Privacy policy

As at 11 August 2026

1. Data controller

The data controller responsible for the processing of personal data in this online shop is:

Claudia Mehmel-Broadhurst, Empathikon
, Große Nübelstraße 5
, 25348 Glückstadt
, Germany
Telephone: +49 4124 937890
Email: info@empathikon.de

Personal data is any information relating to an identified or identifiable individual.

2. Provision of the shop by Shopify

Our online shop is operated via the Shopify platform. The provider for merchants in the European Economic Area is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. In particular, Shopify provides hosting, shop functions, checkout, customer accounts, security features and technical communication.

When you visit and use the shop, Shopify processes data necessary for the provision and security of the service. This may include IP addresses, device and browser data, the date and time of access, pages viewed, referrer URLs, cookie and session IDs, as well as details relating to the shopping basket, account, order and payment.

This processing is carried out for the purpose of taking pre-contractual measures and fulfilling the contract in accordance with Article 6(1)(b) of the GDPR, as well as to safeguard our legitimate interests in maintaining a secure, stable and user-friendly online shop in accordance with Article 6(1)(f) of the GDPR.

Shopify may also process data in Canada, the USA and other countries outside the European Economic Area. According to Shopify, it uses the applicable legal transfer mechanisms for such transfers, in particular adequacy decisions and standard contractual clauses. Further information can be found in Shopify’s privacy policy.

3. Technical access data and security

Whenever you visit the shop, technically necessary access data is processed. This includes, in particular, the IP address, the time and destination of the access, the volume of data transferred, the browser type, the operating system, the referrer URL, and error and security information.

We process this data to provide the website, detect malfunctions, ward off attacks and ensure technical security. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and trouble-free operation of the shop. The data will be deleted or anonymised as soon as it is no longer required for these purposes, provided that no legal obligations or the investigation of a security incident require it to be stored for a longer period.

4. Orders, customer account and contract fulfilment

When you place an order, create a customer account or arrange for a return or complaint to be processed, we process the data you provide and any data generated in the process. This may include your name, billing and delivery addresses, email address, telephone number, customer account, goods ordered, prices, payment method, payment status, dispatch details, messages, returns and complaints.

This processing is necessary for the initiation and performance of the contract. The legal basis is Article 6(1)(b) of the GDPR. Where we are required to retain or use data to fulfil obligations under commercial, tax or consumer protection law, the legal basis is Article 6(1)(c) of the GDPR.

Creating a customer account is voluntary. You can manage the data stored there using the account functions provided by Shopify. Data that must be retained by law for completed orders remains unaffected by the deletion of an account.

5. Payment processing

The available payment methods are displayed at checkout. Depending on your selection, the data required for the payment will be transmitted to Shopify Payments, PayPal or the selected card or wallet service. Supported wallets may include, in particular, Shop Pay, Apple Pay and Google Pay. The respective payment service processes data in accordance with its own privacy policy.

The data transmitted may include your name, billing address, email address, order value, currency, order number, payment status and the payment details required for authorisation. We do not, as a rule, receive full card or account details, but only the confirmation and status information required to process the order.

The legal basis is Article 6(1)(b) of the GDPR. Where payment data is processed for the purpose of fraud prevention, this is also based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in preventing unauthorised or fraudulent transactions.

6. Dispatch and Delivery

For the purposes of delivery, we transfer the necessary data – in particular your name, delivery address and, where applicable, contact details – to the selected delivery company. We primarily use DHL or Deutsche Post for delivery. The legal basis is Article 6(1)(b) of the GDPR.

7. Contact, withdrawal and complaints

If you contact us by email, telephone, via the contact form or by any other means, we process your details in order to respond to your enquiry. This typically includes contact details, the content and time of the message, and, where applicable, order and contract details.

For contract-related enquiries, the legal basis is Article 6(1)(b) of the GDPR. For other enquiries, the legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the proper handling of your enquiry. We process business correspondence that is subject to statutory retention requirements on the basis of Article 6(1)(c) of the GDPR.

For the electronic withdrawal function, we use the Shopify app Revoq from BuschBytes, Hofstraße 2–4, 51061 Cologne, Germany. If you use this function, the following data in particular will be processed: your order reference, the contact and order details required for allocation, the content of the withdrawal notice, and technical access data. The app matches the declaration with the order, documents its receipt and sends the acknowledgement of receipt. The legal bases are Article 6(1)(b) and (c) of the GDPR.

8. Invoices and order documents

We use Order Printer Pro for invoices, delivery notes and other order documents. The app retrieves the necessary shop, order, customer and product data from Shopify and generates or sends the relevant documents. The legal basis for this is Article 6(1)(b) and (c) of the GDPR. Information on processing by the provider can be found in Order Printer Pro’s privacy policy.

9. Newsletter

If you subscribe to our newsletter, we process your email address and the data required to verify your subscription in order to send you the newsletter. The legal basis is your consent under Article 6(1)(a) of the GDPR.

You may withdraw your consent at any time with future effect, in particular via the unsubscribe link in every newsletter email or by sending a message to info@empathikon.de. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected. After you unsubscribe, we will retain the evidence required to document your consent only for as long as is necessary to defend against any potential claims.

10. Cookies and similar technologies

Shopify and integrated services use cookies and similar technologies. Technologies that are technically essential enable, in particular, the shopping basket, checkout, login, security, language settings and the storage of your privacy preferences. No consent is required for these accesses under Section 25(2) of the TDDDG. The subsequent processing of personal data is based, depending on the purpose, on Article 6(1)(b) or (f) of the GDPR.

We only use optional analytics or marketing technologies if you have given your consent via the cookie banner. The legal bases are Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

You may amend or withdraw your consent at any time with future effect. To do so, click on the ‘Cookie settings’ link in the shop’s footer. Rejecting optional technologies does not prevent you from using the shop’s basic functions.

11. Google Analytics 4

With your consent, we use Google Analytics 4, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics processes information about your use of the shop, such as pages visited, interactions, approximate location, device and browser information, referrer URL, and cookie and online identifiers.

This processing helps us to understand how the shop is used and to improve our offering. The legal bases are Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You may withdraw your consent at any time via ‘Cookie Settings’.

Google may also transfer data to Google LLC and other recipients in the USA. According to Google, such transfers are based on the applicable legal transfer mechanisms. Further information can be found in Google’s privacy policy.

12. Recipients and data processors

We only disclose personal data where this is necessary for the purposes described, where there is a legal obligation to do so, or where you have given your consent. Recipients may include, in particular:

  • Shopify and its technical sub-contractors,
  • payment service providers and banks,
  • Shipping and logistics companies,
  • providers of the Shopify apps we use,
  • IT, hosting, communications and analytics service providers,
  • tax advisers, legal advisers, public authorities and other bodies, where required by law.

Service providers who process data exclusively on our behalf are engaged in accordance with the requirements of Article 28 of the GDPR.

13. Transfers to third countries

Some service providers or their sub-processors process data outside the European Economic Area. A transfer will only take place if the conditions set out in Articles 44 to 49 of the GDPR are met. Depending on the recipient, we base the transfer in particular on an adequacy decision by the European Commission, effective standard contractual clauses or a statutory exception.

You can request further information on the safeguards used in each case at info@empathikon.de.

14. Retention period

We store personal data only for as long as is necessary for the respective purpose. We retain data relating to orders, payments, invoices and business correspondence in accordance with the statutory time limits under commercial and tax law. We generally retain data relating to enquiries until the matter has been fully resolved and, beyond that, only to the extent required by legal obligations, limitation periods or legitimate interests.

Where processing is based on consent, we process the data until consent is withdrawn, unless another legal basis or obligation to retain evidence permits further storage. Specific technical retention periods for cookies are set out in the relevant cookie settings displayed.

15. Your rights

In accordance with the statutory requirements, you have, in particular, the right to

  • access under Article 15 of the GDPR,
  • rectification under Article 16 of the GDPR,
  • erasure under Article 17 of the GDPR,
  • restriction of processing under Article 18 of the GDPR,
  • data portability under Article 20 of the GDPR,
  • Objection to processing under Article 21 of the GDPR,
  • Withdrawal of consent with effect for the future under Article 7(3) of the GDPR.

To exercise your rights, simply send an email to info@empathikon.de.

Right to object: Where we process data on the basis of Article 6(1)(f) of the GDPR, you may object at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:

State Commissioner for Data Protection, Schleswig-Holstein
Independent State Centre for Data Protection, Schleswig-Holstein
Holstenstraße 98
24103 Kiel
Telephone: +49 431 988-1200
Email: mail@datenschutzzentrum.de
Website: www.datenschutzzentrum.de

17. Automated decision-making

We do not make any decisions based solely on automated processing that have legal effects on you or similarly significantly affect you. Payment and platform providers may carry out automated security and fraud checks in accordance with their own terms and conditions.

18. Changes to this Privacy Policy

We will update this Privacy Policy if there are changes to the services we use, our processing activities or legal requirements. The current version published on the shop’s website applies.