Privacy policy

Privacy Policy
Last updated: October 10, 2026

1. Controller
Nordmark Gestaltung, Owner: Christoph Ott
Bgm.-Bodmeier-Str. 27, 83539 Pfaffing, Germany
Telephone: +49 171 950 9915, E-mail: order@projekt-nordmark.de
We operate the online shop projekt-nordmark.com (the "Shop").

2. General information and legal bases
We process personal data only to the extent necessary to provide the Shop, to perform contracts or to comply with legal obligations, or where you have given your consent. The legal bases are Art. 6(1)(a) (consent), (b) (performance of a contract), (c) (legal obligation) and (f) GDPR (legitimate interests). For storing information on, or accessing information from, your device (e.g. cookies), Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act) also applies.

3. Shop system and hosting (Shopify)
Our Shop runs on Shopify (Shopify International Limited, Ireland, and affiliated companies, in particular Shopify Inc., Canada/USA). Shopify processes data of visitors and customers on our behalf, such as order data, customer accounts, payment processing and server log files (IP address, date and time, browser, page accessed, referrer). We have a data processing agreement with Shopify (Data Processing Addendum). Where Shopify processes data for its own purposes for certain functions (e.g. Shop Pay, fraud prevention), Shopify is independently responsible (information: https://privacy.shopify.com). Legal bases: Art. 6(1)(b) and (f) GDPR. Data transfers to third countries are based on an adequacy decision or standard contractual clauses.

4. Orders, performance of contract and customer account
To process your order, we process your name, address, e-mail address, where applicable your telephone number, the items ordered, payment information and our correspondence with you. You can order without a customer account. If you create a customer account, we store your login details and order history until the account is deleted. This information is required to perform the contract; without it, an order is not possible. Legal bases: Art. 6(1)(b) and (c) GDPR.

5. Payment service providers
Payment is made via Shopify Payments (technical service provider: Stripe Payments Europe Ltd., Ireland) and via PayPal. Depending on your country and device, Shopify Payments offers various payment methods, e.g. credit card, Apple Pay, Google Pay, Shop Pay, Klarna and local payment methods. The data required for payment (name, address, e-mail, order amount, payment data) is transmitted to the respective payment service provider. We do not receive full card details. PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) and Klarna (Klarna Bank AB (publ), Sweden) may in part process data as independent controllers, for example for fraud and credit checks; their privacy policies apply. For bank transfers, we process the transfer data in order to match your payment. Legal basis: Art. 6(1)(b) GDPR.

6. Shipping and production
For shipments from our warehouse, we pass on your name and delivery address (and, where required for delivery or tracking, your e-mail address or telephone number) to the parcel carrier, e.g. DHL, Deutsche Post or Hermes. For print-on-demand items we use Printify (Printify, Inc. and affiliated companies). Printify processes your name, delivery address, where applicable contact details and order details on our behalf and passes them on to production and shipping partners, who are selected depending on the country of delivery and may also be located outside the EU/EEA. Data is transferred to third countries only where an adequacy decision of the European Commission exists, appropriate safeguards (e.g. standard contractual clauses) are in place, or the transfer is necessary for the performance of the contract (Art. 49(1)(b) GDPR). Legal basis: Art. 6(1)(b) GDPR.

7. Newsletter (Shopify Email)
If you sign up for our newsletter, we process your e-mail address. We use the double opt-in procedure: you receive a confirmation e-mail, and only after you confirm does your subscription become effective and you receive a welcome gift. As proof, we log the time of sign-up and confirmation. The newsletter is sent via Shopify Email (processor). To the extent that open and click rates are recorded, this is done on the basis of your consent. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in every e-mail or by sending us a message.

8. Cookies and consent management
We use technically necessary cookies (shopping cart, session, checkout, security, storing your cookie choice) on the basis of Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. We load analytics and marketing technologies (Sections 9 and 10) only after you have given your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). To obtain and manage your consent, we use the app "Pandectes GDPR Compliance", which stores your choice. You can change or withdraw your consent at any time with effect for the future via the cookie banner or its settings icon in our Shop.

9. Google Analytics 4
With your consent, we use Google Analytics 4 (Google Ireland Limited, Ireland) to measure reach and to optimize the Shop. In doing so, pseudonymous usage data (e.g. pages viewed, time spent, device and browser information, approximate location) is processed. IP addresses are not stored by Google Analytics 4. Data may be transferred to Google LLC in the USA; the basis is an adequacy decision or standard contractual clauses. Event data is deleted after 2 months, and user-related data (linked to cookies, user IDs or advertising IDs) after 14 months. The 14-month period restarts when you use the Shop again. Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

10. Meta Pixel and advertising on Facebook and Instagram
With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta"). The pixel records your behaviour in the Shop (e.g. page views, product views, shopping cart, purchase). We use this data to measure the effectiveness of our ads on Facebook and Instagram (conversion measurement), to target ads to relevant interests and to build audiences (e.g. Custom Audiences). Where we use server-side transmission of events (Conversions API), event data is also sent directly from our or Shopify's server to Meta, possibly including hashed customer data such as e-mail address or telephone number. Meta may transfer data to the USA; the basis is an adequacy decision or standard contractual clauses. We and Meta are jointly responsible for the collection and transmission of the data (Art. 26 GDPR, agreement: https://www.facebook.com/legal/controller_addendum). Meta is solely responsible for any further processing by Meta (https://www.facebook.com/privacy/policy). Legal basis: Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

11. Shopify Analytics
To evaluate our Shop, we use Shopify's reports (e.g. visitors, orders, sales). Shopify processes the data on our behalf. Legal basis: Art. 6(1)(f) GDPR; where cookies that are not technically necessary are used for this purpose, only with your consent.

12. Fonts
Where our theme loads fonts from Google servers (Google Fonts), your IP address is transmitted to Google. Legal basis: Art. 6(1)(f) GDPR (consistent and appealing presentation).

13. Withdrawal function
If you withdraw from your contract using our withdrawal function, we process your name, your e-mail address, the order number, where applicable details of the items and your comment, as well as the date and time of the declaration. We will send you an acknowledgement of receipt by e-mail without delay. The function is operated with the app "EU Widerrufsbutton" (euwiderrufsbutton.de) as processor; a data processing agreement is in place. Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 356a German Civil Code (BGB), as well as Art. 6(1)(b). Requests are automatically deleted in the app after six months; documents relating to processing and refunds are retained in accordance with statutory retention periods.

14. Notice on the legal guarantee
To display the EU notice on the legal guarantee required by law, we use the app "EU Legal Guarantee & GARAN" (provider: Vitals). The graphic is loaded from the app provider's servers, and your IP address is transmitted to the provider. Legal basis: Art. 6(1)(c) and (f) GDPR.

15. Contacting us
If you contact us by e-mail, contact form or telephone, we process your details to handle your request. Legal basis: Art. 6(1)(b) or (f) GDPR. We delete the data once it is no longer required and no statutory retention obligations prevent deletion.

16. Storage periods
We store data only for as long as necessary for the purposes stated. Under commercial and tax law, business letters must be retained for 6 years (Section 257 HGB, Section 147 AO), accounting vouchers for 8 years, and books and annual financial statements for 10 years. After that, we delete the data.

17. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing under Art. 21 GDPR, in particular to processing for direct marketing. You can withdraw any consent you have given at any time with effect for the future. To do so, please contact order@projekt-nordmark.de.

18. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

19. Automated decision-making
There is no solely automated decision-making, including profiling, that produces legal effects.

20. Changes
We update this privacy policy when services or the legal situation change. The current version applies.

21. Online presences on Facebook and Instagram
We maintain a page or profile on Facebook and Instagram (Meta Platforms Ireland Limited). When you visit our page or communicate with us, Meta processes your data in accordance with its own privacy policies. We are jointly responsible with Meta for creating statistics on page usage (page insights) (Art. 26 GDPR). Legal basis: Art. 6(1)(f) GDPR.