Privacy Policy

1. Controller

The controller responsible for the processing of personal data in this online shop is:

Sproutwerk
Owner: Maximilian Budwill
Heideweg 22
14482 Potsdam
Germany

Email: datenschutz@sproutwerk.de
General contact: info@sproutwerk.de
Contact form: https://sproutwerk.de/pages/contact

2. Shopify as Shop Platform

Our online shop is operated using Shopify. For customers in the European Economic Area, Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland, is the relevant Shopify entity.

On our behalf, Shopify processes, in particular, account, contact, order, transaction, usage, and device data where necessary to operate the shop and checkout, process orders, provide customer accounts and the electronic withdrawal function, maintain security, and provide the Shopify services we use. The legal bases for our processing include Article 6(1)(b) GDPR for performing the contract, Article 6(1)(c) GDPR for complying with legal obligations, and Article 6(1)(f) GDPR for the secure and efficient operation of the shop.

For certain services, in particular Shop, Shop Pay, or activated network, analytics, and advertising services, Shopify may act as an independent controller. Information about this processing is available in the Shopify Consumer Privacy Policy. Shopify’s Data Processing Addendum explains its processing on behalf of merchants and international data transfers.

3. Accessing the Shop and Technical Log Data

When you access the shop, technically necessary data is processed, including your IP address, date and time, pages accessed, volume of data transferred, browser, device, and operating-system information, referrer information, and security and error data.

This processing is necessary to deliver the shop, detect attacks and fraud, resolve errors, and ensure stability. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the online shop.

4. Orders and Contract Processing

When you place an order, we process the data necessary for the contract, including your name, billing and delivery address, email address, ordered products, personalisation details, price, payment-status, shipping, communication, and complaint data.

Processing takes place to initiate and perform the purchase contract, manufacture personalised goods, process payments and deliveries, communicate with customers, and handle withdrawals, returns, defects, and refunds, on the basis of Article 6(1)(b) GDPR. We process tax, commercial, and other legally required records on the basis of Article 6(1)(c) GDPR.

Personalisation details are used only to create and process the agreed personalised product. Please do not provide special categories of personal data or data relating to third parties unless this is necessary for the requested personalisation and legally permissible.

5. Customer Account and Electronic Withdrawal Function

Shopify provides customer-account functions for signing in, viewing orders, and submitting return and cancellation requests. This involves processing, in particular, your email address, login and security data, an email verification code, the relevant order, selected items, and the content and time of a return or cancellation request.

Processing takes place to provide account functions and perform the contract under Article 6(1)(b) GDPR, and to comply with legal obligations relating to the electronic withdrawal function and confirmation of receipt under Article 6(1)(c) GDPR.

You may request deletion of your account. Data that must continue to be retained due to legal obligations or for establishing, exercising, or defending legal claims will be stored in a restricted form for those purposes.

6. Contact and Email Communication

If you contact us by email or contact form, we process your contact details, message, timestamps, and, where applicable, order information in order to handle your request and document the correspondence. The legal basis is Article 6(1)(b) GDPR where the request concerns a contract or steps before entering into a contract; otherwise, it is Article 6(1)(f) GDPR. Our legitimate interest is efficient and traceable customer communication.

We use Proton Mail, provided by Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, for business email communication. This may involve processing sender and recipient addresses, delivery and timestamp data, subject lines, message content, and attachments. Proton processes business data under its Data Processing Agreement. Switzerland is covered by an adequacy decision of the European Commission.

Shop transactional messages, such as order, shipping, customer-account, and withdrawal confirmations, are sent through Shopify. Shopify processes, in particular, your email address, message content, order or transaction reference, and delivery and error data. The legal basis depends on the underlying process and is generally Article 6(1)(b) or Article 6(1)(c) GDPR.

7. Inventory Management and Order Processing with Billbee

We use Billbee, provided by Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany, for central order processing, inventory management, stock maintenance, document creation, and shipping preparation.

For these purposes, the data required for these activities is transferred from Shopify to Billbee and processed there. This may include personal and contact data, billing and delivery addresses, order, product, personalisation, price, payment-status, invoice, shipping, and communication data.

Processing takes place to perform the purchase contract under Article 6(1)(b) GDPR and to comply with tax and commercial-law obligations under Article 6(1)(c) GDPR. Billbee processes this data as a processor under an agreement pursuant to Article 28 GDPR.

8. Payment Processing

The payment methods available for your order are displayed during checkout. If you choose a payment method, the data necessary for payment processing and fraud prevention is transferred to the relevant payment service provider. This may include your name, billing address, email address, order value, currency, transaction data, and technical security data.

We generally do not receive complete card or bank-account details, but only the payment status and references required for processing. Processing takes place to perform the contract under Article 6(1)(b) GDPR and, where necessary, to prevent fraud under Article 6(1)(f) GDPR.

Payment service providers may be independently responsible for legally required checks and their payment services. Their privacy information is made available when the relevant payment method is selected or during checkout.

Shopify Payments and Shop Pay

We use Shopify Payments and, where offered at checkout, Shop Pay for integrated payment processing. The responsible Shopify entity for Germany is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland.

Shopify engages the payment processors applicable in Germany for the actual payment processing. Data processed includes identity and contact information, billing address, order value, currency, selected payment method, payment status, transaction references, and device, security, and fraud-prevention data. With Shop Pay, Shopify may additionally process account, delivery, and payment information stored for that service under its own responsibility.

PayPal

If you select PayPal, we transfer the data required for payment to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes account, contact, order, transaction, device, and risk data for payment processing, authentication, fraud prevention, and compliance with its own legal obligations as an independent controller.

Klarna

Once Klarna is offered at checkout and selected by you, the data necessary for the chosen Klarna payment method is transferred to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. This may include identity and contact data, billing and delivery address, order and payment data, and technical data.

Depending on the payment method, Klarna may carry out identity, risk, and creditworthiness checks as an independent controller. No payment-related data is transferred to Klarna while Klarna is not enabled in checkout or is not selected.

9. Shipping with DHL and Deutsche Post

Depending on the selected shipping service, we use DHL Paket GmbH and/or Deutsche Post AG, each at Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany, for parcel and goods shipping.

For transport and delivery, we transfer, in particular, your name, delivery address, shipment and product type, and reference data necessary for shipping. Your email address is transferred only where this is necessary for an instructed delivery notification or similar service and legally permissible.

The legal basis is Article 6(1)(b) GDPR. DHL Paket GmbH and Deutsche Post AG process data for the provision of their postal and transport services under their own responsibility.

10. Product Reviews with Judge.me

We use Judge.me, provided by Judge.me Ltd, c/o Buckworths, 1–3 Worship Street, London EC2A 2AB, United Kingdom, to collect, manage, verify, and display product reviews.

For this purpose, Judge.me may receive from Shopify your name, email address, order number, ordered products, and order date. When you submit a review, the chosen display name, star rating, review text, voluntarily uploaded images or videos, and technical and verification-related metadata may also be processed. Your email address is not displayed as part of the public review; only the content you choose to publish and your selected display name are shown publicly.

Where Judge.me processes data from our shop on our behalf, processing takes place under an agreement pursuant to Article 28 GDPR. Processing a voluntarily submitted review takes place to provide the requested review function under Article 6(1)(b) GDPR. Verification, moderation, and abuse prevention take place under Article 6(1)(f) GDPR; our legitimate interest is authentic, secure, and traceable reviews.

Review invitations are sent only where valid consent under Article 6(1)(a) GDPR has been obtained or where the legal requirements for marketing to existing customers are met. In the latter case, processing is based on Article 6(1)(f) GDPR. You may object to such communications at any time with effect for the future. Images or videos voluntarily provided for publication are published only with the relevant consent.

The United Kingdom is covered by an adequacy decision of the European Commission. Judge.me may also use subprocessors in third countries and states that it uses appropriate safeguards, including Standard Contractual Clauses, where required.

11. Newsletter and Shopify Email Marketing

If you voluntarily subscribe to our newsletter, we process your email address and, where applicable, your name, language and segmentation information, as well as subscription, confirmation, and unsubscribe data in order to send newsletters and document your consent. We use Shopify’s email-marketing functions to send and manage newsletters.

The legal basis is Article 6(1)(a) GDPR. Subscription takes place through a double opt-in process. You may withdraw your consent at any time with effect for the future using the unsubscribe link in each message or by emailing datenschutz@sproutwerk.de. This does not affect the lawfulness of processing carried out before withdrawal.

Where a personalised measurement of openings or interactions is used, this takes place only with separate valid consent. Without such consent, we do not use personalised opening measurement.

12. Google Analytics 4

Where you have given consent through our consent banner, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse use of the shop and improve our offering.

Google Analytics may process browser and device information, language, approximate location, referrer, pages accessed, sessions, interactions, purchases, timestamps, pseudonymous identifiers, and client IDs stored in cookies. The IP address is technically processed during transmission.

Access to, or storage of, information on your device takes place on the basis of your consent under Section 25(1) TDDDG. The subsequent processing of personal data is based on Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future using the cookie settings available in the shop.

User and event data are retained in Google Analytics only for the period configured as necessary for the stated analysis purposes. Aggregated reports may remain available for longer. Configuration-dependent analytics or advertising functions are used only where activated in the shop and covered by your consent.

Google may also transfer data to Google LLC and other group companies or service providers outside the EEA. Such transfers take place in accordance with the safeguards described by Google, including adequacy decisions and Standard Contractual Clauses where applicable.

13. Google Merchant Center and Shopify Google Channel

We use Shopify’s Google sales channel and Google Merchant Center, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Product and shop information, such as product titles, descriptions, images, prices, availability, product identifiers, shipping and return information, and business details, is synchronised with Google so that our products can appear in free listings and in Google services actually activated by us. This product data is generally not personal data.

Where conversion measurement, auto-tagging, Google Analytics, or other measurement functions are activated, pseudonymous identifiers, click and campaign parameters, visited pages, purchase events, order value, and purchased products may additionally be transferred to Google following your consent. The legal basis is Section 25(1) TDDDG for access to your device and Article 6(1)(a) GDPR for subsequent processing.

If the Judge.me product-review feed for Google is activated, the display name, star rating, review text, and product reference may additionally be transferred to Google Merchant Center or Google Shopping and published there. This transfer takes place to display the review that the reviewer has chosen to make public.

14. Cookies, Local Storage, and Consent Management

The shop uses technically necessary cookies and similar technologies so that pages, the shopping cart, checkout, customer account, language settings, security, and requested preferences function correctly. Where access to, or storage on, your device is strictly necessary for the service expressly requested by you, this takes place under Section 25(2) TDDDG. The subsequent processing of personal data is based on Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the purpose.

We use non-essential analytics, personalisation, or marketing technologies only where you have given prior consent through the consent banner. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may change your selection at any time with effect for the future using the privacy or cookie settings available in the shop. Declining optional technologies does not prevent normal purchasing.

Consent management is carried out using Shopify’s customer privacy settings. The categories and providers displayed there are regularly reviewed against the apps, pixels, and sales channels actually installed.

15. Recipients and Processors

Personal data is disclosed only to parties that require it for the purposes described above. These include, in particular, Shopify and its subprocessors, Billbee, Proton Mail, the payment and shipping providers actually selected, and Judge.me and Google.

Authorities, courts, or other bodies receive data where we are legally obliged to disclose it or where this is necessary to enforce legal claims. Where service providers process data on our behalf, they are bound under Article 28 GDPR. Where a recipient determines its own purposes and means, it is responsible for that processing.

16. Transfers Outside the EEA

Shopify and individual subprocessors may process data in countries outside the European Union or the European Economic Area. The same applies to Judge.me and Google. Proton is based in Switzerland and Judge.me is based in the United Kingdom; both countries are covered by adequacy decisions of the European Commission.

For other transfers, processing takes place only where the requirements of Articles 44 et seq. GDPR are met, for example on the basis of an adequacy decision, binding corporate rules, or appropriate Standard Contractual Clauses together with any necessary supplementary measures.

17. Retention Periods

We retain personal data only as long as necessary for the respective purpose. Contract, invoice, and accounting records are generally retained for up to eight years in accordance with statutory retention obligations. Commercial and business correspondence is generally retained for six years. Longer periods may apply to individual records.

Data required for establishing, exercising, or defending legal claims may be retained until the applicable limitation periods expire. Contact requests unrelated to a contract are generally deleted once the request has been fully resolved, unless retention or documentation obligations apply.

Proof of consent and suppression-list entries are retained for as long as necessary to demonstrate consent or permanently respect a withdrawal or objection. Reviews are processed through Judge.me until deleted, a justified request for deletion is made, or the publication purpose no longer applies.

18. Your Rights

Subject to the applicable legal requirements, you have in particular the right to:

• access under Article 15 GDPR;

• rectification under Article 16 GDPR;

• erasure under Article 17 GDPR;

• restriction of processing under Article 18 GDPR;

• data portability under Article 20 GDPR;

• object to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR; and

• withdraw consent at any time with effect for the future.

To exercise your rights, please contact datenschutz@sproutwerk.de. We may request information necessary to verify your identity securely.

19. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our registered business location is in particular:

The State Commissioner for Data Protection and for the Right of Access to Files Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
Germany
Email: Poststelle@LDA.Brandenburg.de
Website: https://www.lda.brandenburg.de/

You may also contact the supervisory authority responsible for your habitual residence or place of work.

20. Status and Changes

Last updated: 6 August 2026.

We will update this Privacy Policy if processing activities, services used, or legal requirements change. For contracts already concluded, the information provided at the time the contract was concluded applies, without prejudice to statutory information obligations.