Privacy policy

As of: 14 July 2026

1. Controller

The controller responsible for the processing of personal data on this website and in the online shop is:

Home Design
Owner: Nils Hartmann
Eckenbacher Hardt 13
51588 Nümbrecht
Germany

Phone: +49 173 1638300
Email: info@velvet-thread.de

The online shop is operated under the Velvet Thread brand.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide our website, process orders, communicate with customers, comply with legal obligations, or for other purposes described in this Privacy Policy.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, telephone number, order data, payment information, IP address, and information about the use of our website.

Processing is carried out in particular on the basis of the following legal grounds:

  • Art. 6(1)(a) GDPR where consent has been given,

  • Art. 6(1)(b) GDPR for taking steps prior to entering into a contract and for the performance of a contract,

  • Art. 6(1)(c) GDPR for compliance with legal obligations,

  • Art. 6(1)(f) GDPR for the purposes of legitimate interests, provided that the interests or fundamental rights of the data subject do not override those interests.

3. Provision and Hosting of the Website by Shopify

Our online shop is operated using the Shopify e-commerce platform.

The provider for merchants based in the European Economic Area is:

Shopify International Limited
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

When you visit our website, Shopify may process in particular the following data:

  • IP address,

  • date and time of access,

  • pages and content accessed,

  • browser type and browser version,

  • operating system,

  • device information,

  • referrer URL,

  • technical log and diagnostic data,

  • cookie and session identifiers,

  • information about interactions with the website.

The processing is carried out to technically provide the website, deliver content, enable the shopping cart and ordering process, ensure system security, detect errors, and prevent misuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and economical operation of our online shop.

Shopify processes a substantial portion of the data on our behalf. For certain Shopify services, particularly where there is a direct relationship between the customer and Shopify, Shopify may process data under its own responsibility under data protection law.

Further information can be found in Shopify’s privacy policy for consumers.

4. Transfers to Third Countries

Shopify may also process personal data outside the European Economic Area, in particular in Canada and the United States.

For intra-group transfers from the European Economic Area, Shopify uses binding corporate rules approved by European data protection authorities. For transfers to other service providers, Standard Contractual Clauses of the European Commission or other legally recognised safeguards may be used.

Personal data is transferred to a third country only where the legal requirements of Arts. 44 to 49 GDPR are met.

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small files that may be stored on or read from a visitor’s device.

Technically Necessary Cookies

Technically necessary cookies are used to enable basic functions of the online shop. These include in particular:

  • shopping cart functionality,

  • ordering and checkout process,

  • storage of language preferences,

  • authentication of a customer account,

  • security and fraud prevention,

  • storage of privacy settings.

Where information is stored on or accessed from the end device for these technologies, this is carried out on the basis of Section 25(2) TDDDG. Subsequent processing of personal data is carried out on the basis of Art. 6(1)(b) or (f) GDPR.

Non-Essential Cookies

Cookies and similar technologies used for analytics, personalisation, or advertising are used only if the visitor has previously given consent.

The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Consent is voluntary and may be changed or withdrawn at any time with effect for the future. Cookie settings can be changed via the “Cookie Settings” or “Cookie Preferences” link in the lower section of our website.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Details of the specific cookies used, their providers, purposes, and storage periods are displayed in the cookie settings.

6. Orders and Contract Processing

When you place an order through our online shop, we process in particular:

  • first and last name,

  • billing and delivery address,

  • email address,

  • telephone number, where provided,

  • products ordered,

  • order quantity and order value,

  • payment method and payment status,

  • shipping and delivery information,

  • returns, refunds, and complaints,

  • communications relating to the order,

  • IP address and time of the order.

The processing is carried out to process and fulfil the order, process payment, arrange delivery, handle returns and complaints, and comply with statutory documentation and retention obligations.

The legal bases are:

  • Art. 6(1)(b) GDPR for contract processing,

  • Art. 6(1)(c) GDPR for statutory retention and documentation obligations,

  • Art. 6(1)(f) GDPR for fraud prevention, legal defence, and internal monitoring of business transactions.

Without the required information, it is not possible to conclude or perform the purchase contract.

7. Customer Account

If you create a customer account, we process in particular:

  • name,

  • email address,

  • address,

  • authentication and login data,

  • order history,

  • saved addresses,

  • account settings.

The processing is carried out to create and manage the customer account, facilitate future orders, and display previous orders.

The legal basis is Art. 6(1)(b) GDPR.

The customer account may be deleted at any time. Order and invoice data subject to statutory retention requirements will not be deleted together with the customer account, but will instead be stored in restricted form for the duration of the statutory retention period.

8. Payment Processing

To process payments, we transmit the data required for this purpose to the payment service provider selected by the customer during checkout.

The following data may in particular be processed:

  • name and address,

  • email address,

  • order number,

  • invoice amount,

  • currency,

  • selected payment method,

  • payment status,

  • technical transaction data,

  • for certain payment methods, bank account or card details.

The legal basis is Art. 6(1)(b) GDPR.

Depending on the payment method, the payment service provider may process the data partly under its own responsibility under data protection law. The privacy policies of the selected payment service provider also apply to such processing.

Complete card or bank account details are generally processed directly by the payment service provider and are not made fully available to us.

Payment service providers may process additional data for fraud prevention, identity verification, risk assessment, or compliance with legal obligations. The respective payment service provider is responsible for such independent processing.

9. Shipping and Delivery

To deliver an order, we transmit the data required for this purpose to the appointed shipping or logistics service provider.

This may include in particular:

  • name,

  • delivery address,

  • where applicable, telephone number,

  • where applicable, email address,

  • parcel and shipment information.

The legal basis is Art. 6(1)(b) GDPR.

A telephone number or email address is transmitted only where this is necessary for delivery, a delivery notification, or shipment tracking requested by the customer.

10. Contacting Us

If you contact us by email, telephone, or via a contact form, we process the information you provide. This includes in particular:

  • name,

  • contact details,

  • content of the enquiry,

  • time of contact,

  • where applicable, order or customer number.

The processing is carried out to handle and respond to the enquiry.

Where the enquiry relates to an existing or potential contract, the legal basis is Art. 6(1)(b) GDPR. For other enquiries, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in properly handling incoming enquiries.

Our business email communications are processed using services provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany.

11. Newsletter and Email Advertising

You can subscribe to our newsletter on our website.

In doing so, we process in particular:

  • email address,

  • where applicable, name,

  • time of registration,

  • consent status,

  • where applicable, IP address,

  • time of confirmation or unsubscribe request.

The newsletter is sent only if you have given prior consent.

The legal basis is Art. 6(1)(a) GDPR.

Where a confirmation procedure is used, you will receive an email after registration asking you to confirm your subscription. This procedure serves to verify that the registration was actually made by the owner of the email address.

Shopify functions may be used to send and manage the newsletter. Shopify processes newsletter data on our behalf.

You may withdraw your consent at any time with effect for the future. You can do so using the unsubscribe link at the end of each newsletter email or by contacting us at info@velvet-thread.de.

After unsubscribing, the email address will no longer be used to send the newsletter. Evidence of previously granted consent may be retained for a limited period on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in demonstrating that consent was obtained properly.

12. Analysis of Shop Usage

Shopify provides us with statistical analyses regarding the use of our online shop. The following information may in particular be processed:

  • pages and products viewed,

  • source or origin of a visitor,

  • device and browser used,

  • approximate location,

  • duration and time of a visit,

  • shopping cart and purchase activities,

  • aggregated revenue and conversion data.

Where only technically necessary data or aggregated data is used for this purpose, processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in analysing and improving the economic performance of our online shop.

Where non-essential cookies, device identifiers, or comparable technologies are used for this purpose, processing takes place only after prior consent in accordance with Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

Consent may be withdrawn at any time via the cookie settings.

13. Security and Fraud Prevention

We and the service providers we use may process personal data in order to:

  • detect unauthorised access,

  • check orders for possible indications of fraud,

  • prevent payment and account misuse,

  • defend against technical attacks,

  • comply with legal obligations,

  • establish, exercise, or defend legal claims.

For these purposes, order, payment, device, usage, and IP data may in particular be processed.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our business, our customers, and our technical systems against fraud, misuse, and security incidents.

Where processing is necessary to comply with legal obligations, the legal basis is Art. 6(1)(c) GDPR.

14. External Links and Social Networks

Our website may contain links to external websites or social networks.

When a simple link is used, data is generally transmitted to the respective provider only when you click the link and access the external website. The respective provider is responsible for processing carried out on the external website.

Please refer to the privacy policy of the respective provider.

15. Recipients of Personal Data

Personal data may in particular be transmitted to the following categories of recipients:

  • Shopify and its subprocessors,

  • payment service providers,

  • banks and financial institutions,

  • shipping and logistics service providers,

  • email and newsletter service providers,

  • IT, hosting, and security service providers,

  • tax advisers and accounting service providers,

  • lawyers and other advisers,

  • authorities and public bodies where required by law.

Data is disclosed only where there is a legal basis for doing so, where disclosure is necessary for the performance of a contract, where consent has been given, or where a legitimate interest exists.

Personal data is not sold.

16. Storage Period

We store personal data only for as long as necessary for the respective purpose or for as long as statutory retention obligations apply.

The following criteria apply in particular:

  • Order, invoice, and accounting data is generally retained for eight years.

  • Commercial and business correspondence may generally be retained for six years.

  • Customer account data is stored until the customer account is deleted, unless statutory retention obligations require continued storage.

  • Contact enquiries are deleted once the enquiry has been fully dealt with and there are no statutory retention obligations or legitimate interests requiring further storage.

  • Newsletter data is stored until consent is withdrawn.

  • Evidence of consent may generally be retained for up to three years after withdrawal or after the last use.

  • Cookie and consent data is stored in accordance with the periods specified in the cookie settings.

  • Data required for legal enforcement or legal defence may be retained until the applicable statutory limitation periods have expired.

After expiry of the relevant period, the data will be deleted or anonymised unless there is another legal basis for continued storage.

17. Your Rights

Subject to the applicable legal requirements, you have in particular the following rights:

Right of Access

Under Art. 15 GDPR, you may request information about the personal data we process about you.

Right to Rectification

Under Art. 16 GDPR, you may request the correction of inaccurate data or the completion of incomplete data.

Right to Erasure

Under Art. 17 GDPR, you may request the erasure of your personal data where there are no legal grounds requiring continued storage.

Right to Restriction of Processing

Under Art. 18 GDPR, you may request restriction of processing subject to the applicable legal requirements.

Right to Data Portability

Under Art. 20 GDPR, you may receive data that you have provided to us and which is processed by automated means on the basis of consent or a contract in a structured, commonly used, and machine-readable format.

Right to Withdraw Consent

Consent that has been given may be withdrawn at any time with effect for the future in accordance with Art. 7(3) GDPR.

The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to Lodge a Complaint

Under Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority.

The supervisory authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Postfach 20 04 44
40102 Düsseldorf
Germany

Email: poststelle@ldi.nrw.de

18. Right to Object

Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

We will then no longer process the relevant data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless the processing serves the establishment, exercise, or defence of legal claims.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time without giving reasons. Following an objection, your data will no longer be used for direct marketing.

The objection may in particular be sent by email to info@velvet-thread.de.

19. Obligation to Provide Data

The provision of certain personal data is necessary for the conclusion and performance of a purchase contract.

Without the information necessary for ordering, payment, and delivery, we cannot process an order.

Providing data for newsletters, advertising, or non-essential analytics purposes is voluntary. Refusing or withdrawing consent does not affect your ability to use our online shop or place an order.

20. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Payment service providers may, under their own responsibility, carry out automated risk, identity, or fraud checks. Information on this can be found in the privacy policies of the payment service provider selected.

21. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access, and other unlawful processing.

Our website uses an encrypted connection. An encrypted connection can be identified in particular by the use of “https” in the browser’s address bar.

Despite appropriate protective measures, completely risk-free transmission of data over the internet cannot be guaranteed.

22. Changes to this Privacy Policy

We may amend this Privacy Policy if our data processing activities, the service providers we use, or legal requirements change.

The version published on this website at any given time shall apply. Material changes requiring notification or renewed consent will be implemented in accordance with the applicable legal requirements.