🔒 Privacy Policy

Last updated: June 2026

1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Christians Technikshop GmbH
Jöllenbecker Str. 180
32130 Enger
Germany
Represented by the Managing Director: Vanessa Schepelmann
Phone: +49 (0) 5224 / 686 909 9
Fax: +49 (0) 5224 / 686 910 0
E-mail: info@christians-shop.de
Website: https://www.christians-shop.de
Commercial register: Local Court (Amtsgericht) Bad Oeynhausen, HRB 18027
VAT identification number: DE318177365

2. General Information on Data Processing

2.1 Scope of Processing

As a matter of principle, we only process our users' personal data to the extent necessary to provide a functional website as well as our content and services. Processing takes place on the basis of consent or a statutory permission.

2.2 Legal Bases

2.3 Storage Period and Deletion

Personal data is deleted as soon as the purpose of storage no longer applies. Longer storage may take place where this is provided for by statutory retention periods (e.g. under commercial and tax law, typically 6 or 10 years).

2.4 Recipients and Processors

Where we pass on data to service providers (e.g. hosting, payment processing, shipping), this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR or the recipient's own controllership.

2.5 Transfers to Third Countries

For individual services, a transfer to a third country (in particular the USA) may take place. We base such transfers on an adequacy decision (e.g. the EU-US Data Privacy Framework), on standard contractual clauses pursuant to Art. 46 GDPR, or on your express consent.

2.6 No Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

3. Hosting and Server Log Files

3.1 Hosting

We host our online shop with our processor netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany. The data required to provide the shop is processed on netcup's servers (e.g. inventory, contact, contract and usage data). The legal basis is Art. 6(1)(f) GDPR (secure and efficient operation) or Art. 6(1)(b) GDPR for contract-related processing. A data processing agreement pursuant to Art. 28 GDPR is in place with netcup.

3.2 Server Log Files

Each time our website is accessed, our system automatically collects data and information from the accessing computer, in particular:

• IP address (generally anonymised/truncated)
• date and time of access
• page/file accessed and volume of data transferred
• referrer URL (previously visited page)
• browser, operating system and language used

This data is stored in log files. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in delivering the website, ensuring system security and analysing errors. The log files are deleted or anonymised as soon as they are no longer required for the stated purposes.

4. Cookies and Consent Management

Our online shop, which is based on JTL-Shop 5, uses technically necessary cookies that are required for operation (e.g. a session cookie for managing the shopping cart and login, and storage of your cookie choices). The legal basis is Sec. 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.

We only use cookies and services that are not strictly necessary (e.g. embedded third-party services) with your consent via our consent banner (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future via the cookie settings.

5. Customer Account and Registration

You can create a customer account in our shop. In doing so, we process the data you provide (in particular name, address, e-mail address, access credentials). Processing takes place for the initiation and performance of a contract on the basis of Art. 6(1)(b) GDPR. You can have your customer account deleted at any time; statutory retention obligations remain unaffected.

6. Shopping Cart, Wish List and Comparison List

To use the shopping cart, wish list and comparison list, the shop stores technically necessary session data. The legal basis is Art. 6(1)(b) GDPR (use of the shop functions) or Art. 6(1)(f) GDPR.

7. Order and Contract Processing

To process your order, we process your inventory and order data (name, delivery and billing address, e-mail address, telephone number where applicable, items ordered, payment method). Where necessary, we pass this data on to commissioned shipping and payment service providers. The legal basis is Art. 6(1)(b) GDPR; for the retention of invoice data, additionally Art. 6(1)(c) GDPR.

8. Payment Processing via PayPal

If you select a payment method offered via PayPal (e.g. PayPal account, credit card, direct debit via PayPal Checkout), your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. The transfer takes place for contract performance pursuant to Art. 6(1)(b) GDPR. PayPal processes the data as an independent controller; for details, please refer to PayPal's privacy policy at https://www.paypal.com/en/legalhub/privacy-full.

Depending on the payment method and PayPal's checks, PayPal may transmit data to credit agencies (e.g. for identity and creditworthiness checks).

9. Shipping

To deliver your order, we transmit the necessary address and, where applicable, contact data to the shipping service provider commissioned by us with the delivery. The legal basis is Art. 6(1)(b) GDPR. Where your e-mail address or telephone number is transmitted for shipment tracking, this only takes place with your consent (Art. 6(1)(a) GDPR).

10. Contacting Us (Form and E-mail)

If you contact us via our contact form or by e-mail, we process the data you provide (e.g. name, e-mail address, message) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (for contract-related enquiries) or Art. 6(1)(f) GDPR (responding to general enquiries). The data is deleted as soon as it is no longer required to achieve the purpose and no retention obligations prevent deletion.

11. Spam Protection

11.1 Google reCAPTCHA

To protect against automated entries (spam), we use Google reCAPTCHA v2 on forms. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA analyses user behaviour on the basis of various characteristics (including IP address, dwell time, mouse and keyboard input) and transmits this data to Google; a transfer to the USA (Google LLC) is possible. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. Further information: https://policies.google.com/privacy.

11.2 LilFOOT SpamProtector

In addition, we use the LilFOOT SpamProtector on forms. It checks form entries for spam characteristics (e.g. by means of invisible check fields and time measurement). The check takes place locally on our website; no transfer to third parties occurs in this process. The legal basis is our legitimate interest in preventing spam pursuant to Art. 6(1)(f) GDPR.

12. Google Services

We use various services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). For these services, a transfer of data to Google LLC in the USA is possible; we base such transfers on the adequacy decision regarding the EU-US Data Privacy Framework or on standard contractual clauses (Art. 46 GDPR). General information can be found in Google's privacy policy at https://policies.google.com/privacy.

12.1 Google Ads and Conversion Tracking

We use the Google Ads online advertising programme and, in this context, what is known as conversion tracking. If you click on an ad placed by Google, a cookie for conversion tracking is stored on your device. If you then visit certain pages of our shop (e.g. the order confirmation), Google and we can recognise that you clicked on the ad and were redirected to our site. The information collected in this way is used to compile anonymised conversion statistics. We do not receive any information that would allow users to be personally identified.

12.2 Remarketing / Audiences

We use Google's remarketing function (Google Ads / Google Marketing Platform). This enables interest-based ads to be displayed on other websites within the Google advertising network to users who have already visited our shop. For this purpose, cookies or comparable technologies are used that can analyse your usage behaviour when visiting various websites and transmit it to Google.

12.3 Legal Basis and Withdrawal

The legal basis for the use of Google Ads, conversion tracking and remarketing is your consent pursuant to Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. These services are only loaded after you have given your consent in the consent banner. You can withdraw your consent at any time with effect for the future via the cookie settings. You can also deactivate interest-based advertising via Google's ad settings: https://adssettings.google.com.

12.4 Google Analytics

We use the web analytics service Google Analytics. It uses cookies and comparable technologies to analyse usage behaviour on our website (e.g. pages visited, click path, dwell time, referrer URL, approximate location as well as browser and device information). The data collected in this process can be transmitted to and processed by Google; a transfer to the USA is possible. We have activated IP anonymisation, so that your IP address is truncated by Google within the EU/EEA prior to storage. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG; you can withdraw your consent at any time via the cookie settings.

12.5 Google Tag Manager

We use Google Tag Manager to manage and integrate website tags. The Tag Manager itself does not set any cookies and does not collect personal data; it merely serves to control other services, which in turn may collect data. However, your IP address may be transmitted to Google when it loads. The services integrated via the Tag Manager are only triggered after you have given your consent in the consent banner (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG).

13. Embedded Videos (YouTube and Vimeo)

On individual pages we embed videos. These are only loaded after you have consented to the respective service in the consent banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings.

13.1 YouTube

We embed videos from the YouTube platform. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a YouTube video is played, a connection to YouTube's servers is established; in doing so, YouTube is informed of, among other things, your IP address and the page accessed, and cookies may be set. If you are logged in to YouTube at the same time, YouTube can associate your usage behaviour with your account. A transfer to the USA (Google LLC) is possible. Further information: https://policies.google.com/privacy.

13.2 Vimeo

We embed videos from the Vimeo platform. The provider is Vimeo Inc., 330 West 34th Street, 5th Floor, New York, New York 10001, USA. When a page with an embedded Vimeo video is accessed, a connection to Vimeo's servers is established; in doing so, Vimeo is informed of, among other things, your IP address and the page accessed, and cookies may be set. If you are logged in to Vimeo, Vimeo can associate your usage behaviour with your account. A transfer to the USA is possible. Further information: https://vimeo.com/privacy.

14. Newsletter via Brevo (formerly Sendinblue)

If you subscribe to our newsletter, we process the data you provide (at least your e-mail address and, where applicable, salutation and name) in order to send you information about offers and products. Subscription takes place via the double opt-in procedure: after you subscribe, you receive an e-mail in which you confirm your subscription. To document your consent, we store the time of subscription and your IP address. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

14.1 E-mail Service Provider Brevo

For sending and analysing our newsletters, we use the Brevo service. The provider is Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany. The data collected for the newsletter subscription is stored on Brevo's servers in Germany.

Brevo enables us to analyse our newsletter campaigns – for example, we can see whether a message has been opened and which links have been clicked. This allows the newsletters to be better tailored to recipients' interests. If you do not want any analysis by Brevo, you must unsubscribe from the newsletter; for this purpose, we provide an unsubscribe link in every message.

We have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR, which ensures that Brevo processes the data only in accordance with our instructions and in compliance with the GDPR. Further information can be found in Brevo's privacy policy at https://www.brevo.com/legal/privacypolicy/.

14.2 Withdrawal, Storage Period and Suppression List

You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter message or by sending us a message. The lawfulness of the processing already carried out remains unaffected. After you unsubscribe, the data stored for the newsletter subscription is deleted both by us and by Brevo.

To prevent future mailings, your e-mail address may be stored in an internal suppression list (blacklist) after you unsubscribe. This data is used exclusively for this purpose and is not combined with other data. The legal basis is our legitimate interest in a legally compliant newsletter dispatch pursuant to Art. 6(1)(f) GDPR.

15. Product Reviews

If you submit a product review, we process the data provided for this purpose (e.g. review text, display name). The legal basis is Art. 6(1)(a) GDPR.

16. Your Rights as a Data Subject

You have the following rights with regard to your personal data vis-à-vis us:

• right of access (Art. 15 GDPR)
• right to rectification (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to withdraw consent given (Art. 7(3) GDPR) with effect for the future

To exercise your rights, a message to the contact details listed under section 1 is sufficient.

17. Right to Object

Insofar as we process your data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

18. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence or of the alleged infringement. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf, Germany
Website: https://www.ldi.nrw.de

19. Validity and Changes to this Privacy Policy

This privacy policy is currently valid. As our website develops further or due to changed legal or regulatory requirements, it may become necessary to amend this policy.

Any Questions?

If you have any questions about data protection, we are happy to help – via our contact form.