Data protection regulation
Status: September 2, 2026
1. Controller
The controller responsible for the processing of personal data on this website is:
Lea Strunk e.K.
Studio Hertzberg
Stuttgarter Straße 47
12059 Berlin
Germany
Phone: +49 1634 360191
E-Mail: team@studiohertzberg.de
Below, we provide information on how we process personal data when you visit our website, use our online shop, place an order, sign up for our newsletter, or communicate with us in any other way.
Personal data is any information relating to an identified or identifiable natural person.
2. What personal data do we process?
Depending on how you use our website and online shop, the following categories of personal data, in particular, may be processed:
- Contact and master data such as name, billing address, delivery address, phone number, and e-mail address
- Order and transaction data such as products ordered or viewed, shopping cart contents, returns, cancellations, and previous transactions
- Payment information, to the extent required for the selected payment method
- Account data if you create a customer account
- Communication data, especially information that you provide to us when contacting us
- Device and access data such as IP address, browser, device, operating system, network connection, date and time of access, as well as technical identifiers
- Usage data, especially information about how you use our website and online shop and how you interact with products, pages, and features
3. Legal basis for processing
We only process personal data if there is a legal basis for doing so.
Where processing is necessary for the performance of pre-contractual measures or the fulfillment of a contract, it is based on Art. 6 (1) (b) GDPR. This applies in particular to orders, payments, shipping, returns, and customer accounts.
Where we are legally obligated to process or store certain data, the processing is based on Art. 6 (1) (c) GDPR.
Where processing is necessary for the protection of our legitimate interests or the legitimate interests of a third party, and your interests or fundamental rights do not override these, it is based on Art. 6 (1) (f) GDPR. This includes, in particular, the technical security of our online shop, fraud prevention, and the handling of general inquiries.
Where we obtain your consent, the processing is based on Art. 6 (1) (a) GDPR. This applies in particular to analysis, marketing, and tracking technologies that require consent.
You may revoke your consent at any time with effect for the future.
4. Hosting and shop operation by Shopify
Our online shop is operated via Shopify. For merchants in the European Economic Area, Shopify services are provided primarily by Shopify International Limited, Ireland, and affiliated Shopify companies.
Shopify processes personal data that is generated during your visit to and use of our online shop. This may include, in particular, IP address, device and browser information, usage data, contact information, order data, and payment information.
Where Shopify processes personal data on our behalf, this is done within the scope of a data processing agreement. Shopify may also process personal data as an independent controller for certain services.
Further information on the processing of personal data by Shopify can be found in Shopify’s Privacy Policy for consumers:
https://www.shopify.com/legal/privacy/app-users
5. Shopify Network Intelligence and Enhanced Services
We have activated Shopify Network Intelligence and thus use Shopify's so-called Enhanced Services.
In this context, Shopify may process information about your interactions with our shop along with information from interactions with Shopify and other Shopify merchants. These services can be used, in particular, to personalize the shopping experience, improve shop performance, and optimize advertising and its targeting.
For certain processing operations in connection with these Enhanced Services, Shopify acts as an independent controller.
Where your consent is required for personalized advertising or comparable processing, such processing is based on your consent. You may revoke your consent at any time with effect for the future.
Further information on processing by Shopify as well as ways to exercise your data protection rights can be found in the Shopify Privacy Portal:
6. Access to our website
When you visit our website, technically necessary data is automatically processed. This may include, in particular, IP address, browser information, device data, operating system, date and time of access, and information about pages accessed.
The processing serves in particular the technical provision, stability, and security of our online shop.
Where the processing is based on our legitimate interests, the legal basis is Art. 6 (1) (f) GDPR.
7. Orders and contract fulfillment
When you place an order, we process the personal data required to carry out the order. This includes, in particular, name, billing and delivery address, e-mail address, and phone number (if applicable), products ordered, as well as information on the selected payment method.
Processing is carried out for the performance of pre-contractual measures and for the fulfillment of the sales contract in accordance with Art. 6 (1) (b) GDPR.
Where legal retention obligations exist, further processing is based on Art. 6 (1) (c) GDPR.
8. Customer account
When you create a customer account, we process the data required for setting up and managing your account.
Processing is carried out in accordance with Art. 6 (1) (b) GDPR.
You may request the deletion of your customer account, provided that no legal retention obligations or other legal reasons prevent such deletion.
9. Contacting us
When you contact us via e-mail, phone, or a contact form, we process the data you provide to handle your inquiry.
If the inquiry is related to an existing or potential contractual relationship, the processing is carried out in accordance with Art. 6 (1) (b) GDPR.
For other inquiries, processing is generally based on our legitimate interest in handling your request in accordance with Art. 6 (1) (f) GDPR.
10. Payment processing
Various payment methods are available in our online shop for payment processing.
Shopify Payments
We use Shopify Payments. Shopify Payments allows for the processing of credit and debit card payments, as well as Shop Pay, Apple Pay, Google Pay, and other payment methods offered at checkout.
When a payment is made, the required data is transmitted to Shopify and, where applicable, to participating banks, card companies, and payment service providers.
The legal basis is Art. 6 (1) (b) GDPR.
PayPal
When selecting PayPal, the information required for payment processing is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
In this process, contact, identification, transaction, and payment information in particular may be processed.
The legal basis is Art. 6 (1) (b) GDPR.
Further information can be found at:
https://www.paypal.com/de/legalhub/paypal/privacy-full
Klarna
When selecting a Klarna payment method, the data required for payment processing is transmitted to Klarna Bank AB (publ), Sweden.
Depending on the payment method selected, Klarna may, in particular, process contact, identification, payment, and transaction data as well as conduct its own identity, fraud, or credit checks.
The legal basis for the transmission of data necessary for the execution of the selected payment method is Art. 6 (1) (b) GDPR.
Further information can be found at:
https://www.klarna.com/de/datenschutz/
Bank transfer
When paying by bank transfer, we process the payment information transmitted in connection with the transfer to assign and process your order.
The legal basis is Art. 6 (1) (b) GDPR.
11. Order processing with Billbee
We use Billbee for order and inventory management.
As part of order processing, the necessary customer and order data may be transmitted to Billbee and processed there on our behalf. This may include, in particular, name, contact details, billing and delivery address, and order information.
The processing serves the management and handling of your order.
The legal basis is Art. 6 (1) (b) GDPR.
12. Shipping with DHL
We use DHL for shipping our orders.
To perform the delivery, we transmit the necessary data, in particular name and delivery address, to the shipping service provider.
The legal basis for the data transmission required for delivery is Art. 6 (1) (b) GDPR.
If additional contact data such as an e-mail address or phone number is transmitted for shipment notification, this only occurs if there is a corresponding legal basis.
13. Newsletter and Klaviyo
We use Klaviyo for our e-mail marketing and to send our newsletter.
When you subscribe to our newsletter, we process in particular your e-mail address as well as any other data you voluntarily provide.
The newsletter is sent based on your consent in accordance with Art. 6 (1) (a) GDPR.
In connection with the registration, information required to prove the registration and consent may also be processed.
As part of its services, Klaviyo may process, in particular, contact, usage, and technical data such as name, e-mail address, IP address, and cookie data on our behalf.
Klaviyo currently stores customer data in the USA. For such international data transfers, Klaviyo uses, among other things, the EU-US Data Privacy Framework and, where this is not applicable, standard contractual clauses.
You may revoke your consent at any time with effect for the future, in particular via the unsubscribe link in our marketing e-mails.
Further information:
https://www.klaviyo.com/de/legal/privacy/privacy-notice
14. Cookies and similar technologies
Our website uses cookies and similar technologies.
Some of these technologies are necessary to technically provide the online shop and the functions you explicitly request.
Where the storage of information on your end device or the access to information already stored there is strictly necessary, this is governed by § 25 (2) TDDDG.
We only use non-essential cookies and similar technologies, in particular for analysis, marketing, and personalization purposes, with your prior consent, to the extent such consent is required by law.
In these cases, the access to or storage of information on your end device occurs in accordance with § 25 (1) TDDDG. The associated processing of personal data is based on Art. 6 (1) (a) GDPR.
You can change or revoke your consent at any time via our cookie settings with effect for the future.
15. Consent management with Consentmo
We use Consentmo GDPR Compliance to manage cookie and privacy settings.
Consentmo allows you to grant, reject, and later change your consent for various categories of cookies and similar technologies.
To manage and document your consent decision, information about the choices you have made as well as technical information and the time of the decision may be processed.
Where Consentmo processes personal data on our behalf, it does so as a data processor.
The processing serves in particular the management and documentation of your privacy and consent decisions as well as the fulfillment of our legal documentation requirements under data protection law.
You can change your choices at any time via the cookie settings on our website.
16. Google Analytics 4
We use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze the use of our website.
In this context, information about pages accessed, interactions with our website, device and browser information, and technical usage information may be processed.
Where consent is required for this, processing is based on Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.
You may revoke your consent at any time via our cookie settings.
Further information on data processing by Google can be found at:
https://policies.google.com/privacy
17. Google Ads and Google & YouTube
We use Google services to promote our products and to measure and optimize our advertising campaigns.
For this purpose, the Google & YouTube sales channel, among others, is integrated into our Shopify shop.
In this context, information may be processed as to whether users visit our shop after viewing or clicking on an advertisement, perform certain actions, or complete an order.
Depending on the technical configuration, data transmission can take place via both web technologies and server-side.
Where consent is required for this, processing is based on Art. 6 (1) (a) GDPR and—when accessing information on your end device—§ 25 (1) TDDDG.
The term "Google & YouTube" refers to the corresponding Shopify/Google integration and does not mean that we embed YouTube videos on our website solely by using it.
Further information:
https://policies.google.com/privacy
18. Meta – Facebook and Instagram
We use services from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to market our online shop on Facebook and Instagram as well as to measure and optimize our advertising campaigns.
This includes, in particular, the technical integration of Facebook and Instagram via Shopify.
In this context, information about your visit to our online shop, devices used, and certain interactions and transactions may be processed.
Depending on the technical configuration, data may be transmitted to Meta via web technologies and other integrations.
Where consent is required for this, processing is based on Art. 6 (1) (a) GDPR and—when accessing information on your end device—§ 25 (1) TDDDG.
You may revoke your consent at any time via our cookie settings.
Further information:
https://www.facebook.com/privacy/policy/
19. Pinterest
We use services from Pinterest to market our products and to measure and optimize our advertising campaigns.
In this context, information about your visit to our website, your device, products viewed, and certain interactions with our online shop may be processed.
According to the current technical configuration of our shop, data transmission can take place via both web technologies and server-side.
Where consent is required for this, processing is based on Art. 6 (1) (a) GDPR and, when accessing information on your end device, in accordance with § 25 (1) TDDDG.
You may revoke your consent at any time via our cookie settings.
Further information:
https://policy.pinterest.com/de/privacy-policy
20. Product reviews – AG Product Reviews
We use AG Product Reviews to provide product reviews in our online shop.
In connection with the use of review functions, the information provided for a review as well as technical data may be processed, provided this is necessary for the provision and display of the review function.
Where non-essential cookies or similar technologies are used, they are only used with your prior consent.
21. Marketing and personalized advertising
Provided you grant us your consent, we may use information about your use of our online shop to measure the effectiveness of our advertising and to show you more relevant or personalized advertising.
In this regard, Google, Meta, Pinterest, and Shopify's Enhanced Services in particular may be used.
Where the processing is based on your consent, the legal basis is Art. 6 (1) (a) GDPR.
You can change or revoke your consent at any time via our cookie settings with effect for the future.
22. Disclosure of personal data
We may share personal data with service providers and partners to the extent necessary to provide our online shop, fulfill contracts, process payments, ship orders, communicate, perform analysis and marketing measures, or fulfill legal obligations.
This includes in particular Shopify, payment service providers, Billbee, DHL, Klaviyo, Consentmo, as well as—given appropriate consent or other legal basis—Google, Meta, and Pinterest.
Where service providers process personal data exclusively on our behalf, this is done on the basis of a corresponding data processing agreement, as required by law.
23. International data transfers
When using individual service providers, personal data may be transmitted to or processed outside the European Economic Area.
Transfers to third countries only take place in compliance with the requirements of Art. 44 et seq. GDPR.
This may take place, in particular, on the basis of an adequacy decision by the European Commission or appropriate safeguards such as the European Commission's Standard Contractual Clauses.
If a recipient in the USA is effectively certified under the EU-US Data Privacy Framework and its scope covers the relevant processing, the transfer may be based on the corresponding adequacy decision.
Setting the hosting location of our Shopify store to the European Union does not necessarily mean that all data processed by all service providers used is processed exclusively within the European Union.
24. Storage duration
In principle, we only store personal data for as long as it is necessary for the respective processing purpose.
Furthermore, statutory retention obligations may exist. In these cases, we store the relevant data for the duration of the statutory retention period.
After the respective processing purpose no longer applies, personal data will be deleted or its processing restricted, provided there are no statutory retention obligations or other legal reasons for further storage.
25. Data security
We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration, or disclosure.
Despite appropriate security measures, completely risk-free data transmission over the Internet cannot be guaranteed.
26. Your data protection rights
Within the framework of the statutory requirements, you have the right to:
- Access in accordance with Art. 15 GDPR
- Rectification in accordance with Art. 16 GDPR
- Erasure in accordance with Art. 17 GDPR
- Restriction of processing in accordance with Art. 18 GDPR
- Data portability in accordance with Art. 20 GDPR
- Objection in accordance with Art. 21 GDPR
If the processing is based on your consent, you may revoke it at any time with effect for the future in accordance with Art. 7 (3) GDPR.
The lawfulness of the processing carried out up to the time of revocation remains unaffected by this.
To exercise your rights, you can contact us at team@studiohertzberg.de.
Insofar as Shopify processes personal data in connection with Shopify Network Intelligence as a controller, corresponding rights can also be exercised directly against Shopify:
27. Right to object
Insofar as we process personal data on the basis of Art. 6 (1) lit. f GDPR, you have the right, under the conditions of Art. 21 GDPR, to object to this processing for reasons arising from your particular situation.
If personal data is processed for the purpose of direct marketing, you may object to the processing for this purpose at any time.
28. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority in accordance with Art. 77 GDPR if you believe that the processing of your personal data violates the GDPR.
In principle, the Berlin Commissioner for Data Protection and Freedom of Information is responsible for our company.
29. Links to third-party websites and platforms
Our website may contain links to third-party websites, social networks, or other platforms.
When you access such a link, the privacy policies of the respective provider generally apply to the processing of personal data on that platform.
30. Changes to this privacy policy
We may update this privacy policy if our data processing, service providers used, or legal requirements change.
The current version will be published on our website.
31. Contact
If you have any questions about data protection or wish to exercise your data protection rights, you can contact us:
Lea Strunk e.K.
Studio Hertzberg
Stuttgarter Straße 47
12059 Berlin
Germany
Phone: +49 1634 360191
E-mail: team@studiohertzberg.de
As of: September 2, 2026
