Privacy policy

1. Controller and contact details

The controller responsible for processing personal data in connection with our online shop is:

Fabio Fedele, trading as Nestful
Paprikastraße 67
70619 Stuttgart
Germany

Email: info@nestful.de
Telephone: +49 176 82224817

This privacy policy explains which personal data we process, why we need it and what rights you have.

2. Data we process

Personal data is information relating to an identified or identifiable person.

In connection with our shop, we process in particular:

  • contact details such as your name, email address, telephone number, billing address and delivery address;
  • order and contract data such as products ordered, order numbers, prices, payments, deliveries and returns;
  • messages and documents you provide when making enquiries, exercising your right of withdrawal or submitting complaints;
  • technical data such as your IP address, browser, operating system, device information and access times;
  • information about consent and privacy settings;
  • usage and interaction data for the analytics and advertising purposes described below;
  • content you provide for product reviews.

This data comes from your entries, your use of our shop and the processing of your order by payment providers, shipping partners and sales platforms.

3. Legal bases

We process personal data on the following legal bases:

  • Article 6(1)(b) GDPR: to handle your enquiries before a purchase and to perform contracts;
  • Article 6(1)(c) GDPR: to comply with legal obligations, particularly tax-related retention requirements and data protection accountability requirements;
  • Article 6(1)(f) GDPR: to pursue legitimate interests, particularly operating a secure shop, handling general enquiries, preventing misuse and establishing, exercising or defending legal claims;
  • Article 6(1)(a) GDPR: on the basis of your consent, particularly for optional analytics and advertising activities.

Section 25 of the German TDDDG additionally applies to storing information on your device and accessing information already stored there. Strictly necessary technical operations are governed by Section 25(2) TDDDG. For other operations, we obtain your consent under Section 25(1) TDDDG.

4. Operating our shop with Shopify

Our online shop is operated using Shopify. The provider for the European region is Shopify International Limited, Ireland.

Shopify provides the technical infrastructure for displaying the shop, the shopping cart, checkout, customer accounts and order management. This involves processing technical access data and the contact, contract and payment information required for your order.

Processing for the performance of the contract is based on Article 6(1)(b) GDPR. The technical operation and security of the website are based on Article 6(1)(f) GDPR. Our legitimate interest is to provide a functional and secure online shop.

When providing the shop infrastructure, Shopify processes data on our behalf. For its own services and certain other processing activities, Shopify acts as an independent controller.

Shopify Network Intelligence

We use Shopify Network Intelligence. Shopify processes data about your interactions with our shop together with information from interactions with Shopify and other merchants. This serves, among other things, to improve services, provide personalisation and support advertising.

Processing for analytics, personalisation and advertising that requires consent takes place on the basis of your consent. You can withdraw this through our cookie settings.

Information about Shopify’s own data processing and ways to exercise your rights is available in its Consumer Privacy Policy and the Shopify Privacy Portal.

Shopify processes data internationally. The safeguards provided are set out in the Shopify Data Processing Addendum. These include binding corporate rules for certain intragroup transfers and standard contractual clauses.

5. Orders and customer accounts

We process your order data to conclude and perform the purchase contract. This includes payment processing, delivery, communication about the order and handling withdrawals, returns and statutory warranty claims.

The legal basis is Article 6(1)(b) GDPR. Processing and retention required for tax purposes are based on Article 6(1)(c) GDPR.

We need the information marked as required during the ordering process to conclude the contract or deliver the goods. Without this information, we cannot process your order. Optional information is marked accordingly.

For a customer account, we process the data needed to create, access and manage the account on the basis of Article 6(1)(b) GDPR. You can request deletion of your customer account by contacting info@nestful.de. Order documents subject to statutory retention requirements remain unaffected.

6. Shipping by suppliers and handling returns

Ordered goods are dispatched directly to you by our suppliers. For this purpose, we provide the supplier responsible for your order with the necessary information, particularly your name, delivery address, ordered items and order reference.

Our suppliers include EUZIEL International GmbH, Germany, for products from the SONGMICS range.

Contact details are shared with suppliers or shipping providers only to the extent necessary to handle the specific delivery or covered by your consent.

For returns, we provide the relevant supplier with the data needed to create the return shipping label and identify the return. For complaints, this also includes your description of the defect and product photos you submit, where necessary to handle the complaint.

The legal basis is Article 6(1)(b) GDPR. Article 6(1)(c) GDPR additionally applies where processing is required to fulfil legal obligations.

7. Payment processing

To carry out your chosen payment method, the necessary data is transmitted to the payment service providers involved. This includes, in particular, the amount, currency, order reference and identification, contact and payment data.

The legal basis for our transmission is Article 6(1)(b) GDPR.

Payment services include Shopify Payments, Shop Pay and PayPal. When Apple Pay or Google Pay is used, the respective wallet providers and financial institutions involved in the payment also participate.

Payment service providers also process data under their own responsibility, particularly to comply with regulatory obligations and prevent fraud. Further information is available here:

Synctrack PayPal Tracking

We use Synctrack by OmegaTheme, operated by Cyber Software Joint Stock Company, Vietnam, to transmit shipment tracking data to PayPal.

This involves processing the order, transaction and shipping information needed to match the data to the relevant transaction and provide proof of delivery. The purpose is to document delivery and handle payment disputes.

Processing necessary for contract performance is based on Article 6(1)(b) GDPR. Retaining proof of delivery to defend legal claims is based on Article 6(1)(f) GDPR.

The provider provides for standard contractual clauses for transfers to Vietnam. Further information is available in the privacy policy and the OmegaTheme Data Processing Addendum.

8. Contact and forms

If you contact us by email, telephone or a form, we process your information to handle your enquiry. This includes your contact details, the content of your message and the information needed to identify the relevant matter.

We also use Shopify Forms for forms. Information submitted through these forms is processed within Shopify’s infrastructure.

For enquiries relating to a contract or a planned order, the legal basis is Article 6(1)(b) GDPR. We handle general enquiries on the basis of our legitimate interest in communicating with you under Article 6(1)(f) GDPR.

Using a contact, complaint or withdrawal form does not subscribe you to our newsletter.

9. Cookies and consent management with Pandectes

We use cookies and similar technologies to operate the shop, store your settings and, with your consent, analyse usage and personalise advertising.

We use Pandectes to manage your choice. This involves processing, in particular, your consent status, the time of your selection and the technical information necessary to associate and document it.

Documenting your choice serves to meet our accountability requirements. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 5(2) and Article 7(1) GDPR. The necessary storage of your choice on your device is governed by Section 25(2) TDDDG.

You can reject optional categories and change your choice at any time through “Cookie settings” in the shop. Withdrawal of consent takes effect for the future.

Consent to analytics or advertising is voluntary and is not a condition of making a purchase.

Further information: Pandectes – Privacy Policy.

10. Newsletters and marketing with Omnisend

We use Omnisend to manage and send our newsletter. The Omnisend group includes companies in Lithuania, the United Kingdom and the United States.

We process your email address, subscription details and information you provide voluntarily to send you the messages you have subscribed to. This is based on your consent under Article 6(1)(a) GDPR.

With your consent to the relevant use, we also process shop interactions and order information to personalise our offers. This includes, for example, viewed products, shopping cart contents and purchases. The processing and access to your device necessary for this are based on Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Consent to website cookies does not replace consent to receive marketing emails.

You can unsubscribe from the newsletter at any time using the unsubscribe link in each marketing email or by sending a message to info@nestful.de.

We document subscriptions and unsubscriptions so that we can demonstrate consent and respect your objection to further advertising.

Omnisend provides for standard contractual clauses for relevant international transfers in its Data Processing Agreement. Further information: Omnisend – Privacy Policy.

11. Product reviews with Loox

We use Loox, provided by Loox Online Ltd., Israel, to collect and display product reviews.

When you submit a review, we process the content you provide, your chosen display name, information about the reviewed product and the order and contact data needed to associate the review with the relevant order. Published reviews and images or videos you submit for publication are visible to other visitors.

Publication of personal data in your review is based on your consent under Article 6(1)(a) GDPR. To investigate and prevent abusive reviews, we process necessary data on the basis of our legitimate interest in reliable reviews under Article 6(1)(f) GDPR.

You can contact info@nestful.de to request deletion of personal data in your review.

The European Commission has adopted an adequacy decision for Israel. Information about Loox and its further recipients is available in its Privacy Policy for End Users.

12. Analytics and online advertising

With your consent, we use analytics and advertising services to understand how our shop is used, measure advertising effectiveness and display suitable offers.

The data processed includes, in particular:

  • pages visited and products viewed;
  • clicks, shopping cart events and purchase events;
  • order values and technical event identifiers;
  • the source of a visit or an advertising campaign;
  • IP address, browser and device information;
  • cookie, session and advertising identifiers.

Providers may combine this information with other information and use it to create interest profiles. Pseudonymous identifiers do not mean that the data is anonymous.

The legal basis is your consent under Article 6(1)(a) GDPR. Section 25(1) TDDDG additionally applies to storage on or access to your device that requires consent.

You can withdraw your consent at any time through our cookie settings.

Google Analytics

We use Google Analytics, provided by Google Ireland Limited, Ireland, to analyse shop usage. This allows us, for example, to identify which products are viewed and how visitors navigate the shop.

Google processes usage events and technical identifiers on our behalf. Personal user and event data whose retention we control is stored for no longer than 14 months. Earlier deletion when the purpose no longer applies or following a justified request for erasure remains possible.

Further information: Google – Privacy Policy.

Google Ads

We use Google Ads, provided by Google Ireland Limited, Ireland, to place advertisements and measure their effectiveness. Advertising clicks are linked to subsequent activity in the shop. With your consent, the data is also used to reach interested visitors again.

Google may process data in the United States in particular. The transfer mechanisms used by Google are explained in its information on international data transfers.

Further information: How Google uses data from partner websites.

Google Consent Mode

We use Google Consent Mode to communicate your consent choice to the integrated Google services. Consent Mode controls these services; it does not replace your required consent.

Meta: Facebook and Instagram

For advertising on Facebook and Instagram, we use services provided by Meta Platforms Ireland Limited, Ireland. Shop events are processed to measure advertising effectiveness and create audiences.

Meta can link events to a user account through technical identifiers and process them for the purposes described in its privacy policy. This may involve transfers to Meta companies in the United States.

For the joint collection and transmission of event data, responsibilities are allocated in accordance with the Meta Controller Addendum. We are responsible, in particular, for integration into our shop and for the required information and consent. You can exercise your rights against us and Meta.

Further information: Meta – Privacy Policy.

Pinterest

We use advertising and measurement services provided by Pinterest Europe Limited, Ireland, with the involvement of Pinterest, Inc., United States.

Shop interactions are analysed to measure advertising effectiveness and create interest-based audiences. Pinterest may combine this data with information from use of its platform.

Information about recipients, retention periods and the transfer mechanisms used is available in the Pinterest Privacy Policy.

TikTok

We use TikTok advertising and measurement services to analyse advertising campaigns and reach interested users. For users in the European Economic Area, the responsible entities are the companies in Ireland and the United Kingdom named in TikTok’s European privacy policy.

Shop events and technical identifiers are processed and linked to advertising interactions. Processing may involve other companies and service providers outside the European Economic Area.

Information about recipients, international transfers, retention periods and your rights is available in TikTok’s European Privacy Policy.

Elevar

We use Elevar to collect, prepare and transmit shop events to our analytics and advertising services. Elevar is offered within the Audiense group.

Technical identifiers, consent information, page views and product, shopping cart and purchase events are processed. This data is used to attribute and measure marketing activities.

Your relevant consent also applies to personal analytics and advertising events transmitted through servers.

Further information is available in the Audiense privacy and contractual documents.

13. Usage analysis with Lucky Orange

We use Lucky Orange, provided by Lucky Orange LLC, United States, to examine the usability of our shop.

Pages visited, clicks, scrolling and other interactions are analysed together with browser and device information. Session recordings allow us to follow usage steps and identify problems in the shop.

Processing takes place on the basis of your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG.

Personal session recordings are retained for no longer than 30 days. You can disable further recording at any time through our cookie settings.

Lucky Orange processes data in the United States. The provider makes available a Data Processing Agreement containing standard contractual clauses.

14. Security and fraud prevention

We process technical access and order data to detect attacks, abusive access and fraudulent orders. We also use MIDA Fraud Filter or IP Blocker for this purpose.

The data processed includes, in particular, IP addresses, device and browser information, access patterns and order information required for checks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect our shop, our customers and our economic rights.

Strictly necessary access to information on your device is governed by Section 25(2) TDDDG. Classifying a function as a security function does not permit additional use for advertising without consent.

If access or an order is blocked in error, you can contact info@nestful.de for a personal review.

MIDA belongs to the BSS group and refers to international infrastructure and locations. For transfers to third countries, the provider provides in particular for standard contractual clauses. Further information: MIDA – Privacy Policy and Data Processing Agreement.

15. Accounting with Lexware Office

We use Lexware Office, provided by Haufe-Lexware GmbH & Co. KG, Germany, for invoicing and accounting. We use the Eshop Guide integration to connect it with Shopify.

The data processed includes, in particular, customer master data, billing address, order line items, invoice amounts, tax details and payment information.

The legal bases are Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR for statutory bookkeeping and retention obligations.

Further information: Lexware – Data Protection and Data Security.

16. Orders through Etsy and CedCommerce

This section applies to orders you place through our Etsy sales channel.

We receive the order, contact, delivery and payment status information from Etsy that is necessary to process the order. We use the CedCommerce Etsy integration to transfer and manage these orders.

Data processing to fulfil your order is based on Article 6(1)(b) GDPR. Tax-related retention obligations are based on Article 6(1)(c) GDPR.

Etsy also processes data as an independently responsible platform operator. CedCommerce supports the technical connection between the platform and the shop. This may involve processing outside the European Economic Area.

Further information: Etsy – Privacy Policy and CedCommerce – Privacy Policy for the Etsy Integration.

17. Social media profiles

We maintain business profiles on Facebook, Instagram, Pinterest and TikTok.

If you communicate with us there, we process your messages and visible profile information to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for contract-related matters and Article 6(1)(f) GDPR for general communication.

Platform operators process usage data under their own responsibility, particularly to provide their services, measure reach and display advertising. This may involve creating user profiles and processing data internationally.

For Facebook Page statistics, joint controllership exists in accordance with the Page Insights agreement. The platform provides the technical analyses, which we use to assess our presence.

You can exercise your rights against us and the relevant platform operator.

18. Recipients and international processing

For the purposes described, recipients of data include in particular:

  • providers of our shop and IT infrastructure;
  • payment service providers and financial institutions involved;
  • relevant suppliers and shipping providers;
  • providers of communication, review, analytics and advertising services;
  • accounting service providers and tax advisers;
  • authorities, courts and legal advisers in connection with legal obligations or legal proceedings.

Service providers processing data on our behalf are subject to the requirements for processing by a processor under Article 28 GDPR. Other recipients, particularly payment service providers and platform operators, also process data under their own responsibility.

Transfers outside the European Economic Area

Where international providers are used, processing also includes transfers to and access from third countries.

The European Commission has adopted adequacy decisions for Israel and the United Kingdom. The adequacy decision for Canada covers certain commercial organisations. The decision concerning the EU-US Data Privacy Framework applies to the US organisations covered by it that hold the relevant certification.

Other transfers require appropriate safeguards, particularly standard contractual clauses under Article 46 GDPR and the necessary supplementary protective measures. Consent to cookies does not replace these requirements.

The mechanisms provided for by Shopify, Omnisend, OmegaTheme, Lucky Orange and MIDA are described in the provider agreements linked above. The other platform providers explain their international transfers in their linked privacy and contractual documents.

You can request information from us about a transfer affecting you and a copy of the relevant safeguards. Trade secrets and other people’s rights will be protected.

19. How long we retain data

We delete personal data as soon as it is no longer needed for its purpose and no legal obligation or permissible further retention prevents deletion.

The following periods and criteria apply:

Orders and accounting

Order data is initially required to perform the contract, including delivery, returns and complaint handling.

The following periods generally apply to documents subject to retention requirements:

  • eight years for invoices and accounting vouchers;
  • six years for commercial and business correspondence and other tax-relevant documents subject to retention requirements;
  • ten years for books, certain records, inventories and annual financial statements.

These periods generally begin at the end of the relevant calendar year. Longer retention takes place where required by statutory extensions, for example for tax proceedings that have not yet been concluded.

These periods apply to the particular documents subject to retention requirements, not indiscriminately to all data relating to a customer.

Customer accounts

Account data is stored to provide the customer account. After the account is deleted, data is retained only for separate purposes such as statutory retention obligations or handling outstanding orders.

Enquiries and complaints

Data from general enquiries is deleted after the matter has been resolved once no further handling is required.

The relevant retention periods additionally apply to contract-related correspondence. Necessary evidence is retained for the duration of a specific legal dispute or until the applicable limitation period expires.

Newsletters and records of consent

Data in the active newsletter mailing list is processed until you unsubscribe or the purpose of sending the newsletter ends.

Records of consent and its withdrawal are retained for as long as we need them to fulfil our accountability obligations or defend specific claims. A limited suppression record is retained for as long as necessary to prevent further unwanted messages.

Reviews

Published reviews are retained to display product experiences. Publication of personal data ends when the review is removed or the consent given for publication is withdrawn. Necessary evidence relating to a specific dispute may continue to be retained separately.

Security data

Technical logs are stored to detect and resolve malfunctions or misuse. The need for retention depends in particular on whether a specific security incident is being investigated. Once the investigation is completed, personal data no longer needed for it is deleted.

Cookies and browser storage

Session-related entries expire at the end of the respective session. Persistent entries are stored until they expire or are deleted earlier. The lifetime of a cookie must be distinguished from the retention of data already transmitted to the relevant provider’s systems.

20. Your rights

Subject to the statutory conditions, you have in particular the following rights:

  • access to your personal data under Article 15 GDPR;
  • rectification of inaccurate or incomplete data under Article 16 GDPR;
  • erasure under Article 17 GDPR;
  • restriction of processing under Article 18 GDPR;
  • data portability under Article 20 GDPR;
  • objection under Article 21 GDPR;
  • withdrawal of consent under Article 7(3) GDPR;
  • lodging a complaint with a data protection supervisory authority under Article 77 GDPR.

You can withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, simply send a message to info@nestful.de. To prevent unauthorised disclosure, we may request the information necessary to confirm your identity.

Objection where processing is based on legitimate interests

You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. This also applies to profiling based on that provision.

We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for legal claims.

Objection to direct marketing

You may object at any time to the processing of your data for direct marketing. This also applies to related profiling. Following your objection, we will no longer use the affected data for these purposes.

Automated decision-making

Subject to its conditions, Article 22 GDPR protects you against decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. To the extent provided by law, this includes the right to human intervention, to express your point of view and to contest a decision.

Right to lodge a complaint

You may in particular contact a supervisory authority in the place of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority responsible for our business location is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

Further information: Lodging a complaint with the data protection supervisory authority of Baden-Württemberg.

21. Changes to this privacy policy

We update this privacy policy when our data processing or legal requirements change.

A change to this policy does not replace any required consent.