Privacy policy

Last updated: August 25, 2026

1. An Overview of Data Protection

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified.

Data Collection on this Website

  • Who is responsible for data collection on this website? The data processing on this website is carried out by the website operator. You can find their contact details in section 2 of this policy.

  • How do we collect your data? Part of your data is collected when you share it with us (e.g., by entering it into a contact or checkout form). Other data is collected automatically or after your consent by our IT systems (primarily technical data like internet browser, operating system, or time of page view).

  • What do we use your data for? Part of the data is collected to ensure the error-free provision of the website. Other data is used to analyze your user behavior, fulfill your orders, process payments, or send review invitations.

2. Information About the Controller

The data controller responsible for processing data on this website under the General Data Protection Regulation (GDPR) is:

Curtis Jackson Neumann

Trading as: some random shirt company

Contact:

Phone: 015678 339292

E-Mail: info@random-shirts.com

3. General Statutory Mandatory Information

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock icon in your browser line.

Your Rights as a Data Subject (GDPR Rights)

You have the following rights at any time, free of charge:

  • Right to Access (Art. 15 GDPR): Right to know what personal data we store about you.

  • Right to Rectification (Art. 16 GDPR): Right to demand the immediate correction of incorrect data.

  • Right to Erasure (Art. 17 GDPR): Right to request the deletion of your personal data.

  • Right to Restriction of Processing (Art. 18 GDPR): Right to restrict how your data is processed.

  • Right to Data Portability (Art. 20 GDPR): Right to receive your data in a common, machine-readable format.

  • Right to Withdraw Consent (Art. 7(3) GDPR): Right to revoke any consent you gave us at any time with effect for the future.

Right to Object to Data Collection (Art. 21 GDPR)

If data processing is based on Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right to Lodge a Complaint with a Supervisory Authority

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement.

4. Hosting and E-Commerce Platform (Shopify)

Our store is hosted on the e-commerce platform provided by Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Greenbrook, Grand Canal Quay, Dublin 2, Ireland).

Shopify provides the infrastructure that allows us to operate this online shop. Shopify automatically handles essential tasks, including Shopify Payments (infrastructure for payment entry) and Shopify Analytics (internal shop statistics).

  • Purpose: Operation, infrastructure, secure checkout, and performance analysis of our online shop.

  • Legal Basis: Art. 6(1)(b) GDPR (performance of a contract) for order-related features, and Art. 6(1)(f) GDPR (legitimate interest) for standard platform security and basic analytics.

  • International Transfers: Data may be transferred to Shopify Inc. in Canada or Shopify cells in the United States. Shopify relies on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) to guarantee an adequate level of data protection.

For more information, please read Shopify’s Privacy Policy: https://www.shopify.com/legal/privacy

5. Integrated Payment, Shipping & Fulfillment Services

PayPal

If you choose payment via PayPal, your payment data will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg).

  • Data Processed: Name, billing address, email address, IP address, and total order amount.

  • Legal Basis: Art. 6(1)(b) GDPR (performance of a contract).

Tracking123 (Order Tracking)

To enable you to track the delivery status of your order seamlessly, we utilize the Tracking123 application. Your order data (such as name, shipping address, email address, tracking number, and chosen courier) is shared with this service provider to generate real-time tracking updates.

  • Legal Basis: Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (our legitimate interest in providing reliable customer support and order tracking information).

Printful (Print-on-Demand Fulfillment)

To process, print, and ship your orders, we work with our print-on-demand partner, Printful. Your data is transferred to Printful Latvia, AS (Satekles iela 2B, Riga, LV-1050, Latvia) and, depending on production routing, to Printful Inc. (11025 Westlake Dr, Charlotte, NC 28273, USA).

  • Data Processed: Name, shipping address, email address, and specific order/product details.

  • Legal Basis: Art. 6(1)(b) GDPR (performance of a contract).

  • International Transfers: We have concluded a Data Processing Agreement (DPA) including EU Standard Contractual Clauses with Printful. For any data transfers to the USA, Printful Inc. is certified under the EU-U.S. Data Privacy Framework.

6. Integrated Third-Party Applications and Tools

Google Services (Google Analytics & Google Web Fonts)

Our store utilizes services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). This includes tracking tools (Google Analytics) to optimize user experience and layout systems (Google Web Fonts) to display text properly.

  • Google Analytics: Evaluates your usage of the website. This data is only collected if you grant your explicit consent through our cookie banner.

  • Google Web Fonts: Integrated locally or via Shopify servers where possible to protect your privacy. If loaded directly from Google servers, your IP address is sent to Google.

  • Legal Basis: Art. 6(1)(a) GDPR (Consent) for Analytics/Marketing, and Art. 6(1)(f) GDPR (Legitimate Interest) for technically necessary presentation tools.

  • International Transfers: Data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework.

Loox (Product Reviews)

We use the Loox application (operated by Loox io Ltd., Israel) to collect and display customer product reviews on our website. After your order has been delivered, you may receive an email invitation to review your purchased shirts.

  • Data Processed: Name, email address, order details, and any review text or images you submit.

  • Legal Basis: Art. 6(1)(f) GDPR (our legitimate interest in conducting direct marketing to existing customers and collecting feedback to improve our products). If explicit consent is requested prior to sending the email, the legal basis is Art. 6(1)(a) GDPR.

  • International Transfers: Data is processed in Israel. The European Commission has issued an adequacy decision for Israel, ensuring that personal data is protected to European standards.

7. Cookies and Consent Management

Our website uses cookies. These are small text files stored on your device.

  • Necessary Cookies: Required for standard shop functions (e.g., maintaining items in your shopping cart, user session handling). They are set based on Art. 6(1)(b) GDPR or legitimate interest.

  • Marketing & Tracking Cookies: Non-essential cookies (such as Google Analytics tracking) will only be activated if you explicitly opt-in via our store's Cookie Consent Banner (Art. 6(1)(a) GDPR). You can alter your choices or revoke consent at any time through that banner.

8. Data Retention Periods

We store your personal data only as long as necessary to fulfill the purposes mentioned in this policy, or as dictated by statutory retention obligations.

  • Under German commercial and tax laws (Handelsgesetzbuch, Abgabenordnung), invoice data and specific business communications must be stored for up to 10 years.

  • Once these statutory retention periods expire, your data is permanently deleted or blocked.