Privacy policy
Privacy Policy
Holzspielzeug & Kunstgewerbe, Inh. Katrin Ulbricht | Bergmannsweg 15, 09548 Kurort Seiffen
Tel.: +49 (0) 37362-8412 | Fax: +49 (0) 37362-17125 | info@firma-ulbricht.de | VAT ID: DE 165826146
1. Controller & Data Protection Officer
Responsible for the processing of personal data on this website and in the associated online shop:
Holzspielzeug & Kunstgewerbe
Craft business for wooden toys and arts & crafts
Owner: Katrin Ulbricht
Bergmannsweg 15, D-09548 Kurort Seiffen
Phone: +49 (0) 37362-8412 | Fax: +49 (0) 37362-17125
Email: info@firma-ulbricht.de
VAT ID: DE 165826146 | Tax number: 228/283/01652
Data protection officer: Katrin Ulbricht (owner). For any questions regarding data protection, please contact: info@firma-ulbricht.de
This privacy policy applies to all personal data collected and processed via our online shop (operated on Shopify), our website, and all related services. The legal basis is the EU General Data Protection Regulation (GDPR) and the Telecommunications Digital Services Data Protection Act (TDDDG, since May 2024).
2. Shopify Shop System, Cloudflare & Data Processing
2.1 Shopify
Our online shop is operated by Shopify International Ltd., Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify acts as our processor pursuant to Art. 28 GDPR. We have concluded a Data Processing Agreement (DPA) with Shopify.
Shopify processes personal data (e.g. order data, payment information, device data) on our behalf and according to our instructions. Data may also be processed on servers outside the EU – based on the Trans-Atlantic Data Privacy Framework (TADPF), the EU adequacy decision for US data transfers effective July 2023.
If you use Shopify Network Intelligence / enhanced services, Shopify may also use data for cross-shop purposes. In this case, Shopify acts as an independent controller. You may object to this use. More information: https://privacy.shopify.com
2.2 Cloudflare & Fastly (CDNs)
Shopify uses the content delivery networks (CDNs) of Cloudflare Inc. (101 Townsend St., San Francisco, CA 94107, USA) and Fastly Inc. (475 Brannan St., Suite 300, San Francisco, CA 94107, USA). These services improve loading speed by caching content globally.
Technical data such as your IP address and browser information may be transmitted to servers in the USA. This transfer is based on the Trans-Atlantic Data Privacy Framework (TADPF). Cloudflare and Fastly have implemented GDPR-compliant safeguards.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and efficient operation)
More information: https://www.cloudflare.com/privacypolicy/ | https://www.fastly.com/privacy
3. Personal Data We Collect
3.1 When visiting our website (automatically)
• IP address (stored in anonymized form)
• Browser type and version, operating system
• Referrer URL (previous page visited)
• Date and time of server request
• Device information, screen resolution
This data is stored in server log files and automatically deleted after 30 days. No merging with other data sources takes place.
3.2 When placing an order
• Name, address (delivery and billing address)
• Email address, phone number
• Payment data (processed by payment providers, not stored directly by us)
• Order history, cart contents, returned or cancelled items
3.3 When creating an account
• Username, password (encrypted storage), security questions
• Settings, configurations, wishlists
3.4 When contacting us
• Name, email address, message content (contact form or email)
3.5 Newsletter registration (double opt-in)
• Email address, possibly name – only with explicit consent
We use the double opt-in procedure pursuant to § 7 (2) No. 3 UWG. After registration, you will receive a confirmation email. The newsletter is only sent after confirmation. Consent can be withdrawn at any time via the unsubscribe link or by emailing info@firma-ulbricht.de.
4. Legal Bases of Processing (Art. 6 GDPR)
We process personal data based on:
Art. 6 (1) (b) GDPR – contract performance (orders, shipping, payments, returns, communication)
Art. 6 (1) (a) GDPR – consent (newsletter, analytics, non-essential cookies, advertising)
Art. 6 (1) (c) GDPR – legal obligation (tax/legal retention laws)
Art. 6 (1) (f) GDPR – legitimate interests (IT security, fraud prevention, CDN usage, optimization)
Consent may be withdrawn at any time.
5. Cookies & Consent Management (§ 25 TDDDG)
We use cookies and similar technologies. Non-essential cookies require prior consent.
We use a certified Consent Management Platform (CMP) documenting consent (Art. 7 GDPR). Consent can be changed or revoked anytime.
5.1 Essential cookies (§ 25 (2) TDDDG)
• Cart cookie
• Login/authentication cookie
• Cookie storing privacy settings
• CSRF security token
5.2 Non-essential cookies (only with consent)
Analytics cookies (Google Analytics 4) – up to 2 years
Marketing cookies (Shopify Audiences, ads) – up to 1 year
Preference cookies – session to 1 year
6. Google Analytics 4
We use Google Analytics 4 by Google Ireland Limited, Dublin, Ireland.
Data collected: pages visited, time on site, source, anonymized IP, device data, approximate location.
IP anonymization is enabled. Data is primarily processed in the EU.
Legal basis: Art. 6 (1) (a) GDPR
Transfer to USA under TADPF
Retention: 14 months
Opt-out: https://tools.google.com/dlpage/gaoptout
Privacy policy: https://policies.google.com/privacy
6a. Facebook & Instagram (Meta Pixel)
We use Meta Pixel (Meta Platforms Ireland Limited, Dublin).
Tracked events: page views, product views, cart actions, search terms.
Purpose: advertising optimization, remarketing.
Legal basis: Art. 6 (1) (a) GDPR + § 25 TDDDG
Data transfer: USA under Data Privacy Framework
Opt-out: https://www.facebook.com/settings/?tab=ads
Privacy policy: https://www.facebook.com/privacy/policy/
7. Payment Provider: PayPal
PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
Data is transmitted to PayPal for payment processing. Credit checks may occur.
Legal basis: Art. 6 (1) (b) GDPR
Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
8. YouTube Videos
We embed YouTube videos (Google Ireland Ltd.).
No data is stored until video playback.
Legal basis: Art. 6 (1) (f) GDPR
Transfer: USA under TADPF
Privacy: https://www.youtube.com/t/privacy
9. Data Sharing with Third Parties
Only when necessary:
• Shipping providers (DHL, DPD)
• Payment providers (PayPal)
• Shopify (processor)
• Cloudflare & Fastly (CDN)
• Google Ireland (analytics with consent)
• Tax authorities (legal obligation)
• Law enforcement (suspected misuse)
9. Invoicing, Shipping & Payment Providers
9.1 FastBill
FastBill GmbH, Frankfurt am Main.
Used for invoicing and accounting.
Legal basis: Art. 6 (1) (b) & (c) GDPR
Retention: 10 years
Privacy: https://www.fastbill.com/datenschutz
9.2 DHL
Deutsche Post DHL Group.
Data shared for delivery.
Legal basis: Art. 6 (1) (b) GDPR
Retention: up to 30 days
Privacy: https://www.dhl.de/de/privatkunden/hilfe-kundendienst/datenschutz.html
9.3 PayPal
Independent controller.
May perform credit checks and transfer data to credit agencies.
Privacy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
9.4 Klarna
Klarna Bank AB, Sweden.
Credit checks may apply.
Legal basis: Art. 6 (1) (b) GDPR
Privacy: https://www.klarna.com/de/datenschutz
10. International Data Transfers
Transfers to the USA occur under the Trans-Atlantic Data Privacy Framework (TADPF), EU adequacy decision of July 2023.
List of certified companies: https://www.dataprivacyframework.gov
11. SSL/TLS Encryption
We use SSL/TLS encryption for secure data transmission.
12. Retention Periods
• Order data: 10 years
• Shipping data: 30 days
• Customer accounts: until deletion request
• Contact requests: up to 3 years
• Logs: 30 days
• Analytics: 14 months
• Newsletter: until withdrawal
13. Your Rights
• Access (Art. 15 GDPR)
• Correction (Art. 16)
• Deletion (Art. 17)
• Restriction (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21)
• Withdrawal of consent (Art. 7 (3))
Contact: info@firma-ulbricht.de
14. Right to Lodge a Complaint
Sächsischer Datenschutzbeauftragter
Devrientstraße 5, 01067 Dresden
https://www.saechsdsb.de
15. Data Security
We implement technical and organizational measures (Art. 32 GDPR).
16. Accessibility (BFSG)
We work to ensure accessibility compliance (since June 28, 2025).
17. Liability & Copyright
We are responsible for our own content. External links are not our responsibility.
18. Children
We do not knowingly collect data from children under 16.
19. Changes to This Privacy Policy
We may update this policy at any time. The latest version is always available on our website.
