Datenschutzerklärung
Introduction
This Privacy Policy describes how bigandtallmart.shop collects, uses, discloses, stores and otherwise processes personal data when you visit our website, make a purchase, communicate with us or otherwise interact with our online store.
Contact concerning privacy matters:
Email: info@bigandtallmart.shop
This policy is intended to reflect applicable European data-protection requirements, including the General Data Protection Regulation ("GDPR") and relevant German privacy rules.
Important Controller Information
bigandtallmart.shop is the commercial designation used for this online store.
Privacy enquiries may be submitted to:
Article 13 GDPR requires a data controller collecting personal data to provide, among other things, the identity and contact details of the controller. Because the legal identity and geographic business address of the operator have not been supplied for preparation of this policy, those details have not been invented here.
Personal Data We May Collect
Depending on how you interact with our store, personal data processed in connection with the website may include:
- Name;
- Billing address;
- Shipping address;
- Email address;
- Telephone number where provided;
- Order information;
- Products purchased;
- Payment-related transaction information;
- Account information;
- Customer-service correspondence;
- Returns and refund information;
- Device information;
- Browser information;
- IP address;
- Website usage information;
- Cookie identifiers;
- Marketing preferences;
- Fraud-prevention information; and
- Other information you voluntarily provide.
We seek to process only information reasonably necessary for legitimate and specified purposes.
Information You Provide Directly
You may provide personal data when you:
Create or use a customer account, place an order, enter shipping information, complete checkout, request customer support, make a return request, exercise a withdrawal right, request a refund, subscribe to marketing or otherwise communicate with us.
If information is required to fulfil an order and you do not provide it, we may be unable to complete the requested transaction.
Information Collected Automatically
When you access our online store, certain technical information may be collected automatically.
This can include IP address, browser type, device type, operating system, referring pages, pages viewed, interaction information, timestamps and cookie or similar technology identifiers.
Some information is required for core ecommerce functionality, security and fraud prevention.
Other technologies used for analytics, personalisation or advertising may require consent before activation.
Cookies and Similar Technologies
We may use cookies, pixels, local storage and comparable technologies.
Technically necessary technologies may be used where required to provide requested website functions, such as maintaining a shopping cart, protecting checkout security or remembering essential settings.
German privacy guidance distinguishes necessary technologies from non-essential technologies. Non-essential tracking used for purposes such as behavioural analytics or personalised advertising generally requires valid consent.
Where consent is required, such technologies should not be activated until appropriate consent has been obtained.
Customers may be able to manage privacy preferences through the cookie or privacy controls displayed on our website.
Purposes for Processing Personal Data
We may process personal data for purposes including:
Processing and fulfilling orders, accepting payments, arranging delivery, providing order confirmations, administering returns and refunds, communicating with customers, maintaining customer accounts, preventing fraud, securing the website, complying with legal obligations, handling disputes, enforcing contractual rights, improving store functionality and providing marketing where permitted by law.
Legal Bases Under GDPR
Where the GDPR applies, personal data may be processed on one or more lawful bases.
Performance of a Contract
We may process information where necessary to enter into or perform a contract with you.
This includes processing information needed to manage an order, payment, shipment, return or refund.
Legal Obligations
We may process and retain information where required to comply with legal obligations, including applicable tax, accounting, consumer-protection and regulatory requirements.
Legitimate Interests
Where permitted, information may be processed for legitimate interests such as preventing fraud, protecting our systems, managing business operations, improving customer support and establishing or defending legal claims.
We balance legitimate interests against the rights and freedoms of affected individuals.
Consent
Where required, we rely on consent for activities such as certain marketing communications and non-essential tracking technologies.
You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Order Processing
When you place an order, we use relevant personal data to process your purchase.
This can include confirming the transaction, collecting payment, checking for fraud, arranging fulfilment, shipping products and communicating with you about your purchase.
Necessary information may be shared with service providers involved in completing the transaction.
Payments
Payment information may be processed by payment providers made available through Shopify or our checkout.
Payment processors may process personal information under their own legal and regulatory obligations.
We generally do not need customer-service personnel to receive complete payment-card credentials by email.
Do not email complete credit-card details to info@bigandtallmart.shop.
Shopify
Our store uses Shopify's ecommerce platform.
Shopify explains that merchants are generally controllers of their customers' personal data and that Shopify can act as a processor when handling customer information on behalf of a merchant.
Shopify may process information needed to operate the ecommerce platform, checkout, security, fraud prevention and related services.
Customers may also interact directly with certain Shopify services, in which case Shopify may process information in its own capacity according to its applicable privacy documentation.
Service Providers
Personal data may be disclosed where reasonably necessary to categories of recipients such as:
Hosting providers, ecommerce technology providers, payment processors, fraud-prevention providers, fulfilment providers, warehouses, shipping carriers, customer-service systems, analytics providers, marketing providers, professional advisers and IT or security providers.
Service providers should receive information only to the extent reasonably necessary for their applicable functions and subject to appropriate legal safeguards.
Shipping Providers
To deliver an order, relevant information such as your name, delivery address, contact information and order details may be supplied to fulfilment providers and shipping carriers.
These parties require relevant information to process and deliver the shipment.
Fraud Prevention and Security
We may process information to detect, investigate and prevent suspected fraudulent or unauthorised transactions.
Security-related processing may involve IP addresses, device information, transaction patterns, payment-related information and account activity.
Marketing Communications
Where permitted by applicable law, we may send marketing communications concerning products, offers or store information.
Where consent is required, such communications will be based on appropriate consent.
Customers may withdraw from marketing emails using an unsubscribe function where provided or by contacting:
Transactional messages concerning an existing order are not necessarily marketing communications and may still be sent where necessary to perform the contract or comply with legal requirements.
International Data Transfers
Some ecommerce or service providers may process personal information outside Germany or outside the European Economic Area.
Where GDPR restrictions on international transfers apply, appropriate transfer mechanisms should be used.
Shopify states that data concerning individuals in the EEA may be received by Shopify International Ltd and transferred within its international infrastructure using mechanisms including approved Binding Corporate Rules and Standard Contractual Clauses where appropriate.
Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and for applicable legal obligations.
Retention periods can vary according to the type of information.
Order and transaction records may need to be retained after an order has been completed where necessary for accounting, tax, consumer-law, fraud-prevention or legal-claims purposes.
When information is no longer required, it may be deleted, anonymised or otherwise handled in accordance with applicable requirements.
Data Security
We use reasonable organisational and technical measures intended to protect personal data from unauthorised access, alteration, disclosure, loss or misuse.
However, no online transmission or storage system can be guaranteed to be completely secure.
Customers should also take appropriate precautions, including protecting passwords and avoiding sending sensitive credentials through unsecured communications.
GDPR Rights
Subject to applicable conditions and exceptions, individuals may have rights including:
- The right of access;
- The right to rectification;
- The right to erasure;
- The right to restriction of processing;
- The right to data portability;
- The right to object to certain processing;
- The right to withdraw consent; and
- The right to lodge a complaint with a competent supervisory authority.
To submit a privacy request, contact:
We may need to verify your identity before processing certain requests to protect personal data from unauthorised disclosure.
Automated Processing
Certain ecommerce, fraud-prevention or payment systems may use automated processes to assess transactions or detect suspicious activity.
Where a decision is subject to specific GDPR rules concerning solely automated decision-making, applicable rights will be respected.
Children's Data
Our website is not intended to knowingly collect personal data from children who cannot lawfully enter into the relevant transaction or provide valid consent where consent is required.
If you believe a child has submitted personal data inappropriately, please contact:
Changes to This Policy
We may update this Privacy Policy when our practices, technologies or legal obligations change.
The current version will be published on bigandtallmart.shop with an updated revision date.
Material changes will be communicated where required by applicable law.
Contact
For questions, requests or complaints concerning this Privacy Policy or personal-data processing:
bigandtallmart.shop
Email: info@bigandtallmart.shop
- Choosing a selection results in a full page refresh.