Datenschutzerklärung

1. Who We Are and Scope

For the processing described in this policy, the operator trading as thecarsonhouse.shop acts as controller unless another party is identified as controller for a particular service. This policy applies to the website, checkout, customer service and related online retail activities directed to Germany.

2. Personal Information We Collect

Identity and contact data, including name, billing and delivery address, email address and telephone number.

Order and transaction data, including products, quantities, payments, refunds, delivery status and customer-service history.

Account data, including login credentials, preferences and saved information.

Device and usage data, including IP address, browser, device identifiers, pages viewed, referral source and interaction events.

Marketing and preference data, including subscriptions, consent records and communication preferences.

Content supplied by the customer, such as messages, reviews, photographs of damaged items and other correspondence.

Fraud-prevention and verification information generated during payment and security checks.

Payment card details are normally processed by payment providers and ecommerce service providers. We may receive limited payment information such as payment status, payment method type, transaction identifier and the last digits of a card, rather than complete card credentials.

3. How We Collect Information

Information is collected directly when a customer submits it; automatically through cookies, logs and similar technologies; and from service providers involved in ecommerce hosting, payments, fraud prevention, analytics, advertising, fulfilment, delivery and customer support. We may also receive information from a person who purchases a gift or arranges delivery for another recipient.

4. Purposes and Lawful Bases

We process personal information only where we have a lawful basis. Depending on the activity, this may be performance of a contract, compliance with a legal obligation, our legitimate interests, consent, or the establishment, exercise or defence of legal claims.

To process orders, take payment, arrange delivery, provide updates and administer returns: performance of a contract.

To answer pre-sale questions and take steps requested before a contract: performance of a contract or steps before entering one.

To prevent fraud, protect accounts, secure the website and enforce terms: legitimate interests and, where applicable, legal obligations.

To maintain tax, accounting and transaction records: legal obligations and legitimate interests.

To improve products, website usability and customer service: legitimate interests, using consent where required for cookies or similar technologies.

To send promotional electronic communications: consent or the limited existing-customer exception where legally available, with an opt-out in every message.

To manage complaints, disputes and legal claims: legitimate interests and legal obligations.

5. Cookies and Similar Technologies

We use essential technologies necessary for core functions such as baskets, checkout, fraud prevention, security and preference storage. Subject to the choices presented on the website, we may also use analytics, personalisation and advertising technologies. Where German law requires consent for non-essential cookies or similar technologies, those technologies should not be used until valid consent is obtained.

Visitors may use the website's cookie controls and browser settings to change preferences. Blocking essential cookies may prevent parts of the service from functioning. Cookie choices can be withdrawn or changed at any time through the available control, although withdrawal does not make earlier lawful processing unlawful.

6. How We Share Personal Information

Shopify and other ecommerce infrastructure providers that host or support the store.

Payment processors, banks and fraud-prevention providers.

Warehouses, suppliers, carriers, couriers and delivery partners.

Technology, security, analytics, advertising and customer-support providers.

Professional advisers, insurers, auditors and authorities where reasonably necessary.

A buyer, investor or successor in connection with a proposed or completed reorganisation, financing, sale or transfer, subject to appropriate safeguards.

We do not sell personal information in the ordinary meaning of selling customer lists for money. Advertising technologies may involve disclosures or profiling that are regulated differently in some jurisdictions; users should use the website's privacy and cookie controls where available.

7. International Transfers

Some providers may process information outside the European Economic Area. Where personal information is transferred internationally, we use an available lawful transfer mechanism and appropriate safeguards, such as an adequacy decision of the European Commission, approved Standard Contractual Clauses, or another mechanism recognised by German law.

8. Retention

We keep information only for as long as reasonably necessary for the purposes described, including order fulfilment, customer support, warranties, fraud prevention, accounting, tax and legal claims. Retention depends on the type of record, contractual and legal limitation periods, statutory record-keeping duties, dispute risk and security needs. When information is no longer required, we delete or anonymise it where reasonably practicable.

9. Security

We use proportionate organisational and technical measures intended to protect information against unauthorised access, loss, alteration or disclosure. No internet transmission or storage system is completely secure. Customers should protect account credentials, use unique passwords and contact us promptly if they suspect unauthorised account activity.

10. Your GDPR Data Protection Rights

The right to be informed about how personal information is used.

The right of access to personal information.

The right to correct inaccurate or incomplete information.

The right to erasure in applicable circumstances.

The right to restrict processing in applicable circumstances.

The right to data portability for certain information.

The right to object to processing based on legitimate interests and to direct marketing.

Rights relating to decisions based solely on automated processing where applicable.

The right to withdraw consent at any time where processing relies on consent.

To exercise a right, email info@thecarsonhouse.shop. We may ask for information reasonably necessary to verify identity and locate records. Rights are not absolute and lawful exemptions may apply. We aim to respond within the period required by law.

11. Marketing Communications

Marketing choices are separate from transactional messages about orders, safety, accounts and customer service. Recipients can unsubscribe through the link in a marketing email or by contacting us. We may keep a minimal suppression record to ensure that an opt-out is respected.

12. Children

Our retail services are not directed to children, and we do not knowingly seek to collect personal information directly from children. Purchases should be made by adults with legal capacity to enter a contract. If a parent or guardian believes a child has provided personal information, they may contact us.

13. Complaints

Please contact info@thecarsonhouse.shop first so that we can review a privacy concern. Individuals also have the right to complain to the competent German data protection supervisory authority. The competent authority depends on the controller's actual establishment and activities. Contact details for German supervisory authorities are available through the Federal Commissioner for Data Protection and Freedom of Information and the relevant state authority.

14. Changes to This Policy

We may update this policy to reflect legal, operational or service changes. The revised version will be published with an updated effective date. Material changes may also be communicated through the website or another appropriate channel.