Privacy policy

Privacy Policy

Last updated: July 2026

Thank you for visiting our website www.smirkthelabel.com and for your interest in our online store. Protecting your personal data is important to us. The following Privacy Policy explains which personal data we process when you use our website, place an order, contact us or subscribe to our newsletter.

1. Controller

The controller responsible for the processing of personal data on this website is:

Smirk the Label, Enßle & Wilfert-Enßle GbR
Herdweg 94i
70193 Stuttgart
Germany

Email: info@smirkthelabel.com
Telephone: +49 711 54042449

Partners authorised to represent the partnership:
Florian Enßle and Nina Wilfert-Enßle

VAT identification number: DE462952931

2. Data Protection Officer

We are currently not legally required to appoint a data protection officer.

You may contact us at any time with questions concerning data protection:

info@smirkthelabel.com

3. General Information About Data Processing

We process personal data only to the extent necessary to provide our website, process orders, communicate with you, comply with legal obligations or process data on the basis of your consent.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, postal address, email address, telephone number, order information, payment information, IP address and the content of communications.

The legal bases for processing personal data are set out, in particular, in the General Data Protection Regulation (“GDPR”):

  • Article 6(1)(a) GDPR, where you have given us your consent;

  • Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;

  • Article 6(1)(c) GDPR, where we are legally required to process personal data;

  • Article 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests or the legitimate interests of a third party, provided that your interests, fundamental rights and freedoms do not override those interests.

4. Provision of the Website and Hosting Through Shopify

Our website and online store are operated using the Shopify e-commerce platform. Shopify provides the technical infrastructure for our online store, including hosting, the presentation of the store and product pages, shopping-cart and checkout functions, security features, customer-account functions and other technical store functionality.

For customers and merchants in the European Economic Area, personal data is initially processed by:

Shopify International Limited
2nd Floor, 1–2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland

Other companies within the Shopify group and Shopify’s subprocessors may also be involved in providing the services.

When you visit our website, Shopify may process technical information, including:

  • IP address;

  • date and time of access;

  • browser type and browser version;

  • operating system;

  • referring URL;

  • pages accessed;

  • technical device information;

  • information about your use of the online store;

  • information relating to the security and stability of the online store.

This processing is carried out to securely and reliably provide our online store, process orders, prevent fraud, analyse errors and technically optimise the store.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing a secure, stable and user-friendly online store. Where processing is necessary for an order or for the use of contractual store functions, the legal basis is Article 6(1)(b) GDPR.

Shopify may process personal data on servers outside the European Union or the European Economic Area. Where personal data is transferred to a third country, the transfer takes place in accordance with applicable data protection requirements, particularly on the basis of an adequacy decision, standard contractual clauses or another legally permitted transfer mechanism.

5. Server Log Files

When you access our website, technical access data is processed automatically. This information is necessary to display the website, maintain system security and identify technical errors.

The information processed may include:

  • IP address;

  • date and time of access;

  • requested file or page;

  • amount of data transferred;

  • browser and operating system;

  • referring URL;

  • status codes and technical error messages.

The legal basis for this processing is Article 6(1)(f) GDPR. Our legitimate interest lies in the technical provision, security and stability of our website.

6. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device. Similar technologies may also store information on your device or access information already stored on it.

We distinguish between strictly necessary cookies and non-essential cookies.

Strictly Necessary Cookies

Strictly necessary cookies are required for our website and online store to function properly. These include, in particular, cookies used for:

  • shopping-cart functions;

  • checkout functions;

  • login and customer-account functions;

  • language settings;

  • security functions;

  • storing your cookie preferences;

  • maintaining the technical stability of the online store.

The storage of or access to information on your device is based on Section 25(2) of the German Telecommunications Digital Services Data Protection Act (“TDDDG”).

The associated processing of personal data is based on Article 6(1)(f) GDPR. Where a cookie is necessary for entering into or performing a contract, processing is additionally based on Article 6(1)(b) GDPR.

Non-Essential Cookies

Non-essential cookies and similar technologies, particularly those used for analytics, marketing, personalisation or tracking, are used only after you have given your consent.

The storage of or access to information on your device is based on your consent pursuant to Section 25(1) TDDDG. The associated processing of personal data is based on Article 6(1)(a) GDPR.

We currently do not use external analytics or marketing-tracking tools such as Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, TikTok Pixel or Pinterest Tag.

Should we use any such services in the future, we will update this Privacy Policy accordingly and, where required, obtain your consent in advance through a cookie or consent banner.

Cookie Banner and Consent Management

We use Shopify’s cookie banner and the privacy functions provided by Shopify Customer Privacy.

These functions allow you to manage your privacy preferences and, where required, give or withdraw your consent.

You may change or withdraw your consent at any time with effect for the future through the cookie-preference function provided on our website.

The withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

7. Orders Placed Through the Online Store

When you place an order through our online store, we process the information necessary to accept, manage and fulfil your order.

This information includes, in particular:

  • first and last name;

  • billing address;

  • delivery address;

  • email address;

  • telephone number, where provided or required for delivery;

  • products ordered;

  • order number;

  • payment method;

  • payment status;

  • shipping information;

  • return and complaint information;

  • communications relating to your order.

Processing is necessary for the performance of the purchase contract and is therefore based on Article 6(1)(b) GDPR.

Where we are legally required to retain information under commercial or tax law, processing is based on Article 6(1)(c) GDPR.

8. Customer Accounts and Guest Checkout

You may use a customer account in our online store. You may also place an order without creating an account by using guest checkout.

When you create or use a customer account, we process the information required to provide the account, including:

  • name;

  • email address;

  • login or access information;

  • address information;

  • order history;

  • saved preferences, where applicable.

Processing is carried out to provide the customer account and simplify future orders. The legal basis is Article 6(1)(b) GDPR.

When you place an order using guest checkout, we process only the information required for the relevant order and any information that must be retained to comply with legal obligations.

9. Payment Processing

We offer various payment methods. Depending on the payment method you select, payment information may be transferred to the relevant payment service provider or collected directly by that provider.

Processing is necessary for the performance of the purchase contract and is based on Article 6(1)(b) GDPR.

Where we are legally required to retain payment and accounting information, processing is based on Article 6(1)(c) GDPR.

Shopify Payments, Credit and Debit Cards, Apple Pay, Google Pay and Shop Pay

We use Shopify Payments and related payment functions. These may be used to process payments made by credit or debit card, Apple Pay, Google Pay and Shop Pay.

When you use one of these payment methods, the following information may be processed:

  • name;

  • billing address;

  • delivery address;

  • email address;

  • payment amount;

  • order information;

  • payment status;

  • technical transaction information;

  • shortened or masked payment information, such as the final digits of a payment card.

Payment processing may be carried out by Shopify and payment service providers involved by Shopify.

We generally do not receive your complete credit- or debit-card details.

PayPal

When you select PayPal as your payment method, personal data is transferred to PayPal or collected directly by PayPal for the purpose of processing your payment.

The provider is:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
Luxembourg

The information processed may include:

  • name;

  • email address;

  • billing and delivery address;

  • payment amount;

  • order information;

  • transaction information.

PayPal also processes personal data under its own responsibility as an independent controller and in accordance with its own privacy policy.

Klarna

When you select Klarna as your payment method, personal data is transferred to Klarna or collected directly by Klarna.

The provider is:

Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden

The information processed may include:

  • name;

  • postal address;

  • email address;

  • telephone number;

  • date of birth, where required;

  • order information;

  • payment amount;

  • billing and delivery address;

  • payment and transaction information.

Klarna may use this information to process payments, verify your identity and creditworthiness, prevent fraud and provide Klarna payment services.

Klarna also processes personal data under its own responsibility as an independent controller and in accordance with its own privacy policy.

10. Shipping and Delivery

To deliver your order, we transfer the information required for delivery to the relevant shipping service provider.

We currently use, in particular:

  • DHL;

  • Deutsche Post;

  • UPS.

The information transferred may include:

  • name;

  • delivery address;

  • email address, where applicable;

  • telephone number, where applicable;

  • shipment information.

The transfer is necessary for the performance of the purchase contract and is based on Article 6(1)(b) GDPR.

Where your email address or telephone number is transferred to a shipping service provider, this may be done to provide shipment tracking, delivery notifications or to coordinate delivery.

Where consent is legally required for such a transfer, we will obtain your consent in advance. Otherwise, and to the extent legally permitted, processing is based on our legitimate interest in providing reliable and customer-friendly delivery services pursuant to Article 6(1)(f) GDPR.

11. Contact by Email or Contact Form

When you contact us by email or through a contact form, we process the information you provide in order to respond to your enquiry.

This may include:

  • name;

  • email address;

  • content of your message;

  • date and time of the enquiry;

  • order number, where applicable;

  • any other information you choose to provide.

Depending on the subject of your enquiry, processing is based on Article 6(1)(b) GDPR where it relates to a contract or steps taken prior to entering into a contract.

For other enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in processing and responding to your enquiry.

12. Returns, Complaints and Customer Service

Returns, complaints and other customer-service enquiries are currently handled by email.

In this context, we may process:

  • name;

  • email address;

  • order number;

  • products purchased;

  • delivery address;

  • payment and refund information;

  • reason for the return or complaint;

  • content of communications.

Processing is necessary for the performance and administration of the contract and is based on Article 6(1)(b) GDPR.

Where statutory retention obligations apply, processing is based on Article 6(1)(c) GDPR.

13. Newsletter

You may subscribe to our newsletter through our website. We use Shopify Email and Shopify Forms to manage subscriptions and send the newsletter.

When you subscribe to our newsletter, we may process:

  • email address;

  • name, where provided;

  • date and time of subscription;

  • consent status;

  • IP address, where recorded;

  • source of the subscription, where recorded;

  • date and time of confirmation through the double opt-in procedure.

Double Opt-In Procedure

Newsletter subscriptions are completed using a double opt-in procedure.

This means that after subscribing, you will receive an email asking you to confirm your subscription. Your email address will be used to send newsletters only after you have completed this confirmation.

Processing for the purpose of sending the newsletter is based on your consent pursuant to Article 6(1)(a) GDPR.

The recording and documentation of your subscription and confirmation are based on Article 6(1)(f) GDPR. Our legitimate interest lies in being able to demonstrate that valid consent was given.

You may withdraw your consent at any time with effect for the future. You may do this by using the unsubscribe link contained in every newsletter or by contacting us at:

info@smirkthelabel.com

After you unsubscribe, we will remove your information from the active newsletter distribution list unless statutory retention requirements apply.

We may retain your email address in a suppression list in order to ensure that you do not receive further newsletters. This processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR in complying with your withdrawal and preventing further marketing emails.

14. Shopify Forms and Newsletter Pop-Ups

We use Shopify Forms to provide newsletter subscription forms and newsletter pop-ups on our website.

When you use one of these forms, the information you enter is processed. This includes, in particular, your email address and any other information you choose to provide.

Processing is carried out for the purpose of managing your newsletter subscription or handling the relevant form submission.

Where you consent to receiving the newsletter, the legal basis is Article 6(1)(a) GDPR.

Where a form is used to submit another type of enquiry, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the context of the enquiry.

15. Shopify Analytics

Shopify provides statistical and administrative information concerning the use and operation of our online store.

This information may help us:

  • manage orders;

  • technically operate and secure the store;

  • understand basic store usage;

  • identify technical problems;

  • evaluate the commercial performance of the online store.

Where Shopify Analytics uses non-essential cookies or similar technologies and processes personal data for analytics purposes, processing takes place only after you have given your consent.

In this case, the storage of or access to information on your device is based on Section 25(1) TDDDG, and the associated processing of personal data is based on Article 6(1)(a) GDPR.

Where statistical, administrative or security-related information is processed without using non-essential cookies or comparable technologies, processing may be based on Article 6(1)(f) GDPR.

Our legitimate interests lie in administering, securing, technically optimising and economically evaluating our online store.

We currently do not use additional external analytics tools such as Google Analytics.

16. No Externally Loaded Web Fonts

We do not use Adobe Fonts or Google Fonts that are loaded directly from external servers when you visit our website.

Adobe Fonts have only been used under a valid licence to design our logo, slogans and text elements contained in advertising materials and image files.

These materials are incorporated into our website as image files. Their display does not establish a direct connection between your device and Adobe’s font servers.

The fonts used for ordinary website text are fonts made available directly through Shopify or form part of the technical design of the website.

17. No External Tracking or Marketing Pixels Currently in Use

We currently do not use external tracking or marketing pixels such as:

  • Google Analytics;

  • Google Tag Manager;

  • Google Ads conversion tracking;

  • Meta Pixel;

  • TikTok Pixel;

  • Pinterest Tag.

Should we use any such services in the future, we will update this Privacy Policy accordingly and, where required, obtain your consent through our cookie or consent banner before activating them.

18. No Embedded Social-Media Feeds or Other External Content

We currently do not directly embed Instagram feeds, TikTok content, Pinterest content, YouTube videos, Vimeo videos, Google Maps or comparable external content on our website.

Should we embed external content or social-media feeds in the future, we will update this Privacy Policy accordingly and obtain your consent where required.

19. Recipients of Personal Data

For the purposes described in this Privacy Policy, personal data may be transferred to the following categories of recipients:

  • technical service providers and hosting providers;

  • Shopify and companies within the Shopify group;

  • payment service providers;

  • shipping and delivery service providers;

  • email and communication service providers;

  • tax advisers, public authorities and other bodies where legally required;

  • other service providers where necessary for the performance of a contract, technical provision of the website or compliance with legal obligations.

Personal data is transferred only where there is a valid legal basis for doing so.

20. Transfers to Third Countries

The use of Shopify and related services may involve the processing of personal data outside the European Union or the European Economic Area.

Where personal data is transferred to a third country, the transfer takes place only in accordance with applicable legal requirements.

Depending on the recipient and country concerned, transfers may be based on:

  • an adequacy decision adopted by the European Commission;

  • appropriate safeguards such as standard contractual clauses;

  • another transfer mechanism permitted under the GDPR.

21. Retention Periods

We retain personal data only for as long as necessary for the relevant purpose or for as long as statutory retention obligations apply.

Information relating to orders, payments, invoices and accounting is retained in accordance with applicable retention requirements under German commercial and tax law.

Depending on the nature of the relevant document or record, retention periods of six, eight or ten years may apply.

We delete information relating to general enquiries once the enquiry has been conclusively resolved, unless statutory retention obligations or legitimate interests require the information to be retained for a longer period.

Newsletter information is retained for as long as you remain subscribed to the newsletter.

After you unsubscribe, certain information may continue to be retained where necessary to demonstrate that consent was previously given or to ensure that no further newsletters are sent to you.

22. Your Rights

Subject to the applicable statutory requirements, you have the following rights:

  • the right of access pursuant to Article 15 GDPR;

  • the right to rectification pursuant to Article 16 GDPR;

  • the right to erasure pursuant to Article 17 GDPR;

  • the right to restriction of processing pursuant to Article 18 GDPR;

  • the right to data portability pursuant to Article 20 GDPR;

  • the right to object pursuant to Article 21 GDPR;

  • the right to withdraw consent pursuant to Article 7(3) GDPR.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

The withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

To exercise your rights, you may contact us at any time:

info@smirkthelabel.com

23. Right to Object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.

Following an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless processing is necessary for the establishment, exercise or defence of legal claims.

24. Right to Lodge a Complaint With a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

The supervisory authority generally responsible for us is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany

You may also contact any other competent data protection supervisory authority.

25. Security

We implement appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction.

Our website uses an encrypted connection. You can recognise this, among other things, from the fact that the website address begins with “https://”.

26. Amendments to This Privacy Policy

We reserve the right to amend this Privacy Policy if our website, data-processing activities, services used or legal requirements change.

This applies, in particular, if we use additional analytics, marketing, social-media, review, accounting, shipping, returns-management or automation tools in the future.

The current version of this Privacy Policy is available on our website.