Privacy policy

Please note: This is a non-binding translation. The German version is legally binding.

1. Data Controller

Julian Sekora, Süderstraße 33, 24955 Harrislee, Germany, email hallo@walleria.de.

2. Overview

We only process personal data to the extent necessary to operate the shop and process orders, or if you have given your consent. The legal bases are Art. 6(1)(b) GDPR (contract and pre-contractual measures), (c) (legal obligations, e.g. retention), (f) (legitimate interests, e.g. security and fraud prevention), and (a) (consent). Section 25 TDDDG applies to the storage and retrieval of information on your end device.

3. Shop System and Hosting (Shopify)

Our online shop runs on the Shopify platform provided by Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify provides the shop, hosts it, and processes the data generated during visits and orders on our behalf: IP address, browser and device details, pages visited, cart, order, contact, and delivery details. We have a data processing agreement with Shopify in accordance with Art. 28 GDPR. The storage location is set to the European Union; however, Shopify may additionally transfer data to Shopify Inc. in Canada (EU Commission adequacy decision) and to sub-processors in other countries, particularly the USA. This is based on the EU-U.S. Data Privacy Framework or the EU Commission's Standard Contractual Clauses. The legal basis is Art. 6(1)(b) and (f) GDPR (operation of a secure, functional shop).

Shopify also processes certain data under its own responsibility, for example to prevent fraud, ensure the security of its services, and – if you use them – for Shop Pay and the Shop App. You can find more details in Shopify's privacy policy at shopify.com/de/legal/datenschutz.

4. Ordering and Personalisation

To process your order, we process your name, address, email address, phone number (if applicable), and the personalisation details you enter in the shop (e.g. names, dates, custom texts) or upload (e.g. ultrasound image or pet photo). This data is required to fulfil the contract (Art. 6(1)(b) GDPR). An ultrasound image can allow conclusions to be drawn about a pregnancy and is therefore considered health data (Art. 9 GDPR); we only process it based on your explicit consent, which you grant via a checkbox when uploading (Art. 9(2)(a) GDPR) and can withdraw at any time with future effect by emailing hallo@walleria.de. Uploaded images are initially stored with Shopify and transferred to our storage at Supabase (Section 10) for production; we delete them 30 days after shipping or the provision of your files. We retain invoice and order data for 10 years due to commercial and tax law obligations (Section 147 AO, Section 257 HGB). Personalisation details (names, dates, custom texts) we delete from our order database 90 days after delivery, unless they are part of the invoice data that must be retained. We receive internal notifications about new orders (name, address, email address, personalisation, print file) in a business email inbox at Apple (iCloud Mail, Apple Distribution International Ltd., Ireland; Art. 6(1)(b) and (f) GDPR). A customer account is not required.

5. Payment Processing

Shopify Payments: We process payments by credit or debit card, Apple Pay, Google Pay, and – where offered – Klarna via Shopify Payments. The service provider in the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland, together with Shopify. The data required for payment (name, email address, billing address, amount, payment method) is transmitted; card details are processed exclusively by the payment service provider and are not visible to us. If you pay with Klarna, Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, will also process your data, including for identity and credit checks in accordance with their own privacy policy.

PayPal: If you choose PayPal, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal receives your name, address, email address, and order amount, and processes the data in accordance with its own privacy policy (paypal.com/de/legalhub/privacy-full).

The legal basis is Art. 6(1)(b) GDPR; fraud prevention checks by payment service providers are based on Art. 6(1)(f) GDPR.

6. Shipping

For printed posters, we create shipping labels using Sendcloud (Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, Netherlands; data processing in accordance with Art. 28 GDPR) and hand the shipment over to DHL / Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn. For this purpose, we transmit your name and delivery address (Art. 6(1)(b) GDPR). We will only pass your email address on to DHL for parcel notifications if you have given your consent.

7. Creation of Print and Download Files

We generate the print and download files automatically from your personalisation details. The calculation runs on servers of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA (GitHub Actions); only the details that appear on the poster and, if applicable, your uploaded image are processed. The transfer to the USA is based on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses; we have a data processing agreement with GitHub. The finished files are stored in our storage at Supabase (Section 10). The legal basis is Art. 6(1)(b) GDPR.

8. Emails and Review Requests

Order and shipping confirmations are sent by Shopify. We send download links and production updates via Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin); we have a data processing agreement with Brevo, and processing takes place in the EU (Art. 6(1)(b) GDPR).

Review request: A few days after your purchase, we will send you a one-off email asking you to review the purchased poster (Art. 6(1)(f) GDPR, Section 7(3) UWG; our interest is honest feedback and improving our range). You can object to this at any time – by clicking the link in the email, with a short reply, or by messaging hallo@walleria.de, without incurring any costs other than the transmission costs according to the basic rates. Following an objection, we will store your email address on a blocklist so that we do not contact you again (Art. 6(1)(c) and (f) GDPR).

Thank-you voucher: A few minutes after your order, we send you a personal discount code for a further order with us by email, once (Art. 6(1)(f) GDPR, Section 7(3) German Unfair Competition Act (UWG); our interest is advertising our own similar products). For this we create the code in our Shopify account and store the order number, code and sending status for a maximum of 90 days. You can object at any time – as with the review request above, free of charge apart from the transmission costs at basic rates.

Consent for digital files: If you order digital files, you confirm in the cart via a checkbox that we may deliver immediately (Section 356(5) BGB). We store the time and wording of this consent as proof with the order (Art. 6(1)(b) and (c) GDPR).

9. Newsletter

Sign-up and content: You can sign up for our newsletter on the home page, on the "Newsletter" page, in the shop footer or at checkout. We will then send you emails about new posters, seasonal ideas (e.g. Christmas, new babies, Mother's Day) and occasional promotions about once or twice a month. All we need is your email address. The legal basis is your consent (Art. 6(1)(a) GDPR).

Confirmation (double opt-in) and proof: After signing up, you will receive an email with a confirmation link. We only add you to our mailing list once you click it; without confirmation you will not receive a newsletter. So that we can prove your consent, Shopify logs on our behalf the time of sign-up and confirmation, the type of consent and – where recorded – the IP address (Art. 6(1)(f) GDPR; our legitimate interest is being able to prove consent under Art. 7(1) GDPR).

Sending via Shopify: We send the newsletter using Shopify's email function (Shopify Messaging, formerly Shopify Email). For this purpose, Shopify processes your email address and subscription status on our behalf (data processing under Art. 28 GDPR, see Section 3). Your subscription is stored in your customer profile at Shopify with the tag "newsletter".

Analytics: Where the sending function technically provides for this, Shopify may record whether a newsletter was delivered and opened and which links in it were clicked (e.g. via an invisible tracking pixel and redirected links). We only use this information to see which topics people like and to improve the newsletter; the legal basis is your consent (Art. 6(1)(a) GDPR). If you do not want this, you can switch off the automatic loading of images in your email program or unsubscribe from the newsletter.

Storage period and unsubscribing: We store your subscription until you unsubscribe. You can withdraw your consent at any time with effect for the future – via the unsubscribe link in every email or with a short message to hallo@walleria.de. After that, you will no longer receive our newsletter. We keep proof of consent and unsubscription for as long as we may need it to defend against claims, usually up to three years (Art. 6(1)(f) GDPR). If you have ordered from us, your order data remains unaffected (Section 4).

Reminders: We will only remind you of an abandoned cart by email if you have subscribed to our newsletter. If you use Shopify's Shop App, Shopify may remind you of viewed items there, depending on your settings in the app.

10. Order Processing, Customer Images and Reviews (Supabase)

We store order data for production, your uploaded images, the finished files, and product reviews with Supabase (Supabase Inc., 970 Toa Payoh North, Singapore) in the Frankfurt am Main data centre (eu-central-1). A data processing agreement in accordance with Art. 28 GDPR, including the EU Commission's Standard Contractual Clauses, is in place.

Online cancellation function: If you declare your cancellation via the "Cancel contract" form, we process the details entered (order number, name, email address, optional items, date, address, and message) as well as the time of receipt in order to process the cancellation and immediately confirm receipt to you by email (Art. 6(1)(b) and (c) GDPR). To protect against abuse, we also store a shortened, irreversible hash value of your IP address (Art. 6(1)(f) GDPR). We retain the declaration as proof for three years to the end of the year, unless longer commercial or tax law retention periods apply.

Product reviews: Only buyers can leave reviews. To do this, you provide the order number and the email address of the order; we use this to check whether you bought the poster. Only the stars, your text, the name provided, and the date are published – never your email address. We check every review before publication. The legal basis is Art. 6(1)(a) GDPR (you submit the review voluntarily); you can request its deletion at any time by email. To prevent abuse, we limit the number of attempts per hour (Art. 6(1)(f) GDPR).

11. Cookies, Consent and Analytics

Strictly necessary: We use cookies and storage entries for the cart, checkout, language and country settings, security, and storing your cookie selection based on Section 25(2)(2) TDDDG. You can find an overview of Shopify cookies at shopify.com/de/legal/cookies.

Only with your consent: The statistics and marketing services mentioned below only load if you consent in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). "Statistics" enables Google Analytics and Microsoft Clarity, "Marketing" enables the Meta Pixel, Google Ads, and ChatGPT Ads. You can change or withdraw your selection at any time via the "Cookie Settings" link at the bottom of the page; the withdrawal applies to the future. Some providers also process data in the USA. The transfer is based on the EU-U.S. Data Privacy Framework, provided the provider is certified under it, otherwise on EU Standard Contractual Clauses (Art. 45, 46 GDPR).

Our own visitor counter (without consent): To help us see which pages and posters are popular and where orders are abandoned, we count page views, selected clicks (e.g. "Add to cart", steps in the checkout), and purchases using our own counter. It does not set any cookies and does not store or read anything on your device. The page visited, the referring page, campaign details from the link (utm parameters or whether an ad click occurred), and the duration of the visit are transmitted. From the IP address and browser identifier, we generate a daily changing, irreversible hash value on the server to recognise multiple visits on the same day; we do not store the IP address and browser identifier themselves, and only the device type (mobile, tablet, computer) and country are derived. Automated access (e.g. search engines and bots) is recognised by the browser identifier and country of origin and is not counted as visits. The data is stored with Supabase in Frankfurt (Section 10) and is automatically deleted after 24 months. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a privacy-friendly measurement of our reach. If you have activated "Do Not Track" or "Global Privacy Control" in your browser, we will not count you. You can object at any time (hallo@walleria.de).

Google Analytics 4 (Statistics): The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use this to measure how the shop is used: page views, viewed items, cart, checkout, and purchases (including order value and items). Google Analytics does not store full IP addresses; advertising and personalisation features are disabled for this measurement. Cookies: _ga, _ga_* (up to 2 years). Google LLC (USA) is certified under the Data Privacy Framework.

Microsoft Clarity (Statistics): The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Clarity shows us in heatmaps and session recordings how visitors use the pages, helping us find usability issues. Inputs in form fields are masked and not transmitted. Cookies: _clck (1 year), _clsk (1 day). Microsoft is certified under the Data Privacy Framework.

Google Ads (Marketing): The provider is Google Ireland Limited (address as above). We measure whether a click on our ad leads to a purchase (conversion tracking) and can show ads to visitors of our shop later (remarketing). Upon purchase, your email address is encrypted in the browser (hash value) and transmitted to Google so that Google can attribute the purchase to the ad (enhanced conversions). Cookies: _gcl_au and _gcl_* (90 days).

Meta Pixel (Marketing): The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel measures whether our ads on Facebook and Instagram lead to visits and purchases, and enables advertising for visitors to our shop. We are jointly responsible with Meta for the collection and transmission of the data (Art. 26 GDPR, agreement); Meta is solely responsible for further processing. Cookie: _fbp (3 months). Meta Platforms, Inc. is certified under the Data Privacy Framework.

ChatGPT Ads (Marketing): The provider is OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. The tracking pixel shows us whether our ads in ChatGPT lead to visits and purchases (page views, viewed items, checkout, purchase). Independently of the cookie banner, we also report every purchase directly from our server to OpenAI, solely with the amount, currency, and a technical order identifier, without name, email address, or device details. This ensures a purchase is only counted once (Art. 6(1)(f) GDPR; our interest is measuring the success of our advertising).

12. Fonts and External Content

All fonts are loaded from our shop's servers or from Shopify; no connection is made to Google Fonts.

Map posters: On the pages of our map posters, we load the map view from OpenFreeMap (openfreemap.org) and use the Photon service from komoot GmbH, Potsdam, for location searches. In doing so, your IP address and – during searches – the entered location are transmitted to these services. This only happens when you open a map poster or search for a location (Art. 6(1)(b) GDPR, design of your poster).

13. Internal Advertising Tool "Walleria Ads Tool" – Handling of Google User Data

To evaluate our own Google Ads campaigns, we operate an internal tool called the "Walleria Ads Tool". It uses the Google Ads API and logs in via Google OAuth 2.0. This statement describes how the tool accesses, uses, stores, and shares Google user data.

Who is affected? Only we ourselves as the operator of walleria.de. The tool is only connected to our own Google account. Visitors and customers do not log in there, and no third-party Google accounts are linked.

Access: The tool requests the OAuth scope "https://www.googleapis.com/auth/adwords" and thereby reads data from our own Google Ads advertising account: campaigns, ad groups, budgets, as well as performance metrics such as impressions, clicks, costs, and conversions. It does not access any emails, contacts, files, calendars, or other content of a Google account.

Use: The retrieved metrics are used solely to monitor our advertising campaigns, generate reports for ourselves, and manage budgets. They are not used for advertising to third parties, profiling, credit checks, or training AI models.

Storage: We store OAuth access and refresh tokens in encrypted form on an access-protected computer in Germany. Retrieved campaign metrics are stored locally as reports and deleted after 24 months at the latest. Access can be revoked at any time under myaccount.google.com/permissions; the tokens will then be deleted.

Sharing: Google user data from the tool is not sold, rented, or shared with third parties. It is only transmitted to Google itself as part of the API usage. Humans only read the data to the extent necessary to evaluate our own advertising.

The use and transfer of information from Google APIs to other applications complies with the Google API Services User Data Policy, including the Limited Use requirements. We will answer any questions about this at the email address listed in our legal notice.

14. Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to withdraw consent at any time with future effect. You can lodge complaints with a data protection supervisory authority; for our registered office, this is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel.