Privacy policy

Unless otherwise stated below, the provision of your personal data is neither required by law or contract, nor is it necessary for the conclusion of a contract. You are not obligated to provide your data. Failure to provide data has no consequences. This only applies insofar as no other information is provided in the processing operations described below.

"Personal data" means any information relating to an identified or identifiable natural person.

Server Log Files

You may visit our website without providing any personal information.

Each time you access our website, usage data is transmitted by your internet browser to us or our web host/IT service provider and stored in log data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of the request, the IP address, the amount of data transferred, and the requesting provider.

Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in ensuring the smooth operation of our website and improving our services.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the USA. An adequacy decision of the EU Commission exists for Canada. For the USA, an adequacy decision of the EU Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to the EU Commission's Standard Contractual Clauses.

Contact

Data Controller

Please contact us if you wish. The controller responsible for data processing is: Davids Grinbergs, Ainazu iela 25 K-3 -2, LV-2160 Saulkrasti, Latvia, +37129166232, woof@northwoofs.com

Customer-Initiated Contact via Email

If you contact us by email on your own initiative for business purposes, we collect your personal data (name, email address, message text) only to the extent you provide it. The data processing serves to handle and respond to your enquiry.

If the contact is for the purpose of pre-contractual measures (e.g., consultation regarding purchase interest, preparation of quotes) or relates to a contract already concluded between you and us, this data processing is carried out on the basis of Art. 6(1)(b) GDPR.

If the contact is made for other reasons, this data processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in processing and responding to your enquiry. In this case, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Art. 6(1)(f) GDPR.

We use your email address solely to process your enquiry. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Data Collection and Processing When Using the Contact Form

When using the contact form, we collect your personal data (name, email address, message text) only to the extent you provide it. The data processing serves the purpose of establishing contact.

Use of Google Maps API Address Validation

We use the address validation service of Google (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, "Google") on our website.

The data processing serves the purpose of checking your entries in our address forms in real time for input and spelling errors, and supplementing any missing data where applicable. In the event of incorrectly entered data, alternative suggestions for correcting the data are displayed. For this purpose, the address data you enter is transmitted to the provider, stored there, and evaluated.

Among other things, the following information may be transmitted to and processed by Google: postal addresses (country, city, postal code, street, house number), email address, telephone number.

Your data may also be transferred to the USA. For the USA, an adequacy decision of the EU Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF, thereby committing to comply with European data protection principles.

The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in maintaining a correct data basis for the fulfilment of our contractual obligations. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.

The data is processed separately by the provider and is not merged with other data. It is deleted by the provider once the status of the entered data has been determined, but no later than 30 days.

For more information on terms of use and data protection at Google, please visit: https://cloud.google.com/maps-platform/terms and https://www.google.de/policies/privacy/.

Personalised Products

Personalised Products and Image Uploads

We offer an online designer (personaliser) on our website, in which you can design personalised products, for example with your dog's name, your contact details and, for some products, a photo of your dog. The data you enter (engraving text, design choices and any uploaded image) is transferred to us via encrypted data transfer, stored with your order and used to produce your product (e.g. laser engraving). The personaliser and the design previews are operated on our own servers at Cloudflare (see "Use of Cloudflare").

The data processing serves the purpose of creating personalised products. Processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you. Please only enter personal data of other people (e.g. a phone number on a dog tag) if you are entitled to do so.

Your data may be shared with service providers we engage as part of commissioned processing. No disclosure to other third parties takes place.

We use your entries and images solely within the scope of service provision. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Creation of Dog Portraits with OpenAI

For portrait products (e.g. portrait dog tags and portrait tumblers), our personaliser turns the photo of your dog that you upload into a drawn portrait. For this purpose, the uploaded photo is transmitted to the image service of OpenAI Ireland Ltd. (1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland; "OpenAI"), which creates the portrait on our behalf as a processor. Please upload photos that show your dog only, without people.

OpenAI does not use the transmitted data to train its models. OpenAI may store the data for a limited period (generally up to 30 days) to detect misuse and then deletes it. The photo and the finished portrait are stored on our servers at Cloudflare for the production of your order.

Your data may be transferred to the USA. This data transfer is based on the standard contractual clauses of the EU Commission agreed with OpenAI.

Processing is carried out on the basis of Art. 6(1)(b) GDPR, as you use the portrait function to design and order a personalised product.

For more information on data protection at OpenAI, please visit https://openai.com/policies/privacy-policy/.

Fitting Room

In our fitting room you can upload a photo of your dog and try our collars, leashes and dog tags on it. For this purpose, the photo is transmitted to fal.ai (Features and Labels, San Francisco, USA; "fal.ai"), which cuts out your dog and removes gear such as an existing collar from the photo on our behalf.

The original photo, the cut-out, the cleaned photo and your fitting room settings (e.g. your dog's name and the selected products) are stored on our servers at Cloudflare (storage location in Eastern Europe) under a random visitor key. We do not store your name or other contact details for this purpose.

Your data may be transferred to the USA. This data transfer is based on the standard contractual clauses of the EU Commission agreed with fal.ai.

Processing is carried out on the basis of Art. 6(1)(b) GDPR, as you use the fitting room as a service of our website. The data is deleted 90 days after your last visit to the fitting room, or immediately if you select "Delete all my dog photos" under "Your dogs".

Data Collection and Processing When Submitting Images via Email

You have the option of sending us images by email in connection with the order of a personalised product.

When you submit your images, we may collect your personal data (depictions of identifiable persons) only to the extent you provide it. The data processing serves the purpose of creating personalised products. The submitted image serves as a template for the product and is used accordingly (e.g., product engraving). Processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.

No disclosure of your data takes place.

We use the image you submit solely within the scope of service provision. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.

Customer Account / Orders

Customer Account

When opening a customer account, we collect your personal data to the extent specified therein. The data processing serves the purpose of improving your shopping experience and simplifying order processing. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out on the basis of the consent prior to revocation. Your customer account will subsequently be deleted.

Collection, Processing and Disclosure of Personal Data for Orders

When placing an order, we collect and process your personal data only to the extent necessary for the fulfilment and processing of your order and for handling your enquiries. The provision of data is necessary for the conclusion of the contract. Failure to provide data means that no contract can be concluded. Processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.

Your data may be disclosed to, for example, shipping companies, dropshipping or fulfilment providers, payment service providers, order processing service providers, and IT service providers. In all cases, we strictly comply with legal requirements. The scope of data transmission is limited to the minimum necessary.

Product Reviews with Loox

We use the review service Loox by Loox Online Ltd. (Israel; "Loox") on our website. The data processing serves the purpose of collecting reviews of our products and displaying them on our website.

After your order, we may ask you by email to review the products you purchased. For this purpose, your name, email address and the purchased products are transmitted to Loox. If you write a review, your review, the name you enter and any photos or videos you upload are published on our website. You decide yourself which content you upload.

The review request is sent on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in receiving feedback on our products, provided you have not objected. You may object to review requests at any time using the link in the email or by notifying us. The publication of your review is carried out on the basis of Art. 6(1)(a) GDPR with your consent, which you give by submitting the review. You may revoke your consent at any time; your review will then be removed.

Your data may be transferred to Israel. For Israel, an adequacy decision of the EU Commission exists. For other countries, Loox uses the standard contractual clauses of the EU Commission. Loox has appointed Prighter as its representative in the EU.

For more information on data protection at Loox, please visit https://loox.app/legal/privacy-policy-merchants.

Online Withdrawal Function

On our website you can declare the withdrawal from a contract online ("Withdraw from contract"). For this purpose, we process your name, the order number or other details of the contract, your email address, the date and time of receipt and, to prevent misuse, your IP address. The data is stored on our servers at Cloudflare (see "Use of Cloudflare"). We send you an acknowledgment of receipt by email via Cloudflare Email Service and keep a copy in our mailbox.

Providing the withdrawal function and sending the acknowledgment of receipt are required by law; processing is carried out on the basis of Art. 6(1)(c) GDPR. Processing of your IP address is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in preventing misuse; it is deleted after 24 hours. We store the withdrawal itself as proof for three years after the end of the year in which it was received; this is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in being able to prove the withdrawal and its date. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Art. 6(1)(f) GDPR.

Advertising

Use of Email Address for Sending Newsletters

We use your email address to send you information and offers by newsletter, provided you have expressly consented to this. The data processing serves exclusively the purpose of promotional contact. For this purpose, we process your email address and any other data you voluntarily provided when subscribing to our newsletter.

Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent prior to revocation.

You may unsubscribe from the newsletter at any time using the corresponding link in the newsletter or by notifying us. Your email address will then be removed from the distribution list. Despite removal from the distribution list, we may continue to store your email address on a so-called blacklist to prevent you from receiving newsletter emails from us in the future. This storage is carried out on the basis of Art. 6(1)(f) GDPR based on our and your legitimate interest in preventing the renewed use of your email address for sending our newsletter. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.

Use of Email Address for Sending Direct Advertising

We use your email address, which we obtained in the course of selling a product or service, for the electronic sending of advertising for our own products or services that are similar to those you have already purchased from us, provided you have not objected to this use. The provision of the email address is necessary for the conclusion of the contract. Failure to provide it means that no contract can be concluded. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in direct advertising. You may object to this use of your email address at any time by notifying us. The contact details for exercising your objection can be found in the Legal Notice (Impressum). You may also use the link provided for this purpose in the advertising email. No costs other than transmission costs at basic rates are incurred for this.

Use of Email Address for Availability Notifications

We offer on our website the service of product availability notifications. If an item is temporarily unavailable, you have the option of entering your email address for the respective item and being notified by email when the item becomes available, provided you have consented to this. You will receive a one-time notification by email about the availability of the respective item when it becomes available. Processing is carried out on the basis of Art. 6(1)(a) GDPR with your consent. You may revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent prior to revocation. You may unsubscribe from the availability notification at any time by notifying us. Your email address will then be removed from the distribution list.

Welcome Discount Code

On our website you can request a one-time welcome discount code with your email address and the answer to a short question (what matters most to you about a dog tag). We store your email address, your answer, your IP address and the time of the request on our servers at Cloudflare. The data processing serves the purpose of issuing the code, issuing only one code per email address, and preventing misuse of the offer (at most five codes per IP address per hour).

Processing of your email address and answer is carried out on the basis of Art. 6(1)(b) GDPR, as you request the code. Processing of your IP address is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in preventing misuse. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Art. 6(1)(f) GDPR.

If you also subscribe to our newsletter, the section "Use of Email Address for Sending Newsletters" applies. Your IP address is deleted after 24 hours. Your email address and answer are deleted when the welcome offer ends, or earlier on request.

Affiliate and Influencer Programme with BixGrow

We work with partners (e.g. influencers) who recommend our products. To recognise which partner referred an order, we use the affiliate service BixGrow by AZIDY PTE. LTD (3 Coleman Street, #03-24, Peninsula Shopping Complex, Singapore 179804; "BixGrow") on our website. When you reach our website via a partner's link or use a partner's discount code, BixGrow stores a cookie or comparable identifier and records the referral and, if applicable, the order (order number and order value). We do not transmit your name or address to the partner.

The data processing serves the purpose of calculating our partners' commissions.

The use of cookies or comparable technologies is carried out with your consent on the basis of Section 25(1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent prior to revocation.

Your data may be transferred to and processed in Singapore, the USA and Vietnam. This data transfer is based on the standard contractual clauses of the EU Commission.

For more information on data protection at BixGrow, please visit https://bixgrow.com/privacy-policy/.

Shipping Service Providers

Shipping via Swotzy

We buy our shipping labels via the shipping platform Swotzy by SIA Swotzy (Friča Brīvzemnieka iela 7, LV-3401 Liepāja, Latvia; "Swotzy"). Depending on the destination and the parcel, the shipment is carried by different carriers, such as Latvijas Pasts, DHL Express, FedEx or UPS. For this purpose, we transmit your name and delivery address to Swotzy and the respective carrier. Processing is carried out on the basis of Art. 6(1)(b) GDPR and is necessary for the performance of a contract with you.

In addition, we transmit your email address and telephone number to Swotzy and the carrier so that the carrier can inform you about the delivery (e.g. the expected delivery date) and contact you if there are questions about the delivery. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in a smooth delivery. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Art. 6(1)(f) GDPR; please let us know before your order is shipped. For shipments outside the European Union, the carriers may forward the data required for customs clearance to the authorities of the destination country.

Payment Service Providers

Use of PayPal Check-Out

We use the payment service PayPal Check-Out by PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of being able to offer you payment via the payment service. When you select and use payment via PayPal, credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfil the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Cookies may be stored in this process that enable recognition of your browser. The resulting data processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in offering a customer-oriented range of payment methods. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.

Credit Card via PayPal, Direct Debit via PayPal & "Pay Later" via PayPal

For certain payment methods such as credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, PayPal reserves the right to obtain a credit assessment based on mathematical-statistical methods using credit agencies. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information obtained about the statistical probability of payment default for a balanced decision on the establishment, performance, or termination of the contractual relationship. The credit assessment may include probability values (score values) calculated on the basis of scientifically recognised mathematical-statistical methods, which may include address data in their calculation. Your legitimate interests are taken into account in accordance with statutory provisions. The data processing serves the purpose of a credit check for the initiation of a contract. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in protection against payment default when PayPal makes advance payments.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR by notifying PayPal. The provision of data is necessary for the conclusion of the contract with your chosen payment method. Failure to provide it means that the contract cannot be concluded with your chosen payment method.

Third-Party Providers

When paying via a third-party provider's payment method, the data required for payment processing is transmitted to PayPal. This processing is carried out on the basis of Art. 6(1)(b) GDPR. To carry out this payment method, the data may then be forwarded by PayPal to the respective provider. This processing is carried out on the basis of Art. 6(1)(b) GDPR. Local third-party providers may include:

Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Invoice Purchase via PayPal

When paying via the invoice purchase payment method, the data required for payment processing is first transmitted to PayPal. To carry out this payment method, the data is then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to fulfil the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR. Ratepay may carry out a credit assessment based on mathematical-statistical methods (probability or score values) using credit agencies, following the process described above. The data processing serves the purpose of a credit check for the initiation of a contract. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in protection against payment default when Ratepay makes advance payments. For more information on data protection and which credit agencies Ratepay uses, please visit https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.

For more information on data processing when using PayPal, please see the PayPal privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Use of Shopify Payments

We use the payment service "Shopify Payments" by Shopify International Limited (2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website. Payment processing is carried out by the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; "Stripe"). The data processing serves the purpose of being able to offer you payment via the Shopify Payments payment service. When you select and use a corresponding "Shopify Payments" payment method, the data required for payment processing is transmitted to Stripe in order to fulfil the contract with you using the chosen payment method. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

Stripe reserves the right to obtain a credit assessment based on mathematical-statistical methods using credit agencies. For this purpose, Stripe transmits the personal data required for a credit check to a credit agency and uses the information obtained about the statistical probability of payment default for a balanced decision on the establishment, performance, or termination of the contractual relationship. The credit assessment may include probability values (score values) calculated on the basis of scientifically recognised mathematical-statistical methods, which may include address data in their calculation. Your legitimate interests are taken into account in accordance with statutory provisions. The data processing serves the purpose of a credit check for the initiation of a contract. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in protection against payment default when Stripe makes advance payments.

You have the right to object at any time, on grounds relating to your particular situation, to this processing of personal data concerning you based on Art. 6(1)(f) GDPR by notifying Stripe. The provision of data is necessary for the conclusion of the contract with your chosen payment method. Failure to provide it means that the contract cannot be concluded with your chosen payment method.

For more information on data processing when using the Shopify Payments service, please see the Shopify privacy policy at: https://www.shopify.com/legal/privacy.

For more information on data processing by the payment service provider Stripe, please see the Stripe privacy policy at: https://stripe.com/privacy.

Klarna and Other Payment Methods via Shopify Payments

Via Shopify Payments, we also offer payment methods of other providers, depending on your country, for example Klarna, iDEAL | Wero, Bancontact, MobilePay, Apple Pay, Google Pay and Shop Pay. The payment methods available to you are shown at checkout. When you select one of these payment methods, the data required for payment processing is transmitted to the respective provider. This processing is carried out on the basis of Art. 6(1)(b) GDPR.

If you choose Klarna, payment is processed by Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; "Klarna"). Depending on the Klarna payment option, Klarna may carry out a credit check; Klarna is responsible for this processing. More information can be found in Klarna's privacy notice at https://www.klarna.com/international/privacy-policy/.

Cookies

Our website uses cookies. Cookies are small text files that are stored in or by the internet browser on a user's computer system. When a user visits a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string that enables the browser to be uniquely identified when the website is accessed again.

Cookies are stored on your computer. You therefore have full control over the use of cookies. By selecting the appropriate technical settings in your internet browser, you can be notified before cookies are set and decide individually whether to accept them, as well as prevent the storage of cookies and the transmission of the data they contain. Cookies that have already been stored can be deleted at any time. However, we would like to point out that you may not be able to use all functions of this website to their full extent in that case.

You can find out how to manage (including disable) cookies in the most common browsers via the following links:

Chrome: https://support.google.com/accounts/answer/61416?hl=en

Microsoft Edge: https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09

Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

Safari: https://support.apple.com/en-us/guide/safari/manage-cookies-and-website-data-sfri11471/mac

Technically Necessary Cookies

Unless otherwise stated below in this privacy policy, we only use these technically necessary cookies for the purpose of making our services more user-friendly, effective, and secure. Cookies also enable our systems to recognise your browser after a page change and to offer you services. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised again after a page change.

The use of cookies or comparable technologies is carried out on the basis of Section 25(2) TDDDG. The processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in ensuring the optimal functionality of the website and a user-friendly and effective design of our services.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.

Our Cookie Banner

Our website uses its own cookie banner, which is part of our shop. It lets you consent to the use of cookies and similar technologies by category (Preferences, Statistics, Marketing) and revoke or change your consent at any time via the "Cookie settings" link at the bottom of every page. Under "Show cookies" in the cookie settings you can see the individual cookies, who sets them and how long they are stored. Your choice is passed on to Shopify's consent function, which applies it to Shopify's own cookies, tracking pixels and the checkout. With your consent under "Preferences", we also remember in your browser which products you viewed last (stored until you delete it).

To be able to prove that consent was given, we keep a record of each choice: a random identifier stored in your browser, the consent identifier assigned by Shopify, the date and time, the version of the banner, the language, the country and region (derived from your connection; your IP address is not stored) and your choice for each category. These records are stored on behalf of us by Cloudflare (see "Use of Cloudflare") in a database located in Western Europe and deleted after three years. Your choice itself is stored in your browser until you delete it.

The data processing is carried out to fulfil a legal obligation on the basis of Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. The storage of your choice in your browser is carried out on the basis of Section 25(2) TDDDG.

Analytics / Advertising Tracking / Communication

Use of Shopify Statistics

We use the statistics and analytics functions of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; "Shopify") on our website as part of commissioned processing. Shopify is an affiliated company of Shopify Inc. (151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).

The data processing serves the purpose of analysing this website and its visitors. For this purpose, data is stored for marketing and optimisation purposes and made available in reports, analyses, and statistics. The following device information, among others, is collected and processed: information about the web browser, IP address, time zone, and some of the cookies installed on your device. When you navigate the website, information about pages or products viewed, the referrer URL (the website through which you accessed our website), and information about how you interact with the website is also collected. Technologies such as cookies and web beacons, tags, and pixels (electronic files for capturing information about how you navigate the website) are used for this purpose.

For more information on data protection at Shopify, please visit https://www.shopify.com/legal/privacy, for information on the data processing agreement visit https://www.shopify.com/legal/dpa, and for information on cookies used visit https://www.shopify.com/legal/cookies.

Use of Google Analytics

If you consent under "Statistics", we use Google Analytics 4 by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.

The data processing serves the purpose of analysing this website and its visitors in order to improve our offer. Google Analytics uses cookies (_ga, _ga_*) and similar technologies to collect information about your use of the website, such as the pages viewed, the time spent on them, the website through which you accessed our website, information about your device and browser and your approximate location. Google Analytics 4 does not store your full IP address. The cookies are stored for up to two years.

Your data may be transferred to and processed in third countries outside the EU, in particular the USA. For the USA, an adequacy decision of the EU Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Google LLC is certified under the TADPF.

For more information on data protection at Google, please visit https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

Use of Meta Pixel

We use the Meta Pixel by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; "Meta") on our website.

Meta and we are joint controllers for the collection of your data and its transmission to Meta when the service is integrated. This is based on an agreement between us and Meta on the joint processing of personal data, which sets out the respective responsibilities. The agreement is available at https://de-de.facebook.com/legal/terms/businesstools. According to this agreement, we are responsible in particular for fulfilling the information obligations pursuant to Art. 13 and 14 GDPR, for complying with the security requirements of Art. 32 GDPR with regard to the correct technical implementation and configuration of the service, and for complying with the obligations under Art. 33 and 34 GDPR insofar as a breach of the protection of personal data concerns our obligations under the joint processing agreement. Meta is responsible for enabling the data subject rights pursuant to Art. 15–20 GDPR, for complying with the security requirements of Art. 32 GDPR with regard to the security of the service, and for complying with the obligations under Art. 33 and 34 GDPR insofar as a breach of the protection of personal data concerns Meta's obligations under the joint processing agreement.

The application serves the purpose of targeting website visitors with interest-based advertising on the social networks Facebook and Instagram. For this purpose, the Meta remarketing tag has been implemented on the website. This tag establishes a direct connection to the Meta servers when you visit the website. This transmits to the Meta server which of our pages you have visited. Meta associates this information with your personal Facebook and/or Instagram user account. When you visit the social networks Facebook or Instagram, you will then be shown personalised, interest-based advertisements.

The application also serves the purpose of creating conversion statistics. In this context, we learn the total number of users who clicked on one of our advertisements and were redirected to a page tagged with a conversion tracking tag, as well as what actions were taken after being redirected to this website. However, we do not receive any information that would allow users to be personally identified.

Your data may be transferred to the USA. For the USA, an adequacy decision of the EU Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Meta has certified itself under the TADPF, thereby committing to comply with European data protection principles.

The processing of your personal data is carried out with your consent on the basis of Art. 6(1)(a) GDPR. You may revoke your consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent prior to revocation.

You can deactivate the "Custom Audiences" remarketing function here. For more information on the collection and use of data by Meta, your rights in this regard, and options for protecting your privacy, please see Meta's privacy policy at https://www.facebook.com/about/privacy/.

Meta Conversions API

In addition to the Meta Pixel, we use the Meta Conversions API. With it, the events described above (e.g. page views, products added to the cart and purchases) are also transmitted to Meta directly from the server of our shop system, together with your email address and phone number in encrypted (hashed) form, so that Meta can match them to your account. This only takes place if you have consented to the use of the Meta Pixel. The legal basis and your options to revoke your consent are the same as for the Meta Pixel.

Use of Google Ads Conversion Tracking

We use the online advertising programme "Google Ads" and, in this context, conversion tracking (visitor action analysis) on our website. Google Conversion Tracking is an analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; Google).

When you click on an advertisement placed by Google, a cookie for conversion tracking is placed on your computer. These cookies have a limited validity, do not contain personal data, and are therefore not used for personal identification. When you visit certain pages of our website and the cookie has not yet expired, Google and we can recognise that you clicked on the advertisement and were redirected to this page. Each Google Ads customer receives a different cookie. This means that cookies cannot be tracked across the websites of Ads customers.

The information obtained using the conversion cookie serves the purpose of creating conversion statistics. In this context, we learn the total number of users who clicked on one of our advertisements and were redirected to a page tagged with a conversion tracking tag. However, we do not receive any information that would allow users to be personally identified.

Your data may be transferred to the servers of Google LLC in the USA. For the USA, an adequacy decision of the EU Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF, thereby committing to comply with European data protection principles.

For more information and Google's privacy policy, please visit: https://www.google.com/policies/privacy/

Use of the Remarketing or "Similar Audiences" Function

We use the remarketing or "Similar Audiences" function of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.

The application serves the purpose of analysing visitor behaviour and visitor interests. To carry out the analysis of website usage, which forms the basis for creating interest-based advertisements, Google uses cookies. The cookies record visits to the website and anonymised data about the use of the website. No personal data of website visitors is stored. If you subsequently visit another website in the Google Display Network, you will be shown advertisements that are likely to take into account previously accessed product and information areas.

Your data may be transferred to servers of Google LLC in the USA. For the USA, an adequacy decision of the EU Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF, thereby committing to comply with European data protection principles.

For more information on Google Remarketing and the associated privacy policy, please visit: https://www.google.com/privacy/ads/

Plugins and Other Services

Use of Cloudflare

We use services of Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA; "Cloudflare") on our website. Cloudflare delivers certain content of our website via its network of servers in various data centres (Content Delivery Network). In addition, we operate our own website functions on Cloudflare's servers, in particular the personaliser, the product pictures of our designs, the fitting room and the welcome discount code. Data you enter in these functions is processed and stored there as described in the respective sections.

The data processing serves the purpose of optimising the loading times of our website, operating these functions securely and thereby making our services more user-friendly.

The following information, among others, may be collected: IP address, system configuration information, information about traffic to and from our website (so-called server log files).

Your data may be transferred to the USA. For the USA, an adequacy decision of the EU Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Cloudflare has certified itself under the TADPF, thereby committing to comply with European data protection principles.

Insofar as Cloudflare only delivers our website, the processing of your personal data is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in the needs-based and targeted design of the website. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Art. 6(1)(f) GDPR. For the functions you use, the legal bases stated in the respective sections apply.

For more information on data protection when using Cloudflare, please visit https://www.cloudflare.com/privacypolicy/.

Customer Photos from Instagram

On our product pages we show selected public Instagram posts in which customers have tagged @northwoofs, with the Instagram username and a link to the original post. We retrieve these posts via the official interface of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) and select them ourselves.

The data processing serves the purpose of showing real photos of our products in use. Processing is carried out on the basis of Art. 6(1)(f) GDPR based on our overriding legitimate interest in presenting our products, as the posts were published by you and you tagged us in them. You have the right to object at any time; please let us know and we will remove your post from our website.

Use of Google Fonts

We use Google Fonts by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.

The data processing serves the purpose of uniformly displaying fonts on our website. To load the fonts, a connection to Google servers is established when the page is accessed. Cookies may be used in this process. Your IP address and information about the browser you use, among other things, are processed and transmitted to Google. This data is not linked to your Google account.

Your data may be transferred to the USA. For the USA, an adequacy decision of the EU Commission exists in the form of the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF, thereby committing to comply with European data protection principles.

For more information on data processing and data protection, please visit https://www.google.com/intl/en/policies/ and https://developers.google.com/fonts/faq.

Data Subject Rights and Storage Duration

Duration of Storage

After complete contract processing, the data is initially stored for the duration of the warranty period, then taking into account statutory retention periods, in particular those under tax and commercial law, and then deleted after expiry of the period, unless you have consented to further processing and use.

Rights of the Data Subject

You have the following rights under Art. 15 to 20 GDPR, provided the legal requirements are met: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability.

In addition, you have a right to object under Art. 21(1) GDPR to processing based on Art. 6(1)(f) GDPR, as well as to processing for the purposes of direct marketing.

Right to Lodge a Complaint with the Supervisory Authority

You have the right under Art. 77 GDPR to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.

Right to Object

If the personal data processing operations listed here are based on our legitimate interest pursuant to Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to these processing operations with effect for the future.

After the objection has been made, the processing of the data concerned will be terminated, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the assertion, exercise, or defence of legal claims.

If the personal data processing is carried out for the purposes of direct marketing, you may object to this processing at any time by notifying us. After the objection has been made, we will cease processing the data concerned for the purposes of direct marketing.

Last updated: 12 October 2026

Country/region