Data Privacy
Privacy Policy
1) Information on the Collection of Personal Data and Contact Details of the Controller
1.1
We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about the handling of your personal data when using our website. Personal data means any information by which you can be personally identified.
1.2
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
Magdalena Landmann
Heinrichstr. 16
38106 Braunschweig
Germany
Phone: +49 531 39067682
E-mail: info@vagabondstitch.com
The controller responsible for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.
1.3
For security reasons and to protect the transmission of personal data and other confidential content, such as orders or enquiries to the controller, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” prefix and the padlock symbol in your browser address bar.
2) Data Collection When Visiting Our Website
When you use our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect data transmitted by your browser to our server (“server log files”).
When you visit our website, the following data may be processed:
- the website visited
- date and time of access
- amount of data transmitted in bytes
- source/referrer from which you reached the page
- browser used
- operating system used
- IP address
Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing a secure, stable and functional website.
The data is not used for any other purpose as a matter of principle. However, we reserve the right to review server log files retrospectively if there are specific indications of unlawful use.
3) Hosting
Hosting through Shopify
We use the e-commerce platform provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”) for hosting and displaying our online shop.
Personal data collected on our website is processed as part of the provision of the Shopify platform. Depending on the functions used, Shopify may also process data through affiliated companies and service providers.
Personal data may be processed in countries outside the European Economic Area. Where required, Shopify uses appropriate safeguards for such transfers, including adequacy decisions or Standard Contractual Clauses.
Where processing is necessary for the performance of a contract, the legal basis is Art. 6(1)(b) GDPR. Where processing is necessary for the secure and efficient operation of our online shop, the legal basis is Art. 6(1)(f) GDPR.
Further information:
https://www.shopify.com/legal/privacy
4) Content Delivery Network – Amazon CloudFront
Our website uses the Content Delivery Network (“CDN”) Amazon CloudFront, a service provided by Amazon Web Services.
A CDN is a network of geographically distributed servers used to deliver website content quickly and reliably. Amazon CloudFront is used to improve the loading speed, availability and security of our website.
Technical information such as IP address, browser information, requested content and access time may be processed when using the CDN.
Processing is based on Art. 6(1)(f) GDPR due to our legitimate interest in providing our website securely, efficiently and reliably.
Further information:
https://aws.amazon.com/privacy/
5) Cookies and Consent Management
We use cookies and similar technologies on various pages of our website. Cookies are small text files stored on your device.
Some cookies are technically necessary for the operation of the website and the ordering process, including cookies used to maintain the shopping cart, process orders, provide security features or save certain settings.
Other cookies and similar technologies may be used for purposes such as marketing or the integration of third-party content. Where legally required, such technologies are only activated after you have given your consent.
The processing of technically necessary data is based on Art. 6(1)(b) GDPR where necessary to provide a function requested by you, or Art. 6(1)(f) GDPR where necessary for the secure and technically reliable operation of the website.
Where consent is required, the legal basis is Art. 6(1)(a) GDPR in conjunction with applicable provisions of the German Telecommunications and Telemedia Data Protection Act (TDDDG).
Complianz Consent Management
We use Complianz as a consent management solution to obtain and document consent for cookies and similar technologies.
Complianz helps us display a consent banner, store your consent decisions and prevent technologies requiring consent from being activated before the required consent has been given.
Processing is based on Art. 6(1)(c) GDPR insofar as necessary to fulfil our legal obligations regarding consent and consent documentation, and on Art. 6(1)(f) GDPR insofar as necessary for the technically proper operation of the consent management system.
Further information:
https://complianz.io/privacy-statement/
You can change or withdraw your consent at any time using the cookie settings provided on our website.
6) Contact
When contacting us, for example by e-mail or via a contact form, personal data may be collected.
The data collected through a contact form is apparent from the respective form. We use this data exclusively to process and respond to your enquiry and for the associated technical administration.
The legal basis is Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries. If your enquiry is aimed at concluding or performing a contract, Art. 6(1)(b) GDPR is an additional legal basis.
Your data will be deleted once your enquiry has been finally dealt with, unless statutory retention obligations apply or further processing is legally permitted.
7) Data Processing When Opening a Customer Account and for Contract Processing
If you open a customer account or provide us with personal data for the purpose of concluding or performing a contract, we process this data pursuant to Art. 6(1)(b) GDPR.
The data collected is apparent from the respective input forms.
You may request deletion of your customer account at any time by contacting us at the address stated above.
We use the data you provide to process your order and fulfil our contractual obligations.
After the contract has been fully performed or the customer account has been deleted, your data will be restricted with regard to further processing and subsequently deleted after expiry of the applicable statutory retention periods, unless you have expressly consented to further use or further storage is legally permitted or required.
8) Product Reviews – Judge.me
We use Judge.me to enable customers to submit and view product reviews.
When you submit a review, information such as the name or username you provide, the content of the review, the date of the review and other information voluntarily provided by you may be processed and published.
Judge.me may also process information necessary to manage reviews and associate a review with the relevant product or order.
Processing is based, where required, on your consent pursuant to Art. 6(1)(a) GDPR or on Art. 6(1)(f) GDPR based on our legitimate interest in providing product reviews and improving our products and services.
Further information:
9) Use of Customer Data for Direct Marketing
9.1 Newsletter Registration
If you subscribe to our e-mail newsletter, we will regularly send you information about our products, offers and news.
The only mandatory information required for sending the newsletter is your e-mail address. Providing additional information is voluntary and may be used to personalise the newsletter.
We use the double opt-in procedure. After registering, you will receive a confirmation e-mail containing a link that you must click to confirm your subscription.
By confirming your subscription, you consent to the processing of your personal data pursuant to Art. 6(1)(a) GDPR.
When registering, we store the IP address used as well as the date and time of registration in order to document consent and prevent misuse of the e-mail address.
You may unsubscribe from the newsletter at any time using the unsubscribe link contained in every newsletter or by contacting us directly.
After unsubscribing, your e-mail address will be removed from the newsletter mailing list unless further storage is legally permitted or required.
9.2 Newsletter Service – Mailchimp
Our e-mail newsletters are sent using Mailchimp, a service provided by The Rocket Science Group LLC, d/b/a Mailchimp, 405 N. Angier Ave. NE, Atlanta, GA 30308, USA.
The data provided when subscribing to the newsletter is transmitted to Mailchimp to enable the sending and management of our newsletters.
Processing is based on your consent pursuant to Art. 6(1)(a) GDPR.
Mailchimp may process personal data in the United States. Where required, appropriate safeguards such as Standard Contractual Clauses are used for international data transfers.
Depending on the functions we use, Mailchimp may provide statistical information about newsletter campaigns, such as whether a newsletter was opened or a link was clicked.
Further information:
https://mailchimp.com/legal/privacy/
Further information about data processing:
https://mailchimp.com/legal/data-processing-addendum/
9.3 Synchronisation Between Shopify and Mailchimp
We use an integration to synchronise relevant customer and newsletter data between Shopify and Mailchimp.
Data necessary for managing our newsletter subscribers may be synchronised between the systems.
Data is transferred only where legally permitted and, where required, on the basis of your consent.
The purpose of the synchronisation is in particular to manage our newsletter mailing lists and ensure that subscription and unsubscribe statuses are correctly reflected.
10) Data Processing for Order Processing
10.1 General Order Processing
We process the personal data provided during the ordering process to process and fulfil your order and to provide the digital products purchased by you.
The legal basis is Art. 6(1)(b) GDPR.
As our products are digital sewing patterns, no physical goods are generally shipped.
Payment data is processed by the payment service provider selected during checkout.
10.2 Billbee
We use Billbee GmbH, Paulinenstraße 54, 32756 Detmold, Germany, to support order and business process management.
Relevant order and customer data may be transmitted to and processed by Billbee insofar as necessary for order processing, invoicing, customer administration and related business processes.
Processing is based on Art. 6(1)(b) GDPR and, where required by law, Art. 6(1)(c) GDPR.
Further information:
https://www.billbee.io/datenschutz
10.3 Shopify Payments
We use Shopify Payments to process payments.
Depending on the payment method selected, Shopify and the payment service providers involved in processing the payment may process information including name, billing address, payment information, payment amount, currency, transaction ID and other information necessary for payment processing.
Processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.
Further information:
https://www.shopify.com/legal/privacy
10.4 Apple Pay
If you select Apple Pay as your payment method, payment is processed through Apple Pay.
Depending on the transaction, information concerning the order and payment may be transmitted to Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, and to the relevant payment service provider or card issuer.
Processing is carried out for payment processing and contract performance pursuant to Art. 6(1)(b) GDPR.
Further information:
https://www.apple.com/legal/privacy/
10.5 Google Pay
If you select Google Pay as your payment method, payment is processed through Google Pay.
Depending on the transaction, information concerning the order and payment may be processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and by the relevant payment service provider or card issuer.
Processing is carried out for payment processing and contract performance pursuant to Art. 6(1)(b) GDPR.
Further information:
https://policies.google.com/privacy
10.6 PayPal
If you select PayPal or a payment method offered through PayPal, payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
Payment and other data required for payment processing are transmitted to PayPal.
Depending on the payment method selected, PayPal may carry out identity or creditworthiness checks. Such processing may be carried out by PayPal on the basis of Art. 6(1)(f) GDPR.
Further information:
https://www.paypal.com/webapps/mpp/ua/privacy-full
10.7 Klarna
If you select a payment method offered by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, Klarna processes the data necessary for payment processing.
Depending on the payment method selected, Klarna may process personal data for identity verification, fraud prevention and, where applicable, credit assessment.
Processing necessary for contract performance is based on Art. 6(1)(b) GDPR. Further processing, particularly credit assessment, may be carried out by Klarna on its own legal basis.
Further information:
https://www.klarna.com/international/privacy-policy/
10.8 Credit Card Payments
Credit card payments may be processed through Shopify Payments or another payment service provider offered during checkout.
Depending on the payment method selected, payment information such as card details, transaction data, billing information, IP address and other information required for authentication and payment processing may be processed.
We generally do not have access to the complete credit card number. Payment data is processed by the respective payment service provider in accordance with its own privacy policy.
Processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.
10.9 Shopify Messaging
We use Shopify Messaging for customer communication and, where applicable, marketing and communication functions.
Depending on the functions used, Shopify may process contact information, order information and information concerning interactions with our messages.
Where communication is based on consent, the legal basis is Art. 6(1)(a) GDPR. Where it is necessary for contract performance, Art. 6(1)(b) GDPR applies. Where direct marketing based on legitimate interests is legally permissible, Art. 6(1)(f) GDPR may apply.
Further information:
https://www.shopify.com/legal/privacy
10.10 Sky Pilot
We use the Shopify app Sky Pilot to provide and manage our digital products, particularly our digital sewing patterns.
Sky Pilot may process information necessary to provide purchased digital products. This may include customer and order information, e-mail address, IP address, browser and operating system information and information relating to purchased products.
Processing is necessary for the performance of the contract pursuant to Art. 6(1)(b) GDPR.
Further information:
https://web.skypilotapp.com/pages/privacy-policy
10.11 Exemptify
We use the Shopify app Exemptify to assist with the processing and management of tax-related information, particularly in connection with VAT-related information.
Depending on the functions used, customer data, billing information, VAT identification numbers, country information and order data may be processed.
Processing is carried out to fulfil contractual and legal obligations pursuant to Art. 6(1)(b) and Art. 6(1)(c) GDPR.
10.12 Crush: Speed and Image Optimizer
We use the Shopify app Crush: Speed and Image Optimizer to optimise images and improve the loading speed and performance of our website.
Depending on the technical implementation, information about the website and the files being optimised may be processed.
Processing is based on Art. 6(1)(f) GDPR due to our legitimate interest in providing a fast, technically efficient and user-friendly website.
10.13 Judge.me
We use Judge.me as described in section 8 to provide and manage product reviews.
Depending on the functions used, information such as name, e-mail address, order information, product information and review content may be processed.
Further information:
11) Social Media
11.1 Facebook Share Button
Our website contains a Facebook Share button.
The button is implemented as a link rather than as an immediately activated social media plugin. Merely loading a page containing the button therefore does not generally establish a connection to Facebook.
Only when you click the button does your browser open Facebook and connect to the servers of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Facebook may then process information about your visit and interaction with the service.
Further information:
https://www.facebook.com/privacy/policies/
11.2 Instagram
We operate an Instagram account for our business. On Instagram, we publish photographs of our sewing patterns as well as short videos showing how our sewing patterns are sewn and used.
If you visit or interact with our Instagram account, Instagram may process personal data, including information about your device, IP address, usage behaviour and interactions with our content.
Processing is carried out by Meta Platforms Ireland Limited and, where applicable, other companies within the Meta group.
We have no comprehensive control over the data collected and processed by Instagram.
Further information:
https://privacycenter.instagram.com/policy/
11.3 Pinterest “Pin It” Button
Our website contains a Pinterest “Pin It” button.
The button is implemented as a link. Merely loading the page does not generally establish a connection to Pinterest. Only when you click the button does your browser connect to Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.
Pinterest may then process information about your visit and interaction with the service.
Further information:
https://policy.pinterest.com/en/privacy-policy
11.4 X Button
Our website contains a button for sharing content via X (formerly Twitter).
The button is implemented as a link. A connection to X is only established when you click the button.
The service is operated by X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Personal data, including technical information such as your IP address, may be processed when using the service.
Further information:
11.5 YouTube
We operate a YouTube channel on which we publish videos showing how our sewing patterns are sewn and used. The videos contain sewing instructions and practical demonstrations relating to our sewing patterns.
If you visit our YouTube channel or watch our videos directly on YouTube, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and, where applicable, other companies within the Google group may process personal data.
This may include information about your device, IP address, browser, usage behaviour and interactions with our videos.
We have no comprehensive control over the data collected and processed by YouTube.
Further information:
https://policies.google.com/privacy
11.6 Embedded YouTube Videos
Where YouTube videos are embedded directly into our website, YouTube may process information about your visit and interaction with the video.
Where technically possible and legally required, embedded YouTube content is only loaded after you have given the required consent through our consent management system.
Further information about how Google processes data when YouTube videos are embedded on third-party websites:
https://policies.google.com/technologies/partner-sites
Processing based on your consent is carried out pursuant to Art. 6(1)(a) GDPR.
12) Tools and Other Services
12.1 Shopify Apps
We use various Shopify apps and integrations for the technical and organisational management and improvement of our online shop.
These include in particular:
- Sky Pilot for the delivery of digital products
- Exemptify for tax-related functions
- Crush: Speed and Image Optimizer for image and performance optimisation
- Shopify Messaging for customer communication
- Judge.me for product reviews
- Mailchimp and the relevant Shopify integration for newsletters
- Complianz for consent management
The relevant processing activities are described in the corresponding sections of this Privacy Policy.
Only data necessary for the respective function is transmitted to the relevant service provider, insofar as technically possible and legally permissible.
12.2 Processing Through Shopify
Because our website is operated using Shopify, Shopify may process technical and customer-related information in connection with the Shopify platform and the functions we use.
Depending on the function used, this may include IP address, browser and device information, customer account data, order data, payment information, communication data and information about interactions with our website.
The applicable legal basis is set out in the respective sections of this Privacy Policy.
Further information:
https://www.shopify.com/legal/privacy
13) Rights of Data Subjects
13.1
Under applicable data protection law, you have the following rights:
- Right of access pursuant to Art. 15 GDPR: You have the right to obtain information about your personal data processed by us and the further information required by law.
- Right to rectification pursuant to Art. 16 GDPR: You have the right to request the immediate correction of inaccurate personal data and completion of incomplete data.
- Right to erasure pursuant to Art. 17 GDPR: You have the right to request deletion of your personal data where the statutory requirements are met.
- Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request restriction of processing of your personal data where the statutory requirements are met.
- Right to data portability pursuant to Art. 20 GDPR: You have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format or, where technically feasible, request its transmission to another controller.
- Right to withdraw consent pursuant to Art. 7(3) GDPR: Where processing is based on consent, you may withdraw that consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.
- Right to object pursuant to Art. 21 GDPR: You have the right to object to the processing of your personal data where the statutory requirements are met.
- Right to lodge a complaint pursuant to Art. 77 GDPR: You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR.
13.2 Right to Object
IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF ART. 6(1)(F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO SUCH PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.
IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH PURPOSES AT ANY TIME.
14) Retention Period of Personal Data
The duration for which personal data is stored depends on the applicable legal basis, the purpose of processing and, where applicable, statutory retention periods.
Where personal data is processed on the basis of consent pursuant to Art. 6(1)(a) GDPR, the data will generally be stored until consent is withdrawn, unless another legal basis permits or requires continued processing.
Where data is subject to statutory retention obligations, it will be stored for the duration of the applicable statutory retention period and subsequently deleted unless further storage is necessary or legally permitted.
Where personal data is processed on the basis of Art. 6(1)(f) GDPR, the data will generally be stored until you exercise your right to object, unless compelling legitimate grounds for continued processing exist or the processing is necessary for the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, the data will be stored until you object to such processing.
Unless otherwise stated in this Privacy Policy, personal data will be deleted when it is no longer necessary for the purposes for which it was collected or processed.
Customers from California click here for information on the California Consumer Privacy Act.