processing is based on Article 6(1)(f) GDPR and our legitimate interest in direct marketing. You can object at any time using the unsubscribe link or by contacting us, at no cost other than basic transmission charges. We will then stop sending you marketing through this channel.

We may use your name and postal address for postal advertising based on the same legitimate interest. You may object to any direct marketing at any time. A purchase does not require agreement to advertising.

15. Back-in-stock notifications

If you request an alert for an unavailable item, we process your email address and the selected item to notify you of availability with your consent under Article 6(1)(a) GDPR. This does not automatically subscribe you to our newsletter. You may cancel the notification at any time by contacting us. Once the requested message has been sent or consent withdrawn, we remove you from the relevant notification list; necessary records and separate lawful processing remain unaffected.

16. PayPal and PayPal Checkout

If you select a PayPal payment method, we transmit the order, contact and transaction data required for payment to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Our transmission is based on Article 6(1)(b) GDPR. PayPal also processes data as an independent controller, for example to prevent fraud and meet legal obligations.

For certain methods, particularly deferred payment or payment by invoice, PayPal or other participating providers may conduct credit checks using credit reference agencies. Statistical scores, including address data, may be taken into account. As a result, the requested method may not be offered. The payment provider’s own information and rights procedures apply to its processing and any automated decisions.

Necessary device access for the payment function you expressly request is governed by § 25(2) no. 2 TDDDG. Non-essential analytics or marketing access requires consent under § 25(1) TDDDG and Article 6(1)(a) GDPR.

Further information is available in the PayPal Privacy Statement.

17. Shopify Payments, Shop Pay and Klarna

We use Shopify Payments to process payments. Contact, billing, payment and transaction information and technical security data needed for your chosen method are shared with Shopify and participating payment providers. Our transmission is based on Article 6(1)(b) GDPR. Necessary device access for the payment function you expressly request is based on § 25(2) no. 2 TDDDG. Payment providers’ further processing, including security and legal compliance, is described in their privacy notices.

The Shopify Payments provider for Germany is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland. Shopify involves payment processors depending on the payment route. Recipient information is available in the payment processor list and Shopify privacy information.

Through Shopify Payments we offer cards, Apple Pay, Google Pay and local methods such as Bancontact, EPS, iDEAL / Wero and MobilePay where available for your order. Data needed for authorisation is transmitted to the banks, card networks, wallet providers and payment providers involved in your selected route.

If you choose Shop Pay, Shopify processes contact, shipping and payment information for accelerated checkout. Storage for future purchases depends on your use of Shop Pay and its settings. The Shopify Consumer Privacy Policy applies to this separate customer relationship.

If you choose Klarna in Shopify checkout, the identification, contact, order and payment data required for processing is shared with Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may conduct identity, fraud and credit checks for the payment method offered. Availability may depend on the result. See Klarna’s privacy information for its own processing, recipients, automated decisions and your rights.

Transfers outside the EEA are subject to the requirements described in the international transfers section. The specific payment selection and terms are displayed before completion.

18. Cookies and similar technologies

Cookies, local browser storage, pixels and similar technologies may store or access information on your device. Where strictly necessary for a service you expressly request, such as your basket, login or privacy choices, access is based on § 25(2) no. 2 TDDDG. Further personal data processing is based on Article 6(1)(b), (c) or (f) GDPR depending on the purpose. Under point (f), our interest is the secure provision of necessary shop functions.

Non-essential analytics and advertising technologies rely on your consent under § 25(1) TDDDG and Article 6(1)(a) GDPR. You can change your choices and withdraw consent for the future through our website’s privacy settings. Rejecting optional technologies does not prevent purchases. You can also delete or block cookies in your browser, although this may restrict necessary functions. Specific cookie durations and provider information are available in the privacy settings.

19. Managing your consent

We use the cookie management service of iSense LLC / iSenseLabs, USA, to record and document your privacy choices. It stores in particular your consent status, the time of your choice and technical identification information. The basis is Article 6(1)(c) GDPR for demonstrating and managing required consent; necessary storage of your choice on your device is based on § 25(2) no. 2 TDDDG.

US transfers must meet the requirements explained under “International data transfers”. An adequacy decision covering certified US companies does not automatically cover every US provider. Provider information: iSenseLabs Privacy Policy.

20. Google Analytics 4 and Google Signals

We use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse shop usage. It processes page views, interactions, referral sources, browser and device information, approximate location and purchase events. Online identifiers can link activities. The analysis is not anonymous merely because we receive aggregated reports. The bases are your consent under Article 6(1)(a) GDPR and, for device access, § 25(1) TDDDG.

According to Google, EU users’ IP addresses are not logged or stored in Analytics; they are processed, including to derive location, and then deleted.

Where Google Signals is enabled and you have given the relevant consent, additional account-related or cross-device information may be used for advertising and analysis if ads personalisation is enabled in your Google account. You can also control ads personalisation there. Transfers outside the EEA, particularly to Google LLC in the USA, are subject to the international transfers section. Information: Google Privacy Policy and Google Signals.

21. Shopify analytics

Shopify analytics functions may be used to evaluate shop activity. Page and product views, interactions, referral sources and device and browser information are linked through identifiers. Where not necessary to provide an expressly requested function, this analysis relies on your consent under Article 6(1)(a) GDPR and, for device access, § 25(1) TDDDG. Necessary order processing to perform contracts is separate. Provider and transfer details are set out in the shop hosting section. Information: Shopify Cookie Policy.

22. Meta Pixel

We use the Meta Pixel from Meta Platforms Ireland Limited, Ireland, to measure Facebook and Instagram advertising and enable interest-based ads. Data includes page views, purchases, device information, IP addresses and online identifiers. Meta may link it to your Facebook or Instagram account. The bases are your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG.

We and Meta act as joint controllers for the collection and transmission of event data within the agreed scope. The Joint Controller Addendum explains responsibilities: we are responsible in particular for information and lawful integration; Meta handles relevant data subject requests for jointly processed data in particular. You may exercise rights against either party. Meta is responsible for its subsequent processing. US transfers are subject to the safeguards below. Information and account settings: Meta Privacy Policy.

23. Google Ads and remarketing

We use Google Ads from Google Ireland Limited, Ireland, to measure ad performance and for remarketing. Cookies, pixels and online identifiers link ad clicks to later shop actions such as purchases. Data includes click identifiers, timestamps, visited pages, transaction information and device and browser details. Pseudonymous identifiers can also be personal data.

Remarketing enables interest-based advertising to shop visitors on other websites or Google services. Processing and non-essential device access rely on your consent under Article 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw consent in our privacy settings and also manage your Google ad settings. Possible US transfers are described below. Information: Google advertising privacy information.

24. Microsoft Advertising

We use Microsoft Advertising from Microsoft Corporation, USA. Cookies and pixels associate ad clicks with subsequent shop actions. Data includes IP addresses, identifiers, referrers, visited URLs and browser and device information. The purpose is to measure advertising effectiveness.

The bases are your consent under Article 6(1)(a) GDPR and, for non-essential device access, § 25(1) TDDDG. You can withdraw consent at any time in our privacy settings. Data may be transferred to the USA, subject to the international transfers requirements below. Further information: provider privacy information.

25. LinkedIn Insight Tag

We use LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company, Ireland. The service measures conversions and supports retargeting. Data includes IP addresses, timestamps, page events, URLs, referrers and device and browser properties. LinkedIn may link visits to a member account. We receive aggregated reports. You can also control advertising use in your LinkedIn account.

26. Pinterest Tag

We use Pinterest Tag from Pinterest Europe Limited, Ireland. The service measures Pinterest ad performance and enables interest-based advertising. Data includes online identifiers, page and product views, searches, basket contents and purchase events. Pinterest may link this information to your account. Cookies without real names can still contain personal data.

27. Awin

We use Awin from AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany. The affiliate programme attributes purchases to referring advertising partners and enables commission accounting. Cookies and device recognition may be used. Data includes partner and transaction identifiers, order value, product type, voucher information and device information. A numerical identifier is not automatically anonymous.

28. Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Ireland, to manage website tags. Loading it may transmit technical connection data, including your IP address, to Google. Analytics and advertising services triggered through Tag Manager are described in their respective sections and depend on your consent. Where Tag Manager is loaded to provide these optional services, processing is based on Article 6(1)(a) GDPR. Information: Google Tag Manager privacy information.

29. Google reCAPTCHA

Google reCAPTCHA from Google Ireland Limited, Ireland, may be used to protect forms against automated abuse. It analyses IP addresses, browser and device information and interactions to distinguish human entries from automated access. Transfers to Google LLC in the USA are possible. The integration described here relies on your consent under Article 6(1)(a) GDPR and, for relevant device access, § 25(1) TDDDG. Information: Google Privacy Policy.

30. Händlerbund and FairCommerce logos

If the logos are loaded directly from servers of Händlerbund e. V., Kohlgartenstraße 11–13, 04315 Leipzig, Germany, it receives technical access data such as IP addresses, timestamps, file URLs, referrers and browser and operating system information. Processing serves delivery and security of the embedded content under Article 6(1)(f) GDPR and our interest in displaying our memberships. If image files are hosted locally only, merely displaying them does not cause this transfer to Händlerbund.

31. Fonts

When Google Fonts is embedded externally, font files are loaded from Google servers. IP addresses and technical browser information may be transmitted to Google Ireland Limited, Ireland, or Google LLC, USA. The external integration described here relies on your consent under Article 6(1)(a) GDPR; § 25(1) TDDDG also applies where device access requires consent. Locally hosted font files do not connect to Google when loaded. Information: Google Privacy Policy.

32. International data transfers

Some services process data outside the EU or EEA. Where an adequacy decision under Article 45 GDPR covers the recipient and processing, the transfer may rely on it. This includes the United Kingdom and certain commercial organisations in Canada. For the USA, the EU–US Data Privacy Framework applies only to appropriately certified organisations and covered transfers; it does not authorise transfers to every US company.

Without an applicable adequacy decision, appropriate safeguards under Article 46 GDPR are required, notably relevant standard contractual clauses or approved binding corporate rules and additional measures where needed. Marketing consent does not replace these requirements. You can request information about the specific safeguards and a copy using our contact details. Exceptions under Article 49 GDPR apply only where their conditions are met.

33. Retention periods

We retain personal data only as long as needed for the relevant purpose or where a legal basis permits or requires continued retention. Contract, invoice and accounting records are kept in accordance with applicable tax and commercial law. Limited retention until the relevant limitation periods expire may be necessary for legal claims.

Consent-based processing stops for the future when consent is withdrawn; independently necessary consent evidence or suppression lists may remain. Technical logs are deleted or anonymised when no longer needed for security or operations. Specific cookie durations are shown in the privacy settings. Retained data whose original purpose has ended is restricted to the remaining lawful purposes.

34. Your data protection rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and data portability under Articles 15–20 GDPR. You may withdraw consent at any time for the future. Processing before withdrawal remains lawful.

Where automated decisions within Article 22 GDPR are used, you have the rights set out there, including, where relevant exceptions apply, human intervention, expressing your views and contesting the decision. For payment provider decisions, you may also contact the provider directly. To exercise your rights, contact shop@drakensberg.de.

35. Right to object

If we process data under Article 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. This also applies to profiling based on those provisions. We will stop processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing serves legal claims.

You may object to direct marketing at any time without giving reasons. This includes profiling related to direct marketing. We will then stop processing your data for those purposes.

36. Right to lodge a complaint

Under Article 77 GDPR, you may complain to a data protection supervisory authority, particularly in your place of habitual residence, workplace or the place of the alleged infringement. One possible contact is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Postfach 30 40, 55020 Mainz, Germany
Telephone: +49 6131 89200
Email: poststelle@datenschutz.rlp.de
Website: Rhineland-Palatinate data protection authority.