Privacy policy

1. Data controller

The data controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Mariana Bayer and Dr Christoph Bayer (Dr.-Ing.) GbR
REDWOOD
Oberer Wingertweg 82
75177 Pforzheim
Germany

Email: info@redwood.fashion

The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. General information on data processing

Personal data is any information relating to an identified or identifiable natural person. This includes, in particular, name, address, email address, telephone number, IP address, as well as order, payment and usage data.

We process personal data only to the extent necessary to provide our website, to process enquiries, to fulfil orders and contracts, to comply with legal obligations, or on the basis of consent or a legitimate interest.

Our products are manufactured in particular using:

  • Article 6(1)(a) of the GDPR where consent has been given,
  • Article 6(1)(b) of the GDPR for the purpose of taking steps prior to entering into a contract and for the performance of a contract,
  • Article 6(1)(c) of the GDPR for the purpose of complying with legal obligations,
  • Article 6(1)(f) of the GDPR for the purposes of safeguarding legitimate interests, unless the interests or fundamental rights and freedoms of the data subject override those interests.

3. Encryption

For security reasons and to protect the transmission of confidential information, this website uses SSL or TLS encryption.

You can recognise an encrypted connection in particular by the fact that the website address begins with ‘https://’.

4. Hosting and the Shopify e-commerce platform

4.1 Shopify

We use the Shopify e-commerce platform to operate our online shop. For personal data relating to customers in the European Economic Area (EEA), the United Kingdom and Switzerland, Shopify International Limited, Ireland, is generally the Shopify company acting as the first-party data controller within the Shopify platform.

In connection with the operation of our shop, Shopify processes, in particular, technical usage data and – where you use the relevant features – contact, account, order, delivery, payment and transaction data.

Where Shopify acts as our data processor, depending on the processing operation, in particular on the basis of Article 6(1)(b) of the GDPR for the performance and fulfilment of contracts, and on the basis of Article 6(1)(f) of the GDPR on the grounds of our legitimate interest in the secure, reliable and cost-effective operation of our online shop.

Where Shopify processes personal data on our behalf, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR.

Shopify uses affiliated companies and other sub-processors. This may also involve the transfer of personal data to countries outside the European Union or the European Economic Area. Such transfers take place only in accordance with the requirements of Articles 44 et seq. of the GDPR, in particular on the basis of an adequacy decision, appropriate safeguards such as standard contractual clauses, or other mechanisms provided for by law.

For further information on Shopify’s processing of personal data, please see the Shopify Consumer Privacy Policy.

5. Server log data

When you visit our website, information that your browser transmits to the servers used to host the website is processed automatically.

These may include, in particular:

  • IP address,
  • Date and time of access,
  • the page or file accessed,
  • Referrer URL,
  • Browser type and browser version,
  • Operating system,
  • Product information,
  • Amount of data transferred.

This data is processed for the technical operation of the website, to ensure its stability and security, and to detect misuse and technical faults.

The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and trouble-free operation of our website.

6. Cookies and similar technologies

Our website uses cookies and similar technologies. Some of these technologies are necessary for the technical operation of our online shop and for the functions you have specifically requested.

The essential technical features include, in particular:

  • Shopping basket and ordering process,
  • Meeting management,
  • Language and country settings,
  • Customer account and login,
  • Safety features,
  • Protection against fraud and misuse,
  • Technical set-up of the online shop.

Where the storage of information on your device or access to information already stored is absolutely necessary for the provision of a digital service that you have expressly requested, this is carried out in accordance with Section 25(2)(2) of the TDDDG.

Where personal data is processed in this context, such processing is carried out, depending on the purpose, in particular on the basis of Article 6(1)(b) of the GDPR or Article 6(1)(f) of the GDPR.

We do not use any additional in-house analytics or advertising services such as Google Analytics or Meta Pixel.

Where such non-essential technologies are used, they will only be activated with your consent, provided that such consent is required by law. The legal basis for storing or accessing information on your device in this case is Section 25(1) of the TDDDG. Where consent is required, the processing of personal data based on this provision is carried out in accordance with Article 6(1)(a) of the GDPR.

You can amend or withdraw any consent you have given at any time, with effect for the future, via the cookie and privacy settings provided on our website.

7. Getting in touch

If you contact us, for example by email or via a contact form, we will process the personal data you provide.

These may include, in particular:

  • Name,
  • Email address,
  • Telephone number, if provided,
  • Order number, if specified,
  • Content of your message,
  • any other information you have provided.

Your details will be processed in order to deal with your enquiry.

If your enquiry relates to an existing contract or is intended to initiate a contract, the legal basis is Article 6(1)(b) of the GDPR.

For other enquiries, your data will be processed on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in the proper processing and response to your enquiry.

Your data will be deleted as soon as your enquiry has been fully processed and there are no statutory retention obligations or other legitimate reasons for further storage.

8. Customer account

You may have the option to create a customer account or to use the customer account features provided by Shopify.

In particular, we process the data required for customer account and order management, for example:

  • Name,
  • Email address,
  • Delivery and billing address,
  • Order history,
  • Account settings.

Data processing is carried out on the basis of Article 6(1)(b) of the GDPR for the purpose of providing your customer account and for processing and managing your orders.

The technical set-up of the customer account is handled by Shopify.

You may request the deletion of your customer account at any time. Where data from completed orders is subject to statutory retention obligations, this data will continue to be stored for the duration of the relevant statutory period, even if your customer account is deleted.

9. Newsletter

You can sign up for our email newsletter on our website. Through the newsletter, we’ll keep you updated on REDWOOD’s products, offers and news.

Your email address is required to register. Any further details are provided on a voluntary basis, where requested.

The newsletter is sent on the basis of your consent in accordance with Article 6(1)(a) of the GDPR.

To provide evidence of consent having been duly given, information relating to the registration – in particular the time and technical audit trail data – may also be stored. The processing of this audit trail data serves to fulfil our data protection obligations regarding the provision of evidence.

Functions provided by our Shopify shop platform or by Shopify’s shipping providers can be used to manage newsletter subscriptions and dispatch orders.

You may withdraw your consent at any time with future effect. To do so, you can, in particular, use the unsubscribe link in a newsletter or contact us at info@redwood.fashion Please contact us.

Withdrawal does not affect the lawfulness of the processing carried out prior to the withdrawal.

Once you have unsubscribed, your email address will be removed from the active newsletter distribution list, provided there is no other legal basis for further storage. Evidence of consent given may be retained beyond the unsubscription process to the extent necessary, insofar as this is required to fulfil statutory record-keeping obligations or to defend against legal claims.

10. Notification of product availability

Where we offer you the option of receiving an email notification when a product that is currently out of stock becomes available again, we will process the email address you provide for this purpose exclusively for this purpose.

The legal basis is your consent in accordance with Article 6(1)(a) of the GDPR.

Consent may be withdrawn at any time with effect for the future. Once the requested notification has been sent or following your withdrawal of consent, the data stored for this purpose will be deleted, provided there is no legal basis for further storage.

11 product reviews

If you submit a product review via our website, we will process the data you provide in the review form.

These may include, in particular:

  • Name or chosen pseudonym,
  • Rating and review text,
  • Email address, where requested,
  • Date of review,
  • Technical data required to prevent misuse and tampering.

The purpose of this data processing is to publish and manage customer reviews, as well as to prevent abusive or manipulated reviews.

The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in providing our customers with authentic experiences of our products and in protecting the integrity of our review system.

Details such as your email address will not be displayed publicly, unless this is expressly stated in the review form and clearly indicated to you.

12. Orders and Contract Fulfilment

When you place an order in our online shop, we process the data necessary to handle and fulfil your order.

These include, in particular:

  • First name and surname,
  • Billing and delivery address,
  • Email address,
  • telephone number, if applicable,
  • Items ordered,
  • Order and billing details,
  • Payment method,
  • Payment status,
  • Postage and delivery information.

The legal basis is Article 6(1)(b) of the GDPR.

Where data must be retained in accordance with commercial or tax law provisions, further processing is carried out on the basis of Article 6(1)(c) of the GDPR.

13. Dispatch

In order to process your order, we will pass on the personal data required for delivery to the relevant delivery company.

This includes, in particular, your name and delivery address, as well as your email address or telephone number, where this is required for delivery or requested by you.

The processing of the data required for delivery is carried out on the basis of Article 6(1)(b) of the GDPR, as it is necessary for the performance of the contract of sale concluded with you.

Where additional contact details are passed on to a delivery service provider – for example, to notify the customer of a shipment or to arrange a delivery date – this is done only where there is a corresponding legal basis for doing so.

14. Payment processing

To process your payment, we will forward the necessary details to the payment service provider you have selected.

The specific payment methods available will be displayed during the ordering process.

The processing and transmission of the data required for payment are carried out on the basis of Article 6(1)(b) of the GDPR.

14.1 PayPal

If you select a payment method offered via PayPal, the data required to process the payment will be transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.

This may include, in particular, your name, address, email address, order total, currency, order details and payment details.

PayPal processes personal data as part of its payment services under its own responsibility for data protection and may, in particular, carry out identity, risk, fraud or credit checks.

Further information can be found in PayPal’s privacy policy.

14.2 Shopify Payments

We use Shopify Payments for the various payment methods offered at checkout. The contractual partner for Shopify Payments in Germany is Shopify International Limited, Ireland. Shopify may engage other payment processors, financial institutions and payment networks to handle payment processing.

The following data, in particular, may be processed as part of the payment process:

  • Name and contact details,
  • Billing address,
  • Order total and currency,
  • Transaction details,
  • Payment information,
  • Technical information on payment, security and fraud checks.

The legal basis for the transfer of the data required for payment processing is Article 6(1)(b) of the GDPR.

Insofar as Shopify or individual service providers involved in the payment processing process personal data in order to fulfil their own legal obligations or for the purposes of risk, fraud, identity or credit checks, such processing is carried out under the respective provider’s own responsibility under data protection law.

Further information on data processing by Shopify can be found in the Shopify Consumer Privacy Policy.

15. Bookkeeping with Lexware Office

We use Lexware Office from Haufe-Lexware GmbH & Co. KG for our bookkeeping and to fulfil our commercial and tax obligations.

In particular, the following personal data may be processed:

  • Name and address,
  • Invoice details,
  • Order and transaction details,
  • Payment information,
  • business correspondence.

The data is processed primarily for the purposes of issuing and storing invoices and accounting records, as well as for complying with tax and commercial law obligations.

The legal basis is Article 6(1)(c) of the GDPR. Insofar as the processing also serves to ensure the efficient organisation of our accounts, it is based on Article 6(1)(f) of the GDPR.

Where Lexware Office processes personal data on our behalf, this is done on the basis of a data processing agreement.

Where necessary, data may also be passed on to our tax adviser, the tax authorities or other recipients authorised by law.

16. Recipients of personal data

We only pass on personal data where there is a legal basis for doing so.

Recipients or categories of recipients may include, in particular:

  • Hosting and e-commerce service providers,
  • IT and security service providers,
  • Shop and platform providers,
  • Newsletter and communications service providers,
  • Payment service providers, payment processors and participating financial institutions,
  • Shipping and logistics service providers,
  • Accountancy and tax service providers,
  • Tax adviser,
  • Government authorities and other public bodies, where there is a legal obligation to do so.

Service providers who process personal data exclusively on our behalf are contractually bound in accordance with the provisions of Article 28 of the GDPR.

17. Transfers to third countries

When using certain service providers, personal data may be processed outside the European Union or the European Economic Area.

Data will only be transferred to a third country if the conditions set out in Articles 44 et seq. of the GDPR are met.

In particular, this can be based on:

  • an adequacy decision by the European Commission,
  • in accordance with binding internal data protection regulations,
  • standard contractual clauses approved by the European Commission,
  • or any other guarantee permitted under the GDPR.

18. Duration of storage

Personal data is generally only stored for as long as is necessary for the respective purpose of processing.

Where statutory retention obligations apply, we store the relevant data for the duration of these obligations.

Data required for the performance of a contract may also be stored until the relevant limitation periods have expired, insofar as this is necessary for the assertion, exercise or defence of legal claims.

We generally process data on the basis of consent until such consent is withdrawn, provided there is no other legal basis for continued storage.

Data processed on the basis of a legitimate interest is, as a rule, deleted as soon as the purpose of processing no longer applies and there are no overriding reasons for further storage.

19. Your rights

Under the GDPR, you have the following rights in particular in relation to us:

19.1 Right of access – Article 15 of the GDPR

You have the right to request information on whether we process any personal data about you and, if so, what data we process, as well as to receive further information required by law regarding this processing.

19.2 Right to rectification – Art. 16 GDPR

You have the right to request, without delay, the rectification of inaccurate personal data and the completion of incomplete data.

19.3 Right to erasure – Article 17 of the GDPR

Subject to the statutory conditions, you have the right to request the erasure of your personal data.

In particular, the right to erasure does not apply where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

19.4 Right to restriction of processing – Article 18 of the GDPR

Subject to the statutory conditions, you have the right to request that the processing of your personal data be restricted.

19.5 Duty to notify – Article 19 of the GDPR

If you have exercised your right to rectification, erasure or restriction of processing, we will inform the recipients of the personal data concerned, insofar as this is required and possible by law.

We can provide you with information about these recipients on request.

19.6 Right to data portability – Article 20 of the GDPR

Provided that the legal requirements are met, you have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format, or to request that it be transferred to another data controller.

19.7 Right to withdraw consent – Article 7(3) of the GDPR

You may withdraw your consent at any time with effect for the future.

Withdrawal of consent does not affect the lawfulness of any processing carried out on the basis of your consent up to the time of withdrawal.

19.8 Right to lodge a complaint – Article 77 of the GDPR

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data breaches the GDPR.

In particular, you may contact a supervisory authority in the Member State of your habitual residence, your place of work or the place where the alleged infringement occurred.

20. Right to object under Article 21 of the GDPR

IF WE PROCESS PERSONAL DATA ON THE BASIS OF ARTICLE 6(1)(e) OR (f) OF THE GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

Following an objection, we will no longer process the personal data in question, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

IF PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF SUCH DATA FOR SUCH MARKETING PURPOSES.

Once you have objected, your personal data will no longer be processed for direct marketing purposes.

To exercise your rights, simply send an email to:

info@redwood.fashion

21. Automated decisions

As part of our online shop, we do not, as a matter of principle, make any decisions based solely on automated processing within the meaning of Article 22 of the GDPR that have legal effects on you or adversely affect you in a similarly significant manner.

Where payment service providers selected by you carry out automated risk, fraud, identity or credit checks on their own responsibility, this is governed by the data protection policy of the respective payment service provider.

22. Changes to this privacy policy

We reserve the right to amend this privacy policy should there be any changes to our website, the services we use, our data processing practices or the legal requirements.

The current version published on our website applies.