Privacy policy

Privacy Policy of DriveDressy GmbH

Data Controller

The data controller is:

DriveDressy GmbH, Karl-Schmid-Straße 11, 81829 Munich, Germany, Email: info@drivedressy.com

Represented by the Managing Director: Leonard Krieger

If you have any questions regarding data protection, please contact us at info@drivedressy.com.

We appreciate your interest in our online store. Protecting your privacy is very important to us. Below, we provide detailed information about how we handle your data.

1. Access Data and Hosting

You can visit our websites without providing any personal information. Each time you access a webpage, the web server automatically stores a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access.

This access data is evaluated exclusively for the purpose of ensuring the smooth operation of the site and improving our offerings. In accordance with Article 6(1)(f) of the GDPR, this serves to safeguard our legitimate interests—which prevail following a balancing of interests—in the accurate presentation of our offerings. The access data is processed by our hosting provider, Shopify, and deleted as soon as it is no longer required for the aforementioned purposes.

Hosting by Shopify

Our online store is operated on the Shopify platform. The provider for customers in Europa is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify processes, on our behalf, all data collected during the use of this website and in the online store’s forms (data processing on our behalf pursuant to Art. 28 of the GDPR).

Shopify also processes data in Canada and the U.S., as well as through other subcontractors. An adequacy decision has been issued by the European Commission for Canada. For transfers to the United States, Shopify relies on the EU-U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses (Article 46(2)(c) of the GDPR). For more information: https://www.shopify.com/de/legal/datenschutz

The legal basis is Article 6(1)(b) of the GDPR (performance of a contract) as well as our legitimate interest in the secure and efficient operation of our online store (Article 6(1)(f) of the GDPR).

Domain Management via Amazon Web Services

Our domain (drivedressy.com) is managed via Amazon Web Services. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (“AWS”). When you visit our website, the request is forwarded to the store via AWS’s servers (domain name resolution/DNS); your IP address is processed in the process. AWS acts as a data processor on our behalf (Art. 28 GDPR). To the extent that data is transferred to Amazon Web Services, Inc. in the U.S., this is done on the basis of the EU-U.S. Data Privacy Framework. The legal basis is our legitimate interest in ensuring reliable access to our website (Art. 6(1)(f) GDPR). For more information on data protection at AWS, please visit: https://aws.amazon.com/de/privacy/.

Website Protection and Delivery via Cloudflare

To protect our website from attacks, bots, and misuse, and to ensure fast and secure delivery, we use the Cloudflare service. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). All requests to our website are routed through Cloudflare’s servers. In particular, your IP address, information about your browser and device, the page accessed, and the date and time of access are processed. Cloudflare may set cookies to detect bots, which are technically necessary for the security of the website.

The legal basis is our legitimate interest in the secure and reliable operation of our website (Art. 6(1)(f) GDPR) or, for technically necessary cookies, § 25(2)(2) TDDDG. Cloudflare processes the data on our behalf (Art. 28 GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Commission’s Standard Contractual Clauses apply. Further information: https://www.cloudflare.com/de-de/privacypolicy/

2. Data Collection and Use for Contract Fulfilment, Establishing Contact, and Opening a Customer Account

We collect personal data when you voluntarily provide it to us as part of your order or when you contact us (e.g., via the contact form, seat fit check form, or email). Required fields are marked as such because, in these cases, we absolutely need the data to fulfill the contract or to process your inquiry, and you cannot complete the order or contact us without providing this information. The specific data collected is indicated on the respective input forms.

We use the data you provide in accordance with Article 6(1)(b) of the GDPR to fulfill the contract and process your inquiries. This also applies to orders for free fabric samples. Providing your phone number is mandatory when placing an order, as we absolutely need it for order fulfillment—in particular, so that we can reach you promptly in the event of last-minute questions regarding your order or delivery. To the extent that you have given your consent pursuant to Article 6(1)(a) of the GDPR by choosing to open a customer account, we use your data for the purpose of opening the customer account.

Contact Form and Vehicle Inquiries

For our contact form, the cancellation form, and vehicle inquiries, we use the Shopify app “Powerful Form Builder” provided by Globo Software, 24 Vo Chi Cong St., Cau Giay Dist., Hanoi, Vietnam (“Globo”). The data you enter (e.g., name, email address, vehicle details, your message) are processed via the app and transmitted to us by email. The provider processes the data on our behalf (Art. 28 GDPR). To the extent that data is transferred to a third country outside the EU (Vietnam) in this context, this is done on the basis of standard contractual clauses issued by the European Commission to ensure an adequate level of data protection. The legal basis for the processing is Article 6(1)(b) of the GDPR, insofar as your inquiry relates to an order or a contract; otherwise, it is our legitimate interest in responding to your inquiry (Article 6(1)(f) of the GDPR). We will delete the data as soon as your inquiry has been fully processed and there are no legal retention requirements to the contrary.

Registration as a Business Customer

To register as a business customer (B2B), we use Shopify’s “Forms” app. The data you enter (e.g., company name, contact person, contact information) is stored directly in your customer account in our store and used to verify and process your registration. The legal basis is Article 6(1), sentence 1, letter b of the GDPR.

Address Verification During the Order Process

To avoid delivery issues, we verify the address you enter during the ordering process using the Shopify app “AddressHero” provided by HeroSoftware GmbH, Walramstraße 23, 65510 Idstein, Germany. If any information is incomplete (e.g., missing house number), you will receive a notification. In this process, your address is transmitted to the service provider and processed by them on our behalf (Art. 28 GDPR). The legal basis is Art. 6(1), sentence 1, lit. b GDPR (contract fulfillment) as well as our legitimate interest in error-free delivery (Art. 6(1), sentence 1, lit. f GDPR).

After the contract has been fully fulfilled or your customer account has been deleted, your data will be restricted for further processing and deleted upon expiration of the retention periods required by tax and commercial law, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond these periods in a manner permitted by law, about which we will inform you in this statement. You may delete your customer account at any time, either by sending a message using the contact information provided below or by using the function provided for this purpose in your customer account.

3. Data Disclosure

To fulfill the contract in accordance with Art. 6(1)(b) of the GDPR, we share your data with the shipping company responsible for delivery, to the extent necessary for the delivery of ordered goods (name, shipping address). Depending on which payment service provider you select during the ordering process, we will transfer the payment data collected for this purpose to the financial institution responsible for processing the payment, to any payment service providers we have engaged, or to the selected payment service, as necessary, in order to process payments. In some cases, the selected payment service providers also collect this data themselves if you create an account with them. In this case, you must log in to the payment service provider’s platform using your login credentials during the ordering process. The privacy policy of the respective payment service provider applies in this regard.

We offer the following payment methods:

PayPal: The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy policy: https://www.paypal.com/de/legalhub/privacy-full
Credit Card (Visa, Mastercard, American Express, Maestro, UnionPay): The payment is processed via Shopify Payments, a service provided by Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Technical payment processing is handled by Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Card data is processed directly by the payment service provider; we do not receive any complete card data. Privacy policy: https://www.shopify.com/de/legal/datenschutz and https://stripe.com/de/privacy
Apple Pay: The provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Privacy policy: https://www.apple.com/de/legal/privacy/
Google Pay: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy policy: https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=de

When paying with Apple Pay or Google Pay, the terms of use and privacy policy of the respective provider with whom you have created your account also apply. The legal basis for the transfer of your payment data is Art. 6(1)(b) of the GDPR.

Disclosure of Data to Shipping Providers

If you have given us your express consent to do so during or after placing your order, we will, on this basis and in accordance with Article 6(1)(a) of the GDPR, also share your email address with the selected shipping provider so that it can contact you prior to delivery to notify you of the shipment or coordinate delivery details.

You may revoke your consent at any time by sending a message to the contact information provided below or directly to the shipping service provider at the contact address listed. Upon revocation, we will delete the data you provided for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use your data beyond this scope, which is permitted by law and about which we inform you in this statement.

We work with the following shipping service providers:

Deutsche Post AG (DHL), Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany, Email: impressum.paket@dhl.com
DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg, Germany, Privacy Policy: https://www.dpd.com/de/de/datenschutz/

Shipping of Fabric Samples via Fillsend

An external fulfillment service provider handles the shipping of our fabric samples: Fillsend, a brand of SR Regensburger GmbH, Jägerbergstraße 3, 93173 Wenzenbach, Germany. When you order fabric samples, your name, shipping address, contact information, and order details are automatically transmitted from our store to Fillsend via the “FFN Connect” interface so that Fillsend can package and ship the fabric samples. Fillsend processes the data on our behalf (Art. 28 GDPR). The legal basis is Article 6(1)(b) of the GDPR (performance of a contract).

Other Data Processors

For inventory management and order fulfillment, we use the Xentral ERP system provided by Xentral ERP Software GmbH, Fuggerstraße 11, 86150 Augsburg, Germany. In particular, your order, contact, and shipping information is processed. Xentral processes the data exclusively on our behalf and in accordance with our instructions (Art. 28 GDPR). The legal basis is Article 6(1), first sentence, letter b of the GDPR (contract performance).

For importing and exporting store data (e.g., product data, customer survey analyses), we use the Shopify app “Matrixify” provided by SIA “ITissible,” Antonijas iela 24-7, Riga, LV-1010, Latvia. This may also involve the processing of customer data. The provider processes the data exclusively on our behalf (Article 28 of the GDPR). The legal basis is our legitimate interest in the efficient management of our store (Article 6(1), first sentence, subparagraph (f) of the GDPR).

Live Chat

We offer a live chat feature on our website through which you can ask us questions. For this purpose, we use LiveChat provided by Text S.A., ul. Zwycięska 47, 53-033 Wrocław, Poland. When you use the chat, we process the messages you enter, as well as your name and email address (if applicable), and technical data such as your IP address and the page you visited. The legal basis is Article 6(1)(b) of the GDPR, insofar as your inquiry relates to an order or a contract; otherwise, it is our legitimate interest in responding to your inquiry (Article 6(1)(f) of the GDPR). To the extent that the chat tool sets cookies that are not technically necessary, this is done only with your consent (Section 25(1) TDDDG). The provider processes the data on our behalf (Article 28 of the GDPR). To the extent that data is processed on servers outside the EU (e.g., in the U.S.), this is done on the basis of standard contractual clauses adopted by the European Commission. Further information: https://www.text.com/legal/privacy-policy/ We delete chat histories as soon as they are no longer needed to process your inquiry.

If you have given your consent in the cookie banner, our team can also see in the chat which page you are currently viewing and which items are in your shopping cart, so that they can provide you with more targeted advice. The legal basis for this is your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG), which you can revoke at any time via the cookie settings.

4. Email Newsletter & Customer Data Management (Klaviyo)

Email Marketing via Newsletter Subscription

When you subscribe to our newsletter—for example, via a sign-up form on our website or by checking the box during the ordering process—we use the data required for this purpose or data you have provided separately to send you our email newsletter on a regular basis based on your consent in accordance with Art. 6(1), sentence 1, lit. a GDPR.

We use the so-called double opt-in procedure for registration: After you sign up, you will receive an email asking you to confirm your subscription. You will only receive the newsletter after you have confirmed your subscription. We store the time of registration and confirmation, as well as your IP address, to be able to verify your consent.

You can unsubscribe from the newsletter at any time, either by sending a message to the contact information provided below or by clicking a link provided for this purpose in the newsletter. After you unsubscribe, we will remove your email address from the recipient list, unless you have expressly consented to further use of your data or we reserve the right to use your data for other purposes that are permitted by law and about which we inform you in this statement.

Newsletter and Customer Data Management via Klaviyo

We use Klaviyo to send our newsletter and manage our customer data. The provider is Klaviyo, Inc., 125 Summer St, Floor 6, Boston, MA 02110, USA. Klaviyo is a service that, among other things, allows us to organize and analyze the distribution of newsletters. When you enter data for the purpose of subscribing to the newsletter (e.g., email address), this data is stored on Klaviyo’s servers.

In addition, Klaviyo is connected to our online store. In this process, our customers’ data from orders and customer accounts is transmitted to Klaviyo, specifically name, email address, phone number, mailing address, and details about ordered products. This applies regardless of whether you have subscribed to our newsletter. We use this data to centrally manage our customer data and to send you order-related information. You will only receive promotional messages via email or WhatsApp if you have consented to them. The legal basis is Article 6(1)(b) of the GDPR (performance of a contract) as well as our legitimate interest in efficient customer management (Article 6(1)(f) of the GDPR).

Klaviyo processes data on our behalf (Article 28 of the GDPR) and also in the United States. Klaviyo is certified under the EU-U.S. Data Privacy Framework; in addition, we have agreed to the EU Commission’s Standard Contractual Clauses.

We use Klaviyo to analyze our newsletters. When you open an email sent via Klaviyo, a file contained in the email (known as a web beacon) connects to Klaviyo’s servers. This allows us to determine whether and when you opened a message and which links you clicked on. In addition, technical information is collected (e.g., time of access, IP address, browser type, and operating system). This information is assigned to your recipient profile and is used to better tailor our newsletters to your interests.

If you have given your consent in the cookie banner, Klaviyo also tracks which pages and products you view in our online store and whether you add items to your shopping cart. We use this information to send you relevant content (e.g., reminders about an unfinished purchase). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

Data processing for the purpose of sending the newsletter and analyzing its performance is based on your consent (Article 6(1)(a) of the GDPR). You may revoke this consent at any time by unsubscribing from the newsletter. We provide a link for this purpose in every newsletter message. The lawfulness of data processing operations that have already taken place remains unaffected by the revocation.

After you unsubscribe from the newsletter, we will remove your email address from the newsletter distribution list and block it from receiving further promotional emails. Data that we have stored for other reasons (e.g., from your orders or your customer account) remains unaffected by this and will be deleted as soon as it is no longer necessary and there are no legal retention obligations preventing its deletion.

For more details, please refer to Klaviyo’s Privacy Policy at: https://www.klaviyo.com/privacy

5. Communication via WhatsApp

During the ordering process, you can use a separate, optional checkbox to consent to us contacting you via WhatsApp. We will then send you updates on shipping status, responses to service inquiries, as well as news and exclusive offers. The checkbox is not preselected; you can place your order even without giving this consent.

For this purpose, we process your cell phone number, your name, details about your order, and the content of the messages exchanged. We store your consent along with the date and time it was given so that we can verify it. The legal basis is your consent pursuant to Art. 6(1)(a) of the GDPR and § 7(2)(2) of the UWG.

We organize the sending of messages via Klaviyo (Klaviyo, Inc., 125 Summer St, Floor 6, Boston, MA 02110, USA), which processes the data on our behalf (Art. 28 GDPR; for data transfers to the U.S., see Section 4). The messages are delivered via the WhatsApp Business service. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. In this context, data may also be transferred to Meta Platforms, Inc. in the U.S.; this transfer is based on the EU-U.S. Data Privacy Framework and on the European Commission’s Standard Contractual Clauses. For more information: https://www.whatsapp.com/legal/business-policy

You may revoke your consent at any time with future effect by sending us an email to info@drivedressy.com. We will then delete your consent and will no longer send you WhatsApp messages. Once we start sending messages via WhatsApp, you can also withdraw your consent by replying to one of our messages with “STOP.” We will store your data for this purpose until you withdraw your consent. The lawfulness of the processing carried out prior to withdrawal remains unaffected.

6. Cookies, Consent Management, and Web Analytics

To make your visit to our website more engaging and to enable the use of certain features, to display relevant products, or for market research, we use so-called cookies and similar technologies on various pages.

We use technically necessary cookies (e.g., for the shopping cart, checkout, and saving your cookie settings) based on Section 25(2)(2) of the TDDDG and Article 6(1)(f) of the GDPR. We use all other cookies and technologies—in particular for web analytics and marketing—only if you have consented to their use (Section 25(1) of the TDDDG in conjunction with Article 6(1), first sentence, letter a of the GDPR).

Cookies are small text files that are stored on your device and saved by your browser. Some cookies contain a so-called cookie ID, a unique identifier that allows your browser to be recognized. Some cookies are deleted at the end of the browser session (session cookies), while others remain on your device and enable us to recognize your browser on your next visit (persistent cookies).

You can configure your browser to notify you when cookies are set, to decide on a case-by-case basis whether to accept them, or to block cookies in specific cases or generally. Instructions on how to do this are available in your browser’s help menu. Please note that rejecting cookies may affect the functionality of our website.

Consent Management (Cookie Banner)

When you first visit our website, we ask for your consent via a cookie banner. For this purpose, we use the Shopify app “Consentmo.” We also use this app to manage Google Consent Mode (Version 2): Google services (Google Analytics, Google Ads) receive information about the purposes to which you have consented and process data in accordance with your selection. Your selection, the time of your selection, and an anonymous identifier are stored so that we can verify your decision and take it into account during future visits. The legal basis is Art. 6(1)(c) of the GDPR (duty to provide evidence) in conjunction with Art. 7(1) of the GDPR. You can change or withdraw your consent at any time via the “Cookie Settings” link in the footer.

Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tool we use to manage tracking and marketing codes (so-called “tags”) on our website. It does not set any cookies itself and does not analyze user data; however, when the page loads, your IP address is transmitted to Google. The services integrated via Tag Manager are triggered only in accordance with your selection in the cookie banner. The legal basis for the use of Tag Manager is our legitimate interest in the efficient management of our website (Art. 6(1)(f) GDPR). To the extent that data is transferred to Google LLC in the U.S., this is done on the basis of the EU-U.S. Data Privacy Framework.

Google Analytics 4

To the extent that you have given your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG), we use Google Analytics 4 to analyze the use of our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The integration is carried out via the Shopify app “Google & YouTube,” which connects our store to Google Analytics, Google Ads, and the Google Merchant Center. Google Analytics uses cookies and similar technologies to track, for example, pages visited, time spent on the site, devices used, approximate location data, and interactions on our website. According to Google, IP addresses are not stored in Google Analytics 4.

The data may also be transferred to servers operated by Google LLC in the United States. Google LLC is certified under the EU-US Data Privacy Framework. The data is deleted after 14 months. You can withdraw your consent at any time via the cookie settings. For more information: https://policies.google.com/privacy

Microsoft Clarity

Provided you have given your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG), we use the web analytics software Microsoft Clarity for our website. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Microsoft Clarity is a tool that allows companies to assess the user-friendliness of their websites. To do this, Microsoft Clarity records user sessions (e.g., mouse movements, clicks, scrolling behavior, pages visited) and uses this data to generate heat maps and analytics. We use these to identify issues with the usability of our website and to improve it.

Clarity is integrated into our online store via a code snippet and uses cookies to associate page views with a specific session. Entries in form fields (e.g., name, email address, mailing address, or chat messages) are automatically anonymized (masked) by Clarity and are not transmitted to Microsoft. Clarity also detects automated traffic (bots) and excludes it from the analytics.

Clarity is linked to our Google Analytics, so that analytics from both services can be reconciled with one another.

Microsoft also processes data in the United States. Microsoft Corporation is certified under the EU-US Data Privacy Framework; in addition, Microsoft uses the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) of the GDPR). To the best of our knowledge, Microsoft deletes records after approximately 30 days, unless we store them separately. You can withdraw your consent at any time via the cookie settings.

You can learn more about the data processed through the use of Microsoft in the privacy policy at: https://privacy.microsoft.com/de-de/privacystatement

7. Online Marketing

Google Ads (Remarketing and Conversion Tracking)

We use Google Ads to advertise this website in Google search results and on third-party websites. If you have given your consent for this (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG), Google sets a so-called remarketing cookie when you visit our website, which automatically enables interest-based advertising using a pseudonymous cookie ID and based on the pages you have visited. In addition, we use Google Ads conversion tracking to measure whether users, for example, complete a purchase after clicking on an ad. In doing so, we use “Enhanced Conversions”: After a purchase, your email address and, if applicable, your phone number, first and last name, and address are transmitted to Google in encrypted (hashed) form so that Google can associate the purchase with an ad. This integration is carried out via the Shopify app “Google & YouTube.”

We also use this same app to transmit our product data (e.g., items, prices, availability) to the Google Merchant Center so that our products can appear in Google Shopping and in ads. No personal data about you is transmitted in this process.

Any further data processing takes place only if you have consented to Google linking your web and app browsing history to your Google Account and using information from your Google Account to personalize ads. In this case, if you are signed in to Google while visiting our website, Google uses your data in conjunction with Google Analytics data to create audience lists for cross-device remarketing.

Google Ads is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. To the extent that information is transferred to servers operated by Google LLC in the United States, this is done in accordance with the EU-U.S. Data Privacy Framework, under which Google LLC is certified. You may revoke your consent at any time via the cookie settings. You can also disable personalized ads at https://adssettings.google.com. Once the purpose has been fulfilled and we have ceased using Google Ads, the data collected in this context will be deleted.

Meta Pixel and Conversions API

To the extent that you have provided your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG), we use the Meta Pixel and the Conversions API on our website. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). These are integrated via the Shopify app “Facebook & Instagram.”

This allows us to track users’ behavior after they have viewed or clicked on one of our ads on Facebook or Instagram (e.g., page views, shopping cart activity, purchases). This enables us to measure the effectiveness of our ads and display ads on Facebook and Instagram that match your interests (remarketing). With the Conversions API, these events are also transmitted directly from our server to Meta.

In particular, the following data may be transmitted to Meta: IP address, browser information, pages visited, and purchase information, as well as—in encrypted (hashed) form—your email address, phone number (if applicable), first and last name, ZIP code, city, country, and a customer ID.

We and Meta are jointly responsible for the collection and transmission of data to Meta (Art. 26 GDPR). The agreement concluded for this purpose can be found at: https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for further processing. Data may also be transferred to Meta Platforms, Inc. in the U.S.; Meta is certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time via the cookie settings. For more information: https://www.facebook.com/privacy/policy

Pinterest Tag

Provided that you have given your consent (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG), we use the Pinterest Tag on our website. The provider is Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (“Pinterest”). This allows us to measure the effectiveness of our ads on Pinterest and display relevant advertisements to you there. In particular, your IP address, browser information, pages visited, and purchase information—as well as your email address, if applicable—are transmitted in encrypted (hashed) form. To the extent that data is transferred to Pinterest, Inc. in the U.S., this is done on the basis of the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. You can revoke your consent at any time via the cookie settings. For more information: https://policy.pinterest.com/de/privacy-policy

8. Display of Google Reviews

We display reviews on our website that customers have submitted about DriveDressy via Google. For this purpose, we use the Shopify app “Google Reviews” provided by Reputon OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Vesivärava tn 50-201, 10152, Estonia. When the review widget loads, the review texts as well as the names and profile pictures of the reviewers are retrieved from servers operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In the process, your IP address is transmitted to Google. The legal basis for this is our legitimate interest in displaying customer reviews (Art. 6(1)(f) GDPR). To the extent that data is transferred to Google LLC in the United States, this is done on the basis of the EU-U.S. Data Privacy Framework.

9. Social Media

Our online presence on Facebook, YouTube, Instagram, Pinterest, TikTok, Xing, and LinkedIn

Our presence on social networks and platforms serves to facilitate better, active communication with our customers and prospective customers. There, we provide information about our products and current special promotions.

When you visit our social media profiles, your data may be automatically collected and stored for market research and advertising purposes. Using pseudonyms, so-called usage profiles are created from this data. These may be used, for example, to display advertisements—both on and off the platforms—that are presumed to match your interests. For this purpose, cookies are generally used on your device. In accordance with Article 6(1)(f) of the GDPR, this serves to safeguard our legitimate interests—which prevail following a balancing of interests—in the optimized presentation of our offerings and effective communication with customers and prospective customers. If you are asked by the respective platform operators to provide consent—for example, via a checkbox—the legal basis for data processing is Article 6(1)(a) of the GDPR.

To the extent that the aforementioned platforms transfer data to the United States, this is done on the basis of the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. You can check whether a company is certified at https://www.dataprivacyframework.gov/list.

For detailed information on the processing and use of data by the providers, as well as contact information, your rights, and settings options—particularly opt-out options—please refer to the providers’ privacy policies linked below. If you still need assistance in this regard, please contact us.

Facebook: https://www.facebook.com/privacy/policy – Data processing is based on an agreement between joint controllers pursuant to Art. 26 of the GDPR: https://www.facebook.com/legal/terms/page_controller_addendum
Google/YouTube: https://policies.google.com/privacy?hl=de
Instagram: https://privacycenter.instagram.com/policy
Pinterest: https://policy.pinterest.com/de/privacy-policy
TikTok: https://www.tiktok.com/legal/privacy-policy-eea
LinkedIn: https://www.linkedin.com/legal/privacy-policy
Xing: https://privacy.xing.com/de/datenschutzerklaerung

Opt-out option:

Facebook/Instagram: https://www.facebook.com/settings?tab=ads
Google/YouTube: https://adssettings.google.com
Pinterest: https://www.pinterest.de/settings
TikTok: https://www.tiktok.com/setting (Settings → Privacy → Ads)
LinkedIn: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
Xing: https://privacy.xing.com/de/datenschutzerklaerung/welche-rechte-koennen-sie-geltend-machen/widerspruchsrecht

10. Retention Period

Unless a more specific retention period is stated in this Privacy Policy, we store your personal data only for as long as necessary for the respective purpose. If the processing is based on your consent, we store the data until you revoke your consent. Statutory retention requirements (in particular under commercial and tax law, generally six or ten years) remain unaffected; in this case, processing will be restricted and the data will be deleted upon expiration of the retention periods.

11. Contact Information and Your Rights

As a data subject, you have the following rights:

pursuant to Art. 15 of the GDPR, the right to request information about your personal data processed by us to the extent specified therein;
pursuant to Article 16 of the GDPR, the right to request, without undue delay, the rectification of inaccurate personal data or the completion of your personal data stored by us;
pursuant to Article 17 of the GDPR, the right to request the erasure of your personal data stored by us, unless further processing is necessary to exercise the right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims;
pursuant to Article 18 of the GDPR, the right to request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data, but you need it to assert, exercise, or defend legal claims, or you have objected to the processing pursuant to Article 21 of the GDPR;
pursuant to Article 20 of the GDPR, the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller;
pursuant to Article 7(3) of the GDPR, the right to withdraw your consent at any time with future effect. The lawfulness of the processing carried out prior to the withdrawal remains unaffected;
pursuant to Article 77 of the GDPR, the right to lodge a complaint with a supervisory authority. As a general rule, you may contact the supervisory authority at your usual place of residence, place of work, or our corporate headquarters. The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, https://www.lda.bayern.de

If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to request information, correction, restriction, or deletion of data, as well as to revoke consent you have given or object to a specific use of your data, please contact us directly at info@drivedressy.com or via the contact information provided in our legal notice. We have not appointed a data protection officer, as there is no legal obligation to do so.

Right to Object

To the extent that we process personal data as described above to safeguard our legitimate interests that prevail following a balancing of interests, you may object to this processing with effect for the future. If the processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. If the processing is carried out for other purposes, you have the right to object only if there are grounds arising from your particular situation.

Once you have exercised your right to object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the processing is necessary for the establishment, exercise, or defense of legal claims.

This does not apply if the processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for this purpose.

Effective: October 6, 2026