Privacy policy

1) Controller

This privacy policy informs you about which personal data we process when you visit our online shop and when you place an order, for what purpose, on what legal basis, and what rights you have. Personal data is any information that can be related to you as a person, for example your name, address, email address or IP address.

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

HF Digital Marketing UG (haftungsbeschränkt)
Altewiekring 20a
38102 Braunschweig
Deutschland
Email: support@puschies.de

No data protection officer has been appointed, as there is no legal obligation to do so.

If you have any questions about data protection or wish to exercise your rights, please write to us at support@puschies.de.

2) Overview and legal bases

2.1 What data we process

If you only browse our shop, we process technical data that your browser transmits automatically (see Section 4) and, if you have given your consent, usage data for analytics and marketing (see Section 14). If you place an order, create a customer account, write to us or subscribe to the newsletter, we additionally process the information you provide to us in doing so.

2.2 Legal bases

We only process personal data if one of the following legal bases applies. For each processing operation, we state the relevant legal basis.

• Art. 6(1)(a) GDPR: You have consented to the processing. You can withdraw your consent at any time with effect for the future.
• Art. 6(1)(b) GDPR: The processing is necessary for the performance of a contract with you or for pre-contractual measures, for example when you place an order.
• Art. 6(1)(c) GDPR: The processing is necessary for compliance with a legal obligation, for example due to retention obligations under commercial and tax law.
• Art. 6(1)(f) GDPR: The processing is necessary for the purposes of our legitimate interests or those of a third party, and your interests do not override them. You can object to such processing (see Section 16).
• § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act): Information is only stored on your device, or accessed there (for example cookies), with your consent, unless this is strictly necessary for the service you have requested pursuant to § 25(2) TDDDG.

2.3 Transfers to third countries

Some of our service providers are based outside the European Union (EU) or the European Economic Area (EEA) or access data from there, in particular in the USA. Such a transfer only takes place if there is an adequacy decision of the EU Commission for the recipient country (Art. 45 GDPR) or if appropriate safeguards are in place (Art. 46 GDPR).

For the USA, the adequacy decision on the EU-US Data Privacy Framework (DPF) of July 10, 2023 applies to companies certified under the DPF. You can check whether a company is certified at https://www.dataprivacyframework.gov/. Where a recipient is not certified, we base the transfer on the Standard Contractual Clauses of the EU Commission (Art. 46(2)(c) GDPR). An adequacy decision exists for Canada. For other countries, for example China, there is no adequacy decision; there, we use Standard Contractual Clauses or only transfer data insofar as this is necessary for the performance of your contract (Art. 49(1)(b) GDPR).

2.4 Encryption

Our shop is delivered exclusively via an encrypted connection (TLS). You can recognize it by “https://” in your browser’s address bar.

2.5 Obligation to provide data

You are under no legal or contractual obligation to provide us with personal data. However, without the data marked as mandatory in the order form, we cannot accept and deliver an order. Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place at our company. Payment service providers may carry out their own checks for individual payment methods (see Section 10).

3) Hosting via Shopify

Our online shop runs on the e-commerce platform Shopify. The provider for merchants in Europe is Shopify International Limited, c/o Intertrust Ireland, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Irland (“Shopify”). Shopify provides servers, shop software, checkout, customer accounts and a content delivery network. All data that you enter in our shop or that arises during your visit is processed on Shopify’s systems.

Shopify processes the data as a processor on our behalf (Art. 28 GDPR). The legal basis is Art. 6(1)(b) GDPR insofar as the processing serves the initiation and performance of contracts, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and cost-efficient operation of the shop.

As part of Shopify’s services, data may be transferred to Shopify Inc. in Canada and to group companies in the USA (including Shopify Data Processing (USA) Inc. and Shopify (USA) Inc.). An adequacy decision of the EU Commission exists for Canada. For transfers within the Shopify group to countries outside the EU, Shopify relies on Binding Corporate Rules (Art. 47 GDPR), and for transfers to further sub-processors on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Shopify uses your IP address to determine the country from which you are accessing the shop in order to show you the appropriate market with language, currency, shipping costs and taxes (Shopify Markets). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to show you the correct prices and delivery terms for your country.

For more information, please see Shopify’s privacy policy: https://www.shopify.de/legal/datenschutz

4) Server log files

Each time you access our shop, your browser transmits data to Shopify’s servers for technical reasons, which is stored there in so-called log files. This includes:

• page or file accessed
• date and time of access
• amount of data transferred and status code
• previously visited page (referrer)
• browser type and version, operating system
• IP address

This data is required to display the pages to you, to ensure the stability and security of the shop and to detect attacks or misuse. The legal basis is Art. 6(1)(f) GDPR. This data is not merged with other data sources to identify individual visitors. The log files are deleted as soon as they are no longer needed for these purposes, unless a specific security incident requires longer retention for investigation.

5) Cookies and consent

5.1 What cookies are

Cookies are small text files that your browser stores on your device. Comparable technologies include, for example, the browser’s local storage, pixels or scripts that read information from your device. In the following, we use the term “cookies” for all of these technologies.

5.2 Necessary cookies

Some cookies are strictly necessary for the operation of the shop, for example to store the contents of your shopping cart, to carry out the checkout, to keep you logged in to your customer account, to remember your language and country settings and to save your cookie choice. We use these cookies without consent (§ 25(2) no. 2 TDDDG). We base the associated processing of personal data on Art. 6(1)(b) GDPR insofar as it serves an order, and otherwise on Art. 6(1)(f) GDPR.

5.3 Cookies requiring consent

We only use cookies and services for statistics, analytics, personalization and marketing if you have given your prior consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). We describe which services these are in Section 14.

5.4 Cookie banner and withdrawal of consent

To obtain your consent, we use Shopify’s cookie banner (Shopify Customer Privacy). On your first visit, you can accept or reject all categories there or select them individually. Your choice is stored in a necessary cookie and passed on to the integrated services so that they only load to the extent permitted. For Google services, we additionally use Google Consent Mode; without your consent, no Google cookies are set. Depending on the settings, cookieless, non-personal signals may be transmitted in this process.

You can withdraw or change your consent at any time with effect for the future via the cookie settings, which you can access at any time via the corresponding link on our website. You can also delete or block cookies in your browser. If you block necessary cookies, the shopping cart and checkout may not work.

If you access the shop from a country outside the EU, the banner may look different or may not be shown, depending on the legal situation there.

6) Contact by email and contact form

You can reach us by email at support@puschies.de or via the contact form in our shop. Messages from the contact form are forwarded to our email inbox via Shopify (see Section 3). We process the data from your message (usually name, email address, order number and the content of the inquiry) in order to handle and respond to your request. The legal basis is Art. 6(1)(b) GDPR if your inquiry relates to an order or a contract, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to customer inquiries.

We delete your inquiry once it has been fully dealt with and no statutory retention obligations prevent deletion. Messages that qualify as commercial or business letters relating to an order are retained for up to six years (see Section 17).

7) Customer account

You can voluntarily create a customer account in our shop. In it, you can see your orders and manage your addresses. You log in with your email address and, depending on the account type, with a one-time verification code that you receive by email, or with a password.

We process the data you provide in the account (email address, name, addresses, phone number if applicable) as well as your order history. The legal basis is Art. 6(1)(b) GDPR. You can have your customer account deleted at any time; a message to support@puschies.de is sufficient. Data that we are required to retain for legal reasons is restricted until the retention periods expire and then deleted.

8) Order processing

8.1 Order data

When you place an order, we process the data required for the conclusion of the contract, payment, delivery, invoicing and, if applicable, returns: name, delivery and billing address, email address, phone number if applicable, ordered items, prices, selected payment method and shipping method. The legal basis is Art. 6(1)(b) GDPR. For the retention of invoices and accounting records, Art. 6(1)(c) GDPR applies in conjunction with the provisions of commercial and tax law.

After your order, we send you emails confirming the order, about shipping and, if applicable, about returns. These messages are part of the performance of the contract (Art. 6(1)(b) GDPR) and are sent via Shopify.

8.2 Personalized items

Many of our products can be personalized in the product configurator, for example with a name or short text that is embroidered, and with a choice of colors and motifs. These details are stored as part of your order and are used only to produce the item as requested, to review the order and to clarify any questions. The legal basis is Art. 6(1)(b) GDPR.

The name is often a child’s first name. Please only enter what should appear on the item and no further information about the child.

8.3 Disclosure to production

To produce personalized items, we pass on the necessary order data (for example order number, item, size, color and personalization details) to production and fulfillment service providers commissioned by us. They only receive your name and address insofar as they ship the goods directly to you. The legal basis is Art. 6(1)(b) GDPR. If a service provider is based outside the EU or EEA, the transfer takes place on the basis of the Standard Contractual Clauses of the EU Commission (Art. 46(2)(c) GDPR).

8.4 Order export to Google Sheets

To plan production, we automatically transfer the necessary order data (order number, item, personalization details and, if applicable, the name of the person ordering) to a spreadsheet in Google Sheets using Shopify Flow. The provider of Google Sheets is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland; data may also be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR; our legitimate interest lies in efficient, error-free production planning. We delete the entries as soon as they are no longer required for production and warranty purposes.

8.5 Customs for deliveries outside the EU

For deliveries to Switzerland and other countries outside the EU, the name, address, contents and value of the shipment must be reported to the customs authorities. We transmit this information to the competent authorities via the shipping service provider. The legal basis is Art. 6(1)(b) and (c) GDPR.

9) Shipping service providers

9.1 DHL

For shipping from Germany, we use DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn. We transmit your name and delivery address and, if available, a Packstation or postal customer number. The legal basis is Art. 6(1)(b) GDPR. For shipments to other countries, DHL may hand the shipment over to a partner company in the destination country for delivery, which also receives the data for this purpose.

We only pass on your email address and, if applicable, your phone number to DHL if you have consented to this during the ordering process, so that DHL can notify you of the delivery and arrange a delivery date with you (Art. 6(1)(a) GDPR). You can withdraw this consent at any time by notifying us or DHL. Without your consent, DHL only receives the information required for delivery, such as your name and delivery address (Art. 6(1)(b) GDPR).

10) Payment service providers

Which payment methods are offered depends on the country of delivery and is shown at checkout. If you choose a payment method, we transmit the data required for payment (usually name, address, email address, order number, invoice amount and currency) to the respective payment service provider. The legal basis is Art. 6(1)(b) GDPR. You enter your card or account details directly with the payment service provider or in its secure input fields; we do not receive them.

For fraud prevention and, for payment methods with deferred payment, for identity and credit checks, the payment service providers also process your data in part under their own responsibility, where applicable involving credit agencies. For details, please refer to the providers’ privacy notices.

10.1 PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxemburg. Depending on the offer, PayPal also includes payment by direct debit, credit card or “Pay Later”; PayPal may carry out a credit check for this. Privacy notice: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

10.2 Mollie

Provider: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Niederlande. Depending on the country of delivery, we process further local payment methods via Mollie, for example Klarna (see 10.4), BLIK or Przelewy24 (see 10.3). The payment methods shown at checkout are decisive. Privacy notice: https://www.mollie.com/de/privacy

10.3 BLIK and Przelewy24 (via Mollie)

Where we offer BLIK or Przelewy24 via Mollie (in particular for orders to Poland), the data is additionally passed on to the respective operator for payment: for BLIK to Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warschau, Polen, and for Przelewy24 to PayPro SA, Kanclerska 15A, 60-326 Poznań, Polen.

10.4 Klarna

Provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Schweden. We offer Klarna’s payment methods via Mollie (see 10.2); Mollie transmits the data required for payment to Klarna. For Klarna payment methods such as invoice or installments, Klarna checks your identity and creditworthiness and may involve credit agencies for this purpose; the result may include probability values (scores). Based on this, Klarna decides whether the selected payment method is offered to you. Klarna is itself responsible for this check. Privacy notice: https://www.klarna.com/de/datenschutz/

10.5 Shopify Payments (Stripe)

We process payments by credit or debit card, Apple Pay and Google Pay via Shopify Payments. For merchants in Europe, Shopify Payments is offered by Shopify International Limited (see Section 3 for the address); payment processing is technically handled by Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Irland. Stripe may transfer data to Stripe, Inc. in the USA; this is based on the EU-US Data Privacy Framework or Standard Contractual Clauses. Privacy notice: https://stripe.com/de/privacy

10.6 Apple Pay

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Irland. When paying with Apple Pay, you confirm the payment on your Apple device. Apple forwards the payment data in encrypted form to the payment service provider; we do not receive a card number. Apple Pay is processed via Shopify Payments (see 10.5).

10.7 Google Pay

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. When paying with Google Pay, Google transmits a single-use transaction identifier to the payment service provider instead of your card details. Google may process transaction data in accordance with its own terms. Google Pay is processed via Shopify Payments (see 10.5).

11) Returns portal and online withdrawal

For returns from Germany, we use a returns portal provided via the Shopify app “easyReturns”. The provider is 247APPS UG (haftungsbeschränkt), In der Goldgrube 28, 56073 Koblenz, Deutschland. In the portal, you enter your order number and email address or postal code, select the items and, if applicable, a reason, and receive a return label and a confirmation of receipt by email. For the return label, your name and address are transmitted to the respective shipping service provider. For this purpose, the provider processes your order and address data as well as the return details as a processor on our behalf. Where data is processed outside the EU in this context, this takes place on the basis of appropriate safeguards (Standard Contractual Clauses).

For orders to all other countries, you declare a withdrawal via a form in our shop or by email. In doing so, we process your name, your email address, the order number and the items concerned, and confirm receipt to you by email.

In each case, the legal basis is Art. 6(1)(b) and (c) GDPR (processing of the withdrawal and the legal obligation to confirm receipt). We process voluntary information on the reason for return on the basis of Art. 6(1)(f) GDPR in order to improve our products and size information.

12) Newsletter and email marketing

12.1 Newsletter with consent

If you subscribe to our newsletter, we will inform you by email about new products, promotions and news. The only mandatory information is your email address; further information such as your first name is voluntary and is used to address you personally. The legal basis is your consent (Art. 6(1)(a) GDPR).

We use the double opt-in procedure: after signing up, you will receive an email with a confirmation link. Your subscription only becomes active once you click this link. In order to be able to prove your sign-up, we store the time of sign-up and confirmation as well as the IP address used (Art. 6(1)(c) and (f) GDPR).

You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending a message to support@puschies.de. After you unsubscribe, we remove your address from the mailing list. We retain proof of your previous consent for up to three years in order to be able to defend ourselves against any claims.

12.2 Advertising to existing customers

If you have placed an order with us, we may send advertising for our own similar products to the email address you provided, even without separate consent (§ 7(3) UWG, German Act against Unfair Competition). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in direct marketing to our customers.

You can object to this use of your email address at any time without incurring any costs other than the transmission costs according to the basic rates. To do so, use the unsubscribe link in every email or write to support@puschies.de.

12.3 Sending via Klaviyo

For newsletters and automated emails (for example reminders about an abandoned shopping cart, if you have given your consent), we use Klaviyo. The provider is Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, USA. Klaviyo stores your email address, the voluntary information, your subscription status and your order history from Shopify and processes them as a processor on our behalf.

Klaviyo records whether and when an email was opened and which links were clicked so that we can evaluate the effectiveness of our emails and tailor content to your interests. With your consent via the cookie banner, Klaviyo also records which products you view in our shop and assigns this to your profile. The legal basis for these evaluations is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), and in the case of advertising to existing customers, Art. 6(1)(f) GDPR.

Data may be processed in the USA; Klaviyo is certified under the EU-US Data Privacy Framework. Privacy notice: https://www.klaviyo.com/privacy

13) Reviews via Judge.me

For product reviews, we use the Shopify app Judge.me. The provider is Judge.me Ltd, c/o Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, Vereinigtes Königreich. Judge.me displays reviews on our product pages and provides a form you can use to submit a review.

After an order, we send you an email via Judge.me asking for a review. This is done on the basis of your consent (Art. 6(1)(a) GDPR) or, if you have placed an order with us, as advertising to existing customers pursuant to § 7(3) UWG (Art. 6(1)(f) GDPR, see 12.2). You can object to this use of your email address at any time without incurring any costs other than the transmission costs according to the basic rates, for example by email to support@puschies.de. For this purpose, Judge.me receives your name, your email address and the items ordered.

If you submit a review, we publish it with the name or initials you provided, the date, star rating, text and, if applicable, photos. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting the review. You can request the deletion of your review at any time by email to support@puschies.de. An adequacy decision of the EU Commission exists for the United Kingdom. According to Judge.me, data may also be stored on servers in the USA; a certification under the EU-US Data Privacy Framework is not known, so the transfer takes place on the basis of Standard Contractual Clauses.

14) Web analytics and marketing

We only use the following services if you have given your consent in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without your consent, they are not loaded or do not receive any data. You can withdraw your consent at any time with effect for the future via the cookie settings (Section 5.4). For each service, you will find the purpose, provider, legal basis, third-country transfer and storage period.

14.1 Google Tag Manager via Stape (server-side)

Purpose: We use Google Tag Manager to manage the integration of analytics and marketing services into our shop. Some of the data is not sent directly from your browser to the services, but first to our own server container, which is operated by Stape. There, we determine which data is passed on to which service and can shorten or remove data before it is passed on. Tag Manager itself does not create user profiles.

Provider and location: Google Tag Manager: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Server container hosting: Stape (Stape Europe OÜ, Tallinn, Estland; servers in the EU).

Legal basis: The server container only processes data for services to which you have consented (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Stape acts as a processor on our behalf.

Third country and safeguards: Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Stape Europe operates the server containers in data centers in the EU; the data processing agreement is part of Stape’s terms of use.

Storage period and withdrawal: The server container forwards data and does not store it permanently; log data at Stape is only retained for a short time. Withdrawal via the cookie settings.

14.2 Google Analytics 4

Purpose: Google Analytics 4 analyzes how visitors use our shop, for example which pages are viewed, where visitors come from, how long they stay and which purchases are completed. We use the reports to improve the shop and our advertising. IP addresses are not stored in GA4.

Provider and location: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google processes the data as a processor on our behalf.

Third country and safeguards: Transfer to Google LLC, USA, on the basis of the EU-US Data Privacy Framework; additionally Standard Contractual Clauses.

Storage period and withdrawal: The cookies (for example “_ga”) are stored for up to two years. User-level event data is deleted in GA4 after a maximum of 14 months. Withdrawal via the cookie settings. More information: https://policies.google.com/privacy

14.3 Google Ads conversion tracking and remarketing

Purpose: With Google Ads conversion tracking, we measure whether a click on one of our ads on Google has led to a purchase or another action. This allows us to evaluate the success of our ads and manage budgets. With remarketing, we later show visitors to our shop ads on other websites and in Google services for products they have viewed. For this purpose, Google creates audiences based on your visit. We only use conversion tracking and remarketing with your consent.

Provider and location: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google also uses the data in part for its own purposes; to that extent, we and Google are joint or independent controllers.

Third country and safeguards: Transfer to Google LLC, USA, on the basis of the EU-US Data Privacy Framework.

Storage period and withdrawal: The conversion cookies are generally stored for up to 90 days. Google stores membership in remarketing lists for a maximum of 540 days. Withdrawal via the cookie settings. You can also turn off personalized advertising from Google in your Google account.

14.4 Meta Pixel and Conversions API

Purpose: We use the Meta Pixel and the Conversions API to measure the success of our ads on Facebook and Instagram, to create audiences for ads (for example visitors to our shop or people similar to them) and to show ads to people who are interested in our products. The pixel sends information from your browser about your actions in the shop (for example page view, adding items to the cart, purchase) to Meta. Via the Conversions API, our server container (see 14.1) additionally sends these events directly to Meta. With advanced matching, we also transmit data such as email address, phone number, name and postal code in hashed form so that Meta can assign the events to a user account.

Provider and location: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), including for transmission via the Conversions API and advanced matching. We and Meta are joint controllers for the collection and transmission of the data to Meta (Art. 26 GDPR); an agreement with Meta is in place for this (Meta Controller Addendum). Meta is solely responsible for the further processing at Meta.

Third country and safeguards: Transfer to Meta Platforms, Inc. in the USA on the basis of the EU-US Data Privacy Framework; additionally Standard Contractual Clauses.

Storage period and withdrawal: The “_fbp” cookie is stored for up to 90 days. Meta stores the transmitted data in accordance with its own policies. Withdrawal via the cookie settings. More information: https://www.facebook.com/privacy/policy/

14.5 Microsoft Clarity

Purpose: Microsoft Clarity records how visitors interact with our pages, for example mouse movements, clicks and scroll depth, and displays this as heatmaps and session recordings. This helps us identify where the shop is difficult to use. Entries in form fields are masked and not recorded.

Provider and location: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (contracting party according to the Clarity terms of use). According to Microsoft’s privacy statement, the controller for users in the European Economic Area is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Irland. Microsoft processes the Clarity data as an independent controller and also for its own purposes, including advertising.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Third country and safeguards: Transfer to Microsoft Corporation, USA, on the basis of the EU-US Data Privacy Framework; Microsoft Corporation is certified.

Storage period and withdrawal: The “_clck” cookie is stored for up to one year, the “_clsk” cookie for one day. Microsoft deletes session recordings after 30 days, and aggregated click data (heatmaps) as well as marked recordings after nine months. Withdrawal via the cookie settings. More information: https://privacy.microsoft.com/de-de/privacystatement

14.6 Microsoft Advertising (UET)

Purpose: With Microsoft Advertising’s Universal Event Tracking (UET), we measure whether a click on one of our ads in the Bing search engine or in the Microsoft advertising network has led to a purchase, and we create audiences for ads.

Provider and location: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Irland.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). UET is only used with your consent.

Third country and safeguards: Transfer to Microsoft Corporation, USA, on the basis of the EU-US Data Privacy Framework.

Storage period and withdrawal: The cookies (for example “_uetvid”) are stored for up to 13 months. Withdrawal via the cookie settings.

14.7 Hotjar

Purpose: Hotjar creates heatmaps and session recordings so that we can see how visitors use our shop, and enables short feedback surveys. Entries in form fields are masked.

Provider and location: Hotjar belongs to the Contentsquare group. The provider in the EU is Contentsquare SAS, 7 rue de Madrid, 75008 Paris, Frankreich.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Hotjar acts as a processor on our behalf.

Third country and safeguards: Hotjar stores the data in the EU. Where data is transferred to Content Square, Inc. or other sub-processors in the USA, this takes place on the basis of the EU-US Data Privacy Framework (Content Square, Inc. is certified) or Standard Contractual Clauses.

Storage period and withdrawal: The cookies are stored for up to one year; recordings are deleted after a maximum of 365 days. Withdrawal via the cookie settings. More information: https://contentsquare.com/privacy-center/services-privacy-policy/

14.8 Adtriba

Purpose: Adtriba attributes purchases to the advertising channels and touchpoints through which a visitor came to us (marketing attribution) and helps us allocate our advertising budget across channels. For this purpose, a pseudonymous identifier, the pages viewed, campaign parameters from links and order events are processed.

Provider and location: Adtriba GmbH (a company of the Funnel group), Hoheluftchaussee 95, 20253 Hamburg, Deutschland.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Adtriba acts as a processor on our behalf.

Third country and safeguards: According to the data processing agreement, Adtriba may also process data in the United Kingdom, Australia and the USA (sub-processors include Amazon Web Services and Google). An adequacy decision of the EU Commission exists for the United Kingdom; transfers to other third countries take place on the basis of Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Storage period and withdrawal: The data is stored until you withdraw your consent and deleted after 24 months at the latest. Withdrawal via the cookie settings.

14.9 Pinterest Tag

Purpose: With the Pinterest Tag, we measure whether ads on Pinterest lead to purchases and create audiences for ads on Pinterest.

Provider and location: Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Irland.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Third country and safeguards: Transfer to Pinterest, Inc., USA, on the basis of the EU-US Data Privacy Framework; Pinterest, Inc. is certified.

Storage period and withdrawal: The “_pin_unauth” and “_epik” cookies are stored for up to one year. Withdrawal via the cookie settings.

14.10 TikTok Pixel

Purpose: With the TikTok Pixel, we measure whether ads on TikTok lead to purchases and create audiences for ads on TikTok.

Provider and location: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Irland.

Legal basis: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Third country and safeguards: TikTok may transfer data to countries outside the EU, including the USA and China (remote access). This is based on Standard Contractual Clauses; a certification under the EU-US Data Privacy Framework is not known.

Storage period and withdrawal: The “_ttp” cookie is stored for up to 13 months after last use. Withdrawal via the cookie settings.

15) Site features

15.1 Country blocker (BM Country Blocker)

We use the Shopify app BM Country Blocker to restrict access to our shop from countries to which we do not deliver. For this purpose, your IP address is processed when you access the shop and compared with a country database. The provider of the app is Boostymark (app developer, USA). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting the shop and restricting it to our delivery areas. Where data is processed in the USA in this context, the transfer takes place on the basis of Standard Contractual Clauses (Art. 46(2)(c) GDPR). We ourselves do not store your IP address permanently in this process.

15.2 YouTube videos

On some pages, we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. Videos are only loaded after your consent or after you click (privacy-enhanced mode youtube-nocookie.com). When a video is played, Google receives, among other things, your IP address and information about the page accessed; if you are logged in to your Google account, Google can assign the visit to your account. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy

15.3 Job applications by email

You can apply to us by email. We process the data from your application (in particular contact details, CV, references and proof of qualifications) exclusively in order to decide on filling the position. The legal basis is Art. 6(1)(b) GDPR (initiation of an employment relationship). If you voluntarily provide special categories of data, for example a severe disability, we process this data pursuant to Art. 9(2)(b) GDPR.

If no employment relationship is established, we delete your documents no later than six months after the application process has been completed. This period results from our legitimate interest (Art. 6(1)(f) GDPR) in being able to defend ourselves against possible claims under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz). If you would like us to keep your application for future positions, we will ask for your consent to do so. If an employment relationship is established, the data will be transferred to the personnel file.

16) Your rights

16.1 Data subject rights

You have the following rights vis-à-vis us with regard to the personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to have recipients notified of rectification, erasure or restriction (Art. 19 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR, see 16.2)
• Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out up to that point remains unaffected

To exercise your rights, an email to support@puschies.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the data protection supervisory authority of the State of Lower Saxony (LfD Niedersachsen), Prinzenstraße 5, 30159 Hannover, https://www.lfd.niedersachsen.de

16.2 Right to object pursuant to Art. 21 GDPR

If we process your personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

If we process your personal data for direct marketing purposes, you can object to this processing at any time without giving reasons. This also applies to profiling to the extent that it is related to direct marketing. After your objection, we will no longer use your data for direct marketing.

You can send your objection informally by email to support@puschies.de or, in the case of advertising emails, declare it via the unsubscribe link in every email.

17) Storage period

We only store personal data for as long as is necessary for the respective purpose or as required by statutory retention obligations. Unless a specific period is stated in the individual sections, the following applies:

• We store data that we process on the basis of your consent until you withdraw your consent or the purpose no longer applies.
• We store data for the performance of contracts until the contract has been fully performed and thereafter until the warranty and limitation periods have expired (generally three years from the end of the year of the order).
• We retain commercial and business letters, for example business emails relating to an order, for six years (§ 257 HGB, German Commercial Code; § 147 AO, German Fiscal Code).
• We retain invoices, other accounting records, books and annual financial statements in accordance with the statutory retention periods under the HGB and AO (generally 8 years for accounting records and 10 years for books and annual financial statements; § 257 HGB, § 147 AO, § 14b UStG, German VAT Act).
• We store data that we process on the basis of legitimate interests until the interest no longer applies or you have effectively objected.

The retention periods begin at the end of the calendar year in which the document was created. Once the periods have expired, we delete the data. As long as data is only stored due to a retention obligation, we restrict its processing.

Last updated: September 26, 2026