Privacy policy
Privacy Policy
mein-Brillenband.de | Last updated: 18 July 2026
This Privacy Policy explains how we process personal data when you visit our online shop, use a customer account, place an order, contact us, subscribe to a newsletter or availability notification, submit a review, or use other functions of our shop.
| Area | Services used / recipients |
|---|---|
| Shop operation | Shopify, customer account, checkout, shop analytics and newsletter |
| Order processing | Billbee; where applicable Lexware Office for accounting |
| Payment | PayPal, credit card via Shopify Payments, Shop Pay and advance payment |
| Reviews | Judge.me |
| Availability | REZ Preorder, Back In Stock |
| Withdrawal | Customer Order Editing / online withdrawal form |
| Shipping | Depending on the selected shipping method, including Hermes and postal service providers |
Details are provided in the sections below.
1. Controller
Michael Meisters
mein-Brillenband.de
Rosenweg 5
84095 Furth
Germany
Phone: 08708 / 928081
Email: info@mein-brillenband.de
2. Principles, Data Categories and Sources
Personal data means any information relating to an identified or identifiable person. The data we process depends on how you use our shop.
In particular, the following categories of data may be processed:
- Master and contact data: name, billing and delivery address, email address, telephone number
- Order and contract data: products ordered, variants, quantities, prices, vouchers, order number, order status, returns, withdrawals and communications relating to the order
- Payment data: selected payment method, payment status, transaction and reference numbers; full card or account details are generally processed directly by the respective payment service
- Account and communication data: customer account, order history, authentication and session data, enquiries, messages and voluntary information
- Review and content data: review, star rating, display name, email address and, where applicable, uploaded images or videos
- Usage and device data: IP address, browser, operating system, device information, referrer URL, pages visited, shopping-cart and interaction data, timestamps and cookie identifiers
We receive data directly from you, automatically when you use the shop, and from service providers, payment providers and shipping companies used by us insofar as this is necessary for processing.
3. Purposes and Legal Bases
We process personal data only where there is a legal basis for doing so. Depending on the processing activity, we rely in particular on:
- Article 6(1)(b) GDPR for pre-contractual measures and performance of the purchase contract, including payment, delivery, customer service, returns and withdrawal
- Article 6(1)(c) GDPR for compliance with legal obligations, in particular requirements under commercial, tax and consumer law
- Article 6(1)(f) GDPR for the purposes of legitimate interests, in particular the secure, functional and economical operation of the shop, fraud prevention, legal defence and internal organisation
- Article 6(1)(a) GDPR where you give consent, for example for newsletters, non-essential cookies, review requests or availability notifications
- Section 25 TDDDG for storing information on your terminal device or accessing it; technically necessary operations are carried out under Section 25(2) TDDDG, while all other operations require consent under Section 25(1) TDDDG
4. Shopify – Hosting and Shop Platform
Shopify International Ltd. – Privacy information for consumers
Our online shop is operated using Shopify. For visitors from the European Economic Area, Shopify International Ltd., c/o Intertrust Ireland, 2nd Floor, 1–2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland, is the central point of contact within the Shopify group.
Shopify processes data to provide the shop technically, deliver pages and content, enable the shopping cart and checkout, manage orders and customer accounts, send messages, ensure security and fraud prevention, and provide shop statistics. This includes, in particular, IP addresses, device and browser data, cookie and session identifiers, usage data, and the data you enter when creating an account and placing an order.
Where Shopify processes data solely on our instructions, this is done on the basis of a data processing agreement. For certain Shopify services of its own and extended functions, Shopify may process personal data under its own responsibility under data protection law. Further information and options for exercising rights can be found in the Shopify Privacy Portal.
The legal bases are Article 6(1)(b) GDPR for contract processing and Article 6(1)(f) GDPR for secure and functional operation. Functions requiring consent are based on Article 6(1)(a) GDPR and Section 25(1) TDDDG.
5. Technical Provision, Log Data and Security
When the shop is accessed, technically necessary connection data is processed. This includes, in particular, the IP address, date and time, page or file requested, amount of data transferred, referrer URL, browser, operating system and error messages. Processing serves to deliver the website, ensure stability, analyse errors, defend against attacks and prevent fraud.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing the shop securely, reliably and in a user-friendly manner. Security logs are stored only for as long as necessary for these purposes, to investigate an incident or for legal defence.
6. Cookies, Consent Management and Shop Analytics
Shopify cookie and consent functions – Shopify Cookie Policy
We use cookies and comparable technologies. Technically necessary cookies enable, among other things, navigation, the shopping cart, checkout, login, language selection, security and storage of your privacy settings. They are used on the basis of Section 25(2) TDDDG and Article 6(1)(b) or (f) GDPR.
Non-essential analytics, personalisation or marketing technologies are used only if you have consented via the consent banner. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can change your selection at any time using the cookie settings provided in the shop or withdraw consent with effect for the future.
Shopify provides technical shop and performance analytics. Pseudonymous usage data such as page views, interactions, shopping-cart actions, purchase events, device and browser information and cookie identifiers may be processed. Where this analysis goes beyond what is technically necessary, it is carried out only with your consent.
7. Customer Account
You can create a customer account or use the customer-account functions provided by Shopify. In doing so, we process in particular your name, email address, addresses, order history, and authentication and session data. The account makes future orders and access to order information easier.
The legal basis is Article 6(1)(b) GDPR. Where a customer account is maintained voluntarily and independently of an order, the processing is additionally based on your consent under Article 6(1)(a) GDPR. You may request deletion of your account provided that no statutory retention obligations prevent this.
8. Orders, Contracts and Customer Service
When you place an order, we process the data entered at checkout, in particular contact, billing, delivery, order and payment-status data. This is necessary to conclude the contract, allocate the payment, dispatch the goods, send order confirmations and invoices, and handle queries, returns, warranty matters and withdrawals.
The legal basis is Article 6(1)(b) GDPR. Statutory retention and evidence obligations are based on Article 6(1)(c) GDPR. Processing may also be based on Article 6(1)(f) GDPR for the prevention of misuse and fraud.
9. Billbee – Order Processing, Invoices and Automation
Billbee GmbH – Privacy Policy
We use Billbee, Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany, for centralised order processing. For this purpose, Shopify transfers order data to Billbee. In particular, the following data is processed: name, billing and delivery address, email address, telephone number, order number, ordered items and variants, quantities, prices, discounts, shipping method, payment method and payment status.
Billbee supports us with order processing, status synchronisation, invoice creation and dispatch, inventory management, shipping preparation and automation. Where Billbee processes data on our instructions, a data processing agreement pursuant to Article 28 GDPR is in place.
The legal bases are Article 6(1)(b) GDPR for contract processing, Article 6(1)(c) GDPR for invoicing and retention obligations, and Article 6(1)(f) GDPR for efficient and low-error organisation of order processing.
10. Accounting and Lexware Office
Lexware Office / Haufe Service Center GmbH – Privacy and Data Security
For accounting, document management and tax documentation, order, customer, payment and invoice data from Billbee or Shopify may be transferred to Lexware Office. The processor for Lexware Office is Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany.
Only data required for accounting and evidence purposes is processed, in particular name, address, invoice data, order number, invoice amount, payment status and documents. The legal bases are Article 6(1)(c) GDPR and Article 6(1)(f) GDPR. Our legitimate interest lies in proper, secure and efficient accounting.
11. Payment Processing
PayPal, credit card via Shopify, Shop Pay and advance payment are currently available at checkout. If you select a payment service, the data required to process the payment is transferred to the respective provider. Payment providers process data partly under their own responsibility, in particular to execute the payment, authenticate users, prevent fraud, assess risk and comply with legal obligations.
PayPal – PayPal Privacy Policy
The provider in the European Union is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. If PayPal is selected, in particular your name, email address, billing and delivery address, order value, currency, order and transaction data and, where applicable, device and security data are transferred. You are redirected to PayPal to confirm payment or use PayPal as an express payment method.
Credit card / Shopify Payments and Shop Pay – Shopify Privacy
Credit-card payments are processed through the payment processing integrated into Shopify. Cardholder details, card number, expiry date, verification data, billing address, amount, currency, device and security data may be transferred to Shopify and the participating banks, card schemes and technical payment service providers. As a rule, we do not receive full card details, but only payment status and reference information.
With Shop Pay, you can store payment and contact details in a Shop account to speed up future purchases. The terms and privacy information of Shopify or Shop additionally apply to this voluntary function.
Advance payment by bank transfer
If you pay in advance, you make the payment yourself to our bank account. We process the information transmitted by your bank, in particular your name, IBAN, amount, payment reference and booking date, in order to allocate the payment to the order.
The legal basis for all payment methods is Article 6(1)(b) GDPR. Where payment providers comply with statutory verification and retention obligations, they additionally process data on the basis of their own legal obligations.
12. Shipping and Delivery
For delivery, we pass the necessary data to the shipping or postal company commissioned for the selected shipping method. This includes, in particular, your name and delivery address and – insofar as required for delivery information and provided by you – your email address or telephone number. Depending on the delivery country, different shipping methods and shipping service providers are available at checkout.
The data is disclosed pursuant to Article 6(1)(b) GDPR for performance of the contract. Any further transfer of your email address or telephone number for shipping notifications takes place only insofar as this is necessary for delivery or you have consented to it.
13. Judge.me – Product and Shop Reviews
Judge.me Ltd. – Privacy Policy
We use Judge.me, Judge.me Ltd., c/o Buckworths, 1–3 Worship Street, London EC2A 2AB, United Kingdom, for product and shop reviews. Judge.me displays reviews in the shop and may send review requests by email where there is a legal basis for doing so.
For this purpose, order data such as name, email address, order number, products ordered and order date may be transferred to Judge.me. When a review is submitted, Judge.me additionally processes the star rating, review text, display name and, where applicable, uploaded images or videos. Your email address is used for allocation and is not automatically displayed publicly.
We send review requests only with your consent or insofar as the statutory requirements for advertising to existing customers are met. The legal basis is Article 6(1)(a) GDPR or Article 6(1)(f) GDPR in conjunction with Section 7(3) of the German Unfair Competition Act (UWG). Article 6(1)(a) GDPR applies to the voluntary publication of a review; Article 6(1)(f) GDPR applies to protection against misuse and manipulation.
Judge.me processes merchant data as a processor; for certain direct interactions Judge.me may itself be responsible. Data may be processed outside the EEA with the involvement of subprocessors. According to Judge.me, it uses in particular Standard Contractual Clauses and a data processing agreement for this purpose.
14. Newsletter
Shopify newsletter and email functions
If you subscribe to our newsletter, we process your email address and, where applicable, your preferred language, as well as the time of registration, evidence of consent and technical delivery information. The newsletter provides information about promotions, new products, offers, tips and information relating to our range.
Registration is based on your consent under Article 6(1)(a) GDPR in conjunction with Section 7(2) UWG. Where a confirmation link is used, we record the confirmation in order to be able to demonstrate consent. You can unsubscribe from the newsletter at any time using the unsubscribe link or by sending us a message. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Where we record opens and clicks to measure reach, this is done only within the scope of your consent. After you unsubscribe, we remove your address from the active distribution list. Evidence of consent given may be stored on the basis of Article 6(1)(f) GDPR until the expiry of possible limitation periods.
15. REZ – Availability Notifications
REZ Preorder, Back In Stock / REZ Commerce – Privacy Information
The “REZ Preorder, Back In Stock” app from REZ Commerce, Dong Da, Hanoi 11500, Vietnam, is integrated into the shop for notifications about products becoming available again. If you request a notification, in particular your email address, the selected product or variant, language, timestamp and technical usage data are processed. The data is used to maintain a waiting list and inform you when the product becomes available again.
The legal basis is your consent under Article 6(1)(a) GDPR. You can unsubscribe from the notification at any time or withdraw your consent with effect for the future. As the provider is based in Vietnam, data may be transferred to a third country. Where no adequacy decision exists, the transfer must be protected by appropriate safeguards, in particular Standard Contractual Clauses.
16. Contact Form, Email and Custom Requests
If you contact us using the contact form, by email or by telephone, we process your contact details, the content of your enquiry and, where applicable, order or product information. In the case of custom lengths and individual creations, we may additionally process the design preferences you provide.
Processing is carried out under Article 6(1)(b) GDPR insofar as the enquiry relates to steps prior to entering into a contract or contract processing. Otherwise, it is based on Article 6(1)(f) GDPR. Our legitimate interest lies in properly responding to and documenting enquiries.
17. Online Withdrawal Form
Customer Order Editing / customerorderediting.com
For electronic withdrawal, we provide a Customer Order Editing form integrated through Shopify. When the form is submitted, your name, email address, order number, the content of any voluntary additional information, date and time, and technical security data are processed. The data is used to allocate the withdrawal, confirm receipt and carry out further processing.
The legal bases are Article 6(1)(b) and (c) GDPR. Where security data is processed to prevent automated or abusive submissions, this is based on Article 6(1)(f) GDPR.
18. External Links and Social Networks
Our shop may contain links to external websites or social networks, such as Facebook. Merely visiting our shop does not generally result in data being transferred to an external provider through an ordinary link. Only when you open the link does the respective provider process data under its own responsibility. This may include, in particular, your IP address, device information, referrer URL and – if you are logged in there – account data. The privacy information of the respective provider applies.
19. Recipients and Processors
We disclose personal data only where this is necessary for performance of a contract, compliance with legal obligations, on the basis of consent, or for the purposes of legitimate interests. Recipients may include in particular:
- shop and IT service providers, hosting, security and support providers
- order, invoicing and accounting service providers
- payment service providers, banks, card schemes and fraud-prevention providers
- shipping and postal companies
- review, newsletter, availability-notification and form providers
- tax advisers, legal advisers and public authorities where legally required.
Where required, we enter into agreements with processors pursuant to Article 28 GDPR. Service providers may process data only on our instructions and for the agreed purposes.
20. Transfers of Data to Third Countries
Some service providers or their subprocessors are located outside the European Economic Area, in particular in Canada, the United States, the United Kingdom or Vietnam. A transfer takes place only where the requirements of Articles 44 et seq. GDPR are met.
We base transfers in particular on adequacy decisions of the European Commission, Binding Corporate Rules or Standard Contractual Clauses. Additional safeguards are agreed where required. Shopify states that it uses, among other mechanisms, approved Binding Corporate Rules and Standard Contractual Clauses for intra-group transfers. Judge.me identifies Standard Contractual Clauses and the UK transfer addendum as safeguards.
21. Retention Period
We retain personal data only for as long as necessary for the respective purpose or for as long as statutory retention obligations apply. The following criteria are particularly relevant:
- Order, contract, invoice and accounting data is retained in accordance with commercial and tax-law requirements. Accounting records are generally retained for eight years and commercial and business correspondence generally for six years; longer periods may apply in individual cases.
- Customer-account data is stored until the account is deleted, provided that no statutory obligations prevent deletion.
- Enquiries and service messages are generally stored until they have been finally processed and thereafter only for as long as necessary for evidence or legal defence.
- Newsletter and availability data is processed until consent is withdrawn or you unsubscribe; evidence of consent may be retained until the expiry of possible limitation periods.
- Published reviews generally remain visible until they are deleted or the purpose ceases to apply; statutory evidentiary interests or interests in preventing misuse may require limited further storage.
- Cookie and analytics data is stored in accordance with the retention periods applicable to the respective cookie or function, as specified in the cookie settings.
22. Your Rights
Subject to the statutory requirements, you have in particular the following rights:
- Access to the personal data we process about you (Article 15 GDPR)
- Rectification of inaccurate data or completion of incomplete data (Article 16 GDPR)
- Erasure of your data where there are no overriding grounds or obligations preventing this (Article 17 GDPR)
- Restriction of processing (Article 18 GDPR)
- Data portability in a structured, commonly used and machine-readable format (Article 20 GDPR)
- Objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR)
- Withdrawal of consent at any time with effect for the future (Article 7(3) GDPR)
- Lodging a complaint with a data protection supervisory authority (Article 77 GDPR)
To exercise your rights, it is sufficient to send a message to info@mein-brillenband.de. We may request appropriate proof of identity where this is necessary to protect your data.
23. Right to Object under Article 21 GDPR
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data where the processing is based on Article 6(1)(e) or (f) GDPR. You may object to direct marketing at any time without giving reasons.
24. Right to Lodge a Complaint
You may lodge a complaint with a data protection supervisory authority. For non-public-sector companies in Bavaria, the authority with particular responsibility is:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
www.lda.bayern.de
25. Children's Data
Our offering is not specifically directed at children. We do not knowingly collect personal data from children acting without the required consent of a parent or legal guardian. If you believe that such data has been provided to us, please contact us.
26. Data Security
We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access or disclosure. These include, in particular, encrypted transmissions, access restrictions, security and authorisation concepts, and the selection of suitable service providers. Absolute security cannot be guaranteed for data transmissions over the internet.
27. Changes to this Privacy Policy
We amend this Privacy Policy if our shop, the services used, legal requirements or processing activities change. The version published in the shop at the relevant time is authoritative. The date of the latest update can be found at the beginning of this Privacy Policy.
28. Privacy Contact
If you have any questions about data protection or exercising your rights, please contact:
Michael Meisters
mein-Brillenband.de
Rosenweg 5
84095 Furth
Germany
Email: info@mein-brillenband.de
Phone: 08708 / 928081
