Privacy policy
Privacy Policy
Last updated: 28 July 2026
Protecting your personal data matters to us. Below we explain what data we collect, the purposes for which we process it, the legal basis for doing so, and the rights available to you.
2. Definitions and Scope
This Privacy Policy applies to our online shop at www.schachatelier.de and www.schachatelier.com, including all associated content, features, and services.
"Personal data" means any information relating to an identified or identifiable natural person. It does not include data collected anonymously or anonymised in such a way that you can no longer be identified.
3. Legal Bases for Processing
We process personal data on the basis of the following provisions of the General Data Protection Regulation (GDPR):
- Art. 6(1)(a) GDPR (consent) – for example, for newsletter distribution, non-essential cookies, and analytics and marketing services.
- Art. 6(1)(b) GDPR (performance of a contract) – for processing your order, manufacturing personalised items, shipping, and handling returns.
- Art. 6(1)(c) GDPR (legal obligation) – in particular to comply with commercial and tax record-retention requirements.
- Art. 6(1)(f) GDPR (legitimate interests) – to ensure technical security, prevent fraud, and tailor our offering to demand.
Storing information on your device and accessing information already stored there is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
4. Categories of Data Processed
- Contact data – name, postal address, billing and delivery address, phone number, email address.
- Contract and transaction data – items ordered, order number, order date, returns, cancellations, wish lists.
- Payment data – payment method, payment status, transaction identifiers. Full card or bank account details are processed exclusively by the respective payment service provider and are never transmitted to us in plain text.
- Personalisation data – engraving text you provide (names, dates, short dedications).
- Account information – username, password (encrypted), settings.
- Communication data – the content of your enquiries by email, contact form, or chat.
- Usage and device data – IP address, browser type and version, operating system, referrer URL, time of access, pages visited, cookie identifiers.
5. Hosting, Shop Platform, and Server Log Files
Our online shop runs on the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes all data arising from the operation of the shop on our behalf, under a data processing agreement pursuant to Art. 28 GDPR.
Each time our website is accessed, information is automatically recorded in server log files: IP address, date and time of access, page requested, volume of data transferred, referrer URL, and browser and operating system information. This processing is technically necessary in order to deliver the website and ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR.
Data may be transferred to Shopify group companies in Canada and the United States. Canada is covered by an adequacy decision of the European Commission. For transfers to the United States, Shopify relies on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
Further information: https://www.shopify.com/legal/privacy
For internal administration, analysis, and maintenance of our shop, we use AI-assisted tools that can access shop data via a secured interface. Your personal data is not used to train AI models. The legal basis is Art. 6(1)(f) GDPR.
6. Cookies and Similar Technologies
We use cookies and comparable technologies (e.g. pixels, local storage). Cookies are small text files stored on your device.
6.1 Strictly Necessary Cookies
These cookies are required for the shop to function – for the cart, session management, language settings, and checkout security. They are set without your consent. The legal basis is Section 25(2)(2) TDDDG in conjunction with Art. 6(1)(f) GDPR.
6.2 Cookies Requiring Consent
Cookies and technologies used for statistics, analytics, audience measurement, and advertising are deployed only if you have first given consent via our cookie banner. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
6.3 Withdrawing Consent
You may withdraw your consent or change your selection at any time with future effect. To do so, use the Your Privacy Settings page or the corresponding link in the footer of our shop. Withdrawal does not affect the lawfulness of processing carried out beforehand.
You can also delete cookies through your browser settings or prevent them from being stored at all. Please note that some features of our shop may then no longer work fully.
7. Order Processing and Customer Account
To process your order we handle your contact, contract, and payment data. Without this information the contract cannot be concluded and the order cannot be fulfilled. The legal basis is Art. 6(1)(b) GDPR.
You may optionally create a customer account to view orders and save addresses. Registration is voluntary and is based on Art. 6(1)(b) GDPR. You can have your account deleted at any time; statutory retention periods remain unaffected.
8. Personalisation and Engraving
For personalised products we collect the engraving text you enter during checkout. To display and capture these input fields we use the Easify Product Options application, which acts as a processor on our behalf.
Engraving details are used exclusively to manufacture and deliver your product and are transmitted to our production partner for that purpose. They are not used for advertising. The legal basis is Art. 6(1)(b) GDPR.
Please note: engraving text cannot be changed once production has begun. Personalised items are excluded from the right of withdrawal under Section 312g(2)(1) of the German Civil Code (BGB).
9. Payment Processing
We offer several payment methods. Depending on the method you choose, your payment data is transmitted to the respective payment service provider, which acts as an independent controller in this respect. The legal basis is Art. 6(1)(b) GDPR.
- Shopify Payments – Shopify International Limited, Dublin, Ireland. Privacy notice
- Klarna – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For pay-on-invoice and instalment payments, Klarna carries out its own identity and credit checks. Privacy notice
- PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. Privacy notice
- Apple Pay – Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland.
- Google Pay – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We neither collect nor store full card or bank account details.
10. Shipping, Fulfilment, and Production Partners
To deliver your order we pass your delivery and contact details to the appointed shipping company. The legal basis is Art. 6(1)(b) GDPR.
We work with the following partners for production and delivery:
- Production partner in Türkiye – Some of our handcrafted and personalised chess sets are made by a partner workshop in Türkiye and shipped directly from there to you. For this purpose we transmit the data required for production and delivery (name, delivery address, order contents, and where applicable the engraving text). Türkiye is not covered by an adequacy decision of the European Commission; the transfer therefore relies on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
- FFOrder – application for the automated transmission of order and delivery data to our production partners.
- Base – fulfilment service provider based in Poland. To pick, pack, and ship your order we transmit the data required for that purpose (name, delivery address, order contents, and – for personalised items – the engraving text). Processing takes place within the European Union under a data processing agreement pursuant to Art. 28 GDPR.
- Gelato – Gelato ASA, Oslo, Norway. Production and shipping of selected printed products (e.g. wall art) through a network of local production sites. Norway is part of the European Economic Area.
- Shopify Collective – application connecting vetted suppliers within the Shopify network; operated by Shopify (see section 5).
11. Customer Reviews
To collect and display product and shop reviews we use Judge.me (Judge.me Ltd., United Kingdom).
After an order is completed we send you an invitation to leave a review. For this, your email address, name, and order data are transmitted to Judge.me. Leaving a review is voluntary. The legal basis for sending the review invitation is your consent under Art. 6(1)(a) GDPR and Section 7(3) of the German Act Against Unfair Competition (UWG); for publishing the review submitted, Art. 6(1)(f) GDPR.
The United Kingdom is covered by an adequacy decision of the European Commission. Information on the authenticity of our reviews can be found on our "Authenticity of Customer Reviews" page.
12. Newsletter and Email Marketing
To send our newsletter and transaction-related marketing emails we use Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA).
Sign-up uses a double opt-in procedure: after registering you receive an email in which you must expressly confirm your subscription. We store your IP address and the time of sign-up and confirmation in order to evidence the registration process.
Our newsletters contain tracking pixels and individualised links. This allows us to see whether and when an email was opened and which links were clicked. We use this analysis to improve our content. With your consent, Klaviyo may additionally record your behaviour in our shop (e.g. products viewed, abandoned carts) in order to send you more relevant content.
The legal basis is your consent under Art. 6(1)(a) GDPR. You may unsubscribe at any time via the link at the bottom of every email or by writing to info@schachatelier.de.
Klaviyo is certified under the EU-U.S. Data Privacy Framework; Standard Contractual Clauses pursuant to Art. 46 GDPR apply in addition.
13. Web Analytics and Audience Measurement
13.1 Shopify Analytics
Shopify provides us with aggregated reports on how our shop is used (e.g. visitor numbers, sales figures, traffic sources). The legal basis is Art. 6(1)(f) GDPR or – where cookies requiring consent are set for this purpose – Art. 6(1)(a) GDPR.
13.2 Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics uses cookies and similar technologies to analyse how our shop is used. Data recorded includes pages visited, time spent, traffic source, approximate location, device type, and interactions such as add-to-cart events and purchases. Google truncates the IP address within the EU before processing it further.
This service is used only with your consent. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework, and Standard Contractual Clauses apply in addition.
13.3 Microsoft Clarity
We use Microsoft Clarity, an analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Using cookies and similar technologies, Clarity records how you use our shop. This includes mouse movements, scrolling behaviour, clicks, and page views, which are compiled into heatmaps and anonymised session recordings. These insights help us identify usability problems and improve our shop.
Entries in form fields are masked by default and are not transmitted in plain text. Payment data is not recorded.
This service is used only with your consent. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Data may be transferred to Microsoft Corporation in the United States, which is certified under the EU-U.S. Data Privacy Framework.
14. Advertising and Retargeting
14.1 Meta Pixel and Custom Audiences
We use the Meta Pixel and the Conversions API provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.
These allow us to follow the behaviour of visitors after they have been directed to our website by clicking a Meta advertisement (Facebook, Instagram). Data recorded includes page views, product views, add-to-cart events, and purchases. On this basis we can measure the effectiveness of our ads, build audiences ("Custom Audiences", "Lookalike Audiences"), and show you interest-based advertising.
The data collected is transmitted to Meta, in part after conversion into an encrypted hash value. Meta may link this data to your Meta user account if you are registered and logged in there.
Joint controllership: For the collection of this data and its transmission to Meta, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Art. 26 GDPR. Any further processing by Meta is carried out under Meta's sole responsibility. The essential content of the joint processing arrangement is available here: https://www.facebook.com/legal/controller_addendum
This service is used only with your consent. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Data may be transferred to Meta Platforms, Inc. in the United States, which is certified under the EU-U.S. Data Privacy Framework.
You can adjust your Meta ad settings here: https://www.facebook.com/settings?tab=ads
14.2 Google Ads and Remarketing
We use Google Ads, an online advertising programme provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, including conversion tracking and remarketing.
Conversion tracking lets us measure whether an advertisement led to a purchase or another action we have defined. Remarketing allows ads for products you previously viewed in our shop to be shown to you on websites in the Google advertising network.
We use Google Consent Mode: without your consent, no advertising cookies are set and no personal identifiers are transmitted.
The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Data may be transferred to Google LLC in the United States, which is certified under the EU-U.S. Data Privacy Framework.
You can disable personalised advertising here: https://adssettings.google.com
15. Communication and Customer Service
If you contact us by email, via our contact form, or through the chat function in our shop, we process your details in order to handle your enquiry. For the chat function we use Shopify Inbox (see section 5).
The legal basis is Art. 6(1)(b) GDPR for contract-related enquiries and otherwise Art. 6(1)(f) GDPR. We delete enquiries once they have been conclusively dealt with, provided no statutory retention obligations apply.
16. Sustainability Programme
For participating orders we fund tree planting through a third-party provider (GoodAPI / Sprout). Only minimal order-related data (e.g. order number, quantity) is transmitted to the provider. Your name and address are not transmitted. The legal basis is Art. 6(1)(f) GDPR.
17. Transfers to Third Countries
Where we have data processed outside the European Economic Area, we ensure an adequate level of data protection through appropriate safeguards. We rely on:
- Adequacy decisions of the European Commission – for example, for Canada and the United Kingdom.
- The EU-U.S. Data Privacy Framework – for certified companies such as Google LLC, Meta Platforms, Inc., Microsoft Corporation, and Klaviyo, Inc.
- Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR – including for Shopify and for our production partner in Türkiye, which is not covered by an adequacy decision.
Please note that, despite these safeguards, a level of protection comparable to that in the EU cannot be guaranteed in every case in third countries, particularly with regard to potential access by government authorities.
18. Retention Periods
We retain personal data only for as long as necessary for the relevant purposes or as required by statutory retention obligations:
- Order and invoice data – 10 years under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).
- Business letters and correspondence – 6 years under Section 257(4) HGB.
- Newsletter data – until you withdraw your consent; evidence of sign-up is kept beyond that point to meet accountability requirements.
- Customer account – until you delete it.
- Server log files – generally 30 days.
- Analytics and marketing data – in line with the respective cookie lifetime, no longer than 14 months.
19. Your Rights
As a data subject you have the following rights:
- Access (Art. 15 GDPR) – to the data we process about you.
- Rectification (Art. 16 GDPR) – of inaccurate or incomplete data.
- Erasure (Art. 17 GDPR) – provided no statutory retention obligations apply.
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR) – to receive your data in a structured, commonly used, machine-readable format.
- Objection (Art. 21 GDPR) – to processing based on legitimate interests. You may object to direct marketing at any time without giving reasons.
- Withdrawal of consent (Art. 7(3) GDPR) – at any time with future effect.
To exercise these rights, an informal message to info@schachatelier.de is sufficient. Alternatively, you can use the Shopify privacy portal: https://privacy.shopify.com/en
20. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data (Art. 77 GDPR). The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
Phone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Web: www.datenschutz-berlin.de
21. Data Security
We take appropriate technical and organisational measures to protect your data. Transmission is encrypted via TLS/SSL, which you can recognise in your browser's address bar. Please note that no security measure can offer complete protection.
22. Children's Data
Our offering is not directed at children. We do not knowingly collect personal data from anyone under the age of 16. Should we become aware of such processing, we will delete the data without delay.
23. Links to Third-Party Websites
Our shop contains links to external websites. We have no influence over their content or data processing and accept no responsibility for them. The privacy notices of the respective providers apply.
24. Changes to This Privacy Policy
We update this Privacy Policy whenever our data processing or the legal framework changes. The version published on this page is the one that applies. The date of the last update appears at the top of this policy.
25. Privacy Contact & Controller
Controller within the meaning of data protection law:
We have not appointed a data protection officer, as the statutory requirements for doing so do not apply to us.
If you have questions about this Privacy Policy or about how we process your personal data, please contact:
Özgür Özel (Schachatelier Berlin)
Janichweg 17A, 13629 Berlin, Germany
Email: info@schachatelier.de