PRIVACY POLICY
Version dated 19 September 2026
1. Controller
The controller responsible for processing personal data in this online shop is:
Volteva GmbH
Eiffestraße 600
20537 Hamburg
Germany
Email: info@volteva.de
Telephone: +49 1514 4209608
2. Principles and legal bases
We process personal data only where necessary to provide the shop, process orders and enquiries, comply with legal obligations or on the basis of your consent.
The principal legal bases are:
- Article 6(1)(a) GDPR for processing based on consent;
- Article 6(1)(b) GDPR for pre-contractual steps and performance of a contract;
- Article 6(1)(c) GDPR for compliance with legal obligations;
- Article 6(1)(f) GDPR for legitimate interests where these are not overridden by your interests or fundamental rights.
3. Website access and technical logs
When you access the shop, technically necessary information is processed, including IP address, date and time, page requested, referrer, browser, operating system and device information. This processing serves secure and reliable operation, troubleshooting and prevention of misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of the shop.
4. Shopify
Our shop is operated using Shopify. Shopify processes data required for operation of the shop, customer accounts, checkout and order processing on our behalf or, for certain services, as an independent controller. Data may be processed by Shopify entities outside the European Economic Area. Where required, recognised transfer mechanisms such as adequacy decisions or EU Standard Contractual Clauses are used.
Information about Shopify's processing is available at https://www.shopify.com/legal/privacy.
5. Orders and customer accounts
When you place an order or use a customer account, we process information including your name, billing and delivery address, email address, telephone number, products ordered, payment and delivery status, communications and order and return data.
Processing is carried out for pre-contractual steps and performance of the contract under Article 6(1)(b) GDPR and to comply with commercial and tax obligations under Article 6(1)(c) GDPR.
6. Payments
The data required to process payment is transmitted to the payment provider selected at checkout. Depending on your selection, this may include Shopify Payments, card companies, PayPal, Klarna, Shop Pay or Google Pay. Payment providers may process data under their own data protection responsibility. Their privacy information, available during the relevant payment process, also applies.
The legal basis is Article 6(1)(b) GDPR. Where processing is required for fraud prevention or legal checks, it may additionally be based on Article 6(1)(c) or (f) GDPR.
7. Shipping and fulfilment
For delivery, we transmit the necessary data, including name, delivery address, contact details and order information, to shipping and fulfilment providers. Where used for an order, this includes Amazon Multi-Channel Fulfillment. The relevant carrier may process data for delivery and tracking.
The legal basis is Article 6(1)(b) GDPR.
8. Invoicing and accounting
We may use easybill to create and manage invoices and credit notes. The customer, order and invoice data necessary for this purpose is processed. The legal bases are Article 6(1)(b) and (c) GDPR.
9. Shipment tracking
We may use TrackingMore and the relevant carriers to provide shipping information. Order number, tracking number, shipping status and contact information needed for notifications may be processed. The legal basis is Article 6(1)(b) GDPR. Optional tracking or analytics functions that are not required to perform the contract are activated only with your consent.
10. Contact
If you contact us by contact form, email or telephone, we process your information to handle your enquiry. Where the enquiry relates to a contract or pre-contractual steps, the legal basis is Article 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in appropriate communication under Article 6(1)(f) GDPR.
11. Newsletter
We send promotional newsletters only with your consent or where otherwise permitted by law. We normally use a confirmation process under which you confirm your subscription by clicking a link. We may store the email address, subscription and confirmation times and technical evidence of consent.
The legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time with future effect, in particular through the unsubscribe link in every newsletter. This does not affect the lawfulness of processing carried out before withdrawal.
12. Cookies and similar technologies
We use strictly necessary cookies and similar technologies so that the shop, cart, checkout, customer account, security functions and language settings work. Storage or access is based, where applicable, on section 25(2) TDDDG; subsequent processing is based, depending on the purpose, primarily on Article 6(1)(b) or (f) GDPR.
Non-essential analytics, personalisation or marketing technologies are used only with your consent. The legal bases are section 25(1) TDDDG and Article 6(1)(a) GDPR. You may change your selection or withdraw consent at any time through the cookie settings.
Details of the cookies currently used, their providers, purposes and lifetimes are shown in the cookie settings dialog.
13. Recipients and processors
Personal data is received only by parties that require it for the purposes described. These may include Shopify, payment providers, banks, shipping and fulfilment providers, IT and hosting providers, tracking and communication providers, easybill, tax advisers and public authorities where required by law.
Where providers act on our behalf, we enter into the legally required data processing agreements.
14. Transfers to third countries
Some providers may process data outside Germany or the European Economic Area. Data is transferred only where the legal requirements are met, in particular on the basis of an adequacy decision, appropriate safeguards such as EU Standard Contractual Clauses or a statutory exception.
15. Retention
We keep personal data only for as long as required for the relevant purpose. Contracts, invoices and accounting records are retained in accordance with statutory commercial and tax retention periods, typically between six and ten years depending on the type of document. Enquiries unrelated to a contract are generally deleted once finally resolved unless statutory retention duties or legitimate evidentiary interests require further retention. Data processed solely on the basis of consent is deleted or anonymised after consent is withdrawn unless another legal basis permits continued processing.
16. Required information
Information marked as required for ordering, payment and delivery is needed to conclude and perform the contract. Without it, we cannot process the order. Other information is voluntary.
17. Automated decisions
We do not make decisions based solely on automated processing that produce legal or similarly significant effects. Payment providers may use their own automated fraud prevention or credit assessment processes; their privacy information applies.
18. Your rights
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with future effect.
Where processing is based on Article 6(1)(f) GDPR, you may object at any time for reasons arising from your particular situation. You may object to processing for direct marketing at any time without stating special reasons.
To exercise your rights, contact info@volteva.de.
19. Right to complain
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our registered office is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22
20459 Hamburg
Germany
https://datenschutz-hamburg.de
20. Security and updates
We use appropriate technical and organisational measures to protect personal data. We update this Privacy Policy if our processing activities or legal requirements change. The current version published in the shop applies.
