Thank you for your interest in our online shop. Protecting your personal data is important to us. Below we explain which data we process, for which purposes and on which legal basis this takes place, and which rights you have.

How long we store personal data depends on the respective purpose of processing and on the statutory retention obligations; where a specific period is stated below, that period applies.

The controller responsible for data processing is:

STRAEDE GmbH
Köhlstraße 10b, 50827 Cologne, Germany
Email: support@straede.cc

Further information about our company can be found in our imprint.

1. Access data, hosting and recipients

1.1 Server log files

You can visit our websites without providing any personal information. Each time a web page is accessed, the web server automatically stores a so-called server log file containing the name of the requested file, your IP address, the date and time of the request, the volume of data transferred and the requesting provider (access data).

This data serves the technical operation of our website. We use the log files to check whether pages are delivered without errors and to detect attacks on our web server in order to fend them off. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in keeping our offering available and protected against attacks.

No later than seven days after the access, we shorten your IP address to such an extent that the entry can no longer be attributed to you. The entries are then used exclusively for aggregated analyses of the use of our website.

The access data is not combined with other data stored by us. The only recipients are the entities named in sections 1.2 and 1.3.

1.2 Hosting and operation of the shop

The operation, hosting and display of our website are provided by service providers that process personal data exclusively in accordance with our instructions and on the basis of a data processing agreement pursuant to Art. 28 GDPR. Unless described otherwise in this declaration, all access data as well as all data that you enter into forms on this website are processed there.

To measure and improve the loading times of our website, we also use a service provider that receives your IP address as well as information about your browser and device. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in a high-performance website.

The provider of our shop system also makes aggregated analyses of the use of our shop available to us, for example on visitor numbers and on the sources through which page views come about. For this purpose, information is stored on and read from your device, and information about your device and your browser is processed. The basis for this is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG. You can withdraw your consent at any time, as described in section 6.3.

To display our website, a program library is retrieved from the server of an external provider. If it is not available there, we retrieve it from a further provider instead. With the retrieval, the respective provider receives your IP address, because it is technically transmitted when the file is transferred. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in fast and stable delivery of our page content. Both providers are based in the United States; for the basis of the transfer, see section 1.3.

1.3 Recipients and transfers to third countries

We pass on personal data to the following categories of recipients, insofar as this is necessary for the purposes described in each case: service providers for hosting and shop operation, logistics and shipping service providers, payment service providers and credit institutions, service providers for returns processing, customer service and email dispatch, providers of web analysis and advertising technologies as well as tax advisors, auditors and public authorities within the scope of statutory obligations.

Some of our service providers are based in countries outside the European Union and the European Economic Area or use servers there.

For the United States of America, an adequacy decision of the European Commission has been in place since 10 July 2023 (EU-US Data Privacy Framework). Insofar as the providers we use are certified under it, the transfer is based on this decision pursuant to Art. 45 GDPR. The European Commission has also determined an adequate level of data protection for Canada and the United Kingdom.

For transfers to countries for which no adequacy decision exists, our cooperation is based on the standard data protection clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR. These clauses are published in Commission Implementing Decision (EU) 2021/914 and can be accessed in the Official Journal of the European Union.

2. Contract processing, customer account and customer service

2.1 Data processing for contract processing

We collect personal data when you provide it to us in the course of an order or when contacting us. Mandatory fields are marked as such, because we need the data entered there to process the contract or to handle your enquiry. Which data is collected in detail can be seen from the respective input forms.

We use this data to process the contract and to handle your enquiries pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR. Order and invoice data are subject to retention obligations under commercial and tax law; the basis for retention in this respect is Art. 6 para. 1 sentence 1 lit. c GDPR. Beyond this, we only use this data insofar as you have consented or we inform you about it elsewhere in this declaration.

2.2 Customer account

You can create a customer account in our shop. We process the data provided in this context in order to give you access to your orders, your stored addresses and your invoices. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

The customer account is voluntary; you can also order as a guest without an account. If you would like to delete your customer account, a message using the contact details stated in section 13 is sufficient. We will then delete the data stored there, insofar as no statutory retention obligations prevent this.

2.3 Electronic withdrawal function

To provide an electronic withdrawal function, we use the application of a service provider that processes personal data on our behalf pursuant to Art. 28 GDPR. The details of your declaration of withdrawal are processed in order to receive it, assign it to your order, document and process it, and to send you an automatic confirmation of receipt by email.

To the electronic withdrawal form

The legal basis is Art. 6 para. 1 sentence 1 lit. c GDPR, insofar as the processing serves to fulfil statutory obligations, and Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as it is necessary for processing the purchase contract. The data is deleted as soon as it is no longer required for these purposes and no statutory retention obligations prevent this.

2.4 Service enquiries and use of artificial intelligence

To handle service enquiries, we use a customer service system whose provider processes personal data on our behalf pursuant to Art. 28 GDPR. Your contact details, the content of your enquiry, the associated order data and the further message history are processed.

A function based on artificial intelligence supports us in handling these enquiries; replies created in this way are marked as such for you.

The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as your enquiry concerns the processing of a contract, and otherwise Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in prompt and consistent handling of enquiries.

2.5 Analysis of complaints for quality assurance

If you report a defect in a delivered item, we process your information and the photos you send us beyond handling your request, also in order to record and analyse product defects and to improve the quality of our products.

The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest lies in identifying potentially recurring product defects. For storing the photos and for the analysis, we use service providers that process on our behalf pursuant to Art. 28 GDPR.

3. Shipping and returns

In order to perform the contract pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR, we pass on the data required for delivery to the logistics service provider commissioned with the shipment.

For handling returns, we use a returns portal whose provider processes the data required for this on our behalf pursuant to Art. 28 GDPR. For returns from other European countries, we additionally commission a logistics service provider with the return shipment.

We retain refund and invoice records on the basis of statutory retention obligations pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR until the periods under commercial and tax law have expired.

4. Payment processing

4.1 Processing of the payment transaction

Depending on the payment method selected, we pass on the data necessary for processing the payment to technical service providers acting for us within the scope of processing on our behalf, or to the commissioned credit institutions, or to the payment service provider you have selected. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR.

In some cases, the payment service providers collect the data required for processing themselves, for example on their own website or via a technical integration in the order process. In this respect, the privacy policy of the respective provider applies, which is referred to during the order process.

4.2 Identity and credit checks

If you select a payment method under which we make advance performance, such as purchase on account or payment by instalments, we transmit the data required for this to the selected payment service provider, which carries out an identity and credit check. The payment service provider is independently responsible for this check; please refer to its privacy policy for details of the procedure, the data sources and your rights.

The legal basis for the transfer is Art. 6 para. 1 sentence 1 lit. b GDPR as well as Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in protection against payment defaults.

4.3 Fraud prevention and payment management

Where applicable, we transmit to our service providers further data beyond the details necessary for the payment, which they use as processors for fraud prevention and to optimise our payment processes, for example for invoicing, handling disputed payments and supporting accounting. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in protection against fraud and in efficient payment management.

5. Email communication

5.1 Marketing notifications

If you consent to receiving marketing emails, we use your email address as well as any data you have provided separately in order to send you corresponding messages. The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.

To demonstrate your consent, we store the time of the registration and, where applicable, of the confirmation, as well as the IP address used. The legal basis for this is Art. 6 para. 1 sentence 1 lit. c GDPR.

You can withdraw your consent at any time via the unsubscribe link in every marketing email or via the contact details stated in section 13.

So that we can permanently observe your withdrawal and prevent further marketing emails to this email address, we store your email address on a blocking list. The data is used exclusively for this purpose. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in permanently observing your withdrawal and avoiding unwanted messages. The email address remains stored for this purpose for as long as this is necessary in order to observe your withdrawal.

5.2 Dispatch service provider

For sending our emails, we work with Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Klaviyo processes your contact details and your order history exclusively on our behalf and in accordance with our instructions pursuant to Art. 28 GDPR. The information you provide when registering is stored on Klaviyo servers in the USA. The legal basis for the processing is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR; for the basis of the transfer to the USA, see section 1.3. Section 7.3 describes how Klaviyo records your use of our website.

5.3 Use of our messages

We record whether and how our marketing emails are used and tailor the content accordingly. The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, which you can withdraw at any time as described in section 5.1.

6. Cookies and similar technologies

In order to make visiting our website attractive and to enable certain functions, we use technologies including so-called cookies. Cookies are small text files that are stored on your device. Some of the cookies we use are deleted again after the end of the browser session (session cookies), others remain on your device and make it possible to recognise your browser on your next visit (persistent cookies).

In addition to the General Data Protection Regulation, the German Telecommunications Digital Services Data Protection Act (TDDDG) applies to access to information on your device. We use technically necessary technologies without your consent pursuant to Section 25 para. 2 no. 2 TDDDG. We use all other technologies on the basis of your consent pursuant to Section 25 para. 1 TDDDG.

6.1 Technically necessary technologies

Certain technologies are strictly necessary for the use of our website, for example for the shopping cart and order function. In this context, your IP address, the time of the visit, device and browser information as well as information about your use of our website are processed. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR, insofar as the processing serves to handle your order, and otherwise Art. 6 para. 1 sentence 1 lit. f GDPR with our legitimate interest in a functional and secure offering.

6.2 Management of your consent

We store your decision on the use of cookies and similar technologies because we have to be able to demonstrate the consent given. Your selection as well as the time and scope of the decision are stored. The legal basis is Art. 6 para. 1 sentence 1 lit. c GDPR. We store it for as long as we need it as evidence; if you make a new decision, it replaces the previous one. To obtain and manage consent, we use a service provider that processes the data arising in this context on our behalf pursuant to Art. 28 GDPR.

6.3 Changing and withdrawing consent

Insofar as you have consented to the use of these technologies pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, you can change or fully withdraw your consent at any time by opening and editing your cookie settings.

7. Web analysis and advertising

Insofar as you have given your consent to this pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR and Section 25 para. 1 TDDDG, we use the third-party technologies described below on our website. Once the purpose has ceased to apply and the use of the respective technology has ended, the data collected is deleted. You can withdraw your consent at any time with effect for the future; section 6.3 describes how to do this.

7.1 Google services

We use technologies of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. The information automatically collected about your use of our website is generally transferred to a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA and stored there; for the basis of the transfer, see section 1.3.

Google Analytics

For the purpose of website analysis, the following data is processed with Google Analytics 4: your IP address, the time of the visit, device and browser information as well as information about your use of our website. From this, usage profiles are created using pseudonyms; cookies may be used for this purpose.

Google Ads: remarketing and conversion tracking

For advertising purposes in Google search results and on third-party websites, a cookie is set when you visit our website which enables interest-based advertising via a pseudonymous identifier.

If you reach our website via a Google Ads advertisement, we measure your subsequent usage behaviour via Google Ads conversion tracking. For this purpose, cookies may be used and data collected from which usage profiles are created using pseudonyms.

Google reCAPTCHA

To protect our web forms against misuse and automated software, Google reCAPTCHA collects your IP address, the time of the visit, browser information as well as information about your use of our website and analyses this by means of JavaScript and cookies. Personal data from the input fields of the respective form is not read out or stored.

7.2 Meta services

We use the Meta pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. With it, we record your use of our website on the basis of events specified by us and use this to form target groups for our advertising on the platforms of Meta and with third parties. Information that allows an assignment to your account with Meta is also transmitted in hashed form.

We determine the parameters of the respective campaign; Meta decides on the delivery of the advertisements to individual users. In this respect, the processing takes place on the basis of a joint controllership agreement pursuant to Art. 26 GDPR, which is limited to the collection of the data and its transmission to Meta Platforms Ireland. The data is generally processed in the United States; for the basis of the transfer, see section 1.3.

7.3 Other providers of web analysis and marketing services

Microsoft Clarity

For the purpose of website analysis, we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. In this context, your IP address, the time of the visit, device and browser information, mouse movements, clicks, your scrolling behaviour as well as information about your use of our website are collected and processed into recordings of individual sessions and into analyses of which areas of our pages are used. Entries in form fields are not recorded. Recordings are generally deleted after 30 days, analyses and individually flagged sessions after nine months.

Tracify

To assess the effectiveness of our advertising measures, we use Tracify, a service of Tracify GmbH, Agnes-Pockels-Bogen 1, 80992 Munich. In this context, your IP address, the time of the visit, the origin of the page view as well as information about your use of our website are collected and processed into usage profiles.

In addition, a pseudonymous identifier is formed from characteristics of your device and your browser, which enables recognition across several visits.

Klar

To analyse our sales and advertising data, we use Klar, a service of Klar Insights GmbH, Marktstraße 18, 80802 Munich. In this context, your IP address, the time of the visit, device and browser information, the origin of the page view as well as information about your use of our website including orders placed are collected and analysed using pseudonyms. The analysis serves to assess through which channels orders come about.

Pinterest Tag

We use the Pinterest Tag of Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. With it, we measure which orders can be attributed to our advertisements on Pinterest and enable interest-based advertising. Your IP address, the time of the visit, device and browser information as well as events specified by us are collected; from this, usage profiles are created using pseudonyms.

ablyft

To improve our offering, we test different variants of our website against each other. For this we use ablyft, a service of Conversion Expert GmbH, Zeppelinring 52c, 24146 Kiel. In this context, the test group to which you are assigned is stored on your device so that the same variant is shown to you on further visits. In addition, pseudonymous data is collected about how the respective variant is used.

Klaviyo

Via Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, we collect information about which pages and products you view in our shop in order to send you emails tailored to this, for example a reminder about an order process you did not complete. For this purpose, an identifier is stored on your device. For the basis of the transfer to the USA, see section 1.3.

7.4 Target groups for our advertising

Beyond the technologies described above, we transmit contact details from our system for email dispatch to the advertising platforms of Google and Meta so that target groups for our advertising can be formed there. The transmission is encrypted. For the basis of the transfer to the USA, see section 1.3.

The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in advertising our offering.

8. Product reviews

For collecting and displaying product reviews, we use judge.me, a service of Judge.me Ltd, c/o Buckworths, 2nd Floor, 1–3 Worship Street, London EC2A 2AB, United Kingdom. The provider processes personal data on our behalf pursuant to Art. 28 GDPR.

If you submit a review, we publish the name you provide, the rating and the review text on our website. The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, which you give by submitting the review. Your review remains published until you request its deletion or withdraw your consent; there is therefore no fixed storage period. You can request deletion at any time. A message using the contact details stated in section 13 is sufficient.

After a purchase, we ask you by email to review the items you bought. The legal basis is Art. 6 para. 1 sentence 1 lit. f GDPR; our legitimate interest lies in receiving feedback on our products. You can object to this use of your email address at any time; a message using the contact details stated in section 13 is sufficient.

9. Size advice

For the size advice on our product pages, we use the service of SAIZ GmbH, Pappelallee 78/79, 10437 Berlin. Your entries are transmitted to the provider in order to calculate a size recommendation from them. Your details on height and weight, your usual clothing size as well as your own assessment of your body type are processed.

The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, which you can withdraw at any time with effect for the future. Your details are deleted as soon as they are no longer required for calculating the recommendation.

10. Bonus and referral programme

For our bonus and referral programme we use the application of memberr GmbH, Masurenweg 6, 33605 Bielefeld, which processes personal data on our behalf pursuant to Art. 28 GDPR. Your customer account data, your orders as well as your points balance, its movements and the tier reached as a result are processed.

If you take part in the bonus programme, you collect points with your purchases. With the points you reach different tiers, each of which is linked to its own benefits. The points are available to you 50 days after the purchase and expire 365 days after they are credited. The legal basis is Art. 6 para. 1 sentence 1 lit. b GDPR, because the processing is necessary in order to operate the programme.

If you refer us to others, we assign an order resulting from this to your referral so that the intended reward can be credited. For this purpose, an identifier is stored on the device when a referral link is opened. This storage is necessary in order to provide the function you have requested (Section 25 para. 2 no. 2 TDDDG); the legal basis for the further processing is Art. 6 para. 1 sentence 1 lit. b GDPR.

11. Our social media presences

We maintain presences on Facebook and Instagram, services of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. If you visit one of our presences, Meta processes data about your use and provides us with aggregated statistics derived from it. The processing takes place on the basis of a joint controllership agreement pursuant to Art. 26 GDPR; our legitimate interest lies in the presentation of our company to the public.

The information collected is generally transferred to a server of Meta Platforms, Inc., 1 Meta Way, Menlo Park, California 94025, USA and stored there; for the basis of the transfer, see section 1.3.

12. Your rights

As a data subject you have the following rights:

pursuant to Art. 15 GDPR the right to request information about your personal data processed by us, to the extent specified there;
pursuant to Art. 16 GDPR the right to request without undue delay the rectification of incorrect personal data or the completion of your personal data stored by us;
pursuant to Art. 17 GDPR the right to request the erasure of your personal data stored by us, unless further processing is necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
pursuant to Art. 18 GDPR the right to request the restriction of the processing of your personal data, insofar as you contest the accuracy of the data, the processing is unlawful but you refuse its erasure, we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR;
pursuant to Art. 20 GDPR the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller;
pursuant to Art. 7 para. 3 GDPR the right to withdraw consent you have given at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected. Section 6.3 describes how to withdraw your consent to cookies and similar technologies, and section 5.1 how to do so for marketing notifications;
pursuant to Art. 77 GDPR the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your habitual place of residence or place of work, or that of our company headquarters, for this purpose.

Right to object

Insofar as we process personal data to safeguard our legitimate interests which prevail in a balancing of interests, you can object to this processing with effect for the future.

If the processing takes place for direct marketing purposes, you can exercise this right at any time without giving reasons. If the processing takes place for other purposes, you have a right to object where grounds exist that arise from your particular situation.

After you have exercised your right to object, we will no longer process your personal data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. In the case of processing for direct marketing purposes, this proviso does not apply; there, following your objection, we will in any case no longer process your data for this purpose.

13. Contact and status of this declaration

If you have questions about the collection, processing or use of your personal data, about information, rectification, restriction or erasure of data, as well as about the withdrawal of consent given or an objection to a specific use of data, please contact: