Privacy policy

This English translation is provided for convenience only. Only the German version is legally binding.

Last updated: 6 November 2026

This privacy policy explains which personal data we process when you visit our online shop at superollie.com (including the English version at superollie.com/en), place an order with us or contact us, for what purposes and on what legal basis we do so, and what rights you have. Personal data means any information relating to an identified or identifiable natural person, for example a name, postal address, email address or IP address.

1. Controller and contact person

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Ollie UG (haftungsbeschränkt)
Charlotte-Temming-Str. 1
44135 Dortmund
Germany

Represented by its managing directors Dennis Madalinski and Mike Andretzki
Telephone: +49 155 67119403
Email: info@superollie.com
Commercial register: Dortmund Local Court (Amtsgericht Dortmund), HRB 37964

Further details can be found in our legal notice. In this privacy policy, ‘we’, ‘us’ and ‘our’ refer to Ollie UG (haftungsbeschränkt).

Data protection officer: We are not legally required to appoint a data protection officer and have not appointed one. Your contact person for all questions about data protection and for exercising your rights is Mr Dennis Madalinski, who can be reached at the address above or by email at info@superollie.com.

2. General information on data processing

2.1 Legal bases

We only process personal data where the law permits us to do so. For each processing activity, we state the relevant legal basis. The following legal bases are particularly relevant:

  • Article 6(1)(a) GDPR – you have given consent to the processing for one or more specific purposes.
  • Article 6(1)(b) GDPR – the processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.
  • Article 6(1)(c) GDPR – the processing is necessary for compliance with a legal obligation to which we are subject (for example retention obligations under commercial and tax law, or the obligations relating to the electronic withdrawal function).
  • Article 6(1)(f) GDPR – the processing is necessary for the purposes of our legitimate interests or those of a third party, unless your interests, fundamental rights and freedoms override them. You have a right to object to processing on this basis (see section 16).
  • Section 25(1) TDDDG – information is stored on your device (for example cookies), or information already stored there is accessed, on the basis of your consent.
  • Section 25(2) no. 2 TDDDG – storing or accessing information is permitted without consent where this is strictly necessary for us to provide a digital service that you have expressly requested (for example the shopping cart or the checkout).

The German Telecommunications Digital Services Data Protection Act (TDDDG) only governs access to your device. The subsequent processing of any personal data obtained in this way is governed by the legal bases of the GDPR listed above.

2.2 Recipients of personal data

We only share personal data where this is necessary for the purposes set out in this privacy policy. Recipients may include:

  • Processors (Article 28 GDPR): service providers that process data solely on our instructions and with which we have concluded the contracts required by law, in particular Shopify (shop system, hosting, sending of emails), IONOS (email mailbox) and Google (Google Analytics).
  • Independent controllers: organisations that process data under their own responsibility, such as payment service providers, Amazon and parcel carriers for shipping, advertising platforms (Google, Meta, TikTok) and WhatsApp. Their processing is governed by the respective providers’ privacy notices, which we refer to in the individual sections.
  • Joint controllers (Article 26 GDPR): where we jointly determine the purposes and means of processing with a provider, we point this out in the relevant sections (see section 12).
  • Public authorities (for example tax authorities, courts, law enforcement authorities) where we are legally obliged to disclose data, as well as advisers bound by confidentiality (for example for accounting, tax or legal advice) where this is necessary to fulfil our obligations or to establish, exercise or defend legal claims.

We do not sell your personal data.

2.3 Transfers to third countries

Some of the providers we use are based outside the European Union (EU) and the European Economic Area (EEA), or belong to groups of companies headquartered in third countries, in particular in the United States and Canada. Data is only transferred to a third country where the requirements of Articles 44 et seq. GDPR are met, in particular:

  • on the basis of an adequacy decision of the European Commission (Article 45 GDPR), for example for Canada (commercial organisations) or for the United States where the recipient is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023),
  • on the basis of the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR), or
  • on the basis of binding corporate rules (Article 47 GDPR).

For each service, we state which safeguard the provider says it relies on. In countries without an adequacy decision, there is a risk, despite such safeguards, that authorities may access the data and that it may be more difficult for you to enforce your rights there.

2.4 Storage period and erasure

We only store personal data for as long as is necessary for the relevant purpose or for as long as your consent is in place. Once the purpose no longer applies or you withdraw your consent, we erase the data unless there is a statutory retention obligation or we need the data to establish, exercise or defend legal claims. In such cases, we restrict the processing and erase the data once the relevant period has expired.

Under commercial and tax law (section 257 of the German Commercial Code (HGB), section 147 of the German Fiscal Code (AO) and section 14b of the German VAT Act (UStG), each in the version applicable since 1 January 2025), we retain in particular:

  • for ten years: books and records, inventories, annual financial statements, management reports and opening balance sheets,
  • for eight years: accounting vouchers, for example invoices and payment records,
  • for six years: commercial and business letters received and copies of commercial and business letters sent (for example business emails relating to an order), as well as other documents relevant for tax purposes.

Each period begins at the end of the calendar year in which the document was created or the letter was received or sent. Where data is needed to defend or enforce claims, we generally store it until the statutory limitation period has expired, which is usually three years from the end of the calendar year in which the claim arose (sections 195 and 199 of the German Civil Code (BGB)).

2.5 Obligation to provide data

You are not legally required to provide personal data. However, to conclude and perform a purchase contract, we need the information marked as mandatory in the order form; without this information we cannot accept your order. Any further information is voluntary.

2.6 No automated decision-making

We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Payment service providers may carry out automated checks under their own responsibility as part of payment processing, for example to prevent fraud (see section 6). If a payment method is declined as a result, you can choose another payment method or contact us.

2.7 Data security

Our shop transmits data in encrypted form (SSL/TLS). You can recognise this by ‘https://’ and the padlock symbol in your browser’s address bar. In addition, we and our service providers take technical and organisational measures to protect your data against loss, misuse and unauthorised access.

3. Hosting and shop system (Shopify)

3.1 Shopify as processor

Our online shop is operated and hosted on the e-commerce platform Shopify. Our contractual partner is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (‘Shopify’), a member of the Shopify group whose parent company, Shopify Inc., is based in Canada.

Shopify is used, among other things, to deliver the website, to provide the shopping cart and checkout, to manage customer accounts and orders, to transmit forms and to send emails. In doing so, Shopify processes on our behalf all data that you enter in the shop or that arises from your use of it. This is based on Shopify’s data processing addendum (https://www.shopify.com/legal/dpa).

The legal basis is Article 6(1)(b) GDPR where the processing serves to prepare or perform a contract, and otherwise Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and cost-effective operation of our online shop.

Shopify may transfer data to Shopify Inc. in Canada and to sub-processors, including in the United States. According to Shopify, such transfers are based on its binding corporate rules, on the European Commission’s adequacy decision for Canada and on standard contractual clauses. Further information can be found in Shopify’s privacy policy: https://www.shopify.com/legal/privacy.

3.2 Server log files

Each time you access our shop, your browser automatically transmits information to Shopify’s servers. This includes in particular your IP address, the date and time of access, the page or file accessed, the amount of data transferred, the status code, the previously visited page (referrer), the browser type and version, and the operating system. This data is needed to deliver the website, to ensure its stability and security, and to detect and prevent attacks or misuse. We do not use this data to draw conclusions about you as a person.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest follows from the purposes stated. Where information is read from your device in this context, this is permitted under section 25(2) no. 2 TDDDG. Shopify only stores the log data for as long as is necessary for these purposes and then erases or anonymises it.

3.3 Shopify as an independent controller (Shop Pay and Shopify Network Intelligence)

In some cases, Shopify processes data not on our behalf but for its own purposes and under its own responsibility:

  • Shop Pay: if you use Shop Pay at checkout, the data in your Shop account is governed by Shopify’s consumer privacy policy (see section 6.2).
  • Shopify Network Intelligence: we have enabled the ‘Shopify Network Intelligence’ feature in our shop. With this feature, Shopify securely uses our shop’s customer data together with data from other merchants and its own data to generate insights for enhanced features, in particular for analytics, product improvement, ad targeting and personalisation. Other merchants do not have access to your data. Shopify is an independent controller for this processing. According to Shopify, data relating to visitors who decline non-essential cookies or object to the sharing of their data is not used for advertising or other non-essential purposes within Network Intelligence.

The legal basis for making data available to Shopify within Network Intelligence is Article 6(1)(f) GDPR. Our legitimate interest is in being able to use the platform features that rely on it. Where the data is used for advertising or personalisation, this only takes place on the basis of your consent in the cookie banner (Article 6(1)(a) GDPR, section 25(1) TDDDG). You can object to this processing at any time, either to us or via Shopify’s privacy portal (https://privacy.shopify.com/en). Further information can be found in Shopify’s consumer privacy policy: https://www.shopify.com/legal/privacy/consumers.

4. Cookies and consent management

4.1 What are cookies?

Cookies are small text files that are stored on your device when you visit a website. Similar technologies include, for example, your browser’s local storage and session storage, pixels and scripts that read information from your device. Below, we use the term ‘cookies’ for all of these technologies. Some cookies are deleted when your visit ends (session cookies), while others remain stored for a set period. You can delete or block cookies at any time in your browser settings; some features of the shop may then not be available.

4.2 Strictly necessary cookies

Some cookies are strictly necessary for the shop to work, for example to store the contents of your shopping cart, to process the checkout, to take account of your country and language, to ensure security and to store your cookie choices. Examples of such Shopify cookies are ‘_shopify_essential’, ‘cart’, ‘localization’ and ‘_shopify_cmp’ (which stores your consent choice for up to one year). We do not need your consent for these cookies (section 25(2) no. 2 TDDDG). The related processing of data is based on Article 6(1)(b) GDPR where it serves to process your order, and otherwise on Article 6(1)(f) GDPR (our interest in a functional and secure shop). Storing your consent choice is additionally based on Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR (proof of consent).

4.3 Cookies that require consent

We only use all other cookies and similar technologies, in particular for preferences, statistics and analytics, and marketing (sections 12 and 13), if you have given your consent beforehand (section 25(1) TDDDG, Article 6(1)(a) GDPR). Without your consent, the services concerned are not loaded.

4.4 Shopify cookie banner

To manage your consent, we use Shopify’s cookie banner with its automated privacy settings. The banner is shown to visitors from EU member states when they first visit the shop. In the banner, you can accept all categories, reject all non-essential cookies or make your choice for each category. Your choice is stored in the ‘_shopify_cmp’ cookie so that the banner does not reappear every time you open a page. Shopify only loads the services we have integrated via Shopify apps once you have accepted the category each of them requires.

4.5 Withdrawing or changing your consent

You can withdraw your consent or change your choice at any time with effect for the future. To do so, click the ‘Cookie settings’ link in the footer of any page; the cookie banner will then open again. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4.6 Google Consent Mode

We use Google’s consent mode (Google Consent Mode). This passes the choice you make in the cookie banner on to the Google services we use (Google Analytics, Google Ads). The Google services only set cookies and process data for analytics or advertising purposes if you have accepted the relevant category. Without your consent, no data is transmitted to Google. If you change your choice later, the status in consent mode is updated accordingly. The provider is Google Ireland Limited (see section 12.3).

4.7 ‘Privacy settings’ page

We also provide Shopify’s ‘Privacy settings’ page. There, you can use a form to object to the sharing of your personal data for targeted advertising (opt-out). The page is mainly intended for visitors from US states with corresponding privacy laws. A ‘Global Privacy Control’ (GPC) signal sent by your browser is treated there as an opt-out. The legal basis for processing the details you enter in the form (in particular your email address) is Article 6(1)(f) GDPR; our legitimate interest lies in implementing your objection and complying with the privacy laws that apply to visitors from the United States. The form is protected by hCaptcha (see section 14). Irrespective of this, the following applies to visitors from the EU: we only use non-essential cookies and tracking with your consent.

5. Orders and performance of the contract

5.1 Ordering in the shop

When you place an order with us, we process the data you enter at checkout or that arises in connection with the order. This includes:

  • contact details: first and last name, email address, delivery and billing address, telephone number where applicable and, for businesses, the company name,
  • order details: products ordered, quantity, prices, shipping method, shipping costs, order number, date and time of the order,
  • payment details: chosen payment method, payment status and transaction number (we do not receive full card details, see section 6),
  • communication about the order, for example queries, withdrawals, returns and warranty claims.

We use this data to conclude and perform the contract, that is to confirm your order, ship the goods, process the payment, keep you informed about the status of your order, and handle withdrawals, returns and warranty claims. The legal basis is Article 6(1)(b) GDPR. If you order on behalf of a business, we process your data as a contact person on the basis of Article 6(1)(f) GDPR; our legitimate interest lies in performing the contract with the business. Invoices and other documents are retained on the basis of Article 6(1)(c) GDPR (see section 2.4).

At checkout, you can also voluntarily consent to receiving our newsletter (see section 11). Your order does not depend on this.

5.2 Customer account

You can create a customer account if you wish. The customer account is provided by Shopify at https://account.superollie.com. You sign in without a password, using a one-time code sent to your email address. In the customer account, we process your email address, your name, saved addresses, your telephone number where applicable and your order history. This allows you to view your orders and manage your details. The legal basis is Article 6(1)(b) GDPR. You can ask us to delete your customer account at any time by emailing info@superollie.com. Data that we are required to retain is blocked until the relevant periods have expired and then erased.

5.3 Guest checkout

You can also place an order as a guest without a customer account. In this case, too, Shopify stores your order and the related contact details so that we can process the order and handle queries, withdrawals or warranty claims. The legal basis is Article 6(1)(b) GDPR.

5.4 Fraud prevention

To protect against payment defaults and misuse, Shopify and the payment service providers automatically check orders and payments for signs of fraud, for example on the basis of the IP address, payment details and address details. If there is an increased risk, we review the order manually before fulfilling it. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in preventing fraud. We do not carry out our own credit checks.

5.5 Storage period

We store contract data until the contract has been fully performed and until the warranty and limitation periods have expired. After that, we retain the documents required by law until the end of the retention periods (in particular eight years for invoices and other accounting vouchers and six years for business letters, see section 2.4). We store data in the customer account until you ask us to delete the account.

6. Payment service providers

To process payments, we pass on the necessary data to the relevant payment service provider. We do not store your full card or account details; they are processed directly by the payment service providers. The legal basis is Article 6(1)(b) GDPR, Article 6(1)(f) GDPR for fraud prevention and Article 6(1)(c) GDPR for the payment service providers’ legal obligations (for example to prevent money laundering). We only offer the payment methods listed below.

6.1 Shopify Payments (credit and debit card, Apple Pay, Google Pay and other payment methods)

We process payments by credit or debit card, Apple Pay and Google Pay via Shopify Payments. The service is provided by Shopify International Limited (for the address, see section 3.1). The actual payment processing is carried out by payment processors selected by Shopify; for Germany, Shopify currently lists Stripe Payments Europe, Limited (Dublin, Ireland), PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) and Adyen N.V. (Amsterdam, Netherlands). The card schemes and the bank that issued your card are also involved. For card payments, your bank may require additional confirmation (strong customer authentication, for example 3-D Secure).

The data processed includes in particular your name, billing address, email address, card details (card number, expiry date, security code) or a payment token, the amount, currency and order number, as well as technical data such as your IP address and device information. Shopify acts as our processor for customer payment data. The payment processors partly process data under their own responsibility, for example to prevent fraud and to comply with legal obligations. Stripe states that it complies with the EU-US Data Privacy Framework. Further information:

Apple Pay and Google Pay: if you use Apple Pay or Google Pay, you authorise the payment in Apple’s or Google’s wallet. The respective provider is responsible for the processing in the wallet: for Apple Pay, the relevant subsidiary of Apple Inc., and for Google Pay, Google Ireland Limited for users in the EEA. Your card number is not passed on to us; we only receive the details needed for the order (for example your name, delivery address and email address) if you take them from the wallet. Further information: Apple (https://www.apple.com/de/legal/privacy/data/de/apple-pay/) and Google (https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de).

Other payment methods via Shopify Payments: Depending on the delivery country, we also offer Bancontact, Bizum, BLIK, eps bank transfer, MB WAY, MobilePay and Satispay. For these, you are redirected to the respective payment provider or your bank to confirm the payment; they process the payment under their own responsibility in accordance with their privacy notices. We only receive information on whether the payment was successful. The legal basis is Art. 6(1)(b) GDPR.

6.2 Shop Pay

Shop Pay is an accelerated checkout provided by Shopify. If you use Shop Pay, you can save your email address, telephone number, delivery details and payment details in a Shop account and reuse them for later purchases after confirming with a one-time code. Shopify is an independent controller for the data in your Shop account; Shopify’s consumer privacy policy applies (https://www.shopify.com/legal/privacy/consumers). The payment itself is processed via Shopify Payments (section 6.1). We receive the data needed for the order from Shopify. The legal basis for our processing is Article 6(1)(b) GDPR.

6.3 PayPal

If you pay with PayPal, you are redirected to PayPal after clicking ‘Pay now’. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (‘PayPal’). We transmit to PayPal the data needed for the payment, in particular your name, address, email address, order number, amount and, where applicable, details of the items ordered. PayPal processes the data under its own responsibility. According to PayPal, it may exchange data with credit reference agencies and fraud prevention bodies in order to verify your identity, prevent fraud and, where applicable, assess your creditworthiness. We have no influence on this; PayPal only tells us whether the payment was successful. According to PayPal, it relies on intra-group agreements and standard contractual clauses for transfers to third countries. Further information: https://www.paypal.com/de/legalhub/paypal/privacy-full. The legal basis is Article 6(1)(b) GDPR.

6.4 Klarna

If you pay with Klarna (for example by invoice, instalments or immediate payment, depending on what is offered at checkout), you are redirected to Klarna. The provider is Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”). We transmit the data required for the payment to Klarna, in particular your name, address, email address, phone number where applicable, order number, amount and details of the items ordered. Klarna processes the data under its own responsibility. According to Klarna, depending on the payment method, it carries out identity, credit and fraud checks and receives information from credit reference agencies for this purpose. We have no influence on this. Further information: https://www.klarna.com/de/datenschutz/. The legal basis is Art. 6(1)(b) GDPR.

7. Shipping via Amazon Multi-Channel Fulfillment and parcel carriers

Our products are stored in Amazon fulfilment centres and shipped via the Amazon Multi-Channel Fulfillment service. Our contractual partner is Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg (‘Amazon’). After you place your order, the data needed for shipping is automatically transmitted from Shopify to Amazon: your name, your delivery address, the order contents (items and quantity), the order number and the chosen shipping method. Amazon picks, packs and ships the goods. Amazon selects the parcel carrier and passes on to it the data needed for delivery. The tracking number is reported back to Shopify so that we can inform you about the shipment.

The legal basis is Article 6(1)(b) GDPR. Amazon and the parcel carriers process the data in order to provide their services; where they pursue their own purposes in doing so, they are responsible themselves. Information on data protection at Amazon can be found at https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010, and information from the parcel carriers in their privacy notices. We ourselves transmit the shipping data to Amazon in Luxembourg, that is within the EU.

Should we ship orders ourselves from Dortmund in future, we will pass on the same data to the shipping company we instruct. For the storage period, see section 5.5.

8. Contacting us

8.1 Email and telephone

If you contact us by email or telephone, we process the information you provide (for example your name, email address or telephone number, the content of your enquiry and the time of contact) in order to deal with your request. For telephone enquiries, we may make a note of the content of the conversation where this is necessary to deal with your request. The legal basis is Article 6(1)(b) GDPR if your enquiry relates to a contract or to entering into one, and otherwise Article 6(1)(f) GDPR; our legitimate interest lies in answering your enquiry.

8.2 Contact form

Using our contact form, you can send us your name (optional), your email address (mandatory) and your message. The information is sent via Shopify by email to our mailbox info@superollie.com (for IONOS, see section 10). The purpose and legal basis are the same as in section 8.1.

8.3 Partner and B2B enquiry form

With the form for partner and retailer enquiries, we process the subject, your name, company, address, email address, telephone number (optional), the type of your business and your message. We use this information to review your enquiry, to reply to you and, where appropriate, to establish a business relationship. The legal basis is Article 6(1)(b) GDPR (pre-contractual steps), or Article 6(1)(f) GDPR where you act on behalf of a business; our legitimate interest lies in handling business enquiries. The information is transmitted as described in section 8.2.

8.4 Product service form

On our product service page, which you can also reach via the QR code on our products, you can send us questions or feedback about a product. We process the selected product, your name, your email address, your message and, optionally, your Amazon order number and the batch or LOT number. The order and batch numbers help us to match your enquiry to an order or production batch. We use the information to deal with your request, to follow up complaints and to look into indications of possible product problems. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a contract with us, and otherwise Article 6(1)(f) GDPR; our legitimate interest lies in good product service and product safety. The information is transmitted as described in section 8.2.

Please only give us information about your health where this is necessary for your request. If you choose to provide such information, for example when reporting an adverse reaction, we process it solely to deal with your request, to fulfil our obligations as a manufacturer and, where applicable, to establish, exercise or defend legal claims (Article 9(2)(f) GDPR), or on the basis of your explicit consent (Article 9(2)(a) GDPR).

8.5 WhatsApp

On the product service page, we provide a link that you can use to write to us via WhatsApp, for example to send photos. When you click the link, WhatsApp opens with our telephone number and a pre-written message; no data is transmitted to WhatsApp before you click. If you write to us, we process your telephone number, your WhatsApp profile name and, depending on your settings, your profile picture, as well as the time and content of your messages, including any photos you send.

For users in Europe, WhatsApp is provided by WhatsApp Ireland Limited, Dublin, Ireland. When you use the service, WhatsApp processes data under its own responsibility, in particular metadata such as your telephone number, timestamps and device information. According to WhatsApp, the content of personal messages is end-to-end encrypted. WhatsApp also transfers data to third countries, in particular to companies of the Meta group in the United States. Further information: https://www.whatsapp.com/legal/privacy-policy-eea.

Using WhatsApp is voluntary. You can always reach us by email, form or telephone instead. The legal basis for our processing is Article 6(1)(b) GDPR where your enquiry concerns a contract, and otherwise Article 6(1)(f) GDPR; our legitimate interest lies in offering you a simple means of communication that you have chosen yourself.

8.6 Storage period for enquiries

We delete enquiries and the related communication once your request has been fully dealt with and no retention obligations apply. If the communication concerns a contract, we retain it as a business letter for up to six years (see section 2.4). We store indications of possible product problems for as long as this is necessary to fulfil our obligations as a manufacturer or to defend claims.

9. Electronic withdrawal function (‘Withdraw from contract’)

Consumers can withdraw from their contract online using the ‘Withdraw from contract’ button, which is linked in the footer of every page (‘Withdraw from contract’ page). No customer account is needed for this. In the form, we process your first and last name, your order number, optionally the individual items if you only withdraw from part of the order, and the email address to which we should send the confirmation of receipt. In addition, the date and time of receipt, the language and the page accessed are processed.

After you click ‘Confirm withdrawal’, your declaration is sent via our shop’s contact form (Shopify, see section 3) to our mailbox info@superollie.com at IONOS (see section 10). We will send you a confirmation of receipt by email without delay, containing the content of your withdrawal and the date and time of receipt. So that the confirmation can be displayed on the page after submission, the information is briefly placed in your browser’s session storage and removed from there once it has been displayed (section 25(2) no. 2 TDDDG).

The purpose of the processing is to receive and document your withdrawal, to send the confirmation of receipt required by law and to unwind the contract. The legal basis is Article 6(1)(c) GDPR in conjunction with section 356a BGB and, for unwinding the contract, Article 6(1)(c) GDPR in conjunction with sections 355 and 357 BGB.

We store your declaration of withdrawal and the confirmation of receipt as evidence until the limitation periods have expired and, as they are business letters, for up to six years (see section 2.4). We retain records of refunds as accounting vouchers for eight years. The message in our mailbox is the authoritative record.

10. Email mailbox (IONOS) and transactional emails

10.1 Email mailbox and domain

Our email mailbox info@superollie.com and our domain are provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. All emails you send us, as well as messages from our forms and the copies of confirmations of receipt, are stored on IONOS servers. IONOS acts as our processor. The legal basis is Article 6(1)(b) or (f) GDPR (see section 8). Further information: https://www.ionos.de/datenschutzerklaerung.

10.2 Transactional emails

We send emails relating to your order and your customer account, for example the order confirmation, the shipping confirmation and sign-in codes, via Shopify. In doing so, Shopify processes your email address, your name and the order details on our behalf. The legal basis is Article 6(1)(b) GDPR. You will receive these emails regardless of whether you have subscribed to our newsletter.

11. Newsletter (Shopify Messaging)

If you sign up for our newsletter, we will inform you by email about our products, offers, guides and news. You can sign up using the sign-up form in the shop or the tick box at checkout. Only your email address is mandatory.

Double opt-in and logging: after signing up, you will receive an email asking you to confirm your subscription via a link. We only add you to the mailing list after you have confirmed. We store the time of sign-up and confirmation, the source of the sign-up and your consent status so that we can prove your consent.

Sending service: we send the newsletter using Shopify Messaging (formerly Shopify Email), a Shopify service (section 3.1) that acts as our processor in this respect.

Open and click tracking: our newsletters contain technical elements (a tracking pixel and personalised links) that record whether and when an email was opened and which links were clicked. We use this analysis to understand which content interests you and to improve our newsletter. This tracking is covered by your consent to the newsletter. You can only object to it together with the newsletter, that is by unsubscribing; if you disable the automatic loading of images in your email program, opening the email will not be recorded.

Legal basis: Article 6(1)(a) GDPR and, where your device is accessed when the email is opened, section 25(1) TDDDG. Logging of the sign-up is based on Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR.

Unsubscribing: you can unsubscribe from the newsletter at any time, using the unsubscribe link in every newsletter email or by writing to info@superollie.com. After you unsubscribe, we remove your email address from the mailing list. To make sure we do not accidentally send you advertising again and to be able to prove your earlier consent, we store your email address and the sign-up records for up to three years after the end of the year in which you unsubscribed (Article 6(1)(f) GDPR).

12. Analytics and marketing (only with your consent)

12.1 General

We only use the following services if you have accepted the relevant category (statistics/analytics or marketing) in the cookie banner. The Google, Meta and TikTok services are integrated via the respective Shopify apps. Shopify only loads their pixels after you have given consent; the server-side transmission of events from Shopify to the providers (Conversions API and Events API) also only takes place if you have given consent.

The legal basis is your consent (Article 6(1)(a) GDPR, section 25(1) TDDDG). You can withdraw your consent at any time via the ‘Cookie settings’ link in the footer of any page (section 4.5). The providers named are based in Ireland but belong to international groups and also transfer data to third countries; details are given for each service. Depending on the cookie, the lifetime of the cookies set ranges from the duration of the session to up to two years; we give examples for the individual services. Data stored by the providers themselves is deleted in accordance with their deletion periods.

12.2 Shopify statistics and marketing cookies

With your consent, Shopify sets its own analytics and marketing cookies (for example ‘_shopify_analytics’ and ‘_shopify_marketing’, each with a lifetime of up to one year). These record information about your visit, such as pages viewed, time spent, where you came from, your device, your approximate location and actions in the shopping cart and checkout. We use the resulting statistics to improve our shop and our advertising. Shopify processes this data on our behalf (section 3.1) and, within Network Intelligence, under its own responsibility (section 3.3).

12.3 Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland (‘Google’). Google Analytics records how visitors use our shop, for example pages viewed, time spent, where visitors came from, device and browser information, and events such as viewing a product, adding it to the cart, starting the checkout and purchases, including order value and products. A randomly generated identifier is stored in a cookie for recognition purposes (for example ‘_ga’, lifetime two years). According to Google, Google Analytics does not log or store the IP addresses of users in the EU but uses them only to derive an approximate location and then discards them.

We use the reports to improve our shop and our range. Google acts as our processor for Google Analytics. User-level and event-level data is automatically deleted after the retention period we have set, which is no longer than 14 months. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-US Data Privacy Framework, and Google additionally relies on standard contractual clauses. Further information: https://policies.google.com/privacy.

12.4 Google Ads (conversion tracking and remarketing)

We use Google Ads to advertise our products on Google, on YouTube and on Google’s partner websites. The provider is Google (section 12.3).

  • Conversion tracking: if you reach our shop via a Google ad, it is recorded whether you then carry out certain actions, for example a purchase. This allows us to measure how successful our ads are. Cookies are set for this purpose (for example ‘_gcl_’ cookies, lifetime 90 days).
  • Remarketing: we may show visitors to our shop ads for our products on other websites and in Google services. Google uses cookies and identifiers for this (for example the ‘IDE’ cookie, lifetime 13 months in the EEA). If your browser is linked to your Google account, Google may associate the information with your account.

The data processed includes in particular event data (for example products viewed, cart, purchase and order value), cookie identifiers, information about the ad click, device and browser information and your IP address. If the ‘enhanced conversions’ feature is enabled, your email address and, where applicable, other contact details are also transmitted in hashed (pseudonymised) form so that conversions can be attributed more accurately. Under its terms, Google is an independent controller for Google Ads. Data may be transferred to the United States; Google LLC is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy and https://business.safety.google/privacy/.

12.5 Google Merchant Center (Shopify app ‘Google & YouTube’)

Via the Shopify app ‘Google & YouTube’, we transmit our product data (for example titles, images, prices and availability) to Google Merchant Center so that our products can be shown in Google Search, Google Shopping and on YouTube. This product data does not contain any personal data. Google Analytics and Google Ads are also connected to our shop via the app (sections 12.3 and 12.4); data about your visit is only collected with your consent. If you click on one of our products on Google, Google processes your data under its own responsibility in accordance with its privacy policy.

12.6 Meta Pixel and Conversions API (Facebook and Instagram)

Via the Shopify app ‘Facebook & Instagram’, we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (‘Meta’). The Meta Pixel is loaded in your browser; via the Conversions API, Shopify also transmits events directly from server to server to Meta.

The data processed includes in particular events in our shop (for example page views, products viewed, adding to cart, starting the checkout and purchases, including order value, currency and products), your IP address, browser and device information, cookie identifiers (for example ‘_fbp’, lifetime 90 days) and information about an ad click. To improve matching, your name, email address, telephone number and location details (for example town or city, postcode, country) may also be transmitted; these are hashed (pseudonymised) before transmission. Meta may associate this information with your Facebook or Instagram account if you have one.

The purposes are to measure the success of our ads, to build audiences (for example visitors to our shop or users similar to them) and to deliver advertising on Facebook, Instagram and in Meta’s advertising network.

Joint controllership: we and Meta are joint controllers (Article 26 GDPR) for the collection of data in our shop using the Meta Business Tools and its transmission to Meta. For this purpose, we have concluded an agreement with Meta that forms part of the Meta Business Tools Terms (Controller Addendum: https://www.facebook.com/legal/controller_addendum). It sets out who fulfils which obligations under the GDPR. We are responsible in particular for informing you about this processing and for obtaining your consent. The subsequent processing of the transmitted data by Meta takes place under Meta’s sole responsibility. You can exercise your rights (section 16) against both us and Meta. Information on data processing by Meta: https://www.facebook.com/privacy/policy/.

Meta also transfers data to Meta Platforms, Inc. in the United States. According to Meta, Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework; Meta additionally relies on standard contractual clauses.

12.7 TikTok Pixel and Events API

Via the Shopify app ‘TikTok’, we use the TikTok Pixel and the Events API of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (‘TikTok’). The pixel is loaded in your browser; via the Events API, Shopify also transmits events directly from server to server to TikTok.

The data processed includes in particular events in our shop (for example page views, products viewed, adding to cart, starting the checkout and purchases, including order value), your IP address, browser and device information, cookie identifiers (for example ‘_ttp’, ‘ttclid’ and ‘ttcsid’, each with a lifetime of up to 13 months) and information about an ad click. To improve matching, your email address and telephone number may also be transmitted in hashed (pseudonymised) form. TikTok may associate this information with your TikTok account if you have one. The purposes are to measure the success of our ads, to build audiences and to deliver advertising on TikTok.

TikTok also processes the transmitted data for its own purposes and is an independent controller in this respect. To the extent that we and TikTok are joint controllers for the collection and transmission of the data under TikTok’s terms (Article 26 GDPR), we are responsible for informing you and obtaining your consent; the further processing takes place under TikTok’s sole responsibility. You can exercise your rights against both us and TikTok.

TikTok also transfers data to countries outside the EEA, including countries without an adequacy decision, and, according to findings of the Irish Data Protection Commission, also allows access from China. According to TikTok, such transfers are based on standard contractual clauses. Please note that the level of data protection in these countries may be lower and that authorities may be able to access the data. Further information: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

13. YouTube videos

On some pages, we embed videos from the YouTube platform. The provider is Google Ireland Limited (section 12.3). Wherever possible, the videos are embedded in privacy-enhanced mode via the youtube-nocookie.com domain. According to Google, watching a video embedded in this way then influences neither your recommendations on YouTube nor the advertising shown to you outside our website.

A video is only loaded once you have accepted the marketing category in the cookie banner or actively click on the video after a corresponding notice. Only then is data transmitted to Google, in particular your IP address, the page accessed, device and browser information and your interactions with the video; cookies or similar technologies may also be stored on your device. If you are signed in to your Google account, Google may associate this information with your account. Google processes this data under its own responsibility.

The legal basis is your consent (Article 6(1)(a) GDPR, section 25(1) TDDDG), which you can withdraw at any time via the ‘Cookie settings’. Data may be transferred to Google LLC in the United States, which is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy.

14. Spam protection with hCaptcha

To protect against spam and abusive automated requests, Shopify uses the hCaptcha service on the ‘Privacy settings’ page (opt-out form) and, where enabled in the Shopify settings, on other forms such as the contact form. The provider is Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA.

hCaptcha checks whether an input comes from a human or from an automated program. For this purpose, it processes in particular your IP address, browser and device information, timestamps, the page accessed and your interaction behaviour (for example mouse movements, keyboard and touch input); cookies or similar technologies may be used. You may be asked to solve a short task.

The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in protecting our forms against misuse. Access to your device is permitted under section 25(2) no. 2 TDDDG because it is strictly necessary for the use of the form that you have requested. Intuition Machines processes the data on behalf of others in order to provide the service; where the company processes data for its own purposes, it is responsible itself. According to its own information, Intuition Machines, Inc. is certified under the EU-US Data Privacy Framework and additionally relies on standard contractual clauses. Further information: https://www.hcaptcha.com/privacy.

15. Links to Amazon and social networks

In our shop, you will find links to Amazon.de, for example to review a product, and to Amazon.com. We may also link to our profiles on social networks. These are simple links: no data is transmitted to these providers when you visit our pages. Only when you click a link are you taken to the provider’s website, and the provider then processes data under its own responsibility, such as your IP address and, if you are signed in, your account data. Reviews on Amazon are governed by Amazon’s terms and privacy notice (https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010); we only see what you publish there publicly. The respective operator is primarily responsible for the processing that takes place when you visit our profiles on social networks; details can be found in its privacy notices.

16. Your rights

Under the GDPR, you have the following rights, provided that the relevant legal requirements are met:

  • access to the personal data we process about you and a copy of that data (Article 15 GDPR),
  • rectification of inaccurate data and completion of incomplete data (Article 16 GDPR),
  • erasure of your data (Article 17 GDPR), unless a retention obligation or another legal reason prevents this,
  • restriction of processing (Article 18 GDPR),
  • data portability, that is receiving the data you have provided to us in a structured, commonly used and machine-readable format, or having it transmitted to another controller (Article 20 GDPR),
  • withdrawal of consent at any time with effect for the future (Article 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object under Article 21 GDPR

Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where we process your data for direct marketing purposes, you can object at any time without giving reasons; this also applies to profiling related to such marketing. Following your objection, we will no longer use your data for direct marketing purposes.

To exercise your rights, an informal message to the contact details given in section 1 is sufficient, for example an email to info@superollie.com. To ensure that we do not disclose data to unauthorised persons, we may ask you to prove your identity.

Right to lodge a complaint with a supervisory authority: you have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Postal address: PO Box 20 04 44, 40102 Düsseldorf, Germany
Telephone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de

17. Changes to this privacy policy

We will update this privacy policy if our data processing, the services we use or the legal situation change. The version published on this page applies. The English version of this privacy policy is a translation provided for information purposes; the German version is authoritative.

Last updated: 6 November 2026