Privacy

The controller for data processing on this website is elty GmbH (contact: hello@elty.studio). The full company details are listed in the Impressum.

We process personal data only where it is required to run this shop, fulfil your orders, manage your customer account and — if you have opted in — send the newsletter. We do not sell data, and there is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes technically necessary connection data (IP address, date and time, requested page, browser identifier) to deliver the site and keep it secure (server logs). The legal basis is our legitimate interest in secure, performant operation (Art. 6(1)(f) GDPR). Transfers to the USA rest on the EU-US Data Privacy Framework and standard contractual clauses. Log data is deleted automatically after a short period.

Name resolution for our domain runs via Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. No website content passes through Cloudflare; only technical DNS queries are processed. Legal basis: Art. 6(1)(f) GDPR (stable, secure operation of the domain).

Our shop backend, order processing and payment run on Shopify International Limited, Victoria Buildings, 2nd floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. When you order, we process the data required to fulfil the contract: name, delivery address, email address, phone number where provided, and order and payment information (Art. 6(1)(b) GDPR). Payment details (e.g. card numbers) are processed exclusively by the respective payment provider and never reach our systems.

If you create an account, we additionally store your credentials (the password only as a cryptographic hash at Shopify), your address book and your order history (Art. 6(1)(b) GDPR). You can delete your account yourself at any time under “Account → Data & privacy”; order records are retained for as long as statutory retention periods require (up to 10 years, § 257 HGB, § 147 AO — Art. 6(1)(c) GDPR).

We set necessary cookies without consent (§ 25(2) TTDSG, Art. 6(1)(b) and (f) GDPR) — without them the bag and sign-in cannot work. Every other category (statistics, marketing) is used exclusively after your consent via the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TTDSG). You can change your decision at any time with effect for the future: open cookie settings

During checkout, Shopify sets its own cookies that are necessary for the purchase; Shopify's privacy policy additionally applies there.

If you have consented via the banner, we use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure reach. IP addresses are truncated; a transfer to the USA is possible and rests on the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR), revocable at any time via the cookie settings. Without consent, no statistics or marketing services load at all.

For the newsletter we use your email address with double opt-in: the subscription only becomes active once you confirm the link in the signup email. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time — via the link in every email or in your account. Sending runs through Shopify's systems (section 5).

Your wishlist is stored locally on your device. If you are signed in, we additionally store it in your account so it is available across devices (Art. 6(1)(b) GDPR). It is deleted together with the account.

If you email us, we process your details to answer the enquiry (Art. 6(1)(b) or (f) GDPR) and delete them once the matter is closed and no retention duties apply.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Contact hello@elty.studio — you can also trigger access and erasure directly in your account under “Data & privacy”. You additionally have the right to complain to a data protection supervisory authority (Art. 77 GDPR), for example the authority of your place of residence.

Version: July 2026. We update this policy when processing or the legal situation changes; the version published here applies.