Privacy policy

1) Introduction and Contact Information for the Data Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we provide information about how we handle your personal data when you use our website. Personal data refers to any data that can be used to personally identify you.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is ITO Yarn & Design GmbH, Schräderheide 41, 48157 Münster, Germany, Phone: +49 251 39491530, Email: info@ito-yarn.com. The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When Visiting Our Website

2.1 In the case of merely informational use of our website, that is, if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to the page server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

The page visited
Date and time of access
Amount of data transferred in bytes
Source/referrer from which you accessed the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

The processing is carried out in accordance with Article 6(1)(f) of the GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be disclosed or used for any other purpose. However, we reserve the right to review the server log files retrospectively should there be concrete evidence of unlawful use.

2.2 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential information (e.g., orders or inquiries to the controller). You can recognize an encrypted connection by the “https://” prefix and the padlock icon in your browser address bar.

3) Hosting & Content-Delivery-Network

3.1 Shopify

We use the system provided by the following provider to host our website and display its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”)

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada

All data collected on our website is processed on the provider’s servers. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

In the case of data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.2 Cloudflare

We use a content delivery network provided by the following vendor: Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA

This service enables us to deliver large media files, such as graphics, page content, or scripts, more quickly via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6(1)(f) GDPR. We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

For data transfers to the U.S., the provider has joined the EU-U.S. Data Privacy Framework, which ensures compliance with European data protection standards based on an adequacy decision by the European Commission.

4) Cookies

To make your visit to our website more enjoyable and to enable the use of certain features, we use cookies, small text files that are stored on your device. Some of these cookies are automatically deleted when you close your browser (so-called “session cookies”), while others remain on your device for a longer period and allow page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage duration in the overview of your web browser’s cookie settings.

If personal data is processed through individual cookies we use, such processing is carried out in accordance with Article 6(1)(b) of the GDPR for the purpose of performing the contract, in accordance with Article 6(1)(a) of the GDPR in the event that consent has been given, or in accordance with Article 6(1)(f) of the GDPR to safeguard our legitimate interests in ensuring the best possible functionality of the website as well as a user-friendly and effective design of the site visit.

You can configure your browser to be notified when cookies are set and decide individually whether to accept them, or to exclude the acceptance of cookies in specific cases or generally.

Please note that if you do not accept cookies, the functionality of our website may be limited.

5) Establishment of Contact

5.1 Hubspot

To provide an online appointment booking feature, we use the services of the following provider: HubSpot Ireland Ltd., 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland

For the purpose of scheduling appointments, we collect your first and last name as well as your email address (and, if applicable, your phone number, if a telephone appointment is requested) are collected and, pursuant to Art. 6(1)(f) GDPR, transmitted to the provider based on our legitimate interest in effective customer management and efficient appointment scheduling, where they are stored for the purpose of organizing the appointment.

After the appointment has taken place or upon expiration of the agreed appointment period, your data will be deleted by the provider.

We have entered into a data processing agreement with the provider that ensures the protection of our website visitors’ data and prohibits unauthorized disclosure to third parties.

5.2 When you contact us (e.g., via the contact form or email), personal data is processed—exclusively for the purpose of handling and responding to your inquiry and only to the extent necessary for that purpose.

The legal basis for processing this data is our legitimate interest in responding to your inquiry pursuant to Article 6(1)(f) of the GDPR. If your contact is aimed at entering into a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR. Your data will be deleted once it is clear from the circumstances that the matter in question has been conclusively resolved and provided that no statutory retention obligations preclude this.

6) Data Processing When Opening a Customer Account

In accordance with Article 6(1)(b) of the GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required to open an account is listed in the input fields of the corresponding form on our website.

You may delete your customer account at any time by sending a message to the above-mentioned address of the controller. After your customer account is deleted, your data will be deleted provided that all contracts concluded in connection with it have been fully processed, no statutory retention periods preclude such deletion, and we no longer have a legitimate interest in continuing to store the data.

7) Use of Customer Data for Direct Marketing

7.1 Subscription to our Email Newsletter

If you subscribe to our email newsletter, we will send you regular updates about our offers. The only required information for receiving the newsletter is your email address. Providing additional data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you will only receive the newsletter once you have expressly confirmed your consent to receive it by clicking on a verification link sent to the email address you provided.

By clicking the confirmation link, you give us your consent to use your personal data in accordance with Article 6(1)(a) of the GDPR. In doing so, we store the IP address assigned to you by your Internet Service Provider (ISP), as well as the date and time of your registration, so that we can investigate any potential misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used strictly for the intended purpose.

You can unsubscribe from the newsletter at any time by clicking the link provided in the newsletter or by sending a message to the data controller named at the beginning of this notice. Once you have unsubscribed, your email address will be immediately deleted from our newsletter distribution list, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this scope, which is permitted by law and about which we inform you in this statement.

7.2 Sending the Email Newsletter to Existing Customers

If you have provided us with your email address when purchasing goods or services, we reserve the right to periodically send you offers via email for goods or services from our product range that are similar to those you have already purchased. For this purpose, we are not required to obtain your separate consent pursuant to Section 7(3) of the German Unfair Competition Act (UWG). Data processing in this regard is based solely on our legitimate interest in personalized direct marketing pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR). If you initially objected to the use of your email address for this purpose, we will not send you any emails.

You have the right to object at any time to the use of your email address for the aforementioned promotional purposes, with future effect, by notifying the data controller named at the beginning of this notice. You will only be charged the standard transmission fees for this. Upon receipt of your objection, the use of your email address for promotional purposes will be discontinued immediately.

7.3 HubSpot

Our email newsletters are dispatched via this provider: HubSpot Ireland Ltd., 2nd Floor 30 North Wall Quay, Dublin 1, Ireland.

On the basis of our legitimate interest in effective and user-friendly newsletter marketing, we pass on the data you provided when registering for the newsletter to this provider in accordance with Art. 6 (1) (f) GDPR, so that they can handle the newsletter dispatch on our behalf.

Subject to your express consent pursuant to Art. 6 (1) (a) GDPR, the provider also carries out a statistical performance evaluation of newsletter campaigns using web beacons or tracking pixels in the sent emails, which can measure opening rates and specific interactions with the content of the newsletter. Terminal device information (e.g., time of access, IP address, browser type, and operating system) is also collected and evaluated but is not merged with other datasets.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have entered into a data processing agreement (Auftragsverarbeitungsvertrag) with the provider, which protects the data of our website visitors and prohibits disclosure to third parties.

7.4 Shopify Email

Our email newsletters are dispatched via this provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

You can revoke your consent to newsletter tracking at any time with effect for the future.

We have entered into a data processing agreement with the provider, which protects the data of our website visitors and prohibits disclosure to third parties.

In the case of data transfer to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

7.5 Shopping Cart Reminders via Email

In the event that you abandon your purchase before completing the order, you have the option to receive a one-time email reminder regarding the contents of your virtual shopping cart.

The only mandatory information required for sending this reminder is your email address. Providing additional data is voluntary and may be used to address you personally. For sending the email, we use the so-called double opt-in procedure, which ensures that you only receive a notification after you have expressly confirmed your consent by clicking on a verification link sent to the email address provided

By activating the confirmation link, you grant us your consent for the use of your personal data in accordance with Art. 6 (1) (a) GDPR for the purpose of sending a shopping cart reminder. In doing so, we store your IP address entered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any potential misuse of your email address at a later date. The data collected by us when you register for our email notification service will be used strictly for its intended purpose.

You can unsubscribe from shopping cart reminders at any time by sending a corresponding message to the controller named above. After unsubscribing, your email address will be deleted immediately from our distribution list set up for this purpose, unless you have expressly consented to further use of your data or we reserve the right to a broader use of data that is legally permitted and about which we inform you in this declaration.

8) Data Processing for Order Handling

8.1 To the extent necessary for contract execution for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR.

If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we will process the contact data submitted by you when ordering to inform you personally within the framework of our statutory information obligations pursuant to Art. 6 (1) (c) GDPR. Your contact data will be used strictly for the purpose of notifications about updates owed by us and will only be processed by us to the extent necessary for the respective information.

For the processing of your order, we also work together with the service provider(s) listed below, who support us wholly or partially in the execution of concluded contracts. Certain personal data will be transmitted to these service providers in accordance with the following information.

8.2 Transfer of Personal Data to Shipping Service Providers

- Deutsche Post

As a transport service provider, we use the following provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany.

We pass on your email address and/or telephone number to the provider in accordance with Art. 6 (1) (a) GDPR prior to the delivery of the goods for the purpose of coordinating a delivery date or for delivery notification, provided you have given your express consent during the ordering process. Otherwise, for the purpose of delivery, we will only pass on the name of the recipient and the delivery address to the provider in accordance with Art. 6 (1) (b) GDPR. The transfer will only take place to the extent necessary for the delivery of goods. In this case, prior coordination of the delivery date with the provider or a delivery notification is not possible.

Consent can be revoked at any time with effect for the future toward the controller named above or toward the provider.

- DHL

As a transport service provider, we use the following provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.

Consent can be revoked at any time with effect for the future toward the controller named above or toward the provider.

- DHL Express

As a transport service provider, we use the following provider: DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn, Germany.

Consent can be revoked at any time with effect for the future toward the controller named above or toward the provider.

- DHL Freight

As a transportation service provider, we use the following provider: DHL Freight GmbH, Godesberger Allee 102-104, 53175 Bonn, Germany

We will disclose your email address and/or phone number to the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or notifying you of the delivery, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.

- DHL Austria

We use the following shipping provider: DHL Paket (Austria) GmbH, Campus 21, Liebermannstrasse F08/401, 2345 Brunn am Gebirge, Austria

We will share your email address and/or phone number with the provider in accordance with Article 6(1)(a) of the GDPR prior to delivery of the goods for the purpose of coordinating a delivery date or notifying you of the delivery, provided that you have given your explicit consent to this during the ordering process. Otherwise, for the purpose of delivery in accordance with Article 6(1)(b) of the GDPR, we will only disclose the recipient’s name and the delivery address to the provider. This disclosure is made only to the extent necessary for the delivery of the goods. In this case, it is not possible to coordinate the delivery date with the provider in advance or to provide a delivery notification.

You may revoke your consent at any time with future effect by contacting the controller named above or the provider.

- FedEx

As a transport service provider, we use the following provider: FedEx Express Germany GmbH, Langer Kornweg 34 k, 65451 Kelsterbach, Germany.

Consent can be revoked at any time with effect for the future toward the controller named above or toward the provider.

- Österreichische Post

As a transport service provider, we use the following provider: Österreichische Post Aktiengesellschaft, Rochusplatz 1, 1030 Vienna, Austria.

Consent can be revoked at any time with effect for the future toward the controller named above or toward the provider.

- PostNL

As a transport service provider, we use the following provider: Koninklijke post NL BV, Waldorpstraat 3, 2521CA The Hague, Netherlands.

Consent can be revoked at any time with effect for the future toward the controller named above or toward the provider.

- UPS

As a transport service provider, we use the following provider: United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss, Germany.

Consent can be revoked at any time with effect for the future toward the controller named above or toward the provider.

8.3 Use of Payment Service Providers (Payment Services)

- Apple Pay

If you choose the payment method "Apple Pay" of Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, the payment processing is carried out via the "Apple Pay" function of your terminal device operated with iOS, watchOS, or macOS by charging a payment card stored with "Apple Pay". Apple Pay uses security features integrated into the hardware and software of your device to protect your transactions. To authorize a payment, it is therefore necessary to enter a code previously specified by you and to verify it by means of the "Face ID" or "Touch ID" function of your terminal device.

For the purpose of payment processing, the information provided by you during the ordering process, together with the information about your order, is passed on to Apple in encrypted form. Apple then re-encrypts this data with a developer-specific key before transmitting the data to the payment service provider of the payment card stored in Apple Pay to carry out the payment. The encryption ensures that only the website through which the purchase was made can access the payment data. After the payment has been made, Apple sends your device account number as well as a transaction-specific, dynamic security code to the originating website to confirm the success of the payment.

If personal data is processed during the described transmissions, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) (b) GDPR.

Apple retains anonymized transaction data, including the approximate purchase amount, the approximate date and time, and whether the transaction was completed successfully. Anonymization completely rules out any personal reference. Apple uses the anonymized data to improve "Apple Pay" and other Apple products and services.

When you use Apple Pay on the iPhone or Apple Watch to complete a purchase made via Safari on the Mac, the Mac and the authorization device communicate via an encrypted channel on the Apple servers. Apple does not process or store any of this information in a format that can identify you. You can disable the ability to use Apple Pay on your Mac in the settings of your iPhone. Go to "Wallet & Apple Pay" and deactivate "Allow Payments on Mac". Further information on data protection for Apple Pay can be found at the following internet address: https://support.apple.com/en-us/HT203027

- Google Pay

If you choose the payment method "Google Pay" of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), the payment processing is carried out via the "Google Pay" application of your mobile device operated with at least Android 4.4 ("KitKat") and equipped with an NFC function by charging a payment card stored with Google Pay or a payment system verified there (e.g., PayPal). To authorize a payment via Google Pay of more than €25, it is necessary to unlock your mobile device beforehand using the respective verification measure set up (such as facial recognition, password, fingerprint, or pattern).

For the purpose of payment processing, the information provided by you during the ordering process, together with the information about your order, is passed on to Google. Google then transmits your payment information stored in Google Pay in the form of a unique transaction number to the originating website, which is used to verify that a payment has been made. This transaction number does not contain any information on the real payment data of your payment methods stored in Google Pay, but is created and transmitted as a uniquely valid numerical token. For all transactions via Google Pay, Google acts merely as an intermediary to process the payment transaction. The execution of the transaction takes place exclusively in the relationship between the user and the originating website by charging the payment method stored with Google Pay.

If personal data is processed during the described transmissions, the processing is carried out exclusively for the purpose of payment processing in accordance with Art. 6 (1) (b) GDPR.

Google reserves the right to collect, store, and evaluate certain transaction-specific information for every transaction made via Google Pay. This includes the date, time, and amount of the transaction, merchant location and description, a description of the purchased goods or services provided by the merchant, photos you have attached to the transaction, the name and email address of the seller and buyer or the sender and recipient, the payment method used, your description of the reason for the transaction, and, if applicable, the offer associated with the transaction.

According to Google, this processing is carried out exclusively in accordance with Art. 6 (1) (f) GDPR on the basis of the legitimate interest in proper accounting, the verification of transaction data, and the optimization and functional maintenance of the Google Pay service.

Google also reserves the right to merge the processed transaction data with other information collected and stored by Google when using other Google services.

The terms of service for Google Pay can be found here: https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=googlepaytos&ldl=en

Further information on data protection for Google Pay can be found at the following internet address:
https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=privacynotice&ldl=en

- Klarna

One or more online payment methods of the following provider are available on this website: Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden.

If you select a payment method of the provider where you make an advance payment (such as credit card payment), your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the contents of your order will be passed on to them in accordance with Art. 6 (1) (b) GDPR. In this case, your data will be passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where the provider makes an advance payment (such as purchase on account, installment purchase, or direct debit), you will also be requested to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, data on an alternative means of payment) during the ordering process.

In order to safeguard our legitimate interest in determining the creditworthiness of our customers, this data will be forwarded by us to the provider in accordance with Art. 6 (1) (f) GDPR for the purpose of a credit check. On the basis of the personal data provided by you as well as other data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option selected by you can be granted with regard to payment and/or default risks.

For the decision-making process within the framework of the application assessment, identity and credit information from the following credit reference agencies may be included in addition to the provider's internal criteria in accordance with Art. 6 (1) (f) GDPR: https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things but not exclusively, is included in the calculation of the score values.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still remain entitled to process your personal data if this is necessary for contractual payment processing.

- PayPal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.

If you select a payment method of the provider where you make an advance payment, your payment data provided during the ordering process (including name, address, bank and card information, currency, and transaction number) as well as information about the contents of your order will be passed on to them in accordance with Art. 6 (1) (b) GDPR. In this case, your data will be passed on exclusively for the purpose of payment processing with the provider and only to the extent necessary for this purpose.

If you select a payment method where we make an advance payment, you will also be requested to provide certain personal data (first and last name, street, house number, postal code, city, date of birth, email address, telephone number, and, if applicable, data on an alternative means of payment) during the ordering process.

In order to safeguard our legitimate interest in determining your creditworthiness in such cases, this data will be forwarded by us to the provider in accordance with Art. 6 (1) (f) GDPR for the purpose of a credit check. On the basis of the personal data provided by you as well as other data (such as shopping cart, invoice amount, order history, payment experience), the provider checks whether the payment option selected by you can be granted with regard to payment and/or default risks.

- PayPal Checkout

This website uses PayPal Checkout, an online payment system from PayPal, which consists of PayPal's own payment methods and local payment methods from third-party providers.

When paying via PayPal, credit card via PayPal, direct debit via PayPal or – if offered – "Pay Later" via PayPal, we pass your payment data on to PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (hereinafter "PayPal") as part of the payment processing. The transfer takes place in accordance with Art. 6 (1) (b) GDPR and only to the extent necessary for payment processing.

PayPal reserves the right to carry out a credit check for the payment methods credit card via PayPal, direct debit via PayPal or – if offered – "Pay Later" via PayPal. For this purpose, your payment data may be passed on to credit reference agencies in accordance with Art. 6 (1) (f) GDPR based on PayPal's legitimate interest in determining your creditworthiness. PayPal uses the result of the credit check regarding the statistical probability of payment default for the purpose of deciding on the provision of the respective payment method. The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. Address data, among other things but not exclusively, is included in the calculation of the score values. You can object to this processing of your data at any time by sending a message to PayPal. However, PayPal may still remain entitled to process your personal data if this is necessary for contractual payment processing.

If the PayPal payment method "Purchase on Account" is available and selected, your payment data will first be transmitted to PayPal to prepare the payment, whereupon PayPal forwards it to Ratepay GmbH, Franklinstraße 28-29, 10587 Berlin ("Ratepay") to carry out the payment. The legal basis is Art. 6 (1) (b) GDPR in each case. In this case, Ratepay conducts an identity and credit check in its own name to determine creditworthiness in accordance with the principle already mentioned above and passes your payment data on to credit reference agencies based on the legitimate interest in determining creditworthiness pursuant to Art. 6 (1) (f) GDPR. A list of credit reference agencies that Ratepay can rely on can be found here:
https://www.ratepay.com/legal-payment-creditagencies/

When using the payment method of a local third-party provider, your payment data is first passed on to PayPal in accordance with Art. 6 (1) (b) GDPR to prepare the payment. Depending on your selection of an available local payment method, PayPal then transmits your payment data to the corresponding provider in accordance with Art. 6 (1) (b) GDPR to carry out the payment:

Apple Pay (Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)
iDeal (Currence Holding BV, Beethovenstraat 300 Amsterdam, Netherlands)
bancontact (Bancontact Payconiq Company, Rue d'Arlon 82, 1040 Brussels, Belgium)
blik (Polski Standard Płatności sp. z o.o., ul. Czerniakowska 87A, 00-718 Warsaw, Poland)
eps (PSA Payment Services Austria GmbH, Handelskai 92, Gate 2, 1200 Vienna, Austria)
MyBank (PRETA S.A.S, 40 Rue de Courcelles, F-75008 Paris, France)
Przelewy24 (PayPro SA, Kanclerska 15A, 60-326 Poznań, Poland). For further data protection information, please refer to the PayPal Privacy Statement: https://www.paypal.com/webapps/mpp/ua/privacy-full

- Shopify Payments

One or more online payment methods of the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

- Stripe

This website offers one or more online payment methods from the following provider: Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

If you select a payment method from this provider that requires you to pay in advance (such as a credit card payment), your payment details provided during the ordering process (including your name, address, bank and payment card information, currency, and transaction number), as well as information about the contents of your order, will be transferred to the provider in accordance with Article 6(1)(b) of the GDPR. In this case, your data is transferred exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method in which the provider makes an advance payment (such as purchase on account, installment plan, or direct debit), you will also be asked during the ordering process to provide certain personal data (first and last name, street, house number, ZIP code, city, date of birth, email address, phone number, and, if applicable, details regarding an alternative payment method).

To safeguard our legitimate interest in determining our customers’ creditworthiness, we forward this data to the provider in accordance with Article 6(1)(f) of the GDPR for the purpose of conducting a credit check. Based on the personal data you have provided, as well as additional data (such as your shopping cart, invoice amount, order history, and payment history), the provider assesses whether the payment method you have selected can be granted in light of payment and/or credit default risks.

The credit report may contain probability values (so-called “score” values). To the extent that score values are included in the credit report’s results, they are based on a scientifically recognized mathematical-statistical method. The calculation of the score values includes, among other things but not exclusively, address data.

You may object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

8.4 Electronic Cancellation Function for Distance Contracts

Consumers who enter into contracts on this website that are subject to a statutory right of cancellation have the option to exercise their right of cancellation via an electronic cancellation function in accordance with the applicable cancellation provisions.

To provide the electronic cancellation function, we use a solution from the following provider: ECOMBEAT (EU Widerruf Pro), Martini & Radl OG, Garnisongasse 4, 1090 Vienna, Austria.

When using the cancellation function, in addition to information identifying the contract to be canceled, other personal information, such as the consumer’s first and last name and email address, must be provided or confirmed.

This information is first collected by the provider based on our legitimate interest in a user-friendly, stable, and process-optimized solution in accordance with Article 6(1)(f) of the GDPR; it is then used to confirm receipt of the notice of withdrawal on our behalf via email; and finally, it is transmitted to us. We subsequently process the transmitted information to properly handle the cancellation in accordance with Article 6(1)(b) and Article 6(1)(c) of the GDPR, based on our legal obligation to provide an electronic cancellation function for paid consumer distance sales contracts.

The information collected by the provider is routinely deleted after the withdrawal request has been fully processed, provided that there are no legal retention requirements to the contrary.

We have entered into a data processing agreement with the provider that protects data processed in connection with the withdrawal function and prohibits unauthorized disclosure to third parties.

9) Web Analysis Services

9.1 Google Analytics 4

This website uses Google Analytics 4, a web analysis service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website.

By default, when visiting the website, Google Analytics 4 sets cookies that are stored as small text blocks on your terminal device and collect certain information. The scope of this information also includes your IP address, which is, however, shortened by Google by the last digits in order to rule out any direct personal identification.

The information is transmitted to Google servers and processed further there. Transmissions to Google LLC based in the USA are also possible.

Google uses the collected information on our behalf to evaluate your use of the website, to compile reports on website activity for us, and to provide other services associated with website use and internet use. The shortened IP address transmitted by your browser within the framework of Google Analytics will not be merged with other data from Google. The data collected within the framework of using Google Analytics 4 is stored for a duration of two months and then deleted.

All processing described above, in particular the setting of cookies on the terminal device used, takes place only if you have given us your express consent for this in accordance with Art. 6 (1) (a) GDPR. Without your consent, Google Analytics 4 will not be used during your visit to the site. You can revoke your consent at any time with effect for the future. To exercise your right of revocation, please deactivate this service via the "Cookie Consent Tool" provided on the website.

We have entered into a data processing agreement with Google, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://business.safety.google/privacy/ and at https://policies.google.com/privacy?hl=en

Demographic Characteristics
Google Analytics 4 uses the special feature "demographic characteristics" and can use it to create statistics that provide information about the age, gender, and interests of website visitors. This is done through the analysis of advertising and information from third-party providers. This allows target groups to be identified for marketing activities. However, the collected data cannot be assigned to any specific person and is deleted after being stored for a duration of two months.

Google Signals
As an extension to Google Analytics 4, Google Signals may be used on this website to have cross-device reports generated. If you have activated personalized ads and have linked your devices to your Google account, Google may, subject to your consent to the use of Google Analytics pursuant to Art. 6 (1) (a) GDPR, analyze your usage behavior across devices and create database models, including cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop the cross-device analysis, you can deactivate the "Personalized advertising" function in the settings of your Google account. To do so, follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=de
Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985?hl=de

UserIDs
As an extension to Google Analytics 4, the "UserIDs" function may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6 (1) (a) GDPR, have set up an account on this website, and log in to this account on different devices, your activities, including conversions, can be analyzed across devices.

9.2 Microsoft Clarity

This website uses the web analysis service of the following provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399 USA.

With the help of cookies and/or comparable technologies (tracking pixels, web beacons, algorithms for reading device and browser information), the service collects and stores pseudonymized visitor data, including information about the terminal device used, such as the IP address and browser information, in order to evaluate it for statistical analyses of usage behavior on our website and to create pseudonymized usage profiles. Among other things, this makes it possible to evaluate movement patterns (so-called heatmaps), which show the duration of page visits as well as interactions with page content (e.g., text inputs, scrolling, clicks, and mouse-overs). Pseudonymization generally rules out any direct personal identification. A merging with clear data collected about your person in any other way does not take place.

All processing described above, in particular the reading or storing of information on the terminal device used, will only be carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

9.3 Shopify Analytics

This website uses the web analysis service of the following provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

We have entered into a data processing agreement with the provider, which protects the data of our website visitors and prohibits disclosure to third parties.

In the case of data transfer to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

10) Page Functionalities

10.1 Integration of the Instagram Feed via Mintt Studio

On our website, we use the services of Mintt Studio, Rua Parque da República 116, 4430-164 Vila Nova de Gaia, Portugal, to display preview images of our Instagram profile. In doing so, cookies are used, which are small text files stored locally in the cache of your internet browser.

Through the widget, a connection to servers of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Instagram") is established when visitors access our website. This provides Instagram with certain browser information, including your IP address. In individual cases, a transmission to servers of Meta Platforms Inc. based in the USA is also possible.

All processing described above, in particular the setting of cookies for reading information on the terminal device used, will only be carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

10.2 Instagram Plugins

Plugins of the social network of the following provider are used on our website: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

These plugins enable direct interactions with content on the social network.

To increase the protection of your data when visiting our website, the plugins are initially integrated into the page in a deactivated state by means of a so-called "2-click" or "Shariff" solution.

This integration ensures that when a page of our website that contains such plugins is called up, no connection is established with the provider's servers yet.

Only when you activate the plugins and thus grant your consent to the data transfer in accordance with Art. 6 (1) (a) GDPR, does your browser establish a direct connection to the provider's servers. In this context, regardless of whether you are logged into an existing user profile, a certain amount of information about your terminal device used (including your IP address), your browser, and your page history is transmitted to the provider and may be processed further there.

If you are logged into an existing user profile on the provider's social network, information about interactions carried out via the plugins is also published there and displayed to your contacts. You can revoke your consent at any time by deactivating the activated plugin by clicking on it again. However, the revocation has no influence on data that has already been transmitted to the provider.

Data may also be transferred to: Meta Platforms Inc., USA.

We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

10.3 Google Maps

This website uses an online mapping service of the following provider: Google Maps (API) of Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Google Maps is a web service for displaying interactive (land) maps in order to present geographical information visually. By using this service, our location is shown to you and a possible arrival is made easier.

As soon as you access the subpages in which the Google Maps map is integrated, information about your use of our website (such as your IP address) is transmitted to Google servers and stored there; this may also involve transmission to the servers of Google LLC. in the USA. This takes place regardless of whether Google provides a user account through which you are logged in or whether a user account exists. If you are logged in to Google, your data is directly assigned to your account. If you do not wish the assignment to your profile with Google, you must log out before activating the button.

Google stores your data (even for users who are not logged in) as usage profiles and evaluates them. The collection, storage, and evaluation are carried out in accordance with Art. 6 (1) (f) GDPR on the basis of Google's legitimate interest in the display of personalized advertising, market research, and/or the demand-oriented design of Google websites. You have a right to object to the creation of these user profiles, and you must contact Google to exercise this right. If you do not agree to the future transmission of your data to Google within the framework of using Google Maps, there is also the option of completely deactivating the Google Maps web service by switching off the JavaScript application in your browser. Google Maps and thus the map display on this website can then not be used.

To the extent legally required, we have obtained your consent for the processing of your data as described above in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future. To exercise your revocation, please follow the option for making an objection described above.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European data protection level based on an adequacy decision of the European Commission. Further information on Google's data protection regulations can be found here: https://business.safety.google/privacy/

10.4 Cloudflare Turnstile

On this website, we use the CAPTCHA service of the following provider: Cloudflare, Inc., 101 Townsend St. San Francisco, CA 94107, USA.

The service checks whether an entry is made by a natural person or abusively by mechanical and automated processing, and blocks spam, DDoS attacks, and similar automated malicious access. To ensure that an action is performed by a human and not by an automated bot, Cloudflare Turnstile collects the IP address of the terminal device used, identification data of the browser and operating system type used, as well as the date and duration of the visit, and transmits this to the provider's servers for evaluation.

The described processing will only be carried out if you have given us your express consent in accordance with Art. 6 (1) (a) GDPR. You can revoke your consent at any time with effect for the future by deactivating this service in the "Cookie Consent Tool" provided on the website.

We have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

11) Tools and Miscellaneous

11.1 DATEV

For the purpose of handling bookkeeping, we use the service of the cloud-based accounting software of the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany.

The provider processes incoming and outgoing invoices as well as, if applicable, the bank transactions of our company in order to automatically record invoices, match them to transactions, and generate the financial accounting from this in a semi-automated process.

Insofar as personal data is also processed in this context, the processing is carried out on the basis of our legitimate interest in an efficient organization and documentation of our business transactions in accordance with Art. 6 (1) (f) GDPR.

11.2 Xentral ERP

For the purpose of handling bookkeeping, we use the service of the cloud-based accounting software of the following provider: Xentral ERP Software GmbH, Fuggerstraße 11, 86150 Augsburg, Germany.

11.3 Cookie Consent Tool

This website uses a so-called "Cookie Consent Tool" to obtain effective user consent for cookies and cookie-based applications that require consent. The "Cookie Consent Tool" is displayed to users when they access the page in the form of an interactive user interface on which consent for certain cookies and/or cookie-based applications can be granted by ticking a box. By using the tool, all cookies/services requiring consent are only loaded if the respective user has given corresponding consent by ticking the box. This ensures that such cookies are only set on the user's terminal device if consent has been granted.

The tool sets technically necessary cookies to store your cookie preferences. Personal user data is generally not processed in this context.

If, in individual cases, personal data (such as the IP address) is processed for the purpose of storing, assigning, or logging cookie settings, this is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in a legally compliant, user-specific, and user-friendly consent management for cookies and thus in a legally compliant design of our website.

A further legal basis for processing is also Art. 6 (1) (c) GDPR. As the controller, we are subject to the legal obligation to make the use of cookies that are not technically necessary dependent on the respective user's consent.

To the extent necessary, we have entered into a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

Further information on the operator and the settings options of the Cookie Consent Tool can be found directly in the corresponding user interface on our website.

12) Rights of the Data Subject

12.1 Applicable data protection law grants you the following data subject rights (rights of information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the cited legal basis for the respective requirements for exercise:

Right of access pursuant to Art. 15 GDPR
Right to rectification pursuant to Art. 16 GDPR
Right to erasure pursuant to Art. 17 GDPR
Right to restriction of processing pursuant to Art. 18 GDPR
Right to notification pursuant to Art. 19 GDPR; Right to data portability pursuant to Art. 20 GDPR
Right to withdraw consent granted pursuant to Art. 7 (3) GDPR
Right to lodge a complaint pursuant to Art. 77 GDPR.

12.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA WITHIN THE SCOPE OF A BALANCE OF INTERESTS ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME, FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION, TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN PROVE COMPELLING LEGITIMATE REASONS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH MARKETING. YOU CAN EXERCISE THE OBJECT AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13) Duration of Storage of Personal Data

The duration of the storage of personal data is determined based on the respective legal basis, the purpose of processing and – if applicable – additionally based on the respective statutory retention period (e.g., commercial and tax law retention periods).

When processing personal data on the basis of an express consent pursuant to Art. 6 (1) (a) GDPR, the data concerned is stored until you revoke your consent.

If statutory retention periods exist for data processed within the framework of contractual or quasi-contractual obligations on the basis of Art. 6 (1) (b) GDPR, this data will be routinely deleted after expiry of the retention periods, provided it is no longer required for contract fulfillment or contract initiation and/or there is no longer a legitimate interest on our part in further storage.

When processing personal data on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

When processing personal data for the purpose of direct marketing on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this declaration regarding specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Instagram

Fine yarns from Japan

With Heritage. With Stance.
For design, not just use.

Worldwide shipping

Fast delivery. No minimum quantity.

14-day return policy

Making a decision takes time. You can take it.

Secure payment

Choose your preferred payment method. Simple and secure.