DE EN

Privacy Policy

Draft – not legally reviewed, as of 2026-09-19. This page will only be published after explicit approval by Dominik.

Privacy Policy

Version: [DATENSCHUTZ_STAND]

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

byGAVRANII
Owner: Dominik Đurak
Siegbertstraße 17
67346 Speyer
Germany
Phone: [TELEFON]
E-mail: info@bygavranii.de

No data protection officer has been appointed, as the legal requirements for this are not met. Please direct data protection enquiries to the contact details above.

2. General information on data processing

We process personal data only to the extent necessary to provide a functional website, our content and services, and to process orders. Depending on the purpose, the legal bases are:

  • Art. 6 (1) (a) GDPR (consent),
  • Art. 6 (1) (b) GDPR (performance of a contract or pre-contractual measures),
  • Art. 6 (1) (c) GDPR (legal obligation, e.g. tax retention obligations),
  • Art. 6 (1) (f) GDPR (legitimate interest).

Personal data is deleted or blocked as soon as the purpose of storage ceases to apply and no statutory retention obligations stand in the way.

3. Hosting and server log files

This website is hosted by Hostinger. Provider: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (verify: responsible contracting entity and server location [SERVERSTANDORT]). A data processing agreement pursuant to Art. 28 GDPR is in place with Hostinger.

When you visit the website, your browser automatically transmits the following data, which is stored in server log files: IP address, date and time of the request, page or file accessed, amount of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL.

The purpose is to deliver the website, ensure stability and security, and analyse errors. The legal basis is Art. 6 (1) (f) GDPR. Log files are deleted after [LOG_SPEICHERDAUER] unless they are required for longer to investigate a security incident. They are not merged with other data sources.

4. Cookies and storage techniques

This website only uses technically necessary cookies (basket, session, customer account login, language selection, payment processing). Access to information on your device that is strictly necessary for the functions you have expressly requested does not require consent under Section 25 (2) No. 2 TDDDG. Insofar as personal data is processed in this context, this is based on Art. 6 (1) (b) GDPR (contract processing) or Art. 6 (1) (f) GDPR (functional operation of the website).

No analytics, tracking or marketing cookies are used. An overview of the cookies used and their storage periods can be found in the Cookie Notice.

5. Fonts and external content

The fonts used (Cormorant Garamond, Montserrat) are stored locally on our server. No connection is made to servers of Google or other font providers. We do not embed maps, videos or social media plugins from third parties.

6. Contact (e-mail, contact form, phone)

If you contact us by e-mail, via the contact form or by phone, we process the data you provide (name, e-mail address, order number if applicable, and the content of your message) to handle your enquiry. Mandatory fields in the contact form are marked as such.

The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry relates to a contract or its initiation, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). The data is deleted once the enquiry has been fully processed and no retention obligations stand in the way; enquiries relating to a contract are retained together with the contract documents.

E-mails are sent via [MAIL_ANBIETER] (verify: Hostinger mailbox or external mail service, possibly a processor).

7. Customer account

You can optionally create a customer account. The data provided during registration (name, e-mail address, password in encrypted form, billing and delivery addresses) and your order history are stored. Registration is voluntary; orders can also be placed as a guest.

The legal basis is Art. 6 (1) (b) GDPR. You can have your customer account deleted at any time in the account settings or by contacting us. Data that we must retain for tax or commercial law reasons is blocked after deletion of the account for the duration of the statutory periods and deleted thereafter.

8. Orders and contract processing

To process your order, we process the following data: name, billing and delivery address, e-mail address, phone number if provided (for queries and delivery, voluntary), items ordered, order and payment information (without full payment details), IP address and time of the order. The legal basis is Art. 6 (1) (b) GDPR.

Order data is stored for the duration of the statutory retention periods (generally 10 years for accounting records and invoices under Section 147 of the German Fiscal Code (AO) and Section 14b of the German VAT Act (UStG); 6 years for commercial and business letters under Section 257 of the German Commercial Code (HGB)). The legal basis for retention is Art. 6 (1) (c) GDPR.

8.1 Transfer to the production partner Shirtee (fulfilment)

After receipt of the order, our textiles are printed and shipped by our production partner: Shirtee GmbH, [SHIRTEE_ANSCHRIFT] (verify). For this purpose, we transmit the data necessary for production and shipping: name, delivery address, items ordered (product, size, colour, design), order number and, where required for delivery, e-mail address and phone number.

Shirtee processes this data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR [AV_VERTRAG_SHIRTEE: status open]. The legal basis for the transfer is Art. 6 (1) (b) GDPR.

8.2 Transfer to carriers

For delivery, Shirtee passes your name and delivery address on our behalf to the respective carrier (DHL, DPD, Deutsche Post Warenpost, GLS or UPS, depending on the destination country). Your e-mail address or phone number is only passed on to the carrier if you have expressly consented to this for delivery notifications (Art. 6 (1) (a) GDPR); you can withdraw this consent at any time with effect for the future.

8.3 Payment service providers

Depending on the payment method selected, we transmit the data required for payment (name, billing address, e-mail address, amount, order number and, where applicable, basket contents) to the respective payment service provider. The payment service providers are independently responsible under data protection law for processing your payment data. The legal basis for the transfer is Art. 6 (1) (b) GDPR.

PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. When paying with PayPal, you are redirected to the PayPal website; PayPal may carry out a credit or risk assessment for fraud prevention. Privacy statement: https://www.paypal.com/de/legalhub/privacy-full

Card payment via WooPayments: WooPayments is provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA (verify: for the EEA possibly Aut O’Mattic A8C Ireland Ltd., Dublin). Technical payment processing is carried out by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Card details are transmitted directly to the payment service provider and are not stored on our servers. For fraud prevention, the payment service provider may process device and browser information as well as the IP address (Art. 6 (1) (f) GDPR, legitimate interest in secure payments). Data may be transferred to the USA; this is based on the provider’s certification under the EU-US Data Privacy Framework or on standard contractual clauses (verify). Privacy statements: https://automattic.com/privacy/ and https://stripe.com/de/privacy

9. Order confirmation and transactional e-mails

After an order, we send you transactional e-mails (acknowledgement of receipt, order confirmation with GTC and Instructions on Withdrawal, shipping confirmation and, where applicable, refund confirmation). The legal basis is Art. 6 (1) (b) GDPR. We currently do not send a newsletter. Should we introduce a newsletter, this will only be done with your express consent using the double opt-in procedure.

10. Reviews

We currently do not offer product reviews. [BEWERTUNGEN: add section if WooCommerce reviews are activated.]

11. Our social media profiles

We maintain profiles on Instagram and TikTok. This website does not embed plugins or content from these networks; only links are provided. When you visit our profiles, the privacy policies of the respective provider apply, over which we have no influence:

  • Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy policy: https://privacycenter.instagram.com/policy
  • TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (verify). Privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en

Insofar as the providers make statistics on the use of our profiles available to us (“insights”), we are joint controllers with the provider within the meaning of Art. 26 GDPR. Processing is based on Art. 6 (1) (f) GDPR (information and communication with interested parties). You can address requests regarding your rights to us or directly to the provider; we will forward them where necessary.

12. Encryption

This website uses TLS/SSL encryption (recognisable by “https://” and the padlock symbol in the browser). Data you transmit to us cannot be read by third parties as a result.

13. Your rights

You have the following rights with regard to personal data concerning you:

  • right of access (Art. 15 GDPR),
  • right to rectification (Art. 16 GDPR),
  • right to erasure (Art. 17 GDPR),
  • right to restriction of processing (Art. 18 GDPR),
  • right to data portability (Art. 20 GDPR),
  • right to object to processing (Art. 21 GDPR, see below),
  • right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, an informal message to info@bygavranii.de is sufficient.

Right to object: Insofar as we process data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
(State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate)
Hintere Bleiche 34
55116 Mainz, Germany
Phone: +49 6131 208-2449
E-mail: poststelle@datenschutz.rlp.de
https://www.datenschutz.rlp.de

14. No automated decision-making

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Payment service providers may carry out their own automated checks for fraud prevention; they are independently responsible for this.

15. Obligation to provide data

Providing personal data is not required to visit the website. For an order, the information marked as mandatory is necessary; without it, we cannot conclude and perform the contract.

16. Changes to this privacy policy

We will adapt this privacy policy if the legal situation, our website or our processing operations change. The version published on this page at the relevant time applies.