Privacy policy
Legal Notice
This Privacy Policy is provided in English for convenience and informational purposes. In the event of any discrepancy, inconsistency, or conflict between the English version and the German version, the German version shall prevail and be legally binding.
Last updated: June 22, 2026
This Privacy Policy explains the nature, scope and purpose of the processing of personal data when you use this website, place orders through my online shop or contact me.
Personal data means any information relating to an identified or identifiable natural person.
This Privacy Policy applies to all visitors to this website, customers and any other individuals who contact me or make use of the services I offer.
Please read this Privacy Policy carefully.
Table of Contents
1 Controller
2 General Information on Data Processing
3 Website Hosting and Provision
4 Cookies and Consent Management
5 Orders and Contract Processing
6 Contact
7 Social Media
8 Data Retention
9 Rights of Data Subjects
10 Right to Lodge a Complaint with a Supervisory Authority
11 Changes to this Privacy Policy
1 Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Saskia Kaufmann
Ernst-Thälmann-Platz 12a
14641 Wustermark
Germany
E-Mail: siebenkoepfig@outlook.de
2 General Information on Data Processing
I process personal data exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, address, e-mail address, payment information, order details or IP address.
Personal data is processed only to the extent necessary for providing my website, responding to enquiries, processing orders, fulfilling contractual obligations, complying with legal obligations or on the basis of your consent.
Where consent is required for specific processing activities, personal data is processed on the basis of Article 6(1)(a) GDPR. In all other cases, processing is carried out in particular on the basis of Article 6(1)(b) GDPR for the performance of a contract or pre-contractual measures, Article 6(1)(c) GDPR for compliance with legal obligations, and Article 6(1)(f) GDPR based on my legitimate interest in the secure and efficient operation of my online shop.
3 Website Hosting and Provision
I use the e-commerce platform Shopify International Ltd., Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify") to operate this website.
Shopify provides the technical infrastructure required to operate my online shop. This includes, in particular, website hosting, operation of the online shop, technical maintenance, and ensuring the security and availability of the systems.
When you visit this website, Shopify and its technical service providers automatically collect certain information and store it in server log files. This may include, in particular:
• IP address
• Date and time of access
• Information about your browser and operating system
• Referrer URL (the previously visited website)
• Accessed pages and content
• Device information
This data is processed to ensure the secure, stable and uninterrupted operation of the website and to protect the systems against misuse and attacks.
The legal basis for this processing is Article 6(1)(f) GDPR. My legitimate interest lies in the secure, efficient and user-friendly provision of my online services.
Where Shopify processes personal data on my behalf, this is carried out on the basis of a Data Processing Agreement pursuant to Article 28 GDPR.
When using Shopify, personal data may also be transferred to companies within the Shopify group of companies and to technical service providers located outside the European Union (EU) or the European Economic Area (EEA). Where personal data is transferred to third countries, such transfers are carried out on the basis of appropriate safeguards within the meaning of Articles 44 et seq. GDPR, in particular by using the European Commission's Standard Contractual Clauses where required by law.
Server log files are generally retained by Shopify only for as long as necessary to ensure the security, stability and functionality of the website. Any further retention takes place only where required by law or where necessary for the establishment, exercise or defence of legal claims.
4 Cookies and Consent Management
Cookies and similar technologies are used on this website. Cookies are small text files that are stored on your device and contain certain information.
4.1 Essential Cookies
Necessary cookies are required for the operation of the website and the provision of basic functions. They enable, in particular, the use of the shopping cart, the completion of the ordering process, the use of technically necessary forms, and the security and stability of the online shop.
These include, in particular, cookies and similar technologies provided by Shopify that are necessary for operating the online shop, the shopping cart function, shopping cart localization, the ordering process, technically necessary forms, security functions, and the technical stability of the website. In addition, technically necessary cookies provided by Cookiebot are used to store, manage, and document your cookie settings and consents.
The processing is carried out on the basis of Section 25 (2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 6 (1)(f) GDPR. My legitimate interest lies in providing a secure and fully functional online shop.
4.2 Analytics Cookies
Analytics cookies help me understand how visitors use my website. The information obtained is used to analyse and improve the functionality, usability and content of my online shop.
For this purpose, I use Shopify Analytics. If you have consented to the use of analytics cookies, information about your use of the website will be processed. This may include, in particular, information about page views, navigation behaviour, the devices and browsers used, as well as interactions with the online shop.
The processing is carried out for the purpose of analysing and optimising my online services.
Analytics cookies and the resulting processing of personal data are used exclusively on the basis of your consent in accordance with Section 25 (1) TDDDG and Article 6 (1)(a) GDPR.
When using Shopify Analytics, personal data may also be transferred to companies within the Shopify group of companies and to technical service providers located outside the European Union (EU) or the European Economic Area (EEA). Where personal data is transferred to third countries, such transfers are carried out on the basis of appropriate safeguards within the meaning of Articles 44 et seq. GDPR, in particular by using the European Commission's Standard Contractual Clauses where required by law.
Further information on Shopify's processing of personal data can be found in Shopify's Privacy Policy.
4.3 Marketing-Cookies
Marketing cookies are used to collect information about the use of the online shop and to use this information for marketing purposes as well as to improve the relevance of content and advertising.
The use of marketing cookies and the associated processing of personal data are carried out exclusively on the basis of your consent pursuant to Section 25 (1) TDDDG and Article 6 (1) (a) GDPR.
4.4 Consent Management with Cookiebot
I use Cookiebot, a service provided by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, to obtain, manage and document your consent regarding the use of cookies and similar technologies.
Where Cookiebot processes personal data on my behalf, this is carried out on the basis of a Data Processing Agreement pursuant to Article 28 GDPR.
Cookiebot enables me to obtain, manage and document your consent to the use of cookies and similar technologies. In particular, Cookiebot processes your consent preferences, your IP address in shortened form, information about your browser and device, as well as the date and time of your consent.
The processing is carried out to document the consents given and to comply with the legal obligations relating to consent management.
The legal basis for the processing of personal data in connection with consent management is Article 6 (1)(c) GDPR in conjunction with the applicable legal obligations regarding proof of consent, as well as Article 6 (1)(f) GDPR. My legitimate interest lies in the legally compliant documentation and management of the consents granted.
You may withdraw or change your consent at any time with future effect via the settings of the consent banner.
5 Orders and Contract Processing
5.1 Order and Contract Processing
When you place an order in my online shop, I process the personal data you provide during the ordering process.
This may include, in particular:
• First and last name
• Billing and delivery address
• E-mail address
• Order details
• Payment and transaction information
• Any other information you voluntarily provide in connection with your order
Your personal data is processed for the purpose of processing and fulfilling your order, delivering the goods you have purchased, communicating with you regarding your order, and complying with applicable legal obligations.
The processing is necessary for the performance of the purchase contract and is carried out on the basis of Article 6 (1)(b) GDPR. Where processing is required to comply with legal retention or documentation obligations, it is carried out on the basis of Article 6 (1)(c) GDPR.
For the technical operation of my online shop, I use the Shopify platform. Information about Shopify's processing of personal data can be found in Section 3 of this Privacy Policy.
5.2 Payment Processing
I use external payment service providers to process payments. The payment methods available to you are displayed during the checkout process.
If you choose a particular payment method when placing your order, the personal data required to process the payment will be transmitted to the respective payment service provider. This may include, in particular, your name, billing address, order information, and payment and transaction details.
The processing is carried out for the purpose of payment processing and the performance of the purchase contract on the basis of Article 6 (1)(b) GDPR.
Shopify Payments
For the processing of credit and debit card payments (Visa, Mastercard, American Express, Maestro, and UnionPay), as well as payments via Apple Pay, Google Pay, Shop Pay, and the local payment method Klarna, the Shopify Payments payment service may be used.
The provider of Shopify Payments for merchants in Germany is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland.
For the purpose of processing payments, the personal data required for the transaction is transmitted to Shopify and to the financial institutions and payment service providers involved in the payment process. These payment and financial service providers process your personal data under their own responsibility for data protection purposes.
PayPal
If you choose PayPal as your payment method, payment processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
The personal data required to process the payment will be transmitted to PayPal. PayPal processes this personal data under its own responsibility for data protection purposes.
Transfers of Personal Data to Third Countries
As part of the payment process, it cannot be ruled out that personal data may also be transferred to recipients located outside the European Union (EU) or the European Economic Area (EEA).
Where personal data is transferred to third countries, such transfers are carried out on the basis of appropriate safeguards in accordance with Articles 44 et seq. GDPR, in particular by using the European Commission's Standard Contractual Clauses where required by law.
5.3 Shipping
To create shipping labels and technically process shipments, I use the service Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, Netherlands.
For this purpose, the personal data required for shipping is transferred to Sendcloud. This may include, in particular:
• First and last name
• Delivery address
• Email address
• Telephone number, where required for delivery or delivery notifications
• Order and shipment information
Where Sendcloud processes personal data on my behalf, this is carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR.
The processing is carried out for the purpose of creating shipping labels and technically handling the shipment.
For the delivery of the ordered goods, the personal data required for shipping is transferred via Sendcloud to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.
The data is transferred exclusively for the purpose of delivering the ordered goods, providing shipment tracking, and sending delivery notifications.
The legal basis for this processing is Art. 6 (1) lit. b GDPR, insofar as the processing is necessary for the performance of the purchase contract.
For international shipments, DHL may cooperate with local postal, transport, or delivery service providers in the destination country. In such cases, the personal data required for delivery may be transferred to the respective service providers to the extent necessary.
Where personal data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA), such transfers are carried out for the performance of the contract and in compliance with the applicable data protection requirements.
5.4 Invoicing and Accounting
For the creation and management of invoices and for the fulfillment of statutory tax and commercial law obligations, I use the **Easy Invoices** app provided by **A&C Finance Solutions GbR, Bamenohler Str. 34, 57413 Finnentrop, Germany**.
The data required for invoicing is taken from the contractual data collected as part of the order and processed for the purpose of creating legally compliant invoices. This includes, in particular, the following personal data:
• First and last name
• Billing address
• Order and invoice data
• Payment and transaction information
The processing is carried out for the purpose of proper invoicing, accounting, and compliance with statutory retention and documentation obligations.
The legal basis for the processing is Art. 6 (1) lit. b GDPR, insofar as the processing is necessary for the performance of the purchase contract, as well as Art. 6 (1) lit. c GDPR for compliance with legal obligations, in particular under applicable commercial and tax laws.
Where Easy Invoices processes personal data on my behalf, this is carried out on the basis of a data processing agreement in accordance with Art. 28 GDPR.
6 Contact
You may contact me via the contact form, the online cancellation/withdrawal form or by e-mail. In doing so, I process the personal data you provide to the extent necessary to respond to your enquiry or to process your withdrawal.
This may include, in particular:
• First and last name
• E-mail address
• Order details, where required
• The content of your message or withdrawal
• Any additional information you voluntarily provide
The processing is carried out exclusively for the purpose of handling your enquiry, communicating with you or processing your withdrawal.
The legal basis for this processing is Article 6 (1)(b) GDPR, insofar as your enquiry or withdrawal relates to an existing contractual relationship or to steps taken prior to entering into a contract. In all other cases, processing is carried out on the basis of my legitimate interest pursuant to Article 6 (1)(f) GDPR in responding to enquiries.
7 Social Media
My website contains links to external services as well as content sharing features ("Share" functions). These include, in particular, a link to my Instagram profile and share functions on individual product pages that allow you to share content or product pages using the applications or services available on your device.
Simply visiting my website does not result in any personal data being transmitted to social networks or other external services through the Instagram link or the share functions.
A connection to the respective provider is established only when you click the Instagram link or actively use a share function and select a service. From that point onwards, the respective provider processes personal data under its own responsibility for data protection purposes.
The provider of Instagram is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Please note that when using external services, personal data may also be transferred to countries outside the European Union (EU) or the European Economic Area (EEA), in particular to the United States. I have no control over such data processing.
The Instagram link and the share functions are provided on the basis of my legitimate interest pursuant to Article 6 (1)(f) GDPR in promoting my business and products and making it easier to share my content.
8 Data Retention
I retain personal data only for as long as necessary for the respective processing purposes or where I am subject to statutory retention obligations.
In particular, the following retention periods apply to the individual processing activities:
• Order, contract, payment and invoice data are retained for the duration of the contractual relationship and thereafter generally for ten years in accordance with the applicable commercial and tax law retention obligations.
• Business correspondence that is subject to statutory commercial or tax law retention obligations is generally retained for six years.
• Personal data collected through the contact form or by e-mail is generally retained until your enquiry has been fully processed. Where the communication results in a contractual relationship, where statutory retention obligations apply, or where legitimate interests, in particular for the establishment, exercise or defence of legal claims, prevent deletion, the data will be retained accordingly.
• Personal data submitted through the online withdrawal form is retained for as long as necessary to process your withdrawal. Where such data forms part of records that are subject to contractual or statutory retention obligations, the applicable retention periods shall apply.
• Records of consent and cookie preferences processed via the Cookiebot consent management tool are generally retained for 12 months. This includes, in particular, the "CookieConsent" cookie, which stores your cookie preferences and proof of the consent you have given.
• Analysis, statistical and marketing data processed through Shopify Analytics and the Shopify Forms app are stored for the period necessary for the respective purpose, depending on the function of the cookies used. The specific storage period may vary depending on the cookie used.
Once the respective purpose of the processing no longer applies and no statutory retention obligations or legitimate interests, in particular for the establishment, exercise or defence of legal claims, require further storage, the personal data will be deleted or anonymised.
9 Rights of Data Subjects
Where the applicable legal requirements are met, you have the following rights with regard to the processing of your personal data:
Right of Access (Article 15 GDPR)
You have the right to obtain confirmation as to whether I process personal data relating to you. If this is the case, you have the right to obtain information about the personal data processed, the purposes of the processing, the recipients or categories of recipients, the planned storage period or, where this is not possible, the criteria used to determine that period, as well as the other information provided for in Article 15 GDPR.
Right to Rectification (Article 16 GDPR)
You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.
Right to Erasure (Article 17 GDPR)
You have the right to request the deletion of your personal data, provided that the legal requirements are met and no statutory retention obligations or other legal obligations prevent its deletion.
Right to Restriction of Processing (Article 18 GDPR)
You have the right to request the restriction of the processing of your personal data where the legal requirements are met.
Right to Data Portability (Article 20 GDPR)
You have the right to receive the personal data you have provided to me, where it is processed by automated means on the basis of your consent or for the performance of a contract, in a structured, commonly used and machine-readable format or, where technically feasible, to have those data transmitted to another controller.
Right to Object (Article 21 GDPR)
Where personal data is processed on the basis of Article 6 (1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.
Withdrawal of Consent (Article 7 (3) GDPR)
Where the processing of personal data is based on your consent, you may withdraw your consent at any time with effect for the future. The lawfulness of the processing carried out before the withdrawal remains unaffected.
To exercise your rights, you may contact me at any time using the contact details provided in the Legal Notice (Imprint) or in this Privacy Policy.
10 Right to Lodge a Complaint with a Supervisory Authority
Pursuant to Article 77 GDPR, and without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the General Data Protection Regulation (GDPR).
You may, in particular, lodge such a complaint with the supervisory authority at your habitual residence, your place of work or the place of the alleged infringement.
11 Changes to this Privacy Policy
This Privacy Policy will be updated whenever necessary to reflect changes in legal requirements, the services I offer or the processing of personal data. The version of this Privacy Policy published on this website at the time of your visit shall apply.