Privacy policy
Thank you for your interest in our online shop. Protecting your personal data is important to us. Below we explain which data we process, for what purpose and on what legal basis, and what rights you have.
1. Controller
The controller for data processing on this website within the meaning of Art. 4(7) GDPR is:
Sabine Lindner / Hundessa
Haringstraße 11
85635 Höhenkirchen-Siegertsbrunn
Germany
Email: hundessa@web.de
Phone: +49 152 01366025
We have not appointed a data protection officer, as the legal requirements of Art. 37 GDPR in conjunction with section 38 of the German Federal Data Protection Act (BDSG) do not apply to us. If you have questions about data protection, please contact us directly at the address above.
2. General information on data processing
Personal data is any information relating to an identified or identifiable natural person. We only process your data where this is necessary to provide our online shop, to process your order, or because of a legal obligation, or where you have given your consent.
The legal basis for each processing activity is stated with the activity concerned. The following may apply:
- Art. 6(1)(a) GDPR – your consent
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
- Art. 6(1)(c) GDPR – compliance with a legal obligation, in particular tax retention obligations
- Art. 6(1)(f) GDPR – protection of legitimate interests, provided your interests do not override them
We delete your data as soon as the purpose of processing no longer applies, unless statutory retention obligations prevent deletion. You will find an overview of retention periods under section 15.
3. Hosting and provision of the online shop
Our online shop runs on the platform of Shopify International Limited, Ireland. Shopify is the contracting party responsible for the European Economic Area and processes the data of our shop visitors on our behalf. We have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR.
Each time our online shop is accessed, the platform automatically collects data transmitted by your browser. This includes in particular:
- IP address of the requesting device
- date and time of access
- page or file requested
- volume of data transferred and notification of successful retrieval
- browser type and operating system used
- previously visited page (referrer)
This processing is technically necessary in order to deliver the online shop, ensure its stability and security, and prevent misuse. Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the online shop.
4. Cookies and consent management
We use cookies and comparable technologies. Cookies are small text files stored on your device.
Strictly necessary cookies are required for the online shop to function – for example to store the contents of your basket, to recognise you during a session, or to remember your cookie choice. We set these cookies without your consent. Legal basis: section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(f) GDPR.
All other cookies are only set if you have previously consented via our consent banner. Legal basis: section 25(1) TDDDG and Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future. To do so, use the Cookie settings link in the footer of our online shop. Withdrawing consent does not affect the lawfulness of processing carried out up to that point.
You can also delete cookies in your browser settings or prevent them from being stored in the first place. Please note that in this case individual functions of the online shop may not be available or may not work fully.
No web analytics, no third-party advertising networks: We do not use a web analytics service such as Google Analytics or Matomo. The Meta pixel and comparable tools of other advertising networks are not embedded. External fonts from third-party providers are not loaded either.
Google tag for conversion measurement
We present our products through Google Merchant Center in the free product listings of Google Search. So that we can tell which of these listings lead to an order, a Google tag is embedded in our online shop. It reports to Google that a page was viewed (page_view), a product was viewed (view_item) or an order was completed (purchase) — in the latter case together with the order value. In doing so, your IP address, information about your device and browser, and a pseudonymous identifier are processed. We ourselves receive only aggregated reports from Google and cannot identify individual people from them.
The Google tag is only loaded after you have given your consent in the consent banner. If you decline, no data is transmitted to Google. You can withdraw your consent at any time via the Cookie settings link in the footer. Legal basis: section 25(1) TDDDG and Art. 6(1)(a) GDPR.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google also processes the data for its own purposes and may transfer it to Google LLC in the United States; see section 16. Details can be found in Google’s privacy policy.
5. Orders and performance of the contract
When you place an order with us, we process the data required to perform the contract:
- first and last name
- billing and delivery address
- email address
- telephone number, if provided
- order and payment data
Purpose: conclusion and performance of the purchase contract including shipping, invoicing, payment processing, and handling of enquiries, withdrawals and warranty claims.
Legal basis: Art. 6(1)(b) GDPR. Where we retain invoices and accounting records, additionally Art. 6(1)(c) GDPR in conjunction with section 147(3) of the German Fiscal Code (AO) and section 14b(1) of the German VAT Act (UStG).
6. Payment processing
We use payment service providers to process payments. Your payment data is transmitted directly to the respective payment service provider and processed there. We do not receive complete payment details such as credit card numbers.
Legal basis: Art. 6(1)(b) GDPR. For the prevention of payment defaults and misuse, additionally Art. 6(1)(f) GDPR.
Shopify Payments
If you pay via Shopify Payments – for example by credit or debit card – your payment data is transmitted to and processed by Shopify International Limited, Ireland. For the technical processing of card payments, Shopify uses the payment service provider Stripe. We never receive complete card details; we are only informed whether the payment was successful.
PayPal
If you choose PayPal as your payment method, the data required to process the payment is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal is an independent controller for this processing; PayPal's privacy policy applies accordingly.
PayPal may involve credit agencies to verify identity and creditworthiness and may pass data on to affiliated companies and service providers. We have no influence over this processing. Further information is available at paypal.com/de/webapps/mpp/ua/privacy-full.
7. Shipping
In order to deliver your order, we pass your name and delivery address to our shipping service provider DHL. Where you have agreed to this or where it is necessary to coordinate delivery, we additionally transmit your email address or telephone number so that the shipping service provider can inform you about the delivery.
To create shipping labels and hand over the shipment data, we use the Shopify application "Post & DHL Shipping" provided by DHL. For this purpose the application accesses order, customer and checkout data in our shop. For the subsequent carriage of the shipment, DHL is an independent controller under data protection law.
Legal basis: Art. 6(1)(b) GDPR.
For deliveries to Switzerland, we transmit the information required for the customs declaration – in particular name, address and contents of the shipment – to the shipping service provider and the competent customs authorities. Legal basis: Art. 6(1)(c) GDPR.
8. Customer account
You can order from us without creating a customer account. If you voluntarily create an account, we store the data you provide together with your order history so that you do not have to enter all details again for future orders.
You log in using a one-time code that we send to your email address. No password is stored.
Legal basis: Art. 6(1)(b) GDPR. You can have your customer account deleted at any time; statutory retention obligations for orders already completed remain unaffected.
9. Contact form and contact by email
If you contact us via the contact form or by email, we process the data you provide – at least your name, email address and the content of your message – in order to handle your enquiry.
Legal basis: If your enquiry relates to a contract or its initiation, Art. 6(1)(b) GDPR. In all other cases Art. 6(1)(f) GDPR; our legitimate interest lies in responding to enquiries.
10. Fit Assistant – information about your dog
For made-to-measure products, our Fit Assistant collects measurements and details about your dog, such as back length, chest and neck girth and, where applicable, the breed and name of your dog. This information is attached to your order as order characteristics so that we can make the product to your specifications.
Information about your dog is not personal data in itself. As it is linked to your order, we treat it in the same way as your other order data.
Legal basis: Art. 6(1)(b) GDPR.
11. Electronic withdrawal function
For the electronic withdrawal function required by law under section 356a of the German Civil Code (BGB), we use an application provided by Visionz GmbH, Richthofenstraße 29, 31137 Hildesheim, Germany.
If you declare a withdrawal using this function, your name, your email address, the order identification and the content, date and time of your declaration of withdrawal are processed. Technically, your IP address and information about your browser and operating system are also collected. This data serves to receive your declaration, to send you the confirmation of receipt required by law, and to evidence that it was received in good time.
Legal basis: Art. 6(1)(c) GDPR in conjunction with section 356a BGB, and Art. 6(1)(b) GDPR for the reversal of the contract.
Further information from the provider is available at visionz.de/eu-widerrufsbutton-privacy-policy.
12. Newsletter
If you subscribe to our newsletter, we process your email address in order to send you information about our products and offers.
Legal basis: Art. 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every newsletter email or by sending us a message. The newsletter is sent via the Shopify platform.
13. Links to social media
Our online shop contains links to our profiles on Facebook and Instagram. These are simple links, not embedded content or plugins. No data is transmitted to the operators of these networks unless you click the respective link.
Only when you follow a link do you leave our online shop. From that point on, the privacy policy of the respective network applies. We have no influence over the processing that takes place there.
14. Recipients of your data
Your data is only passed on where this is necessary for the purposes described. The recipients are:
| Recipient | Purpose | Role |
|---|---|---|
| Shopify International Limited, Ireland | operation of the online shop, hosting, checkout, customer accounts, email delivery | processor |
| Visionz GmbH, Hildesheim | electronic withdrawal function under section 356a BGB | processor |
| DHL, including the Shopify application "Post & DHL Shipping" | creation of shipping labels and delivery of shipments | processor for label creation, otherwise independent controller |
| Shopify International Limited, Ireland, with Stripe as technical service provider | payment processing via Shopify Payments | processor and its service provider |
| PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg | payment processing via PayPal | independent controller |
| Google Ireland Limited, Ireland | conversion measurement for the free product listings via the Google tag – only with your consent | joint controller with us for the collection, otherwise independent controller |
| tax advisors, customs and tax authorities | compliance with legal obligations | depending on the case |
15. Retention periods
| Data | Retention period |
|---|---|
| server log data | deleted as soon as no longer required for operation |
| order and invoice data | 8 years after the end of the calendar year in which the invoice was issued (section 14b(1) UStG, section 147(3) AO) |
| business letters, including order correspondence | 6 years (section 147(3) AO) |
| customer account | until you delete the account; order data is subject to the periods above |
| enquiries via contact form or email | until the enquiry has been dealt with conclusively, unless a retention obligation applies |
| declarations of withdrawal and confirmations of receipt | until expiry of the statutory limitation and retention periods |
| newsletter consent | until consent is withdrawn; evidence of the withdrawal is kept beyond that |
16. Transfers to third countries
Processing generally takes place within the European Union. Where our platform Shopify transfers data to companies within its own group or to service providers outside the European Union – in particular to Canada and the United States – this is done on the basis of appropriate safeguards under Art. 46 GDPR, in particular the standard contractual clauses of the European Commission, or on the basis of an adequacy decision.
If you have consented to the Google tag, Google Ireland Limited may transfer data to Google LLC in the United States. This is based on the adequacy decision of the European Commission for the EU-US Data Privacy Framework and, in addition, on the standard contractual clauses of the European Commission. Legal basis: Art. 6(1)(a) GDPR in conjunction with Art. 45 and Art. 46 GDPR.
For deliveries to Switzerland, the data required for the customs declaration is transferred to Switzerland. An adequacy decision of the European Commission exists for Switzerland. Legal basis: Art. 6(1)(b) and (c) GDPR in conjunction with Art. 45 GDPR.
17. Your rights
You have the following rights in relation to the personal data concerning you:
- access to the data we process (Art. 15 GDPR)
- rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
- erasure of your data, unless a retention obligation prevents this (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)
- withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
Right to object under Art. 21 GDPR: Where we process data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
To exercise your rights, an informal message to hundessa@web.de is sufficient.
18. Right to lodge a complaint with a supervisory authority
Without prejudice to any other legal remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the General Data Protection Regulation. The supervisory authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Postfach 13 49
91504 Ansbach, Germany
Visitor address: Promenade 18, 91522 Ansbach
www.lda.bayern.de
You may also contact the supervisory authority of your habitual residence or place of work.
19. No automated decision-making
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
20. Obligation to provide data
You are neither legally nor contractually obliged to provide your data. However, without the information required to perform the contract, we cannot enter into a contract with you and cannot process your order.
21. Changes to this privacy policy
We will amend this privacy policy if the legal situation, our data processing or the services we use change. The version available on this page applies in each case.
Last updated: 24 August 2026.
