Privacy Policy

Controller

Overview

This Privacy Policy explains how Atelier Derman ("we", "us", "our") collects, uses and protects personal data when you visit our website, browse our collection, place an order, or subscribe to our newsletter. We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection law.

Our store runs on the Shopify platform. Some processing described below is carried out by Shopify rather than by us, and this Policy identifies where that is the case.

Data We Collect

Depending on how you interact with our website, we may collect the following categories of personal data:

Browsing data: IP address, browser type, device information, pages visited, and referring URLs, collected automatically when you access our website.

Account and order data: name, delivery and billing address, email address, telephone number, and details of the items you order, collected when you place an order or create an account.

Payment data: payment details are collected and processed directly by our payment service providers. We do not store full payment card details on our own systems.

Communication data: information you provide when you contact us via the contact form, email, or newsletter sign-up, including your name, email address, and the content of your message.

Sources of Personal Data

We collect personal data directly from you when you create an account, place an order or contact us; automatically from your device when you use the website, including through cookies and similar technologies; and from our service providers where they process personal data on our behalf.

Purposes and Legal Basis for Processing

We process your personal data for the following purposes and on the following legal bases under Art. 6 GDPR:

Contract performance (Art. 6(1)(b) GDPR): to process and fulfil your orders, arrange delivery, and manage returns or cancellations.

Legal obligation (Art. 6(1)(c) GDPR): to comply with statutory retention obligations, in particular under German commercial and tax law.

Consent (Art. 6(1)(a) GDPR): for non-essential cookies and for sending marketing communications such as our newsletter, where you have actively opted in.

Legitimate interests (Art. 6(1)(f) GDPR): to operate, secure, and improve our website, prevent fraud, and respond to enquiries.

Hosting and Platform Processing

Our online store is hosted on the Shopify platform, operated by Shopify Inc. and its affiliates. Shopify processes personal data necessary to operate the website, host our content, and support checkout functionality.

Our primary data storage location is set to the European Union. This does not mean that no data leaves the EU: Shopify and certain other service providers may process personal data in other jurisdictions, subject to the safeguards described under International Data Transfers below.

Shopify Network Intelligence

Shopify Network Intelligence is enabled for our store. Under this feature, data from your interactions with our store is used together with data from other Shopify merchants and from Shopify itself, in order to improve Shopify's products, security, ad targeting and personalisation.

This processing is carried out by Shopify and is governed by Shopify's Additional Services Terms. Other merchants cannot see data relating to our store.

Where Shopify determines the purposes and means of this processing, Shopify is responsible for it, including for responding to requests to exercise your rights in relation to it. You can read the Shopify Consumer Privacy Policy and exercise applicable rights through the Shopify Privacy Portal.

To provide these Enhanced Services, information about your activity may be shared with Shopify and relevant third parties, including parties located in other countries, subject to applicable data-protection safeguards.

Cookies and Similar Technologies

We use cookies and similar technologies for the purposes described below. You can review or change your choices at any time using the Cookie Settings link in the footer of any page.

Required. Strictly necessary for the site to function — keeping items in your cart, remembering that you are signed in, and securing checkout. Provided by Shopify. These do not require consent.

Personalisation. Your language preference is stored locally in your browser so the site displays in your chosen language on future visits. This information stays on your device.

Analytics. Atelier Derman does not operate Google Analytics or any comparable third-party analytics tool. Shopify's own platform analytics and the Shopify Network Intelligence feature described above operate at platform level.

Marketing. Atelier Derman does not operate advertising cookies, a Meta Pixel, or any custom marketing pixel of its own. The platform-level processing described under Shopify Network Intelligence includes ad targeting carried out by Shopify. Where consent is required, Shopify's use of data for advertising and other non-essential purposes through Shopify Network Intelligence is subject to your consent choices, which you can review or change at any time through Cookie Settings. If we introduce our own marketing or advertising technology, this Policy and the cookie categories will be updated beforehand.

Newsletter and Email Marketing

If you subscribe to our newsletter, we process your email address and, where provided, your name in order to send communications about new collections, availability and related updates, on the basis of your consent (Art. 6(1)(a) GDPR). Subscriptions are recorded directly in Shopify as a customer record with marketing consent. You may withdraw your consent and unsubscribe at any time using the unsubscribe link contained in every newsletter email, or by contacting us directly.

Correspondence

Emails you send to us, for example to info@atelierderman.com or orders@atelierderman.com, are received and stored using Google Workspace. Google processes the content of that correspondence on its servers as our service provider.

Payment Processing

When you complete a purchase, your payment is processed by third-party payment service providers integrated into our checkout. These providers process payment data on their own responsibility as independent controllers, in accordance with their own privacy policies, in order to authorise and process your payment securely.

Order Documents

We use Order Printer Pro, provided by Shop Circle Holdings Ltd, to generate invoices and other order documents. The application acts as a data processor on our behalf and processes the order and customer data required to produce those documents.

Disclosure of Data to Third Parties

We share personal data with third parties only where necessary for the purposes described in this Policy, in particular: Shopify as our hosting and e-commerce platform provider; payment service providers; shipping carriers engaged to deliver your order; Order Printer Pro for the generation of order documents; and Google Workspace for correspondence.

We do not sell your personal data to third parties.

International Data Transfers

Where personal data is transferred to service providers located outside the European Economic Area, we ensure that appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses, or that the recipient is located in a country recognised by the European Commission as providing an adequate level of data protection.

Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law. Order and invoice data is generally retained for the statutory retention periods applicable under German commercial and tax law, typically six to ten years. Newsletter data is retained until you unsubscribe.

Children's Data

Our website is not intended for children, and we do not knowingly collect personal data from children. If you are a parent or guardian and believe that a child has provided us with personal data, please contact us using the details above and we will delete it.

Your Rights

Under the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15 GDPR);
• request rectification of inaccurate personal data (Art. 16 GDPR);
• request erasure of your personal data, subject to statutory retention obligations (Art. 17 GDPR);
• request restriction of processing in certain circumstances (Art. 18 GDPR);
• receive your personal data in a structured, machine-readable format and transmit it to another controller (Art. 20 GDPR);
• object to processing based on our legitimate interests (Art. 21 GDPR);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details provided above or via our Contact Form.

For processing carried out by Shopify under Shopify Network Intelligence, requests can also be made through the Shopify Privacy Portal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that our processing of your personal data infringes applicable data protection law. The competent supervisory authority for North Rhine-Westphalia is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.

A list of supervisory authorities across the European Economic Area is available at https://edpb.europa.eu/about-edpb/about-edpb/members.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable legal requirements. The current version is always available on this page.

Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at info@atelierderman.com or via our Contact Form.