Privacy Policy
Privacy Policy
Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor is it necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide it has no consequences. This only applies to the extent that no other information is provided during the subsequent processing operations.
"Personal data" means any information relating to an identified or identifiable natural person.
Server log files
You can visit our websites without providing any personal information. Every time you access our website, usage data is transmitted to us or our web host/IT service provider by your internet browser and stored in protocol data (so-called server log files). This stored data includes, for example, the name of the page accessed, the date and time of the request, the IP address, the volume of data transferred, and the requesting provider.
Processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in ensuring the trouble-free operation of our website as well as improving our services.
Your data may be transmitted to and processed in third countries outside the EU, in particular in Canada and the USA. An adequacy decision by the EU Commission exists for Canada. For the USA, an adequacy decision by the EU Commission is in place, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission's standard contractual clauses.
Contact
Controller
Feel free to contact us. The controller responsible for data processing is: Katja Hafer, Hamburger Landstraße 16, 21357 Bardowick Germany, +4915118955531, info@hafer-bikes-parts.de
Customer's proactive contact by e-mail
If you initiate business contact with us by e-mail, we will only collect your personal data (name, e-mail address, message text) to the extent provided by you. The data processing serves the purpose of processing and answering your contact request.
If the contact serves to perform pre-contractual measures (e.g., consultation for purchase interest, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 para. 1 lit. b GDPR.
If the contact occurs for other reasons, this data processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and answering your request. In this case, you have the right to object at any time to the processing of personal data concerning you, which is based on Art. 6 para. 1 lit. f GDPR, for reasons arising from your particular situation.
We only use your e-mail address to process your request. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Collection and processing when using the contact form
When using the contact form, we only collect your personal data (name, e-mail address, message text) to the extent provided by you. The data processing serves the purpose of establishing contact.
If the contact serves to perform pre-contractual measures (e.g., consultation for purchase interest, preparation of an offer) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 para. 1 lit. b GDPR.
If the contact occurs for other reasons, this data processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and answering your request. In this case, you have the right to object at any time to the processing of personal data concerning you, which is based on Art. 6 para. 1 lit. f GDPR, for reasons arising from your particular situation.
We only use your e-mail address to process your request. Your data will subsequently be deleted in compliance with statutory retention periods, unless you have consented to further processing and use.
Customer Account Orders
Customer Account
When opening a customer account, we collect your personal data to the extent specified there. Data processing serves the purpose of improving your shopping experience and simplifying the order process. Processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the legality of the processing carried out on the basis of the consent until the revocation. Your customer account will subsequently be deleted.
Your data may be transmitted to and processed in third countries outside the EU, in particular in Canada and the USA. An adequacy decision by the EU Commission exists for Canada. For the USA, an adequacy decision by the EU Commission is in place, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission's standard contractual clauses.
Payment service providers
Use of PayPal Check-Out
We use the payment service PayPal Check-Out on our website from PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal"). Data processing serves the purpose of being able to offer you payment via the payment service. By selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfill the contract with you using the selected payment method. This processing is based on Art. 6 para. 1 lit. b GDPR.
Cookies may be stored here, which enable your browser to be recognized. The data processing that takes place as a result is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in a customer-oriented offering of various payment methods. You have the right to object at any time to this processing of personal data concerning you, for reasons arising from your particular situation.
Credit card via PayPal, direct debit via PayPal & "Pay Later" via PayPal
For individual payment methods such as credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, PayPal reserves the right to obtain a credit report based on mathematical-statistical procedures using credit agencies. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default for a balanced decision on the establishment, implementation, or termination of the contractual relationship. The credit report may include probability values (score values), which are calculated on the basis of scientifically recognized mathematical-statistical procedures and in whose calculation address data, among other things, flows. Your interests worthy of protection are taken into account in accordance with legal provisions. Data processing serves the purpose of credit checking for the initiation of a contract. Processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default if PayPal makes an advance payment.
You have the right to object at any time to this processing of personal data concerning you, which is based on Art. 6 para. 1 lit. f GDPR, by notifying PayPal for reasons arising from your particular situation. The provision of data is necessary for the conclusion of the contract with your preferred payment method. Failure to provide it results in the contract not being concluded with your chosen payment method.
Third-party providers
When paying via a third-party payment method, the data required for payment processing is transmitted to PayPal. This processing is based on Art. 6 para. 1 lit. b GDPR. To carry out this payment method, the data may then be passed on by PayPal to the respective provider. This processing is based on Art. 6 para. 1 lit. b GDPR. Local third-party providers can be, for example:
- Sofort (SOFORT GmbH, Theresienhöhe 12, 80339 Munich, Germany)
- giropay (Paydirekt GmbH, Stephanstr. 14-16, 60313 Frankfurt am Main)
Invoice purchase via PayPal
When paying via the payment method "Invoice purchase," the data required for payment processing is first transmitted to PayPal. To carry out this payment method, the data is then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to fulfill the contract with you using the chosen payment method. This processing is based on Art. 6 para. 1 lit. b GDPR. Ratepay may carry out a credit check based on mathematical-statistical procedures (probability or score values) using credit agencies according to the procedure described above. Data processing serves the purpose of credit checking for the initiation of a contract. Processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default if Ratepay makes an advance payment. Further information on data protection and which credit agencies Ratepay uses can be found at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/.
More detailed information on data processing when using PayPal can be found in the associated privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
Rights of the data subject and storage duration
Duration of storage
After complete fulfillment of the contract, the data is initially stored for the duration of the warranty period, then taking into account legal, particularly tax and commercial law retention periods, and then deleted after the period has expired, unless you have consented to further processing and use.
Rights of the data subject
If the statutory requirements are met, you have the following rights according to Art. 15 to 20 GDPR: Right to information, to correction, to deletion, to restriction of processing, to data portability.
In addition, according to Art. 21 para. 1 GDPR, you have the right to object to processing based on Art. 6 para. 1 f GDPR, as well as to processing for the purpose of direct marketing.
Right to lodge a complaint with the supervisory authority
According to Art. 77 GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful.
You can lodge a complaint, among others, with the supervisory authority responsible for us, which you can reach at the following contact details:
State Commissioner for Data Protection Lower Saxony
Prinzenstraße 5
30159 Hannover
Tel.: +49 511 1204500
Fax: +49 511 1204599
E-Mail: poststelle@lfd.niedersachsen.de
Right to object
If the personal data processing listed here is based on our legitimate interest according to Art. 6 para. 1 lit. f GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation with effect for the future.
After an objection has been made, the processing of the affected data will be terminated unless we can demonstrate compelling legitimate grounds for the processing that outweigh your interests, rights, and freedoms, or if the processing serves the assertion, exercise, or defense of legal claims.
You can also exercise your right of withdrawal online via the “Cancel contract” button. If you use this online function, we will immediately send you a confirmation of receipt of your withdrawal by e-mail.
Electronic withdrawal function
Purpose of processing: When you use the online withdrawal function on our website, we process the data you enter (e.g., name, contact details, order number) in order to receive and process your withdrawal.
Legal basis: Processing is carried out for the fulfillment of a contract or the implementation of pre-contractual measures according to Art. 6 para. 1 lit. b GDPR.
Recipients: The data is forwarded internally to process the withdrawal. In addition, you will automatically receive a confirmation of receipt at the e-mail address you provided
last update: 16.06.2026
