Datenschutzerklärung

 

This Privacy Policy describes how universalstandardx.shop handles personal information when you visit our storefront, place an order, communicate with us, or request support. In this policy, “we,” “us,” and “our” mean the business operating universalstandardx.shop. Contact details for privacy questions and requests appear below.

1. Information We Collect

• Contact and delivery information: your name, email address, telephone number, billing address, and shipping address.
• Order information: products purchased, order identifiers, amounts paid, delivery status, and records of cancellations, returns, or refunds.
• Payment-related information: payment status, transaction references, and limited payment-method information made available by the payment provider. Payment credentials supplied at checkout are handled by the payment service involved in the transaction.
• Communications: messages, attachments, product-issue descriptions, and other information you choose to provide when contacting us.
• Technical and usage information: IP address, browser and device details, pages requested, timestamps, and identifiers needed to maintain a session, operate the cart, and protect checkout.

We obtain information directly from you, automatically through operation of the storefront, and from providers handling payments, hosting, fulfillment, delivery, and fraud prevention. Please provide only information relevant to your request and avoid sending passwords or complete payment-card details by email.

2. Purposes and Lawful Bases

We process personal data to form and perform contracts, take steps requested before contract formation, process payments, deliver orders, handle returns and support, prevent fraud, maintain security, keep legally required tax and accounting records, and defend legal claims. The legal bases may include Article 6(1)(b) GDPR for contract performance, Article 6(1)(c) for legal obligations, Article 6(1)(f) for proportionate legitimate interests, and Article 6(1)(a) for consent.

Where consent is used, it must be freely given, specific, informed, and unambiguous and may be withdrawn at any time without affecting earlier lawful processing. We document legitimate-interest balancing where appropriate and do not rely on a contractual basis for processing that is not objectively necessary for the requested contract.

3. Recipients of Information

We disclose relevant information to service providers that support the storefront and order process, including Shopify as our commerce platform, payment processors, delivery carriers, fulfillment providers, technical-support providers, and professional advisers. We limit disclosures to the functions involved and applicable legal requirements.

Information may also be disclosed when reasonably necessary to comply with a valid legal demand, protect legal rights, investigate fraud, or address security incidents. If the business is transferred or reorganized, relevant records may be transferred subject to appropriate protections and any required notice.

Shopify and payment providers may process certain information for their own legal, security, and service purposes. Their separate notices explain those activities. See Shopify's Privacy Policy and Shopify's privacy controls. Your purchase contract remains with our store.

4. Cookies, End-Device Access, and Advertising

The storefront may use cookies, pixels, local storage, software development kits, and comparable technologies. Access to or storage of information on a user’s terminal equipment requires prior consent under section 25 TDDDG unless the operation is strictly necessary to transmit a communication or provide a digital service expressly requested by the user.

Non-essential analytics, advertising, profiling, or cross-site tracking must remain disabled until valid consent is obtained. The consent interface must permit a genuine choice, explain purposes and providers, record the choice, and make withdrawal as easy as giving consent. Refusing non-essential technologies must not prevent access to core shopping functions unless a legally valid necessity exists.

Because the actual Shopify apps, advertising pixels, consent configuration, and enhanced services have not been verified, this draft does not claim that the store sells personal data, avoids targeted advertising, or uses any particular tracker. A live cookie inventory and consent test are required before publication.

5. Retention and Security

We retain information for as long as reasonably needed for the purposes described above, including order support, accounting, tax requirements, fraud prevention, and the establishment or defense of legal claims. Retention depends on the information's nature, the transaction, applicable obligations, and any unresolved dispute. Information no longer required is deleted or de-identified where appropriate.

We use reasonable safeguards intended to protect personal information. No method of transmission or storage is completely secure. Please contact us if you believe an order or communication associated with our store has been compromised.

6. Privacy Requests and Complaint Procedure

Subject to GDPR conditions and exemptions, individuals may request access, correction, erasure, restriction, portability, or objection; withdraw consent; and request safeguards concerning qualifying solely automated decisions. Email info@universalstandardx.shop. We may request proportionate information necessary to verify identity or a representative’s authority.

Under Article 12 GDPR, we respond without undue delay and normally within one month after receipt. Where necessary because of complexity or the number of requests, that period may be extended by two further months, but we will give notice and reasons within the first month. Requests are normally free; any lawful fee or refusal for manifestly unfounded or excessive requests will be explained.

An internal request or complaint does not remove the right to complain to the competent German data protection supervisory authority or seek a judicial remedy. Based on the supplied Cologne address, the likely regional authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, but the controller’s actual establishment and competence must be verified before publication.

7. Children and International Processing

The store is not directed to children, and we do not knowingly seek data from a child who cannot lawfully provide the relevant information or consent. If such data was collected without an appropriate legal basis or required parental authorisation, we will delete or restrict it as required. The live storefront must be reviewed for products, profiling, or age-assurance features that create additional duties.

Shopify and other providers may process information in countries outside the European Economic Area. Any transfer must rely on a lawful GDPR mechanism, such as an adequacy decision, approved standard contractual clauses with an appropriate transfer assessment and supplementary measures, binding corporate rules, or a narrowly applicable derogation.

8. Order Records and the Role of Each Participant

Different participants in a transaction can hold different records. We use the customer and order information available to us to administer the purchase and provide support. A payment provider may separately maintain payment authentication and dispute records, while a carrier may hold routing, delivery, signature, and delivery-photograph information. Their handling of information may be governed by their own notices and legal duties.

A request sent to us covers information for which we are responsible and the assistance we are legally required to obtain from our providers. We will explain when a request concerns a separate provider's independently controlled records. Referring you to a provider does not release us from our own responsibilities for information disclosed through our store.

9. Information Supplied About Other People

You may supply another person's delivery details when arranging a gift or an authorized purchase. Provide only the information needed to complete that request and ensure you have an appropriate reason to provide it. We use a recipient's delivery information for the transaction and related support; receiving a gift does not by itself constitute agreement to receive marketing.

When a person asks about an order placed by someone else, we may need to confirm their authority before revealing information, changing an address, or discussing a payment. Verification should reflect the sensitivity of the action. A request for general product information ordinarily does not require identity verification.

10. Financial Information and Sensitive Details

Checkout may require payment details necessary for the method you select. Do not assume that a payment processor's collection of a card credential means our support team can see the complete credential. We use payment status and the limited transaction information made available to us for order administration, fraud checks, refunds, and dispute resolution.

We do not ask customers to send passwords, complete card numbers, health records, or government identifiers in ordinary support correspondence. If a specific legal or transaction requirement makes additional information necessary, we will explain the purpose and an appropriate method for providing it. Any legally defined sensitive information is handled subject to the limitations applicable to its actual use.

11. Operational Logs and Service Diagnostics

Technical information helps the storefront respond to page requests, maintain a shopping session, detect suspicious activity, and investigate failures. Relevant records may indicate that a checkout request encountered an error without containing the full contents of a payment credential. Access to diagnostic information should be tied to the operational task involved.

12. Preference Choices and Their Effects

Some privacy choices operate at browser level and others relate to an identifiable customer record. Deleting cookies or switching devices may remove locally stored preferences. If you use more than one browser, you may need to manage local cookie settings on each. A browser choice does not necessarily identify every transaction associated with your email address.

You may also contact us directly to explain a privacy concern. We will distinguish an opt-out request from a deletion request or a request to stop promotional email because those actions have different effects. Necessary records may remain after marketing stops, and deleting an order record does not automatically undo a completed financial transaction.

13. German and EU Transparency and Data-Use Disclosures

This notice is intended to meet Articles 12–14 GDPR and the supplementary German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) by explaining the controller, data categories and sources, purposes, legal bases, recipients, retention logic, transfers, rights, complaint route, and consequences of failing to provide necessary data. Information must be concise, transparent, intelligible, and easy to access.

The live notice must be updated to match the actual Shopify plan, payment providers, fulfilment partners, apps, analytics, advertising pixels, customer-account features, and international transfers. We will not describe a service as a processor, joint controller, or independent controller without checking the actual arrangement.

14. GDPR Data-Protection Rights

Applicable rights include access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18, notification under Article 19, portability under Article 20, objection under Article 21, and protections concerning qualifying automated decisions under Article 22. The right to object is highlighted where processing relies on legitimate interests or direct marketing.

Rights are not absolute. We may retain information needed for tax, accounting, fraud prevention, legal claims, product safety, or another binding obligation. Any limitation will be explained by reference to the applicable rule rather than a blanket refusal.

15. Identity Verification and Representatives

We use proportionate verification and do not request more information than reasonably necessary. A representative may act where the law permits and authority can be demonstrated. We may communicate directly with the individual where needed to confirm authority or protect information.

A request is not rejected solely because it arrives by email or does not use a form. Where clarification is reasonably needed to identify the requested information, we will explain what is needed and why. Excessive or manifestly unfounded requests may be handled only as permitted by law.

16. Deletion Exceptions and Corrected Records

A deletion request does not always require erasing every record immediately. Relevant exceptions may permit retention to complete a requested transaction, comply with tax or other legal obligations, prevent fraud, address security incidents, or establish and defend legal claims. We will explain a material exception rather than use recordkeeping as a blanket reason to disregard the request.

A correction can update an inaccurate contact or order-support record while preserving the historical accuracy of an invoice or transaction log where required. We distinguish correcting a fact from altering a valid record of what occurred. If we disagree that information is inaccurate, we will explain the decision and any available review route.

17. Retention by Record Type

Transaction records are retained according to accounting, tax, payment-dispute, and contract requirements. Support records are assessed according to the unresolved issue and the need to demonstrate its resolution. Technical records are assessed according to security and troubleshooting needs. Marketing preferences may need to be retained in a limited suppression record so an unsubscribe request continues to be respected.

These criteria do not create an unlimited retention period. When the relevant need ends, information should be deleted or de-identified subject to lawful exceptions and practical backup handling. Where deletion from a backup is not immediate, the information should not be restored to ordinary use merely to avoid the effect of a valid request.

18. International Requests and Transfers

Personal data may be processed outside the European Economic Area by Shopify, payment providers, carriers, cloud providers, or support services. The live notice must identify actual destinations and mechanisms. Safeguards may include an EU adequacy decision, approved standard contractual clauses, binding corporate rules, or a specific Article 49 GDPR derogation used only where appropriate.

Individuals may request information about relevant safeguards. A provider’s separate notice does not remove our duty to describe our role accurately, evaluate transfer risk, and implement supplementary protections where needed. International processing does not reduce GDPR rights.

19. Public Reviews and Voluntary Content

If a review or other public-submission feature is available and you choose to publish content, information you include may be visible to other visitors. Avoid posting order numbers, home addresses, phone numbers, payment information, or another person's private details. Private support correspondence is not treated as permission to publish it as a testimonial.

20. Security Concerns and Suspicious Messages

Contact us if you receive a message that appears to misuse our store identity or asks for unexpected sensitive information. Describe the message and provide only the details needed to assess it. Do not open a suspicious attachment or provide a password simply because a message mentions an order number.

Where a security incident affects personal information, we will assess the event and provide notices required by applicable law. This policy is not a guarantee that an incident can never occur. A report to customer service does not require a customer to perform a technical investigation or collect information from someone else's account.

21. Material Changes in Processing

Changes to collection purposes, recipient categories, or advertising practices can require more than editing a date. Before implementing a material new practice, we will provide the information and choices required by applicable law. Previously collected information will not automatically be repurposed merely because a revised policy is posted.

Questions about a policy change may be sent to info@universalstandardx.shop with the relevant date or paragraph. We will explain the practice at issue and the available request route. If a concern remains unresolved, you may use any complaint or appeal channel available under applicable law without being penalized for doing so.

22. Changes, Controller Contact, and Supervisory Authority

We may update this notice prospectively when processing, providers, law, or store configuration changes. Material changes will be brought to users’ attention where required. Earlier processing remains governed by the version applicable at that time and by mandatory law.

Controller contact: universalstandardx.shop, GERTRUDENSTR. 31, ALTSTADT/NORD, KÖLN, Germany; info@universalstandardx.shop. This is a draft identifier, not a substitute for the operator’s legal name and complete address. The missing legal name, legal form or authorised representative, register data, VAT details if applicable, telephone number, and postcode must be supplied where legally required before publication.

Individuals may complain to the competent German supervisory authority. No data protection officer is named because none was provided; the live notice must identify one if appointment is legally required.