Privacy Policy
1. Contact Details & Controller
The data controller is INSANIFY. Full contact details (address, email, authorised representatives) can be found in our Legal Notice.
Data-protection contact: A data protection officer is not legally required and has therefore not been appointed. Please send enquiries to the email address stated in the Legal Notice.
2. Definitions & Legal Bases
We process data on the basis of the GDPR, in particular:
- Art. 6 (1) (b) GDPR – performance of a contract and pre-contractual measures (e.g. order processing, customer account).
- Art. 6 (1) (a) GDPR – consent (e.g. newsletter, optional cookies / tracking).
- Art. 6 (1) (c) GDPR – compliance with legal obligations (e.g. tax and commercial retention requirements).
- Art. 6 (1) (f) GDPR – legitimate interests (e.g. IT security, fraud prevention, needs-based design).
3. Hosting, Platform & Log Files (Shopify)
Our shop is operated on the e-commerce platform Shopify (Shopify International Ltd., Ireland; parent company Shopify Inc., Canada). Shopify provides hosting, infrastructure, payment / shipping integrations and security functions and processes data on our behalf (data processing agreement pursuant to Art. 28 GDPR).
Processed data: access data / server log files (IP address, date / time, pages / files accessed, referrer URL, browser used, etc.).
Purposes: operation and delivery of the online offering, stability & IT security, error analysis.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and economic operation).
Shopify may engage affiliated companies / sub-processors and process data outside the EU/EEA (including in Canada and the USA) (details in the “Third Countries” section). Shopify's privacy notice: shopify.com/legal/privacy.
4. Cookies & Consent Management
We use cookies and similar technologies. Necessary cookies are required for functions such as basket, checkout and security. Optional cookies (convenience, statistics, marketing) are only used with your consent.
Consent tool: Consent management is provided via Shopify's native consent / cookie banner (Shopify Customer Privacy / Consent Management). Your selection is stored and controls the setting of optional cookies.
You can change your cookie settings at any time via the “Cookie settings” link in the footer.
| Category | Purpose / examples | Storage period | Legal basis |
|---|---|---|---|
| Necessary | Session ID, basket, checkout, security | Session / up to 1 year | Art. 6 (1) (b/f) |
| Preferences | language, region, display options | 6–12 months | Art. 6 (1) (a) |
| Statistics | reach measurement (Shopify Analytics) | up to 13 months | Art. 6 (1) (a) |
| Marketing | remarketing, conversion tracking (if activated) | variable | Art. 6 (1) (a) |
5. Shop Functions (Account, Basket, Orders)
Customer account (optional): registration, login, order history. Data: master data, access credentials, order data.
Order / checkout: we process the data required for the performance of the contract (name, billing / shipping address, contact details, order and payment information).
Legal basis: Art. 6 (1) (b) GDPR; statutory obligations: Art. 6 (1) (c) GDPR.
6. Payment Processing
For payment processing we use only the payment services actually displayed at checkout and selected by you. The respective provider receives the master, order and payment data required for payment processing, fraud prevention and accounting.
Legal basis: Art. 6 (1) (b) and (f) GDPR; for optional functions requiring consent, Art. 6 (1) (a) GDPR. This policy will be updated before further payment methods are activated.
7. Shipping & Fulfilment
For delivery / returns we transmit the necessary data (name, address, email, phone number where applicable, order information) to our shipping partners. We generally ship with DHL (Deutsche Post DHL Group).
Legal basis: Art. 6 (1) (b) GDPR.
We use Gelato ASA, Dronning Eufemias Gate 8, 0191 Oslo, Norway, as our print and fulfilment partner. We transmit the order, contact and delivery data required for production, order processing and shipping. Gelato may use local print partners. Appropriate safeguards, including EU Standard Contractual Clauses where required, are used for transfers to third countries.
8. Communication (Contact Form, Email)
If you contact us via the contact form or by email, we process your details for the purpose of handling your enquiry and for follow-up questions. The contact form is provided via Shopify.
Legal basis: Art. 6 (1) (b) (contractual / enquiries), (f) (general communication), where applicable (a) (consent).
9. Newsletter / Marketing
With your consent, we will send you newsletters with information about our products / offers. Registration and dispatch are handled via Shopify (Shopify Email / customer contacts). We log the sign-up / confirmation and may measure openings / clicks in order to improve content.
Legal basis: Art. 6 (1) (a) GDPR in conjunction with § 7 UWG; withdrawal at any time with future effect (unsubscribe link in every email).
10. Reach Measurement / Analytics
Subject to your consent, we use the analytics integrated into Shopify (Shopify Analytics) for reach measurement. Further analytics or marketing services (e.g. Google Analytics, Meta Pixel) are only used where activated and listed in the consent banner.
Legal basis: Art. 6 (1) (a) GDPR (consent), withdrawal possible at any time via “Cookie settings”.
Reviews: We use Judge.me Ltd., c/o Buckworths, 1–3 Worship Street, London EC2A 2AB, United Kingdom, to display and manage reviews. Depending on use, device, usage, order and review data may be processed to provide and verify reviews and prevent misuse. The legal bases are Art. 6 (1) (b) or (f) GDPR; optional analytics or marketing functions are used only with consent under Art. 6 (1) (a) GDPR. Data is retained only for as long as required for these purposes or by law. Appropriate safeguards are used for transfers outside the EEA.
11. Social Media & External Links
We may maintain online presences on social networks. When you access the respective platform, the privacy terms of that platform operator apply. Links from our website to such platforms are set as ordinary external links; data is exchanged only upon click.
12. Your Rights
- Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21 GDPR).
- Withdrawal of consent (Art. 7 (3)) with future effect.
- Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) – e.g. at your place of residence or at our registered seat.
13. Retention & Deletion
We process and store data only for as long as necessary for the purposes stated or as required by law. Statutory retention periods (e.g. under commercial and tax law) are generally 6–10 years.
14. Transfers to Third Countries
Processing may also take place outside the EU/EEA (e.g. by Shopify or integrated services in Canada / the USA). In such cases we ensure appropriate safeguards, in particular the EU Standard Contractual Clauses (Art. 46 GDPR) and, where applicable, the recipient's certification under the EU-US Data Privacy Framework. An adequacy decision by the EU exists for Canada.
15. Requirement to Provide Data
Certain data is required to conclude a contract / place an order (mandatory fields at checkout). Without this data we cannot provide the service. Information for marketing / convenience is voluntary.
16. Automated Decision-Making / Profiling
No automated decision-making within the meaning of Art. 22 GDPR takes place. Any fraud / risk checks in the payment process are carried out by the payment services and serve solely to prevent fraud.
17. Changes to this Policy
We will adjust this privacy policy where legal requirements, processing operations or services change. The current version is available here at all times; the date of the last update is shown above.