1. Controller

The controller responsible for the processing
of personal data is:

Felix Horsch

trading as "Felix Horsch
Schuhe"

Hohenzollernstraße 12

70178 Stuttgart

Germany

E-mail: info@horsch-schuhe.de

Telephone: +49 172 7405123

2. General Information

We process personal data only to the extent
necessary to provide our online shop, to process orders, for communication, to
comply with legal obligations, or on the basis of consent. Personal data is any
information relating to an identified or identifiable natural person.

3. Hosting and Shop
Platform Shopify

The online shop is operated via Shopify.
Shopify provides the technical shop platform as well as hosting, security,
database, and administration functions. In this context, in particular IP
address, device and browser information, log data, order and account data, and
communication data may be processed. This processing serves to provide a secure
and functional online shop, to perform the contract, and to safeguard our
legitimate interest in reliable shop operations (Art. 6(1)(b), (f) GDPR). Where
data is processed outside the European Economic Area, the applicable data
protection transfer mechanisms (e.g. Standard Contractual Clauses) apply.

4. Server Log Files

When the online shop is
accessed, technically necessary data is processed. This may include the IP
address, date and time, the page accessed, referrer URL, browser type,
operating system, amount of data transferred, and status messages. This
processing serves the technical provision, stability, error analysis, and
prevention of misuse. The legal basis is generally Art. 6(1)(f) GDPR. Log data
is deleted or anonymised once it is no longer required for these purposes,
unless longer statutory or security-related retention periods apply.

5. Cookies and Similar Technologies

We use cookies and comparable
technologies within the meaning of Section 25 of the German
Telecommunications-Telemedia Data Protection Act (TTDSG). Technically necessary
technologies may be used without consent to the extent they are strictly
necessary for the expressly requested use of the shop, the shopping cart
function, login, security, or payment processing (Section 25(2) No. 2 TTDSG in
conjunction with Art. 6(1)(b), (f) GDPR). Non-essential analytics, convenience,
or marketing technologies are only used subject to your consent (Section 25(1)
TTDSG in conjunction with Art. 6(1)(a) GDPR). You may change or withdraw your
choices at any time, with future effect, via the consent management tool in
use.

6. Orders and Contract Processing

When placing an order, we
process in particular your name, billing and delivery address, contact details,
ordered items, prices, payment status, shipping information, returns and
complaints data, and, where applicable, tax and customs data. This processing
is necessary to initiate and perform the contract, to carry out payments and
deliveries, to handle enquiries, and to process warranty and reversal
procedures. The legal basis is Art. 6(1)(b) GDPR. Statutorily required
retention is based on Art. 6(1)(c) GDPR.

7. Customer Account

You may create a customer
account. In doing so, we process the master, contact, address, and account data
you provide, as well as order histories, to the extent made available in the
customer account. This processing serves to set up and manage the account and
to simplify order processing. The account may be deleted at any time, unless
statutory retention obligations or open contractual matters preclude this.

8. Contact

If you contact us by e-mail,
telephone, or via a contact form, we process your information to handle your
enquiry and any follow-up questions. For contract-related enquiries, processing
is based on Art. 6(1)(b) GDPR, otherwise generally on Art. 6(1)(f) GDPR. Where
consent is obtained, Art. 6(1)(a) GDPR applies.

9. Newsletter

When subscribing to the
newsletter, we process your e-mail address and, where applicable, your name,
subscription time, confirmation time, and technical proof-of-consent data.
Registration takes place using the double opt-in procedure. The legal basis for
sending the newsletter is your consent under Art. 6(1)(a) GDPR. Consent may be
withdrawn at any time with future effect, in particular via the unsubscribe
link in the newsletter. Proof of consent may be retained for the duration of
applicable statutory documentation obligations.

10. Payment Service Providers

For payment processing,
depending on your selection and availability, data is transmitted to payment
service providers. This may include name, address, e-mail address, invoice
amount, currency, order number, payment status, device, and transaction data. The
respective provider may process data under its own data protection
responsibility in part.

PayPal

When paying via PayPal, the data
required for payment processing is transmitted to PayPal. The legal basis is
generally Art. 6(1)(b) GDPR; statutory verification and documentation
obligations may additionally be based on Art. 6(1)(c) GDPR.

Credit Card

Credit card payments are
processed via the payment infrastructure integrated into checkout. Complete
card data is generally not stored by us. The legal basis is generally Art.
6(1)(b) GDPR; statutory verification and documentation obligations may additionally
be based on Art. 6(1)(c) GDPR.

Apple Pay

With Apple Pay, payment and
transaction data is processed in line with the technical integration between
Apple, the payment processor, and the banks involved. The legal basis is
generally Art. 6(1)(b) GDPR; statutory verification and documentation obligations
may additionally be based on Art. 6(1)(c) GDPR.

Google Pay

With Google Pay, payment and transaction data
is processed in line with the technical integration between Google, the payment
processor, and the banks involved. The legal basis is generally Art. 6(1)(b)
GDPR; statutory verification and documentation obligations may additionally be
based on Art. 6(1)(c) GDPR.

Klarna

When using a Klarna payment method, the data
required for payment verification and processing is transmitted to Klarna. The
legal basis is generally Art. 6(1)(b) GDPR; statutory verification and
documentation obligations may additionally be based on Art. 6(1)(c) GDPR.

11. Shipping Provider DHL

For delivery, we transmit the data required for
shipping, in particular name, delivery address, and shipment information, to
DHL. An e-mail address or telephone number is only transmitted where necessary
and legally permissible for delivery notifications. The legal basis is Art.
6(1)(b) GDPR; optional shipping information may be based on consent or a
legitimate interest.

12. Returns, Complaints and Customer Service

For returns and complaints, we
process order, contact, shipping, payment, communication, and, where
applicable, image data in order to carry out the return, refund, remedial
performance, or other processing. The legal basis is Art. 6(1)(b) GDPR, as well
as – for statutory obligations – Art. 6(1)(c) GDPR.

13. Fraud Prevention and Security

To prevent misuse, payment
fraud, account takeovers, and other security incidents, order, device, network,
payment, and usage signals may be processed. The legal basis is generally Art.
6(1)(f) GDPR. Our legitimate interest lies in securing the shop, protecting
customer accounts, and preventing economic damage. Automated decisions with
legal or similarly significant effects are only made under the statutory
requirements.

14. Analytics and Marketing Services

Analytics or marketing services
are only used where they are actually deployed and correctly reflected in the
consent banner. Where these are not technically necessary, processing only
takes place following consent under Art. 6(1)(a) GDPR in conjunction with
Section 25(1) TTDSG.

15. Social Media Presence

To the extent we maintain a
presence on social networks, the respective platform providers process data on
their own responsibility when you visit. If you communicate with us via a
platform, we process the data transmitted to handle your message.

16. Recipients and Processors

Data may, where necessary, be
transmitted to IT, hosting, shop, payment, shipping, communication, accounting,
tax advisory, and support service providers. Providers who process data on our
behalf are engaged in accordance with statutory requirements. Data is only
disclosed for other purposes where there is a legal basis or consent.

17. Transfers to Third Countries

Where international service
providers are used, processing may take place outside the European Union or the
European Economic Area. In such cases, the statutory requirements for transfers
to third countries are observed, such as an adequacy decision, appropriate
safeguards such as Standard Contractual Clauses, or a relevant exemption.
Details depend on the providers actually used.

18. Retention Period

We store personal data only for
as long as necessary for the respective purpose. Contract, order, and invoice
data is stored in accordance with the statutory retention periods under
commercial and tax law. Enquiries are deleted once they have been finally
resolved and no statutory or legitimate grounds for further retention exist.
Proof of consent may be retained for the duration of any applicable
documentation obligations.

19. Your Rights

You have the following rights:

●       
Access to the personal data we hold about you

●       
Rectification of inaccurate data or completion of
incomplete data

●       
Erasure, unless statutory grounds preclude this

●       
Restriction of processing

●       
Data portability, where the statutory requirements are
met

●       
Objection to processing based on legitimate interests

●       
Withdrawal of consent given, with future effect

●       
Lodging a complaint with a competent data protection
supervisory authority, e.g. the State Commissioner for Data Protection and
Freedom of Information of Baden-Württemberg (Landesbeauftragter für Datenschutz
und Informationsfreiheit Baden-Württemberg)

To exercise your rights, a
message to info@horsch-schuhe.de is sufficient.

20. Objection to Direct Marketing

Where personal data is processed
for the purpose of direct marketing, you may object to such processing at any
time. Following your objection, the data will no longer be used for direct
marketing.

21. Security

We take appropriate technical
and organisational measures to protect personal data against loss, misuse,
unauthorised access, alteration, or disclosure. Data transmission within the
shop is generally encrypted. However, absolute security cannot be guaranteed
for electronic systems.

22. Minors

Our offering is not specifically
directed at children. Orders may only be placed by persons with legal capacity
or with the consent of their legal representatives. If we become aware of
unlawfully processed data of minors, it will be deleted in accordance with
statutory requirements.

23. Changes to this Privacy Policy

We may amend this Privacy Policy
where the shop, the services used, or legal requirements change. The version
published in the online shop at the relevant time is decisive.