Privacy policy

1. Who is responsible
The controller responsible for processing personal data on this website (ivyandbaer.de) is:
Ashleigh Hindsch, trading as Ivy & Baer
c/o flexdienst – #22114, Kurt-Schumacher-Straße 74
67663 Kaiserslautern, Germany
Email: hello@ivyandbaer.de
Phone: +49 1523 3919137

2. Overview
We only process personal data where the law allows it. This policy explains what data we process, why, on which legal basis, who receives it and how long we keep it. "GDPR" means the EU General Data Protection Regulation. "TDDDG" means the German Telecommunications Digital Services Data Protection Act.

3. Hosting and shop system (Shopify)
Our online shop runs on Shopify. For customers in the EU, the provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify hosts our website and processes the data you enter in our shop (for example orders, contact details and newsletter sign-ups) on our behalf. We have a data processing agreement with Shopify under Art. 28 GDPR. Shopify may also process data outside the EU, in particular in Canada and the USA. These transfers are protected by recognised safeguards, such as Binding Corporate Rules and the EU Standard Contractual Clauses.
Legal basis: Art. 6(1)(b) GDPR for orders, and Art. 6(1)(f) GDPR (our legitimate interest in running a secure and reliable online shop).

4. Server log files
When you visit our website, technical data is collected automatically: IP address, date and time of access, pages visited, browser type and version, operating system and the referring website. This is needed to deliver the website securely and to detect and prevent misuse. The data is not combined with other data and is only kept as long as needed for these purposes.
Legal basis: Art. 6(1)(f) GDPR.

5. Cookies and consent
We use cookies and similar technologies. Some are technically necessary, for example for the shopping cart, checkout, security and saving your cookie choices. We use these on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR.
All other cookies, for example for statistics or marketing, are only used if you consent in our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Our cookie banner is provided by Shopify (see section 3). You can change or withdraw your consent at any time via the "Cookie settings" link in the footer of our website.

6. Customer account
If you create a customer account, we process your name, email address, addresses, order history and password (stored encrypted). This lets you view your orders and check out faster. You do not need an account to place an order. You can ask us to delete your account at any time. Data we must keep by law is then restricted and deleted when the retention period ends.
Legal basis: Art. 6(1)(b) GDPR.

7. Orders
When you place an order, we process your name, billing and shipping address, email address, phone number (if provided), order details, payment method and payment status. We need this data to process your order, deliver it, take payment, and handle customer service, returns and withdrawals.
Legal basis: Art. 6(1)(b) GDPR. We keep invoices and order records to meet our obligations under tax and commercial law (Art. 6(1)(c) GDPR).

8. Payment
Payments are handled by payment service providers. We pass on the data needed for the payment. We do not receive or store your full card or bank details.

Shopify Payments: Card payments (Visa, Mastercard, Maestro, American Express, UnionPay), Apple Pay and Google Pay are processed through Shopify Payments, which is provided by Shopify (see section 3) together with Stripe Payments Europe, Ltd., Dublin, Ireland.

Apple Pay and Google Pay: If you pay with Apple Pay or Google Pay, Apple Distribution International Ltd. (Cork, Ireland) or Google Ireland Limited (Dublin, Ireland) also process your data under their own privacy policies.

Klarna: If you pay with Klarna, we pass your name, address, email address, order details and order amount to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may carry out identity and credit checks under its own responsibility. Klarna's privacy policy applies to this.

PayPal: If you pay with PayPal, we pass your name, address, email address, order details and order amount to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal may carry out identity and credit checks under its own responsibility, in particular for PayPal's "Pay Later" options. PayPal's privacy policy applies to this.

Shop Pay: See section 16.

Payment providers may also carry out fraud checks under their own responsibility.
Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for fraud prevention.

9. Shipping
We pass your name and shipping address to our shipping provider, Deutsche Post AG (including its parcel service DHL), Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany, so that your order can be delivered.
Legal basis: Art. 6(1)(b) GDPR.
We only pass your email address or phone number to the shipping provider if you have agreed to this, for example for delivery notifications (Art. 6(1)(a) GDPR).
If we deliver your order ourselves (local delivery), your data stays with us.

10. Contacting us
If you contact us by email, through our contact form or our chat, we process the information you give us (for example name, email address and your message) to answer your enquiry. We delete it once your enquiry has been dealt with, unless we must keep it by law.
Legal basis: Art. 6(1)(b) GDPR if your enquiry relates to an order or contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).
Our chat function is provided by Shopify Inbox, a service of Shopify (see section 3).

11. Online withdrawal form
If you use our online withdrawal form ("Withdraw from contract"), we process your name, email address, order number, the items you are withdrawing, and the date and time your withdrawal is received. We use this data to match your withdrawal to your order, confirm receipt and process your refund. The form is sent using Shopify's contact form function.
Legal basis: Art. 6(1)(c) GDPR in conjunction with § 356a BGB (our legal obligation to provide a withdrawal function), and Art. 6(1)(b) GDPR (handling of the contract).

12. Newsletter
If you sign up for our newsletter, we send it using Shopify Email, a service provided by Shopify (see section 3). We use the double opt-in procedure: after signing up, you receive an email asking you to confirm. Only after you confirm will you receive our newsletter.
We store your email address, the time of sign-up and confirmation, and your IP address, so that we can prove your consent. Shopify Email also records whether a newsletter was opened and which links were clicked, so that we can improve our newsletter.
You can unsubscribe at any time using the link in every newsletter or by emailing us. We keep your email address until you unsubscribe. We keep the proof of your consent for up to three years afterwards, to be able to show that it was given.
Legal basis: Art. 6(1)(a) GDPR (consent). Storing the proof of consent: Art. 6(1)(c) and (f) GDPR.

13. Website translation
Our website is available in several languages. Translations are created and delivered through Shopify's Translate & Adapt app (see section 3), so no additional provider receives your data.

14. Links to social media and Etsy
Our website links to our profiles on Instagram, TikTok, Facebook and Pinterest, and to our Etsy shop. These are simple links. No data is sent to these platforms unless you click on a link. After that, the privacy policy of the platform applies.

15. Statistics
With your consent, we use Shopify's built-in statistics to understand how our shop is used.
Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG. You can withdraw your consent at any time via the "Cookie settings" link in the footer of our website.

16. Shop Pay and Shopify's own services
If you use Shop Pay or the Shop app, Shopify processes your data as its own controller. You can find more information at https://www.shopify.com/legal/privacy.

17. Transfers to countries outside the EU
Some of the providers named above process data outside the EU or EEA, in particular in the USA and Canada. We only allow this where an adequate level of data protection is ensured, for example by an EU adequacy decision, Binding Corporate Rules or the EU Standard Contractual Clauses.

18. How long we keep your data
We delete personal data as soon as it is no longer needed for the purpose it was collected for, unless the law requires us to keep it. In particular:
- Invoices, order and accounting records: 8 to 10 years, depending on the document type (§ 147 AO, § 257 HGB).
- Business letters and emails relating to orders, including withdrawals: 6 years (§ 257 HGB, § 147 AO).
- Newsletter: until you unsubscribe; proof of consent for up to 3 years afterwards.
- Other enquiries: until your enquiry has been dealt with.

19. Do you have to provide your data?
You need to give us the data marked as required in the checkout so that we can process your order. Without it, we cannot accept your order. Creating a customer account, signing up for the newsletter and providing optional information are voluntary.

20. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

21. Your rights
You have the right to:
- access the data we hold about you (Art. 15 GDPR)
- have incorrect data corrected (Art. 16 GDPR)
- have your data deleted (Art. 17 GDPR)
- restrict processing (Art. 18 GDPR)
- receive your data in a common format (Art. 20 GDPR)
- withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR)
To exercise these rights, email us at hello@ivyandbaer.de.

22. YOUR RIGHT TO OBJECT (Art. 21 GDPR)
Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing your data, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
If we process your data for direct marketing, you have the right to object at any time without giving reasons. We will then no longer use your data for this purpose.
To object, email us at hello@ivyandbaer.de.

23. Right to complain
You have the right to complain to a data protection supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de
You can also contact the authority where you live or work.

24. Changes to this policy
We update this privacy policy when our services or the law change. The current version is always available on our website.