Privacy policy

Last updated: 28 June 2026

This Privacy Policy explains how PirmaPinas handles your personal data. For visitors in the EU/EEA, our German-language Datenschutzerklärung is the controlling version and contains the full GDPR detail; this English policy mirrors it and adds region-specific information for customers in the United States, Canada, the United Kingdom and Australia.

1. Controller / who we are

PirmaPinas, owner Kerstin Roy, Am Waldesrand 1, 03054 Cottbus, Germany. Email: privacy@pirmapinas.com. VAT ID DE364556479. No data protection officer is appointed, as none is legally required.

2. What we collect

Contact data (name, billing/shipping address, email, optional phone); order and transaction data; payment data (status/details — full card data is handled by the payment provider); usage/device data (IP address, browser/device info, log data, pages visited, cookie IDs); communication data (your support messages); and marketing data (newsletter/SMS opt-ins, campaign responses) where you consent.

3. How we collect personal data

We collect personal data directly from you when you place an order, create or use an account, contact us, subscribe to email/SMS marketing, submit a review, or otherwise interact with the store.

We also collect some data automatically through Shopify, cookies, pixels, log files and similar technologies, depending on your consent settings and location.

We may receive personal data from service providers and partners where needed to operate the store, process payments, fulfil orders, provide customer support, prevent fraud, run analytics, or provide marketing services.

4. Why we use it and our legal bases (GDPR Art. 6)

  • Contract performance (Art. 6(1)(b)): order processing, delivery, payment, account, returns/refunds, order communication.
  • Legal obligation (Art. 6(1)(c)): retention of invoice and accounting records.
  • Legitimate interests (Art. 6(1)(f)): IT security, fraud/abuse prevention, legal enforcement, basic shop optimisation.
  • Consent (Art. 6(1)(a)): newsletter, SMS marketing, analytics/marketing cookies and pixels (GA4, Meta, TikTok, Pinterest), personalised advertising/remarketing. You can withdraw consent at any time with effect for the future.

5. Hosting & store platform (Shopify)

Our store runs on Shopify, which processes data to operate the store (checkout, security, performance) and may process data outside the EU/EEA under recognised transfer mechanisms (e.g. EU Standard Contractual Clauses). Shopify may process customer/store interaction data for Shop, Shop Pay, fraud prevention, platform improvement, privacy preferences, and targeted-advertising opt-outs where Shopify acts in its own role. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy . Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.

6. Cookies, consent & tracking

We use technically necessary cookies without consent (cart, checkout, security). Analytics and marketing technologies — Google Analytics 4, Meta Pixel, TikTok Pixel, Pinterest Tag — are used only after your consent, managed via Shopify Customer Privacy. You can change or withdraw your choice any time via the "Cookie settings" footer link.

For US visitors, our website is configured to honor Global Privacy Control (GPC) signals as an opt-out request where required by applicable state privacy law. More detail is in section 16.

7. Production (print-on-demand) & shipping

We use Printful for print-on-demand fulfilment and pass it your name, delivery address, ordered items and (where needed) email. With Printful "Smart Fulfilment", production locations vary by product and destination and may be outside the EU/EEA. Shipping carriers (e.g. DHL, Hermes) receive name, address and shipment data.

8. Payments

Depending on the method chosen: Shopify Payments (incl. Shop Pay, Apple Pay, Google Pay), PayPal, and Klarna (Europe only). Providers process payment data on their own responsibility; Klarna may run an automated credit check (profiling) to determine available options. We receive payment status/transaction info, not full card/bank details.

9. Email & SMS marketing

We use Klaviyo and Shopify Email as processors for email/SMS marketing. Newsletter sign-up uses double opt-in. Legal basis is your consent; you can unsubscribe any time (unsubscribe link, or "STOP" for SMS). Carrier message rates may apply.

10. Product reviews

We use Judge.me; reviews are shown anonymously or with initials only. Legal basis is our legitimate interest in transparency and trust.

11. Recipients and disclosures

We disclose personal data only where needed to operate the store, fulfil orders, provide customer service, comply with legal duties, protect our rights, prevent abuse or fraud, or where you have consented.

Recipients may include:

  • Shopify, for hosting, checkout, store operations, fraud prevention, performance, customer privacy tools and related platform services.
  • Printful, for print-on-demand production and fulfilment.
  • Shipping carriers, such as DHL and Hermes, for delivery and shipment tracking.
  • Payment providers, including Shopify Payments, Shop Pay, PayPal, Klarna (Europe only), Apple Pay and Google Pay. Some payment providers act as independent controllers for their own payment, fraud-prevention and compliance checks.
  • Marketing, analytics and advertising services, including Google, Meta, TikTok and Pinterest, but only where the relevant consent or opt-out rules allow this.
  • Email and SMS providers, including Klaviyo and Shopify Email, where you have subscribed or where transactional communication is required.
  • Review services, including Judge.me, where reviews are submitted or displayed.
  • IT, hosting, security, professional, accounting, legal and business support providers where needed for store operations and compliance.
  • Public authorities, courts, regulators, law enforcement or other parties where required by law, legal process, tax obligations, fraud prevention, dispute resolution or enforcement of our terms.
  • Third parties where you direct us to disclose data, for example when using social media features, third-party login tools, payment options or other integrations.
  • Buyers, advisers or other relevant parties if we ever sell, transfer, restructure or merge all or part of the business.

Some recipients process data on our behalf. Others, such as payment providers or certain advertising platforms, may process data under their own privacy notices.

12. Retention

Order/payment/invoice data: generally 10 years (tax and commercial-law retention). Account data: until you delete the account. Newsletter/SMS: until you withdraw consent. Security/log data: as long as needed for security/abuse prevention, then deleted.

13. Minors

Our offering is not directed at persons under 16. We do not knowingly collect data from minors. Parents/guardians can contact privacy@pirmapinas.com for deletion. (US note: we do not knowingly collect data from children under 13 — COPPA.)

14. Your rights (EU/EEA/UK – GDPR / UK GDPR)

Access, rectification, erasure, restriction, data portability, objection to legitimate-interest processing, and withdrawal of consent. Exercise any right by emailing privacy@pirmapinas.com. You may also complain to a data protection authority (in the EU, your local supervisory authority; in the UK, the ICO).

15. International data transfers

We operate globally and may transfer, store or process personal data outside your country of residence.

For EU/EEA and UK users, this may include transfers to countries outside the EU/EEA or UK, including the United States, Canada, Australia and other countries where our service providers operate. Where required, we rely on adequacy decisions, Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms.

You can contact privacy@pirmapinas.com if you want more information about the safeguards used for international transfers.

16. United States: state privacy rights

Depending on your state of residence and whether the relevant law applies to us, you may have rights to know, access, correct, delete and obtain a portable copy of your personal information. You may also have the right to opt out of the "sale" or "sharing" of personal information, targeted advertising, and certain profiling.

Our use of advertising cookies, pixels and similar technologies, including Meta, TikTok, Pinterest and Google, may be considered a "sale", "sharing" or "targeted advertising" under some US state privacy laws.

You can opt out by using the "Do Not Sell or Share My Personal Information" / privacy settings control in our website footer, by changing your cookie settings, or by emailing privacy@pirmapinas.com.

Our website is configured to honor Global Privacy Control (GPC) signals as an opt-out request for the browser or device sending the signal, where required by applicable law. If Shopify can associate the signal with a Shopify account, Shopify may apply the opt-out to that account as described in Shopify's privacy tools.

We do not discriminate against you for exercising your privacy rights. We do not knowingly sell or share the personal information of consumers under 16. You may use an authorized agent to submit a request where applicable law allows this; we may ask for proof of authorization and may need to verify your identity before acting on the request.

17. Canada

Where Canadian privacy law applies, we handle personal information in line with PIPEDA and applicable provincial privacy laws, including Quebec's Law 25 where relevant.

You may request access to or correction of your personal information by emailing privacy@pirmapinas.com. You may also contact us with privacy questions or complaints. We will review and respond as required by applicable law.

We collect, use and disclose personal information for the purposes described in this Policy, including order fulfilment, payments, customer support, security, fraud prevention, marketing where you have consented, analytics where permitted, and legal compliance. Personal information may be processed outside Canada by service providers such as Shopify, Printful, Klaviyo and other vendors listed in this Policy.

18. Australia

Where the Australian Privacy Principles apply, we handle personal information in an open and transparent way and use it only for the purposes described in this Policy.

You may request access to or correction of your personal information, or raise a privacy complaint, by emailing privacy@pirmapinas.com. We will review your request or complaint and respond within a reasonable time.

Your personal information may be disclosed to overseas recipients, including service providers and partners in Germany, the EU/EEA, the United States, Canada, the United Kingdom, Australia and other countries where Shopify, Printful, Klaviyo, payment providers, shipping providers, analytics providers or advertising partners process data for the purposes described in this Policy.

19. Third-party links & data security

Our site may link to third-party websites we do not control; review their policies. We apply technical and organisational safeguards, though no internet transmission can be guaranteed fully secure.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law.