Privacy policy
This English version is provided for information. The German version is legally binding.
Thank you for visiting our online shop. Protecting your personal data is important to us. Below we inform you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process, for what purposes, on what legal basis, to whom we disclose it, how long we store it and what rights you have.
1. Controller
Franz Ziener GmbH & Co. KG
Schwedengasse 5
82487 Oberammergau
Germany
Phone: +49 8822 9206-0
Email: info@ziener.de (subject “Data protection”)
2. Data protection officer
You can reach our data protection officer at:
Mrs Beate Fiedler, fiedler-IT
Bernbeurener Straße 10
86956 Schongau
Germany
Phone: +49 8861 9108424
3. Legal bases
We process personal data on the following legal bases:
- consent (Art. 6(1)(a) GDPR), where applicable together with § 25(1) TDDDG for access to information on your device;
- performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR);
- legal obligation (Art. 6(1)(c) GDPR), for example retention obligations under commercial and tax law;
- legitimate interests (Art. 6(1)(f) GDPR); we state the interest for each processing activity. Strictly necessary access to your device is based on § 25(2) no. 2 TDDDG.
4. Provision of the online shop and hosting (Shopify)
Our online shop runs on the Shopify e-commerce platform. The contracting entity for merchants in Europe is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland. Shopify provides the shop, product catalogue, cart, checkout, customer accounts and order and returns management, and delivers content via its own content delivery network.
When you visit our online shop, data transmitted by your browser is processed automatically: IP address, date and time of access, page requested, referrer URL, browser type and version, operating system and language setting. This is necessary to deliver the shop, ensure its stability and security, and defend against attacks (Art. 6(1)(f) GDPR; legitimate interest: secure and functioning operation). Shopify does not state a fixed storage period for this server log data; it is deleted as soon as it is no longer needed for these purposes.
For the provision of the shop, Shopify is our processor; we have concluded a data processing agreement with Shopify. The European Union is set as the storage location for our shop's data. Shopify nevertheless processes some data on servers outside the EU, in particular in Canada and the USA (Shopify Inc.). An adequacy decision of the European Commission exists for Canada; other transfers are safeguarded by binding corporate rules and EU standard contractual clauses.
Shopify processes data for its own purposes as an independent controller, in particular for Shop Pay and the Shop app (see section 10) and, for example, for fraud prevention. More information: https://www.shopify.com/legal/privacy
5. Technical service provider and data backup
For the build, configuration, operation and maintenance of our online shop we use DEED B.V., Boven de Wolfskuil 20, 6049 LZ Herten, the Netherlands, as a processor. DEED has access to personal data only to the extent necessary for operation, error analysis and support, and is contractually bound by our instructions (Art. 28 GDPR).
To back up our shop data we use the Shopify app BackupMaster by BackupMaster Technologies Pty Ltd, Sydney, Australia, as a processor. BackupMaster regularly creates backup copies of our shop, including customer and order data (name, contact details, delivery and billing address, orders), so that we can restore the data after an error or data loss (Art. 6(1)(f) GDPR; legitimate interest: availability and security of our data). The backups are stored in Microsoft Azure data centres in the USA. Transfers to Australia and the USA are safeguarded by EU standard contractual clauses.
6. Customer account and guest orders
You can order as a guest or create a customer account. For the customer account we process name, email address, addresses, phone number (optional) and your order history, in order to provide the account (Art. 6(1)(b) GDPR).
A guest order does not create a reusable account. However, we also store the order data itself for guest orders, because it is needed for delivery, invoicing, warranty and statutory retention obligations (see section 22).
You can have your customer account deleted at any time. We automatically delete accounts that have not been used for three years. Data subject to statutory retention obligations is kept in restricted form until those obligations expire.
7. Cookies and consent management (CookieYes)
We use cookies and similar technologies (e.g. local storage, pixels). Strictly necessary technologies, for example for the cart, checkout, language setting and security, are used on the basis of § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. All other technologies, for example for functionality, analytics and advertising, are used only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
To obtain and record your consent we use the Shopify app CookieYes by CookieYes Limited, 3 Warren Yard, Warren Park, Wolverton Mill, Milton Keynes, MK12 5NW, United Kingdom, as a processor. CookieYes passes your choice to Shopify, so that Shopify and the connected services only process data within the scope of your consent. As proof of consent, a pseudonymous consent ID, your truncated IP address, your country, the date and time and your choice per category are stored. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent). The consent records are stored on servers in the EU. An adequacy decision of the European Commission exists for the United Kingdom; transfers to sub-processors outside the EU are safeguarded by EU standard contractual clauses. Your choice is stored for 12 months in the cookie “cookieyes-consent”; after that we ask you again.
A complete list of all cookies and similar technologies used, with provider, purpose and storage period, can be found in the cookie settings. There you can also change or withdraw your consent at any time with effect for the future. You can open the cookie settings via the “Cookie settings” link in the footer of every page.
8. Order processing
When you place an order, we process the data you enter in the checkout: form of address, first and last name, delivery and billing address, email address, phone number (optional), items ordered, prices, payment method and order and payment status. This is done to perform the contract (Art. 6(1)(b) GDPR) and to comply with legal obligations (Art. 6(1)(c) GDPR).
To process your order we transfer the order data to our merchandise management system (Comarch ERP), in which we handle the order, delivery, invoice and returns, and pass the necessary data to the shipping provider (section 9) and to the payment provider you choose (section 10). Automated processes within Shopify, such as notifications and status changes, run through Shopify Flow.
We create invoices with the Shopify app Order Printer Pro by Shop Circle Ltd, 25 Eccleston Place, London SW1W 9NF, United Kingdom, as a processor. An adequacy decision of the European Commission exists for the United Kingdom; transfers to sub-processors in the USA are safeguarded by EU standard contractual clauses.
Transactional emails such as the order confirmation, shipping confirmation, account notifications and the acknowledgement of a withdrawal are sent via Shopify.
If you buy a gift card and have it sent directly to another person, we process that person's name and email address solely to deliver the gift card. For the recipient: we receive this data from the person who ordered the gift card and named you as the recipient. The legal basis is our legitimate interest and that of the person ordering in delivering the gift card (Art. 6(1)(f) GDPR). We store the data until the gift card can no longer be redeemed. The email containing the gift card includes a reference to this privacy policy.
9. Shipping
For delivery we transfer name, delivery address, order number and parcel data to DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (Art. 6(1)(b) GDPR). We do not pass your email address or phone number to DHL. We inform you about the shipment ourselves by email with a tracking link.
10. Payment processing
Depending on the payment method you choose, we transfer the data required for payment (name, billing address, email address, order amount, order number) to the payment provider concerned (Art. 6(1)(b) GDPR). Neither we nor our technical service provider receive complete card details. Payment providers partly process your data as independent controllers under their own privacy notices.
Shopify Payments
Payments by credit card, Apple Pay and Google Pay are processed via Shopify Payments. The provider is Shopify International Limited (address in section 4), which uses specialised payment processors for this purpose. More information: https://www.shopify.com/legal/privacy
Shop Pay
If you use Shop Pay, Shopify processes your data as an independent controller to store your payment and delivery details for future purchases. More information: https://www.shopify.com/legal/privacy/app-users
PayPal
If you pay with PayPal, we transfer your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal is an independent controller for payment processing. More information: https://www.paypal.com/de/legalhub/privacy-full
Klarna
If you pay with Klarna, we transfer your contact and order data to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna is an independent controller. For purchase on invoice and instalments, Klarna carries out an identity and credit check and transfers data to credit reference agencies for this purpose. On the basis of this check, Klarna decides whether the payment method is offered to you. The legal bases are Art. 6(1)(b) and (f) GDPR. Which credit agencies Klarna uses, how Klarna processes your data and what rights you have against Klarna, including the right to obtain human intervention, to express your point of view and to contest an automated decision, can be found here: https://www.klarna.com/de/datenschutz/
Fraud prevention
To protect against payment default and fraud, orders are checked automatically for risk indicators by Shopify or the payment provider concerned (Art. 6(1)(f) GDPR; legitimate interest: fraud prevention).
11. Withdrawal, returns and returns portal
If you declare a withdrawal or return goods, we process name, contact details, order number, items concerned, optionally the reason for return, and the date and time of your declaration (Art. 6(1)(b) and (c) GDPR). If you use the online withdrawal function, we send you an acknowledgement of receipt by email.
For returns and the online withdrawal function we use the portals of 8returns GmbH, Pappelallee 78/79, 10437 Berlin, Germany, as a processor: the returns portal at https://ziener.portal.8returns.com/ and the withdrawal portal at https://ziener.portal.8returns.com/withdrawal. To sign in, you enter your order number and email address. 8returns retrieves the required order data from Shopify, records your return or withdrawal and, for returns, creates the return label.
12. Contact and customer service (Gorgias)
If you contact us by email, contact form or phone, we process your details (name, email address, order number, content of your message) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest: responding to enquiries).
We use the helpdesk system of Gorgias, Inc., 180 Sansome Street, Suite 1800, San Francisco, CA 94104, USA, as a processor to handle customer enquiries. The transfer to the USA is safeguarded by EU standard contractual clauses.
13. Live chat (Gorgias)
We offer a Gorgias live chat on our website. The chat widget is only loaded once you have given your consent in the cookie settings (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). The chat transcript, name and email address (if provided), device and browser data and your IP address are processed. For transfers to the USA, see section 12.
14. Protection against spam and abuse (hCaptcha)
To protect our contact and comment forms and the forms for login, registration and password reset against automated access and spam, the hCaptcha service by Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA, is integrated in our shop system. hCaptcha only becomes active when you use one of these forms. Your IP address, browser and device information and interaction data such as mouse movements and keystrokes are transmitted to hCaptcha and analysed to determine whether the input comes from a human.
The access to information on your device required for this is strictly necessary so that we can securely provide the service you have explicitly requested, namely submitting the form (§ 25(2) no. 2 TDDDG). The subsequent processing is based on our legitimate interest in protecting our forms against abuse and spam (Art. 6(1)(f) GDPR). Intuition Machines, Inc. is certified under the EU-US Data Privacy Framework. More information: https://www.hcaptcha.com/privacy
15. Newsletter
If you subscribe to our newsletter, we process your email address and the date, time and IP address of the sign-up and confirmation. We use the double opt-in procedure: you receive an email with a confirmation link and are only added to the mailing list after confirming. The legal basis is your consent (Art. 6(1)(a) GDPR).
Sign-up, management and sending of the newsletter take place via our shop system Shopify (section 4).
You can unsubscribe at any time via the link in every email or by sending a message to info@ziener.de.
16. Reviews (Judge.me and Trusted Shops)
Product reviews (Judge.me)
We use Judge.me by Judge.me Ltd, c/o Buckworths, 1-3 Worship Street, London EC2A 2AB, United Kingdom, to collect and display reviews of our products and shop.
If you have consented in the checkout, we send you an email about seven days after delivery asking for a review, and possibly one reminder (Art. 6(1)(a) GDPR). You can withdraw this consent at any time via the unsubscribe link in the email. If you submit a review, we process name, email address, order reference, review text, star rating and any images you upload. Your review is published with your first name and abbreviated last name. The legal basis for publication is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time; the review will then be removed.
An adequacy decision of the European Commission exists for the United Kingdom. Judge.me also stores data on servers in the USA; this transfer is safeguarded by EU standard contractual clauses.
Authenticity of reviews: Only customers who have ordered through our online shop can submit reviews; they are verified via the order reference. For every review submitted you receive a 10% discount code, regardless of its content. Reviews with four or five stars are published automatically, all others after a check for insults and unlawful content; negative reviews are not suppressed.
Trusted Shops
We have integrated widgets of Trusted Shops SE, Subbelrather Straße 15c, 50823 Cologne, Germany (Trustbadge) to display our Trusted Shops seal and collected reviews. We and Trusted Shops are joint controllers for the integration and the related data processing (Art. 26 GDPR). You can exercise your rights against us and against Trusted Shops; we will provide the essence of the arrangement on request.
When you visit our shop, the Trustbadge is delivered via a content delivery network provider. Your IP address, the date and time, the amount of data transferred and the requesting provider are processed in server log files; the IP address is anonymised immediately after collection. The Trustbadge sets session cookies that are required for its display and function (§ 25(2) no. 2 TDDDG). After an order, the order total, order number and your email address, the latter encrypted with a cryptographic one-way function, are transmitted to Trusted Shops to check whether you are already registered with Trusted Shops. If you are not registered, this data is deleted automatically. The legal basis is our legitimate interest in a trustworthy presentation of our shop and our reviews (Art. 6(1)(f) GDPR).
You will only receive a review invitation from Trusted Shops if you have expressly consented during the ordering process (Art. 6(1)(a) GDPR); you can withdraw this consent at any time.
Trusted Shops uses service providers in the USA and Israel. An adequacy decision of the European Commission exists for both countries, for the USA under the EU-US Data Privacy Framework; EU standard contractual clauses apply in the alternative. More information: https://www.trustedshops.com/legal/privacy
17. Web analytics
Shopify Analytics
Shopify provides us with reports on visits, orders and conversion. Where non-essential cookies or similar technologies are used for this, this only happens with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which is passed to Shopify via CookieYes.
Google Analytics 4
With your consent, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse and improve the use of our online shop. A pseudonymous client ID, device and browser data, approximate location, pages viewed and events such as cart and purchase are processed. Google processes the IP address to derive approximate location information and, for users from the EU, discards it before it is logged or stored. We use Google Consent Mode v2 in basic mode: Google Analytics is only loaded once you have given your consent in the cookie settings. Without your consent, no cookies are set and no data is transmitted to Google. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. The data is deleted after 14 months. Legal basis: § 25(1) TDDDG, Art. 6(1)(a) GDPR. More information: https://policies.google.com/privacy
18. Search and filters
For search and product recommendations we use the Shopify app Search & Discovery; the data remains with Shopify. For the filter function on category pages we use Smart Product Filter & Search by Globo Software Solution JSC, 18 Khuc Thua Du, Hanoi, Vietnam, as a processor. Search terms, filter selections and a session identifier are processed (Art. 6(1)(f) GDPR; legitimate interest: user-friendly product search). The transfer to Vietnam is safeguarded by EU standard contractual clauses.
19. Links to social networks
Links to our profiles on Instagram, Facebook and other networks are simple links. Only when you click a link are you taken to the network concerned, which is then responsible for the data processing.
20. Fonts
Fonts are loaded from Shopify's servers. No connection is made to servers of Google Fonts or other font providers.
21. Recipients and transfers to third countries
We only disclose personal data where this is necessary for the purposes stated. Recipients are processors that we have carefully selected and contractually bound under Art. 28 GDPR, independent controllers such as payment and shipping providers, and Trusted Shops as joint controller. Authorities only receive data within the scope of legal obligations.
| Provider | Purpose | Role | Third country and safeguard |
|---|---|---|---|
| Shopify International Ltd., Ireland | Shop system, hosting, Shopify Payments | Processor | Canada (adequacy decision), USA (binding corporate rules, standard contractual clauses) |
| Shopify International Ltd., Ireland | Shop Pay, Shop app, fraud prevention | Independent controller | Canada (adequacy decision), USA (binding corporate rules, standard contractual clauses) |
| DEED B.V., Netherlands | Technical operation and support | Processor | None |
| BackupMaster Technologies Pty Ltd, Australia | Data backup | Processor | Australia and USA (standard contractual clauses) |
| CookieYes Limited, United Kingdom | Consent management | Processor | UK (adequacy decision), sub-processors outside the EU (standard contractual clauses) |
| DHL Paket GmbH, Germany | Shipping | Independent controller | None |
| PayPal (Europe), Luxembourg | Payment | Independent controller | None |
| Klarna Bank AB, Sweden | Payment, credit check | Independent controller | None |
| 8returns GmbH, Germany | Returns and withdrawal portal | Processor | None |
| Gorgias, Inc., USA | Customer service, live chat | Processor | USA (standard contractual clauses) |
| Judge.me Ltd, United Kingdom | Product reviews | Processor | UK (adequacy decision), USA (standard contractual clauses) |
| Trusted Shops SE, Germany | Seal and reviews | Joint controller | USA (Data Privacy Framework), Israel (adequacy decision) |
| Shop Circle Ltd, United Kingdom | Invoice creation | Processor | UK (adequacy decision), USA (standard contractual clauses) |
| Globo Software Solution JSC, Vietnam | Filter function | Processor | Vietnam (standard contractual clauses) |
| Intuition Machines, Inc. (hCaptcha), USA | Spam protection for forms | Integrated via Shopify | USA (Data Privacy Framework) |
| Google Ireland Ltd. | Google Analytics 4 | Processor | USA (Data Privacy Framework) |
Transfers to countries outside the EU and EEA only take place where an adequacy decision of the European Commission exists for the country (for the USA: for companies certified under the EU-US Data Privacy Framework) or where appropriate safeguards under Art. 46 GDPR are in place, in particular EU standard contractual clauses. You can request a copy of the standard contractual clauses from us.
22. Storage period
We store personal data only for as long as necessary for the purpose concerned or as required by statutory retention obligations. The data is then deleted or, as long as a retention obligation applies, restricted from processing.
| Data | Storage period |
|---|---|
| Invoices and other accounting records | 8 years from the end of the calendar year (§ 147 AO, § 257 HGB) |
| Commercial and business letters, e.g. order and shipping confirmations | 6 years from the end of the calendar year (§ 147 AO, § 257 HGB) |
| Other order data | 3 years from the end of the year of the order (standard limitation period) |
| Customer account | Until you delete it or after three years without use |
| Withdrawal and returns data | Same as the related order data |
| Customer service correspondence (Gorgias) | 3 years after the request is closed |
| Newsletter | Until you unsubscribe; proof of consent for a further 3 years |
| Review requests and product reviews | Until consent is withdrawn or as long as the review is published |
| Name and email address of gift card recipients | Until the gift card can no longer be redeemed |
| Cookie choice and proof of consent (CookieYes) | Your choice applies for 12 months; we keep the proof at least as long as the consent is valid |
| Trusted Shops | Server log data 7 days; order data of non-registered customers is deleted automatically |
| Google Analytics 4 | 14 months |
| Server log data (Shopify) | Until no longer needed for security and error analysis; Shopify does not state a fixed period |
23. Obligation to provide data
To conclude a purchase contract, we need the details marked as mandatory in the checkout. Without this data we cannot conclude or perform the contract. All other details are voluntary.
24. Automated decisions
We do not make any solely automated decisions within the meaning of Art. 22 GDPR ourselves. For the credit check by Klarna, see section 10.
25. Business customers
If you order on behalf of a company, we additionally process the company name, VAT ID where applicable, and the contact details of the person acting. The legal basis is Art. 6(1)(b) GDPR where you yourself are the contracting party, otherwise Art. 6(1)(f) GDPR (legitimate interest: conducting the business relationship with your company).
We may receive the contact details of the person acting (name, business email address, phone number and position) from your employer or another contact person at your company.
26. Your rights
Where the respective legal requirements are met, you have in particular the following rights:
- under Art. 15 GDPR to request access to your data processed by us;
- under Art. 16 GDPR to request the rectification of inaccurate data;
- under Art. 17 GDPR to request the erasure of your data, unless a retention obligation applies;
- under Art. 18 GDPR to request the restriction of processing;
- under Art. 20 GDPR to receive your data in a structured, commonly used and machine-readable format;
- under Art. 7(3) GDPR to withdraw consent at any time with effect for the future;
- under Art. 77 GDPR to lodge a complaint with a supervisory authority.
To exercise your rights, a message to info@ziener.de (subject “Data protection”) or to our data protection officer is sufficient. As a rule, we will inform you of the action taken within one month of receipt of your request. In the cases provided for by law, this period may be extended by up to two further months.
Right to object under Art. 21 GDPR: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds. Where your data is processed for direct marketing, you can object at any time without giving reasons; we will then no longer process the data for this purpose.
The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the supervisory authority at your place of residence; in Austria this is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.
27. Data security
Our online shop uses TLS encryption, recognisable by the padlock symbol and “https://” in the address bar. We and our service providers take technical and organisational measures to protect your data against loss, manipulation and unauthorised access.
28. Changes
We update this privacy policy when our online shop, the services used or the legal situation change. The version published here applies.
Last updated: October 2026