PRIVACY POLICY
Last updated: October 3, 2026
This Privacy Policy explains which personal data we process when you visit https://stockwerkclo.com (the "Site"), join our list or place an order, why we do it, and which rights you have. Because our business is based in Germany, we process personal data in line with the EU General Data Protection Regulation (GDPR) and German data protection law, no matter where you live.
1. WHO IS RESPONSIBLE
The controller responsible for data processing on this Site is:
Dennis Tobie
trading as STOCKWERK
Karl-Wüst-Straße 15
74076 Heilbronn
Germany
Email: hello@stockwerkclo.com
Phone: +49 17656714424
We are not required to appoint a data protection officer. For all privacy questions, email hello@stockwerkclo.com.
2. VISITING THE SITE
Our online store runs on Shopify. For merchants in Europe, the service is provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"), which processes data on our behalf.
When you visit the Site, Shopify automatically processes technical data that your browser sends, such as your IP address, date and time of access, pages visited, referring website, browser type, device type and operating system. We need this data to deliver the Site, keep it stable and secure, and prevent abuse. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and working online store).
Shopify may process data in Canada and the USA. Canada has an adequacy decision from the EU Commission. Transfers to the USA are based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
3. COOKIES AND YOUR CONSENT
We use cookies and similar technologies.
- Necessary cookies keep the cart, checkout and security features working. They are used without consent (§ 25(2) TDDDG, Art. 6(1)(f) GDPR).
- Analytics and marketing cookies are only used if you agree in our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
You can change or withdraw your choice at any time using the cookie settings link at the bottom of the Site. Withdrawing your consent does not affect processing that took place before.
4. ORDERS AND CHECKOUT
When you place an order, we process your name, email address, shipping and billing address, phone number (if you provide it), the items ordered, the order amount and the payment status. We use this data to process, ship and deliver your order, send order and shipping emails, handle cancellations, returns and refunds, and answer your questions.
Legal basis: Art. 6(1)(b) GDPR (performance of the contract). We also check orders for fraud and automated bot purchases to protect our store and our customers. Legal basis: Art. 6(1)(f) GDPR. Where commercial and tax law requires us to keep records, the legal basis is Art. 6(1)(c) GDPR.
5. PAYMENT
Payments are processed by Shopify Payments and its payment processing partners, or by the other payment provider you choose at checkout (for example PayPal). The payment provider receives the data needed to process your payment and may run fraud checks. We never receive your full card number. Legal basis: Art. 6(1)(b) and (f) GDPR. The privacy policy of the provider you choose also applies.
6. SHIPPING AND FULFILLMENT
Our products are produced and shipped by our manufacturing and fulfillment partner in China. To ship your order, we share your name, shipping address, phone number (if you provided it) and the order details with this partner and with the carriers that deliver your package (for example USPS or UPS). Carriers may use your email address or phone number for delivery notifications.
Legal basis: Art. 6(1)(b) GDPR. Our partner processes this data on our behalf (Art. 28 GDPR) and only receives what is needed for shipping. For China, there is no EU adequacy decision. We have agreed the EU Standard Contractual Clauses with our partner to protect your data. You can request a copy by email.
7. CUSTOMER ACCOUNT
You can order as a guest. If you use a customer account, we process your email address and order history so you can see your orders and their status. You sign in with a one-time code sent to your email. Legal basis: Art. 6(1)(b) GDPR.
8. CONTACTING US
When you email us, we process your email address, your name (if you provide it) and the content of your message to answer you. Legal basis: Art. 6(1)(b) GDPR if your message is about an order or a purchase, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries).
Our mailbox is provided by GoDaddy and runs on Microsoft 365. These providers process emails on our behalf. Data may be processed in the USA. Transfers are based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
9. THE LIST (DROP EMAILS)
If you join our list, we send you emails about drops, early access and list-only offers. We use Klaviyo, Inc., Boston, USA ("Klaviyo") to manage the list and send emails. Klaviyo processes data on our behalf and participates in the EU-U.S. Data Privacy Framework.
We use the double opt-in process: after you sign up, you receive an email asking you to confirm. You are only added to the list once you confirm. We store your email address, the time of sign-up and confirmation, your IP address at that time and where you signed up, so we can prove your consent.
Our emails contain small tracking elements that tell us whether an email was opened and which links were clicked. We use this to improve our emails.
Legal basis: Art. 6(1)(a) GDPR (your consent). You can unsubscribe at any time using the link in every email or by emailing us. This also ends the open and click tracking.
10. BRING A FRIEND
After joining the list, you receive a personal link with a referral code. If someone joins the list through your link, we save your code in their list profile and count how many of your friends have confirmed their email. We use this only to give you the early-access perk. Legal basis: Art. 6(1)(b) GDPR (providing the perk you asked for).
11. SIGN-UP NOTIFICATIONS ON THE SITE
Our homepage can show short notices about recent sign-ups, for example "j•••@gmail.com joined the list · 3 min ago". We only show the first letter of the email address and a common email domain. Other parts are hidden, and no names are shown. To do this, we use a small service at Cloudflare, Inc., San Francisco, USA, which participates in the EU-U.S. Data Privacy Framework. When our homepage loads these notices, your browser connects to Cloudflare, which processes your IP address for this purpose. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in showing real activity on our list). You can object at any time by emailing us, and we will stop showing your sign-up.
12. ADVERTISING ON INSTAGRAM AND FACEBOOK
We advertise on Instagram. If you agree in our cookie banner, we use the Meta Pixel and the related server connection from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). They help us measure which ads lead to visits and purchases and show our ads to relevant people. Meta may combine this data with your Meta account. For the collection and transfer of this data, we and Meta are joint controllers (Art. 26 GDPR). The essence of our arrangement with Meta is available at https://www.facebook.com/legal/controller_addendum. Meta is responsible for any further processing. Data may be transferred to Meta Platforms, Inc. in the USA under the EU-U.S. Data Privacy Framework.
Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (your consent). You can withdraw your consent at any time in the cookie settings. Meta's privacy policy: https://www.facebook.com/privacy/policy
13. ANALYTICS
If you agree in our cookie banner, Shopify records how the Site is used, for example which pages are visited and which products are viewed, so we can improve the store. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG.
14. ORDER TRACKING AND LINKS
Our Track Order page opens the external website of 17TRACK when you enter your tracking number. Only then does your browser send the tracking number to 17TRACK. We do not share any other data with them. 17TRACK's own privacy policy applies to their website.
Links to Instagram or other websites are plain links. No data is sent to those websites until you click.
15. WHO RECEIVES YOUR DATA
We only share personal data where necessary for the purposes above:
- Shopify (online store, checkout, customer accounts, analytics)
- Payment providers
- Our manufacturing and fulfillment partner in China and shipping carriers
- Klaviyo (list and emails), GoDaddy and Microsoft (email), Cloudflare (sign-up notifications)
- Meta (advertising, only with your consent)
- Tax advisors and authorities, where required by law
We do not sell your personal data.
16. HOW LONG WE KEEP YOUR DATA
- Order and invoice records: as long as commercial and tax law requires, usually up to 10 years
- Customer emails: as long as needed to handle your request, and longer only where legal retention periods apply
- List data: until you unsubscribe. We keep proof of your consent for up to 3 years after that.
- Customer account and referral data: until you delete your account or leave the list
- Server logs and fraud checks: as long as Shopify and our payment providers need them for security, usually a few months
- Cookies: according to your cookie settings and the cookie's lifetime
After that, we delete or anonymize the data.
17. YOUR RIGHTS
Under the GDPR, you have the right to:
- Get access to the personal data we hold about you (Art. 15)
- Have incorrect data corrected (Art. 16)
- Have your data deleted (Art. 17)
- Restrict processing (Art. 18)
- Receive your data in a portable format (Art. 20)
- Withdraw your consent at any time with effect for the future (Art. 7(3))
- Lodge a complaint with a data protection supervisory authority (Art. 77). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.
RIGHT TO OBJECT (ART. 21 GDPR): Where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop, unless we have compelling legitimate grounds or need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time without giving reasons.
To use your rights, email hello@stockwerkclo.com.
18. DO YOU HAVE TO PROVIDE YOUR DATA?
You need to provide the data marked as required at checkout so we can process and deliver your order. Without it, we cannot complete the order. Joining the list is voluntary.
19. AUTOMATED DECISIONS
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Shopify's fraud analysis may flag orders, but a person reviews flagged orders.
20. US RESIDENTS
We do not sell your personal information. Some browsers send "Do Not Track" signals. There is no common standard for them, so the Site does not respond to them. Instead, analytics and advertising cookies are only used with your consent. Depending on the state you live in, you may have rights to know, correct or delete your personal information. To use them, email hello@stockwerkclo.com. We will not treat you differently for using your rights.
21. CHILDREN
The Site is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, email hello@stockwerkclo.com and we will delete it.
22. SECURITY
The Site uses TLS encryption, shown by "https" in your browser. We use reasonable technical and organizational measures to protect your data. No method of transmission or storage is completely secure.
23. CHANGES TO THIS POLICY
We may update this Privacy Policy when our services or the law change. The current version is always available on this page, with the date at the top.