Privacy Policy
1. Controller
Alex Trupp ATE-Commerce
Vahrenwalderstr. 213
30165 Hannover
Germany
E-mail: a.trupp@ate-commerce.de
2. Hosting / Shop System
Our online shop is operated on the Shopify platform (Shopify International Limited). When you visit the shop, technically necessary data are processed in order to provide the shop. The legal basis is Art. 6(1)(f) GDPR.
3. Server Log Files
Each time the shop is accessed, information is collected automatically (including IP address, date/time, page accessed, browser type), which is processed for technical and security reasons (Art. 6(1)(f) GDPR).
4. Cookies and Consent
We use cookies. Non-essential cookies are set only with your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You may withdraw your consent at any time.
5. Order Processing
To process your order, we process the data you provide (name, address, e-mail address and, where applicable, telephone number). The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
6. Payment Service Providers
For payment processing, we disclose your payment data to the payment service provider you have selected (e.g. Klarna, PayPal; Art. 6(1)(b) GDPR).
7. Shipping Service Providers
For delivery, we disclose your address data to the shipping, freight forwarding or logistics company commissioned (Art. 6(1)(b) GDPR).
8. Your Rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a data protection supervisory authority.
9. Objection to Advertising
You may object at any time to the use of your contact data for advertising purposes.
10. Google Analytics 4
Insofar as you have given your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies or comparable technologies to analyse the use of our shop (including pages accessed, approximate location, device/browser data). The IP address is processed in truncated/anonymised form. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time with effect for the future.
A transfer to the USA (Google LLC) cannot be ruled out; such transfers are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Details: policies.google.com/privacy.
11. Google Ads (Conversion Tracking & Remarketing)
Insofar as you have given your consent, we use Google Ads provided by Google Ireland Limited to measure the success of our advertisements (conversion tracking) and to display interest-based advertising to you (remarketing). Cookies are set for this purpose. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which may be withdrawn at any time. With regard to data transfers to the USA, the statements made under Section 10 apply accordingly.
12. Google Search Console
We use Google Search Console for the technical analysis of our visibility in Google Search. In doing so, no cookies are set on your device; the analysis is based on aggregated search statistics provided by Google. Consent is not required for this; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
13. Meta Pixel and Conversions API (Facebook, Instagram)
Insofar as you have given your consent, we use the Meta Pixel and the Conversions API provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). This enables us to measure the success of our advertisements on Facebook and Instagram and to display interest-based advertising to you there (remarketing). Events in our shop are recorded, such as page views, product views, additions to the shopping cart and completed orders (including order value), as well as device and browser data. The data are transmitted via cookies or comparable technologies in your browser (Meta Pixel) and, additionally, directly from our shop server to Meta (Conversions API); in this process, contact data such as your e-mail address or telephone number may be transmitted in encrypted (hashed) form so that Meta can match the events to a Meta user account.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time with effect for the future. Without your consent, neither is the Meta Pixel loaded nor are any data transmitted to Meta via the Conversions API.
We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR); the corresponding agreement is available at facebook.com/legal/controller_addendum. Meta is solely responsible for any subsequent processing. A transfer to the USA (Meta Platforms, Inc.) cannot be ruled out; such transfers are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Details: facebook.com/privacy/policy.
14. AI Chat (Customer Advice in the Shop)
In our shop, you can submit questions to a chat that is answered by artificial intelligence (AI). We expressly point this out in the chat window. Use of the chat is voluntary; you may also contact us at any time by e-mail at info@loftandlys.com. Merely visiting our pages does not result in any data being transmitted to the chat service; data are transmitted only once you send a message in the chat window. The chat does not set any cookies; the conversation history is stored in your browser's memory (sessionStorage) only for the duration of your visit so that the conversation is preserved when you switch pages.
Data processed: your chat messages and the responses, the language and the shop page on which you use the chat, as well as an encrypted (hashed) identifier of your IP address for protection against misuse; this identifier changes daily and does not permit any inference as to the IP address. If you ask about the status of an order, we process the order number and e-mail address you provide in order to identify you as the person who placed the order. If you request a response from our team, we additionally process your name (voluntary), your e-mail address and the chat history. Please do not enter any payment data or other sensitive data in the chat.
Purpose and legal basis: answering your questions about products, delivery and orders, the implementation of pre-contractual measures and the performance of the contract (Art. 6(1)(b) GDPR), as well as our legitimate interest in providing prompt customer advice and in protecting the chat against misuse (Art. 6(1)(f) GDPR). The storage of the conversation history in your browser is strictly necessary for the chat function requested by you (Section 25(2) No. 2 TDDDG).
Recipients: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, as provider of the AI model; Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, for the operation of the chat service; Supabase Pte. Ltd., Singapore, for the storage of the chat history in our customer service system, with storage taking place on servers in the EU (Sweden); in the case of a response by e-mail, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data processing agreements (Art. 28 GDPR) are in place with these providers.
Transfers to third countries: For Anthropic (USA), transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) agreed in the data processing agreement. EU Standard Contractual Clauses have likewise been agreed with Supabase (Singapore); the chat histories are stored on servers in the EU. Cloudflare is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Anthropic is contractually bound not to use your chat content to train AI models.
No automated decision-making: The chat does not make any decisions that produce legal effects concerning you (Art. 22 GDPR); binding information, offers and the conclusion of contracts are provided or effected exclusively via the shop or by our team.
Storage period: We automatically delete chat histories after 90 days. If a chat results in an enquiry to our team, we retain it in the same manner as an e-mail enquiry or for as long as required by statutory retention obligations.
Your rights: see Section 8.