Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Peppersack und Frey Sports GbR
Westheck 13
59427 Unna
Germany

Represented by its partners Ben Peppersack and Luca Frey.

E-mail: retroboots.de@web.de
Telephone: +49 1515 5824538

The online shop is operated under the trade name Retroboots.de.

We have not appointed a data protection officer because the statutory conditions under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG) do not apply to us. For any data protection matter, please use the contact details above.

2. Principles and legal bases

We process personal data only where the law permits it or where you have given your consent. The following legal bases may apply:

  • Art. 6(1)(a) GDPR – your consent, for example for newsletters, web push notifications and all cookies and tracking services that are not strictly necessary.
  • Art. 6(1)(b) GDPR – performance of a contract with you or steps taken at your request prior to entering into a contract, for example for orders, customer accounts, shipping and returns.
  • Art. 6(1)(c) GDPR – compliance with legal obligations, in particular retention obligations under commercial and tax law.
  • Art. 6(1)(f) GDPR – our legitimate interests, for example in the secure and uninterrupted operation of the website and in preventing abuse.

Storing information on your device and accessing information already stored there is additionally governed by Section 25 TDDDG. Where such access is not strictly necessary, we obtain your consent.

3. Hosting and shop system (Shopify)

This online shop runs on the Shopify platform. For users in the European Economic Area, the provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland, together with Shopify Inc., 151 O'Connor Street, Ground floor, Ottawa, Ontario, K2P 2L8, Canada.

Shopify provides the technical infrastructure, stores this shop's data and processes, on our behalf, all data arising from your visit and your order. We have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR. The legal basis is Art. 6(1)(b) GDPR for performing the contract and Art. 6(1)(f) GDPR for the technically secure operation of the website.

An adequacy decision of the European Commission exists for Canada in respect of organisations subject to PIPEDA. In addition, Shopify has entered into Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Further information: shopify.com/legal/privacy

4. Server log files

When you access our website, data transmitted by your browser is automatically collected. This includes:

  • IP address of the requesting device
  • Date and time of access
  • Name and URL of the page retrieved
  • Volume of data transferred
  • Notification of successful retrieval
  • Browser type, browser version and operating system
  • Referrer URL, i.e. the previously visited page

This data is technically necessary to deliver the website and serves the security of our information technology systems. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the stable and attack-resistant operation of the website. We do not combine this data with other data sources for profiling purposes.

5. Cookies and consent management

We use cookies and comparable technologies such as local storage. We distinguish between:

  • Strictly necessary cookies – without them the shop does not work. These cover the shopping cart, session management, sign-in, language setting, fraud detection and the storage of your cookie decision itself. Legal basis: Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(b) and (f) GDPR.
  • Analytics, marketing and preference cookies – these are only set after you have given your consent. Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

For consent management we use Shopify's consent banner (Customer Privacy API). On your first visit from the European Economic Area, the United Kingdom and Switzerland you can consent to or reject the analytics, marketing and preferences categories separately.

You may withdraw your consent at any time with effect for the future. Use the "Your Privacy Choices" or "Cookie settings" link in the footer of every page. Withdrawing is as easy as giving consent. The lawfulness of processing carried out before withdrawal remains unaffected.

6. Order processing and customer account

To process your order we handle master data (name, billing and delivery address), contact data (e-mail address and, on a voluntary basis, telephone number), contract data (items ordered, prices, order date) and payment data.

The legal basis is Art. 6(1)(b) GDPR. Without this data we cannot perform the purchase contract. Once the transaction is complete, the data is subject to retention periods under commercial and tax law; to that extent processing is based on Art. 6(1)(c) GDPR.

You can order without creating a customer account. If you voluntarily create one, we store the data held there until the account is deleted. You may have the account deleted at any time; statutory retention obligations remain unaffected.

7. Payment processing

We offer the following payment methods. Your full payment details – such as card numbers – are transmitted directly to the respective payment service provider and are not disclosed to us in plain text.

Shopify Payments

Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify Payments processes credit and debit card payments and supplementary methods. The data processed includes name, address, payment method details, amount, time and technical data for fraud prevention.

PayPal

Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. If you select PayPal, the data required for payment processing is transmitted to PayPal. PayPal is an independent controller for that processing. Privacy information: paypal.com/de/webapps/mpp/ua/privacy-full

Shop Pay, Apple Pay and Google Pay

These accelerated payment methods are provided by Shopify and by Apple Inc. and Google Ireland Limited respectively. When you use them, the address and payment details stored in your wallet are transmitted to us in order to complete the order. At your request, Shop Pay stores your details for future orders; this requires confirmation by SMS.

The legal basis for all payment methods is Art. 6(1)(b) GDPR. Where payment service providers process data for fraud prevention, this is additionally based on Art. 6(1)(f) GDPR and on legal obligations under Art. 6(1)(c) GDPR.

8. Shipping

To deliver your order we pass your name, delivery address and – where necessary for delivery – your e-mail address and telephone number to the shipping company.

The shipping service provider is DHL Group (Deutsche Post AG / DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany). To create shipping labels and transmit consignment data we use the Shopify applications easyDHL and Post & DHL Shipping.

If you have agreed to receive shipping notifications by e-mail, we transmit your e-mail address to the shipping service provider for that purpose. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(a) GDPR for the notification.

9. Contacting us and customer service

If you contact us by e-mail, telephone, contact form or live chat, we process your details in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR based on our interest in responding to enquiries.

Live chat and helpdesk (Willdesk)

For live chat and the management of service enquiries we use Willdesk, provided by Channelwill Limited (Hong Kong). When you use the chat, your chat messages, your e-mail address or name where you provide it, and technical data such as IP address, browser and pages visited are processed and stored by the provider. Chat transcripts are personal data and are retained in order to handle and document your enquiry.

The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR for contract-related enquiries. Where the service is embedded using cookies that are not strictly necessary, this is based on your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. For processing outside the European Union we rely on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

10. Forms (Shopify Forms)

We use Shopify Forms for sign-up and contact forms. The data entered there is processed on our behalf within the Shopify infrastructure. Mandatory fields are marked; all other entries are voluntary.

11. Product reviews

After a purchase we may ask you for a product review. Providing one is voluntary.

Judge.me

Provider: Judge.me Limited, 128 City Road, London, EC1V 2NX, United Kingdom. The data processed includes your name or initials, your e-mail address, the review text, the star rating, any images you upload and the link to your order. Reviews are published on the product page together with your name or initials.

Klaviyo Reviews

Provider: Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA, represented for users in the European Economic Area by Klaviyo EU Limited, Dublin, Ireland.

The legal basis for the review request and for publication is Art. 6(1)(a) GDPR. An adequacy decision of the European Commission exists for the United Kingdom. For transfers to the USA we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

12. Newsletter, e-mail marketing and web push

Klaviyo (e-mail and SMS)

We use Klaviyo, provided by Klaviyo Inc. and Klaviyo EU Limited, to send our newsletter and other marketing messages. Sign-up uses the double opt-in procedure: after you sign up you receive an e-mail in which you confirm your subscription. We log the time of sign-up, the time of confirmation and the IP address in order to be able to demonstrate consent.

Klaviyo evaluates whether and when you open our messages and which links you click. We use this to tailor content to your interests.

Web push notifications (Brevo PushOwl)

If you allow push notifications, your browser stores an anonymous identifier through which we can send you messages. The provider is PushOwl (Brevo). You can stop receiving them at any time in your browser's notification settings.

The legal basis for all marketing messages is your consent under Art. 6(1)(a) GDPR in conjunction with Section 7(2) of the German Act Against Unfair Competition (UWG). You may withdraw your consent at any time – via the unsubscribe link at the end of every e-mail, via your browser settings, or informally to retroboots.de@web.de. After withdrawal we store your e-mail address on a suppression list to prevent further messages; the legal basis for this is Art. 6(1)(c) and (f) GDPR.

13. Analytics and advertising

The following services are activated only after you have given your consent. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

Google and YouTube

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use Google services for reach measurement and advertising purposes, including measuring completed purchases and serving advertisements. The data processed includes your IP address, device and browser data, pages visited, products viewed and purchased, and advertising identifiers.

Note on server-side tracking: for Google and YouTube, data is transmitted not only via your browser but additionally server-side. This means event data is sent directly from the Shopify infrastructure to Google. This transmission likewise only takes place if you have consented to the analytics or marketing categories.

TikTok

Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and TikTok Information Technologies UK Limited. We use the TikTok pixel and the TikTok Events API to measure advertising performance and to build audiences. The data processed includes IP address, device and browser data, products viewed and purchased, and advertising identifiers.

TikTok likewise receives data server-side. Transmission takes place only after you have given your consent.

In the case of TikTok, transfers to third countries, in particular to China and the USA, cannot be ruled out. TikTok bases such transfers on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. A level of data protection equivalent to European standards cannot be guaranteed in every case; in particular, access by state authorities cannot be excluded. By giving your consent you expressly also consent to this transfer (Art. 49(1)(a) GDPR).

Meta and Pinterest

Connections to Facebook, Instagram and Pinterest are technically configured in our shop but are currently not active. No data is collected through these channels. Should we activate them, we will update this privacy policy beforehand.

14. Other services used

We additionally use the following applications to operate the shop. Where they process personal data, they do so on our behalf on the basis of data processing agreements pursuant to Art. 28 GDPR.

  • Orbe Geolocation – determines your approximate country from your IP address in order to suggest the appropriate language and country version of the shop. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the correct display of prices, shipping options and language.
  • Shopify Search & Discovery – evaluates search terms and click behaviour within the shop in order to improve search results and product recommendations.
  • Translate & Adapt – provides the translated content of the shop.
  • BOOSTER SEO and IndexGPT – optimise metadata and the discoverability of our pages in search engines.
  • Shopify Flow – automates internal processes such as setting order tags.
  • Marketplace Connect – synchronises product and order data with connected sales platforms.
  • Section Store and SimGym – provide design components and development functions for our theme.

15. Social networks

Our website contains links to our profiles on social networks. These are plain links, not embedded plug-ins. Data is only transmitted to the respective provider once you click the link. The respective provider is responsible for processing on those platforms.

16. Transfers to third countries

Some of the service providers named above are established outside the European Economic Area or process data there. A transfer only takes place where one of the following conditions is met:

  • an adequacy decision of the European Commission pursuant to Art. 45 GDPR – this applies to the United Kingdom, to Canada (for organisations subject to PIPEDA) and to the USA where the recipient is certified under the EU-US Data Privacy Framework;
  • Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR together with supplementary safeguards;
  • your explicit consent pursuant to Art. 49(1)(a) GDPR.

Please note that third countries need not offer a level of data protection comparable to that of the European Union and that legal remedies against access by state authorities may not be available to the same extent.

17. Retention periods

We store personal data only for as long as is necessary for the respective purpose:

  • Order and invoice data: ten years from the end of the calendar year in which the invoice was issued (Section 147 AO, Section 257 HGB).
  • Commercial letters, e.g. order correspondence: six years (Section 257(4) HGB).
  • Customer account data: until the account is deleted, subject to the periods above.
  • Newsletter data: until you withdraw your consent; the record of consent is retained beyond that for documentation purposes.
  • Server log files: as a rule no longer than 30 days.
  • Chat transcripts and service enquiries: until the matter is finally resolved, thereafter within the statutory retention periods.

18. Your rights

You have the following rights in relation to your personal data:

  • Access (Art. 15 GDPR) – whether and which data we process about you.
  • Rectification (Art. 16 GDPR) – correction of inaccurate data and completion of incomplete data.
  • Erasure (Art. 17 GDPR) – unless a statutory retention obligation stands in the way.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR) – receipt of your data in a structured, commonly used and machine-readable format.
  • Withdrawal of consent given (Art. 7(3) GDPR) – at any time with effect for the future and as easily as you gave it.

An informal message to retroboots.de@web.de is sufficient to exercise these rights.

19. Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data which is based on Art. 6(1)(f) GDPR. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.

Where your data is processed for direct marketing purposes, you have the right to object at any time and without giving reasons. Following such an objection we will no longer use your data for direct marketing.

20. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Telephone: +49 211 38424-0
E-mail: poststelle@ldi.nrw.de
www.ldi.nrw.de

You may also contact the supervisory authority of your habitual residence or place of work.

21. No automated decision-making

Automated individual decision-making, including profiling, producing legal effects concerning you within the meaning of Art. 22 GDPR does not take place. The fraud prevention checks carried out by payment service providers do not automatically result in your order being rejected.

22. Data security

This website uses TLS encryption. You can recognise this by your browser's address bar beginning with "https://". Data you transmit to us is therefore protected against interception while in transit.

23. Changes to this privacy policy

We will amend this privacy policy if our processing activities or the legal situation change. The version available on this page applies in each case.

Last updated: August 2026