Datenschutzerklärung

1. Scope and Controller Contact

This Privacy Policy explains how personal data is processed when you visit or make a purchase from christmastraditions.shop, communicate with us, subscribe to marketing or otherwise use our services. For privacy enquiries and requests, contact info@christmastraditions.shop. The website name and email are not a substitute for any additional controller identity and address information that applicable law requires to be displayed in a complete Legal Notice; see the publication notice in Section 6 of this document.

2. Personal Data We Collect

Identity and contact data, such as name, billing and delivery address, email address and telephone number.

Order and transaction data, such as products purchased, order value, discounts, returns, refunds and customer-service history.

Payment-related data. Payment providers process full card or account credentials; we generally receive status, method, limited identifiers and fraud-screening results rather than complete payment credentials.

Technical and usage data, such as IP address, browser, device, operating system, referring pages, pages viewed, timestamps and cookie or similar identifiers.

Marketing preference data, including consent choices, subscriptions, campaign interaction and opt-out records.

Information you voluntarily provide in reviews, enquiries, photographs, warranty claims or other communications.

3. Sources of Data

We collect data directly from you, automatically through the website and cookies, and from service providers involved in ecommerce operations. These may include Shopify, payment processors, fraud-prevention providers, analytics and advertising providers, carriers, fulfilment partners, customer-support tools and email service providers. We may also receive data from social platforms when you interact with an integrated feature, subject to your settings and the platform’s rules.

4. Purposes and Legal Bases

Contract performance: processing orders, taking payment, arranging delivery, providing tracking, handling returns and responding to service requests.

Legal obligations: tax and accounting records, consumer-rights compliance, product safety, sanctions or fraud-related duties, and responding to lawful authority requests.

Legitimate interests: operating and securing the store, preventing fraud, improving products and services, understanding aggregate performance, defending legal claims and providing proportionate service communications, balanced against your rights.

Consent: non-essential cookies, certain analytics or advertising activities, and email marketing where consent is required. Consent may be withdrawn at any time without affecting prior lawful processing.

Vital interests or public-interest grounds only in exceptional cases where the applicable legal conditions are met.

5. Shopify and Service Providers

Our store is hosted on Shopify. Shopify processes personal data to provide the ecommerce platform and may act as a processor or, for certain activities, as an independent controller. We share only data reasonably necessary with providers that support hosting, checkout, payment, fraud screening, order fulfilment, delivery, customer support, analytics, marketing, security, professional advice and legal compliance. Providers are expected to use data only for authorised purposes and to protect it appropriately.

6. Cookies and Similar Technologies

The website may use essential cookies needed for checkout, security, language, cart and account functions. With your consent where required, it may also use functional, analytics and advertising technologies. A consent interface should allow you to accept, reject or manage non-essential categories. You can also change browser settings, but blocking essential cookies may prevent parts of the store from working. Withdrawal of cookie consent should be as easy as giving it.

7. Marketing Communications

We send promotional email only where permitted by law, such as with valid consent or another lawful basis. Every marketing email should include a practical unsubscribe method. You may also opt out by emailing info@christmastraditions.shop. Transactional messages about orders, security, returns or policy changes are not marketing and may still be sent where necessary.

8. International Data Transfers

Some providers may process data outside Germany or the European Economic Area. Where a recipient is in a country without an EU adequacy decision, appropriate safeguards may include European Commission Standard Contractual Clauses, supplementary security measures and transfer assessments. You may contact us for information about applicable safeguards, subject to lawful confidentiality limits.

9. Retention

We retain personal data only as long as reasonably necessary for the purpose collected, including contract performance, customer support, fraud prevention, dispute resolution and legal compliance. German commercial and tax retention duties may require certain transaction records to be kept for several years. Marketing data is retained until consent is withdrawn or the purpose ends, subject to retaining a limited suppression record so an opt-out can be respected. Security logs are retained for proportionate periods based on risk.

10. Your Rights

Subject to the GDPR and applicable conditions, you may request access to personal data, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests or direct marketing. You may withdraw consent at any time. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where an applicable legal exception and safeguards apply.

To exercise a right, email info@christmastraditions.shop. We may request information necessary to verify identity and protect data. We generally respond within one month, subject to lawful extensions for complex or numerous requests. You may lodge a complaint with a competent data protection supervisory authority, particularly in the EU Member State of your habitual residence, workplace or the place of the alleged infringement.

11. Automated Decision-Making and Fraud Prevention

Checkout, payment and fraud tools may automatically assess indicators such as transaction pattern, device, location or payment status. This may result in an order being reviewed, delayed or declined. Where GDPR rules on solely automated decisions apply, you may request information and appropriate human review as required by law.

12. Children

The store is intended for adults purchasing seasonal products. We do not knowingly seek personal data directly from children for independent use of the service. If you believe a child has provided personal data without appropriate authorisation, contact us so that we can investigate and take appropriate action.

13. Security

We use reasonable organisational and technical measures designed to protect personal data, including access controls, provider due diligence, encrypted transmission where supported, account security and monitoring. No internet transmission or storage method is completely secure. Customers should use unique passwords, protect account credentials and contact us promptly about suspected unauthorised activity.

14. Third-Party Links

The website may link to third-party websites or services. Their processing is governed by their own privacy notices. We are not responsible for third-party practices and encourage you to review their information before providing personal data.

15. Changes and Contact

We may update this policy to reflect operational, legal or technical changes. The current version will be posted with a revised effective date. Material changes will be communicated where required. Questions and privacy requests should be sent to info@christmastraditions.shop.