Datenschutzerklärung
Controller
The controller under the GDPR is:
Walter Palm
trading as Fashion Kontor / Bags Kontor
Königsplatz 27
91126 Schwabach
Germany
Email: bagskontor@gmail.com
Telephone: +49 151 41469775
Fashion Kontor and Bags Kontor are Walter Palm's trading names, not separate controllers.
Data and purposes
Depending on use, we process identity and contact details, billing and delivery addresses, order and contract data, payment status and transaction identifiers, account and communication data, returns and defects information, and technical data such as IP address, device, browser, timestamps, security and cookie identifiers. Full card or wallet credentials are normally provided directly to the payment provider and are not fully disclosed to us.
Data necessary for orders, payment, delivery, withdrawal, returns, refunds, conformity rights and customer service is processed under Article 6(1)(b) GDPR. Legally required records use Article 6(1)(c). General non-contract enquiries use Article 6(1)(f); our legitimate interest is answering and administering enquiries.
Shopify
Shopify supplies hosting, storefront, checkout, account, order-management and security functions and processes customer, order, device, usage and transaction data. European services generally involve Shopify International Limited, affiliates and subprocessors. Shopify acts as processor for certain activities and may be an independent controller for its own activities. Legal bases are Article 6(1)(b) for contracts and Article 6(1)(f) for secure and efficient shop operation. Optional personalisation, analytics or advertising requiring consent is based on Article 6(1)(a) GDPR and section 25(1) TDDDG only after consent. See https://www.shopify.com/legal/privacy/consumers.
Payments
Checkout may offer Shopify Payments/cards, PayPal, Apple Pay, Google Pay and Shop Pay. Required order, identity, billing and transaction data is shared with the selected provider under Article 6(1)(b) GDPR. Fraud and security checks may use Article 6(1)(f) or provider legal obligations. Providers may act as independent controllers. PayPal is generally provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Apple Pay and Google Pay use device and provider tokenisation; Shop Pay is a Shopify service.
Manufacturers, fulfilment and shipping
Required data is shared with the relevant partner manufacturer or fulfilment provider in Italy and the carrier, including name, delivery address, necessary contact details, order reference and products. The basis is Article 6(1)(b) GDPR. For deliveries outside the EEA, data may be transferred to destination carriers, customs or fulfilment providers where necessary to perform the requested contract, potentially under Article 49(1)(b) GDPR.
Cookies and tracking
Necessary technologies provide the cart, checkout, login, security, payment and privacy settings. End-device access relies on section 25(2) TDDDG, with subsequent processing under Article 6(1)(b) or (f) GDPR. Optional analytics, personalisation or advertising requires consent under section 25(1) TDDDG and Article 6(1)(a) GDPR. Consent can be changed through Cookie Settings.
Based on the information used for this version, Google Analytics, Google Ads tracking and Meta Pixel are not active. If enabled, this policy and consent tool must be updated first. The consent tool must show the current technologies, providers, purposes and durations.
Newsletter
No newsletter is currently operated. The existing footer signup form must be removed or fully disabled before this policy is published so it does not collect data without a defined purpose. If newsletters are introduced later, provider, consent, measurement, withdrawal and retention information must be added first.
Recipients and international transfers
Where necessary and lawful, recipients include IT/hosting providers, payment and fraud services, manufacturers and fulfilment partners, carriers, professional advisers, authorities and courts. Processors act on documented instructions. Shopify, payment providers or subprocessors may process outside the EEA. In the absence of an adequacy decision, Standard Contractual Clauses and supplementary safeguards are generally used; a GDPR Article 49 derogation may apply in individual cases.
Retention
Data is retained only as necessary. Order, invoice, payment and accounting records are kept for German commercial and tax periods, generally six to ten years depending on document type. Contract and conformity records may be kept until limitation periods expire and longer only for concrete disputes. General enquiries are deleted after resolution unless retention or legal defence is needed. Accounts remain until deletion, subject to legal retention. Security logs are kept briefly unless an incident requires longer retention. Consent and preference evidence is kept as long as needed to demonstrate lawfulness.
Required data and automated decisions
Checkout-required data is necessary to conclude and perform the contract. Without it, the order cannot be completed. Bags Kontor makes no solely automated decision with legal or similarly significant effect under Article 22 GDPR. Payment or fraud providers may conduct their own automated risk assessments and provide their own notices.
Your rights
Subject to legal conditions, you have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent under Articles 15-21 and 7(3) GDPR. Where processing relies on legitimate interests, you may object for reasons relating to your situation. Direct-marketing processing may be opposed at any time. Contact bagskontor@gmail.com; reasonable identity verification may be requested.
Complaints, security and changes
You may complain to a supervisory authority. The authority generally competent for private businesses in Bavaria is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de. We use appropriate technical and organisational security measures but cannot guarantee risk-free transmission or storage. This policy will be updated when processing, providers or law changes.