Privacy policy
Controller
whynoty GbR
Partners authorised to represent the company: Manuel Fürtsch, Levent Ulutas
c/o flexdienst - #22147
Kurt-Schumacher-Straße 74
67663 Kaiserslautern
Germany
Email: info@whynoty.eu
General information on data processing
We only process personal data insofar as this is necessary to provide our online shop, to process orders, payments and deliveries, to communicate with customers or for the purposes described below.
Depending on the purpose, the processing is carried out in particular on the basis of Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) or Art. 6(1)(f) GDPR (legitimate interests).
Shopify and hosting
Our online shop is operated via Shopify.
The provider for merchants in the European Economic Area is:
Shopify International Limited
2nd Floor, 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
When you visit and use our online shop, Shopify processes data that is necessary for providing and operating the shop. This may include in particular the IP address, browser and device information, technical usage data and information about the interaction with our shop. In the context of an order, the contact, order, delivery, transaction and payment information required to process the contract is also processed.
Insofar as the processing is necessary to carry out an order, it is based on Art. 6(1)(b) GDPR. Otherwise, the processing is based in particular on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online shop.
Shopify also processes data to provide, secure and improve its platform. Insofar as Shopify processes personal data for its own purposes and under its own responsibility, Shopify's privacy information applies in addition.
Shopify may use affiliated companies and sub-processors. In this context, personal data may also be processed outside the European Economic Area, in particular in Canada and the USA. According to its own information, Shopify uses appropriate data protection transfer mechanisms for this purpose.
Server log data
When our online shop is accessed, technically necessary data may be processed automatically. This may include in particular the IP address, time of access, pages accessed, browser and device information and other technical log data.
The processing serves the technical provision, stability and security of our online shop as well as the detection and prevention of abusive or fraudulent activities.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online shop and in the prevention of fraud and abuse.
Orders and contract processing
If you place an order in our online shop, we process the data required to carry out the order. This includes in particular your name, billing and delivery address, email address, telephone number if provided, ordered products, order and transaction information, selected payment method as well as shipping and delivery information.
The processing is carried out to perform and process the contract concluded with you, including payment, shipping, return, refund and necessary customer communication.
The legal basis is Art. 6(1)(b) GDPR.
Insofar as statutory retention obligations exist, further storage is based on Art. 6(1)(c) GDPR.
Payment processing
Depending on the payment method selected in the checkout, the data required for payment processing is transmitted to the payment service providers involved in each case.
Shopify Payments
We use Shopify Payments. In the course of payment processing, in particular contact, order, payment and transaction information as well as information for fraud prevention may be processed.
The processing is carried out in particular to execute the payment you have chosen on the basis of Art. 6(1)(b) GDPR.
PayPal
If you select a payment method offered via PayPal, the data required for payment processing is transmitted to PayPal.
The provider is:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal
L-2449 Luxembourg
PayPal may process in particular contact, payment and transaction information as well as data for fraud prevention and risk assessment.
The transmission is carried out to execute the payment you have chosen on the basis of Art. 6(1)(b) GDPR.
Klarna
Insofar as a Klarna payment method is offered to you in the checkout and you select it, the data required for payment processing is processed.
The provider is:
Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden
Depending on the payment method selected, Klarna may process in particular contact, order and payment information as well as data for identity verification, fraud prevention, risk assessment and, where applicable, credit checks.
The processing is carried out in particular to execute the selected payment method on the basis of Art. 6(1)(b) GDPR.
The specific payment methods available will be shown to you in the checkout.
Shipping with DHL
We use DHL for the delivery of our goods.
For this purpose, we transmit the data required to carry out the delivery, in particular name, delivery address and required shipping information, to:
DHL Paket GmbH
Sträßchensweg 10
53113 Bonn
Germany
The processing is carried out to fulfil the contract concluded with you on the basis of Art. 6(1)(b) GDPR.
After shipping, you may receive a shipping confirmation with tracking information from our shop.
Contacting us and contact form
We provide a contact form on our website. You can also contact us by email.
If you contact us, we process the data you transmit, in particular your name, your email address and the content of your message, insofar as this information is transmitted.
The processing is carried out to handle your enquiry. If the enquiry relates to an existing or potential contract, the legal basis is Art. 6(1)(b) GDPR. For other enquiries, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of the enquiries addressed to us.
Electronic withdrawal
On our website, we provide an electronic option through which you can withdraw from a contract.
In doing so, we process the data you provide, in particular your contact details, order number and other information required to assign and process the withdrawal.
The processing is carried out to process and document your withdrawal and to fulfil the associated contractual and statutory obligations on the basis of Art. 6(1)(b) and (c) GDPR.
Email sending via Resend
For certain transactional emails, in particular confirmations in connection with the electronic withdrawal and, insofar as technically set up accordingly, messages in connection with our contact form, we use Resend.
The provider is:
Plus Five Five, Inc.
2261 Market Street #5039
San Francisco, CA 94114
USA
In this context, in particular the recipient's email address, the content of the message to be sent and technical sending information may be processed.
We use Resend for the technical execution of this communication. Resend is not used to send our advertising to existing customers.
As the provider is based in the USA, personal data may be processed in the USA. For such international data transfers, Resend's Data Processing Addendum provides in particular for the Standard Contractual Clauses of the European Commission.
The legal basis depends on the purpose of the respective message and is in particular Art. 6(1)(b) or (c) GDPR.
Email advertising to existing customers
We may use the email address that we have received from you in connection with the sale of goods to advertise our own similar goods or services, insofar as all statutory requirements for this are met.
This is done under the conditions of Section 7(3) of the German Act against Unfair Competition (UWG). A prerequisite is in particular that we have received your email address in connection with the sale of goods or services, that we use it for direct advertising of our own similar goods or services, that you have not objected to this use and that you are clearly and unambiguously informed of the possibility to object when the email address is collected and each time it is used.
You may object to the use of your email address for advertising purposes at any time without incurring any costs other than the transmission costs according to the basic rates.
The associated processing of personal data is based on our legitimate interest in direct advertising pursuant to Art. 6(1)(f) GDPR.
WhatsApp newsletter, early access and discount campaigns
We offer a voluntary newsletter via WhatsApp. Through it, we inform you in particular about new drops and products, early access and discount campaigns.
If you select the corresponding link on our website, you will be redirected to WhatsApp. You subscribe by actively sending us the message intended for subscription there. In connection with the subscription, you may receive a discount code.
For communication, we use the WhatsApp Business Platform (WhatsApp Business API).
The provider for the European region is:
WhatsApp Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
As part of the WhatsApp newsletter, we process in particular your telephone number, information about your subscription and the data required for communication.
The processing and sending of the messages is based on your consent pursuant to Art. 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future. To do so, you can in particular send STOP via WhatsApp. You will then be automatically unsubscribed from our mailing list and receive a corresponding confirmation.
When using the WhatsApp Business Platform, personal data may also be processed outside the European Economic Area. According to its own information, WhatsApp uses the data protection transfer mechanisms required in each case for this purpose.
Technical operation of the WhatsApp newsletter via Railway
For the technical operation of our self-developed WhatsApp newsletter system, we use Railway.
The provider is:
Railway Corporation
548 Market St PMB 68956
San Francisco, CA 94104
USA
Via the Railway infrastructure, we process in particular telephone numbers and information about the subscription and unsubscription of our WhatsApp subscribers, insofar as this is necessary to provide the newsletter.
We use a European deployment region for our system. Irrespective of this, personal data may also be processed in the USA or by further sub-processors in the course of providing the service. For such international data transfers, Railway's Data Processing Addendum provides in particular for the Standard Contractual Clauses of the European Commission.
The processing is carried out to provide the WhatsApp newsletter you have requested on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
After unsubscribing, the data stored exclusively for the newsletter will be deleted, insofar as no other legal basis permits or requires further storage.
Cookies and similar technologies
Our Shopify shop uses cookies and comparable technologies.
Some of these technologies are technically necessary so that the online shop and its essential functions can be provided. These include, for example, functions for the shopping cart, checkout, security and privacy settings.
Insofar as the storage of information on your terminal device or access to information already stored there is strictly necessary, this is done in accordance with Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
For cookies and comparable technologies that are not strictly necessary, we obtain your consent in advance, insofar as required by law. In this case, access to the terminal device is carried out in accordance with Section 25(1) TDDDG. Any associated processing of personal data is based on Art. 6(1)(a) GDPR.
To manage such consents, we use the privacy and cookie functions provided by Shopify for the online shop.
Consent given can be changed or withdrawn at any time with effect for the future via the privacy settings provided on our website.
Analytics and marketing technologies
We currently do not use any additional analytics or marketing technologies such as Google Analytics, Meta Pixel or TikTok Pixel in our online shop.
Should we use such services in the future, we will adapt our privacy policy and the required consent settings accordingly.
Instagram and TikTok
We operate business profiles on Instagram and TikTok.
No posts, feeds or comparable functions of these platforms are currently embedded on our website. Insofar as there are merely links to our social media profiles, these platforms are not thereby integrated into our shop as a social media plugin.
If you visit our profiles on Instagram or TikTok or interact with us there, the respective platform operators process personal data in accordance with their own privacy policies.
Insofar as you communicate with us via our social media profiles and we thereby receive personal data, we process this data in particular to handle your communication and to manage our social media presence on the basis of Art. 6(1)(f) GDPR.
Insofar as the communication is aimed at the conclusion or performance of a contract, the processing is based on Art. 6(1)(b) GDPR.
Links to external websites
Our online shop may contain links to websites or online services of third parties. If you access such a link, you leave our online shop. The respective operators are generally responsible for the processing of personal data on the respective external websites. The privacy policies of the respective provider apply.
Data security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration.
However, completely risk-free data transmission or storage cannot be guaranteed.
Storage period
As a rule, we only store personal data for as long as is necessary for the respective processing purpose.
If statutory retention obligations exist, the data concerned will be stored for the period prescribed by law and then deleted, insofar as no other legal basis permits or requires further storage.
Data processed exclusively on the basis of consent is generally processed until the consent is withdrawn or until the processing purpose no longer applies.
Your rights
Subject to the statutory requirements, you have in particular the right of access pursuant to Art. 15 GDPR, rectification pursuant to Art. 16 GDPR, erasure pursuant to Art. 17 GDPR, restriction of processing pursuant to Art. 18 GDPR, data portability pursuant to Art. 20 GDPR and objection pursuant to Art. 21 GDPR.
You can withdraw any consent given at any time with effect for the future pursuant to Art. 7(3) GDPR. The lawfulness of the processing carried out until the withdrawal remains unaffected.
If personal data is processed for the purpose of direct advertising, you have the right to object at any time to the processing of your personal data for such purposes.
To exercise your rights, you can contact us in particular at info@whynoty.eu.
Right to lodge a complaint
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.
The following supervisory authority is particularly relevant for us:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, LfDI Baden-Württemberg)
Updates to this privacy policy
We adapt this privacy policy if the services we use, the processing of personal data or the legal requirements change.
Last updated: September 2026