Privacy policy

This is a translation for your convenience. The legally binding version is the German one.

Last updated: 25 August 2026

1. Who is responsible for your data

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Lorenz & Rotsch GbR
Sandheide 28
21714 Hammah
Germany

Partners authorised to represent the company: Richard Rotsch, Enzo Lorenz
Email: info@304supply.de
Phone: +49 176 47114202

For all questions about data protection and to exercise your rights you can reach us at info@304supply.de.

Data protection officer: We have not appointed a data protection officer because, as a rule, fewer than 20 people are permanently engaged in the automated processing of personal data at our company (section 38 (1) BDSG).

2. What this policy is about

At 304supply.de we operate an online shop for jewellery made of 304 stainless steel. This policy tells you which data we process, why we do so, on what legal basis, how long we store the data and what rights you have.

Personal data is any information relating to you or traceable back to you. This includes your name, your address, your email address, but also your IP address and identifiers assigned to your device.

3. Our principles

• We only store what we need for the respective purpose.
• We state the legal basis for every processing operation.
• You can withdraw consent you have given us at any time with effect for the future.
• All service providers who process data for us work on the basis of a data processing agreement under Article 28 GDPR.

4. Overview: which services we use

Service	What for	Legal basis	Where the data is held
Shopify	shop, basket, checkout, customer account, orders	Art. 6 (1) (b) and (f)	Ireland, Canada, USA
Shopify Payments / Stripe, PayPal, Klarna, Apple Pay, Shop Pay, Google Pay	payment	Art. 6 (1) (b)	EU, USA
Billbee	shipping processing, labels, invoices	Art. 6 (1) (b)	Germany
DHL	delivery and parcel tracking	Art. 6 (1) (b)	Germany
Klaviyo	email marketing and transactional emails, customer profile	Art. 6 (1) (a), (b), (f)	USA
Vercel	operation of our own Inner Circle app at auth.304supply.de, server logs	Art. 6 (1) (b) and (f)	USA, EU
Resend	sending the Inner Circle registration and login emails	Art. 6 (1) (b)	USA
Microsoft Clarity	session recording and heatmaps	loaded when the page is opened	USA
Triple Whale	measuring which advertisement led to an order	loaded when the page is opened	USA
Judge.me	product reviews	Art. 6 (1) (a) and (f)	United Kingdom
Pandectes GDPR Compliance	the cookie notice itself and the record of your consent	Art. 6 (1) (c), section 25 (2) no. 2 TDDDG	Estonia
hCaptcha / reCAPTCHA (via Shopify)	protecting forms against automated requests	Art. 6 (1) (f)	USA

5. The processing operations in detail

5.1 Visiting our website

When you open 304supply.de, our shop system processes technically necessary data: your IP address, date and time of access, the page opened, the page previously visited, browser type and operating system as well as the amount of data transferred.

The purpose is delivery of the page, the stability of the shop and defence against attacks. The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest lies in operating the shop securely and in working order.

The shop is operated by Shopify International Limited. Shopify processes this data on our behalf and is at the same time responsible for some of its own purposes. Details are set out in section 5.2.

Storage period: in accordance with Shopify's own rules; the provider does not state a fixed period.

5.2 Shop platform Shopify

Provider: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, with parent company Shopify Inc., Ottawa, Canada.

Shopify hosts the shop, manages the basket, checkout, customer account and orders and uses technically necessary cookies for this. These include session and basket cookies as well as cookies for fraud prevention at checkout.

The legal basis for contract processing is Article 6 (1) (b) GDPR. Section 25 (2) no. 2 TDDDG applies to the technically necessary cookies; we do not need consent for these. For fraud prevention we rely on Article 6 (1) (f) GDPR.

Shopify also processes data outside the EU, in particular in Canada and the USA. For Canada there is an adequacy decision of the European Commission for commercial organisations. Section 6 applies to transfers to the USA.

Shopify also uses what are known as Web Pixels for us.

5.3 Cookies, tracking and your consent

On 304supply.de we use cookies and comparable technologies. We distinguish two groups.

Technically necessary. Without them the shop does not work. These include the basket, login, language setting, security checks at checkout and the storage of your cookie decision itself. Legal basis: section 25 (2) no. 2 TDDDG and Article 6 (1) (b) and (f) GDPR. We do not need consent for this.

Not necessary. These include session recording, reach measurement, advertising measurement and marketing. For this group we obtain your consent via the cookie notice. Legal basis: section 25 (1) TDDDG and Article 6 (1) (a) GDPR.

The cookie notice is provided by the app Pandectes GDPR Compliance, Pudisoo küla, Männimäe/1, 74626 Kuusalu vald, Estonia. It stores your decision and documents it so that we can demonstrate the consent (Article 7 (1) GDPR).

You can change or withdraw your decision at any time. To do so, click the cookie icon at the bottom left of every page. The withdrawal takes effect for the future.

What actually happens today, differing from the above. We tell you this openly because we do not want to give you a description that departs from reality. Two services are already loaded when our pages are opened, that is before you have made a decision in the cookie notice:

Service	What happens when the page is opened
Microsoft Clarity	A connection to clarity.ms is established. From that moment your mouse movements, clicks, scrolling, the pages you open and details about your browser and device are recorded and assembled into a replayable session recording. Details in section 5.10.
Triple Whale	A connection to config-security.com is established, a measurement address of this provider. In the process a persistent device identifier is set and your path through the shop is combined with a later order. Details in section 5.11.

This happens regardless of whether you accepted, declined or clicked nothing at all in the cookie notice. If you do not want this, today you can only block both services via your browser or an extension, for example by blocking the addresses named above. We are working on placing both services behind the cookie notice.

Storage period for the consent records: 3 years from being given or withdrawn

5.4 Order and contract processing

When you order, we process: first and last name, billing and delivery address, email address, telephone number where applicable, the items ordered, the order value, the means of payment, the payment status and the order number.

The purpose is performance of the contract of sale with you, including shipping, invoicing, queries and the handling of returns. Legal basis: Article 6 (1) (b) GDPR. Insofar as we retain the data for accounting purposes, additionally Article 6 (1) (c) GDPR in conjunction with section 147 AO and section 257 HGB.

Providing this data is necessary for the conclusion of the contract. Without it we cannot carry out your order.

5.5 Payment

Depending on the payment method chosen, payment is processed via one of the following providers:

• Shopify Payments, technically processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland
• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
• Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
• Apple Pay, Google Pay and Shop Pay as accelerated payment routes via Shopify

We pass on to the respective provider the data required for the payment: name, address, email address, amount and order reference. You enter payment card details and bank details directly with the payment service provider. We do not see or store them.

Legal basis: Article 6 (1) (b) GDPR. The payment service providers are independently responsible for their own purposes, in particular fraud prevention and credit checks. Please read their own privacy notices on this.

5.6 Shipping via Billbee and DHL

For shipping processing we use Billbee, Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany. Billbee takes order data from Shopify, creates shipping labels and documents and reports the tracking number back.

Delivery is carried out by DHL, DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany. For this we transmit your name, delivery address and, if you have provided them, email address and telephone number. The email address and the telephone number are used to notify you about the delivery.

Legal basis: Article 6 (1) (b) GDPR. Both providers process the data in Germany.

5.7 Customer account and Inner Circle

The 304 Inner Circle is our free membership programme. It runs via our own application, which we operate at auth.304supply.de. It is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA.

Login without a password. You enter your email address and receive a one-time login link from us. This link is valid for 30 minutes. Only clicking the link proves that the address belongs to you. We store no password. These registration and confirmation emails are sent via Resend, Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.

After logging in we set a session cookie named _ic_session. It is valid for one year and serves solely to keep you logged in. In addition, a session identifier is held in your browser's local storage, because some browsers block cookies between our two domains.

What we store about your membership. We store the following details on your customer record at Shopify. We do not operate a database of our own.

Field	Content
miles_balance, miles_lifetime	current Miles balance and Miles collected in total
miles_expires_at	date on which your Miles expire
miles_history	booking journal of your Miles, truncated to the last 200 entries
actions_completed, pending_submissions	completed and submitted challenges
pending_discount, pending_redeem	outstanding discount codes from a Miles redemption
referred_by, referral_invites, referral_unlock	who referred you and whom you have invited
birthday	your birthday, day and month only, without the year
phone	your telephone number, if you provide it
instagram_handle, tiktok_handle	your account name if you complete a follow challenge
login_streak	how many days in a row you have logged in
email_verified, consent_state	whether your address is confirmed and whether marketing consent exists
whatsapp_consent_at, whatsapp_consent_version	time and wording of a WhatsApp consent
attribution	origin of your first visit: UTM values, landing page, referring page. Without IP address and without browser identifier.
return_ledger	register of your return credits
used_auth_codes, redeem_idem	technical one-time identifiers so that a link or a redemption does not take effect twice
last_order_at, delivered_at, ic_joined_at	points in time for managing the membership
email_flow_log	when which automated email was last sent to you, so that you do not receive too many
Customer tags	inner-circle, your class, where applicable ic-nurture

Purposes and legal bases.

• Operation of your member account, login, Miles account, rewards: Article 6 (1) (b) GDPR. The membership is a separate contractual relationship with us.
• Birthday, telephone number, Instagram and TikTok name: Article 6 (1) (a) GDPR. These details are voluntary. You receive Miles for them. If you do not provide them, your membership remains fully intact, you simply do not receive those Miles.
• attribution: Article 6 (1) (f) GDPR. Our legitimate interest is the analysis of the route by which members come to us.
• return_ledger, used_auth_codes, redeem_idem and the anti-misuse limits: Article 6 (1) (f) GDPR. Our legitimate interest is preventing misuse of the programme.

Deletion. You can have your member account deleted at any time. Simply write informally to info@304supply.de. Deleting the customer record removes all of the fields listed above in one step. Separately from this, your order and invoice data remain stored for as long as tax and commercial law require (section 7).

5.8 Returns, withdrawal and the Miles alternative

If you start a return via our returns portal or declare your withdrawal online, we process your name, your order number and your email address. You receive an acknowledgement of receipt on a durable medium.

If you opt for the voluntary alternative "1.5 times the goods value as a Miles credit", we create an entry for it in the return_ledger register. The entry contains the order number, goods value, Miles credited, date and status.

Legal basis for processing the withdrawal: Article 6 (1) (c) GDPR in conjunction with sections 355 et seq. BGB. Legal basis for the register: Article 6 (1) (f) GDPR. Our legitimate interest is the traceability of credits and the prevention of multiple use.

5.9 Email marketing via Klaviyo

Provider: Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA

Klaviyo sends two different kinds of emails for us, and the rules for them differ.

Transactional and service emails. Order confirmation, shipping notification, login link, confirmation of a return, issue of a discount code you requested. These emails are part of the performance of your contract. Legal basis: Article 6 (1) (b) GDPR. You receive them without separate consent and cannot unsubscribe from them while a contract is running.

Promotional emails. Welcome series, reminders about your Miles balance, birthday campaign, win-back, review requests, referral calls and offers. We only send these:

1. if you have expressly consented and confirmed that consent by clicking the confirmation link (double opt-in). Legal basis: Article 6 (1) (a) GDPR and section 7 (2) no. 2 UWG; or
2. if you have purchased from us and we send you advertising for our own similar goods. Legal basis: Article 6 (1) (f) GDPR and section 7 (3) UWG. In this case we point out in every email that you can object.

We document the time and status of your consent so that we can demonstrate it (Article 7 (1) GDPR).

What your Klaviyo profile contains. In a measurement on 19 August 2026, 501 profiles had been created. A profile may contain: name, address, telephone number, birthday (day and month), your orders and order values, which emails you opened and clicked, your Inner Circle class and your Miles balance. For some of the profiles an IP address is additionally stored (on 19 August 2026 this was 10 out of 501). It originates from the registration process.

Open and click measurement. In our promotional emails we measure whether you opened the email and which links you clicked. We use this to improve our emails and to send you more relevant content. The legal basis is your consent under Article 6 (1) (a) GDPR, which you give when signing up to the newsletter.

Withdrawal. You can withdraw your consent at any time. Use the unsubscribe link at the end of every promotional email or write to info@304supply.de. The withdrawal takes effect for the future. You will continue to receive transactional emails afterwards.

5.10 Session recording with Microsoft Clarity

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA.

Clarity records how you use our pages. Mouse movements, scrolling behaviour, clicks, pages opened, time spent, browser type, screen size, approximate location at country level and a truncated or processed IP address are recorded. From this, replayable session recordings and heatmaps are created.

The purpose is to understand where visitors get stuck and to improve the shop.

When Clarity loads. Clarity is loaded when our pages are opened, that is before you have decided in the cookie notice, and regardless of how you decide there. We describe this in detail in section 5.3.

Legal basis. Your consent under Article 6 (1) (a) GDPR and section 25 (1) TDDDG is intended. As long as the service loads before your decision, that consent does not cover the operation.

Microsoft also processes the data in the USA. See section 6.

Storage period stated by Microsoft: recordings 30 days; click data, labelled or favourited sessions and heatmaps 9 months.

5.11 Advertising measurement with Triple Whale

Provider: Triple Whale, Inc., 800 North High Street, Columbus, OH 43215, USA.

When our pages are opened, Triple Whale sets a tracking pixel and a persistent device identifier. With it we attribute an order to the advertisement through which you came to us. Among other things, the pages opened, the source (UTM values, referring page), device and browser details, the IP address and the order itself are recorded.

Because a persistent identifier is set in the process and your behaviour is combined across several visits, this constitutes profiling for advertising purposes.

When Triple Whale loads. The tracking pixel is loaded when our pages are opened, that is before you have decided in the cookie notice, and regardless of how you decide there. The requests run via the address config-security.com. We describe this in detail in section 5.3.

Legal basis. Your consent under Article 6 (1) (a) GDPR and section 25 (1) TDDDG is intended. As long as the service loads before your decision, that consent does not cover the operation.

The storage period and the lifetime of the device identifier are determined by the provider. It does not state a fixed period publicly; we are obtaining it from the provider and will enter it here as soon as we have it.

5.12 Product reviews with Judge.me

Provider: Judge.me Ltd, c/o Buckworths, 2nd Floor, 1–3 Worship Street, London EC2A 2AB, United Kingdom.

After a purchase we may ask you by email for a review. If you submit a review, we process your name or the display name you have chosen, your rating, the text, any images uploaded and the information as to whether it is a verified purchase. Your review is displayed publicly on the product page.

Legal basis for the request: Article 6 (1) (a) GDPR insofar as the request is made by promotional email, otherwise Article 6 (1) (f) GDPR. Legal basis for publishing your review: Article 6 (1) (a) GDPR. You decide for yourself whether to submit a review.

For the United Kingdom there is an adequacy decision of the European Commission.

5.13 Creator programme

If you apply via our Creator page, we process: your name, your email address, your platform and your account name on Instagram, TikTok or YouTube, the reach you state yourself, your niche, your location, your message to us as well as the time and existence of your express consent to being contacted. In addition we process your IP address briefly in order to protect the form against automated bulk submissions.

Creator applications are stored separately from our customer data in a separate application. They do not become a customer account and do not become a membership of the Inner Circle.

Legal bases: Article 6 (1) (a) GDPR for being contacted, Article 6 (1) (b) GDPR for initiating and carrying out a collaboration, Article 6 (1) (f) GDPR for protecting the form.

Storage period: rejections are deleted after 6 months. Ongoing collaborations are stored for the duration of the collaboration, accounting documents thereafter in accordance with the tax retention periods

5.14 Security and prevention of misuse

We limit how often the same address or the same connection can trigger certain operations, for example requesting login links. For this we process your IP address only transiently in the working memory of our server. It is not stored permanently and not linked to your account.

For forms in the shop, Shopify additionally uses automatic bot protection (hCaptcha or reCAPTCHA respectively).

Legal basis: Article 6 (1) (f) GDPR. Our legitimate interest is protection against misuse, against exploitation of our bonus programme and against attacks.

5.15 Accounting and statutory obligations

We are obliged to retain invoices, receipts and order data and to hand them over to the tax authorities if required.

Legal basis: Article 6 (1) (c) GDPR in conjunction with section 147 AO, section 257 HGB and section 14b UStG.

5.16 Contacting us

If you write to us by email or via a form, we process your details in order to answer your enquiry.

Legal basis: Article 6 (1) (b) GDPR if it concerns a contract with you, otherwise Article 6 (1) (f) GDPR.

Storage period: enquiries without a contractual connection 6 months after final processing. Emails that qualify as commercial letters, 6 years under section 257 (4) HGB

5.17 QR code on the printed thank-you card

A printed thank-you card is enclosed with every shipment. It carries a QR code. It leads to

https://304supply.de/pages/inner-circle?ic_login=1

What the QR code itself contains. The code contains only this one address. It contains no order number, no customer name, no identifier and no individual code. All printed cards carry the same code. We therefore cannot deduce from a scan who scanned it or which order the card belonged to.

What happens when it is scanned. The scan opens a perfectly ordinary page of our shop. The same rules therefore apply as for any other visit to our pages:

• The technical access data from section 5.1 arises, in particular your IP address, time, page opened as well as browser and device details.
• The services named in section 5.3 load, that is including Microsoft Clarity and Triple Whale. A scan of the card is therefore recorded and attributed to advertising measurement just like any other page visit. The same open point applies to the legal basis as there.
• The addition ic_login=1 in the address does only one thing: the Inner Circle login window opens immediately instead of you having to look for it. It does not transmit any data about you.

What happens if you then log in. Only when you enter your email address in the login window does personal data relating to your membership arise. Section 5.7 applies to this. If you only scan and leave the page again, no member account is created.

Legal basis for the page visit: Article 6 (1) (f) GDPR (section 5.1).
Legal basis for a subsequent login: Article 6 (1) (b) GDPR (section 5.7).

6. Transfers to the USA and other third countries

Some of the services named above process data in the USA. This concerns in particular Shopify, Klaviyo, Microsoft Clarity, Triple Whale, Vercel and Resend.

The USA is a third country without a general level of protection equivalent to the European one. The following applies:

EU-US Data Privacy Framework. On 10 July 2023 the European Commission decided that companies in the USA certified under the EU-US Data Privacy Framework offer an adequate level of protection. No further safeguard is therefore required for transfers to certified companies.

Whether a provider is certified we check individually for each provider against the official list at https://www.dataprivacyframework.gov. Where a certification does not exist or is not established, the following paragraph applies.

Standard contractual clauses. Where a provider is not certified, we base the transfer on the European Commission's standard contractual clauses under Article 46 (2) (c) GDPR, supplemented by additional technical and organisational measures.

Consent. If you consent in the cookie notice, you thereby also consent to the transfer of your data to the USA (Article 49 (1) (a) GDPR). We point out that under certain conditions US authorities can access this data and that you may not have legal remedies comparable to those under European law.

Canada. Shopify's group headquarters are in Canada. For Canada there is an adequacy decision of the European Commission for commercial organisations subject to the Canadian PIPEDA.

You can request a copy of the standard contractual clauses from us.

7. How long we store your data

Type of data	Period	Reason
Order and invoice data, accounting vouchers	10 years from the end of the calendar year	section 147 (3) AO, section 257 (4) HGB. Note: since 1 January 2025 a shortened period of 8 years applies to accounting vouchers; for commercial books, inventories and annual financial statements it remains 10 years.
Commercial letters, business emails	6 years from the end of the calendar year	section 257 (4) HGB, section 147 (3) AO
Customer account and Inner Circle membership, if you delete it yourself	immediately, at the latest 30 days	Article 17 GDPR
Inactive customer account, no order and no login	deletion after 24 months, with advance warning by email 30 days beforehand	Article 5 (1) (e) GDPR. The value must be longer than the expiry period for Miles, otherwise we delete accounts that still hold a balance.
Marketing profile at Klaviyo after your withdrawal	deletion after 6 months	after the withdrawal the legal basis ceases to apply. The period then serves only to prove the withdrawal.
Suppression list of marketing opt-outs	indefinite, email address only in shortened form	Article 6 (1) (c) and (f) GDPR. Without this list we might inadvertently contact you again.
Consent records (cookie notice, newsletter)	3 years from withdrawal or end of use	Article 7 (1) GDPR in conjunction with section 195 BGB
Server logs Vercel and Shopify	in accordance with the respective provider's own rules	Article 6 (1) (f) GDPR. Retention lies with the provider; Shopify does not state a fixed period, and depending on the plan Vercel retains runtime logs for only a few hours to days. We therefore do not state a period we cannot keep to.
IP address in rate limiting	transient, not stored permanently	Article 6 (1) (f) GDPR
Session recordings Microsoft Clarity	30 days, labelled sessions and heatmaps 9 months	as stated by Microsoft
Device identifier Triple Whale	determined by the provider, period requested from the provider	statement outstanding
Returns register return_ledger	3 years after the last entry	section 195 BGB
Withdrawal declarations and acknowledgements of receipt	3 years	proof of compliance with the obligations under section 356 BGB
Creator applications without collaboration	6 months	Article 6 (1) (f) GDPR
Product reviews	for as long as the review is published, thereafter 3 years	proof of authenticity under section 5b (3) UWG

Irrespective of this, we delete data as soon as the purpose ceases to apply and no retention obligation remains. Where a retention obligation prevents deletion, we block the data from any further use instead.

8. Your rights

You have the following rights in relation to us:

• Access (Article 15 GDPR): you can find out which data we process about you and request a copy of it.
• Rectification (Article 16 GDPR): you can have incorrect data corrected.
• Erasure (Article 17 GDPR): you can request the erasure of your data, insofar as no statutory retention obligation prevents it.
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR): you can receive your data in a common format or have it transferred directly to another provider.
• Objection (Article 21 GDPR): you can object at any time if we process your data on the basis of a legitimate interest. You can object to direct marketing at any time and without giving reasons. After that we will no longer use your data for advertising.
• Withdrawal of consent (Article 7 (3) GDPR): you can withdraw consent given at any time with effect for the future. The lawfulness of the processing up to the withdrawal remains unaffected.

How to reach us:

By email to info@304supply.de or by post to
Lorenz & Rotsch GbR, Sandheide 28, 21714 Hammah, Germany.

An informal message is sufficient. You do not have to fill in a form or state a reason. We may ask you for proof of your identity if there are reasonable doubts that the request comes from you (Article 12 (6) GDPR).

Our deadline: we reply without undue delay, at the latest within one month of receiving your request. If your request is particularly extensive, we may extend this period by up to two further months. In that case we will tell you within the first month and state the reason (Article 12 (3) GDPR).

Exercising your rights is free of charge for you.

Your right to lodge a complaint with a supervisory authority

You can lodge a complaint with a data protection supervisory authority at any time, in particular in the country of your residence, your place of work or the suspected infringement (Article 77 GDPR).

Because Hammah is in the district of Stade in Lower Saxony, the authority responsible for us is:

Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
Internet: https://www.lfd.niedersachsen.de

9. Automated decisions and profiling

An automated decision in an individual case under Article 22 GDPR that produces legal effects concerning you or similarly significantly affects you does not take place.

We do, however, form groups and segments in order to send you suitable offers. Your Inner Circle class, for example, results automatically from your total spend to date. The selection of which automated email you receive is also rule-based, according to your behaviour. The legal basis for this is your consent under Article 6 (1) (a) GDPR, or Article 6 (1) (b) GDPR for the membership itself.

Member prices. Members of the Inner Circle see different prices than non-members. This difference depends solely on the membership and not on an automated analysis of your personal behaviour.

10. Are you obliged to provide data?

For an order we need your name, your address and your email address. Without these details no contract comes about.

All other details are voluntary. This applies expressly to birthday, telephone number, Instagram and TikTok name and participation in the Inner Circle. If you do not provide these details, you suffer no disadvantages when purchasing.

11. Data security

The transmission between your browser and our shop is encrypted with TLS. For the Inner Circle we store no passwords, but work with one-time login links. Access to our administration areas is protected with keys.

No security procedure is perfect. Please do not send us confidential information over unencrypted channels.

12. Changes to this policy

We adapt this policy when our processing operations or the legal situation change. The version published on this page applies in each case. We will inform you of material changes insofar as this is required by law.