Privacy Policy

1. Data Controller EuroRoots Doeberlstraße 6a 80937 Munich Germany Email: info@euroroots.store Represented by: Erik Petzsch

2. General Information on Data Processing

2.1 Scope of Personal Data Processing We process personal data of our users only to the extent necessary to provide a functioning website, our online shop, content, and services.

2.2 Legal Basis for Processing

  • Art. 6(1)(a) GDPR: Consent (e.g. cookies, newsletter, SMS marketing, product reviews)
  • Art. 6(1)(b) GDPR: Performance of a contract / pre-contractual measures (e.g. order processing, shipping, customer account)
  • Art. 6(1)(c) GDPR: Legal obligation (e.g. tax retention requirements)
  • Art. 6(1)(f) GDPR: Legitimate interest (e.g. fraud prevention, traffic analysis, system security, review requests)

2.3 Data Deletion and Storage Duration Personal data is deleted or blocked as soon as the purpose of storage no longer applies, unless statutory retention periods prevent deletion (e.g. § 147 AO: up to 10 years, § 257 HGB: 6–10 years).

3. Website Provision and Server Log Files Each time our website is accessed, our system automatically collects data from the accessing computer system (IP address, date/time, requested file, HTTP status code, data volume, referrer URL, browser type, operating system). This data is stored in log files.

Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: technically error-free presentation and system security. Deletion generally occurs within 7 days.

4. Hosting and Shop System (Shopify) Our online shop is operated by Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify processes server log files, IP addresses, order and customer data on our behalf. A data processing agreement pursuant to Art. 28 GDPR is in place. Data transfers to the U.S. are based on the EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.

More information: www.shopify.com/legal/privacy Legal basis: Art. 6(1)(b), (f) GDPR, Art. 28 GDPR.

5. Cookies and Consent Management (Avada Cookie Consent) We use the app Avada Cookie Consent to manage cookie consent in accordance with GDPR, ePrivacy Directive, CCPA and similar laws.

  • Technically necessary cookies (shopping cart, login, language selection, security): Legal basis Art. 6(1)(f) GDPR.
  • Analytics, marketing and non-essential cookies: only with your explicit consent via the cookie banner (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time via the cookie settings.

The Avada app processes consent data (IP address, consent status, timestamp) to document and manage your choices.

6. Registration and Customer Account When creating a customer account we collect name, email address and password to fulfil the contract. Legal basis: Art. 6(1)(b) GDPR.

7. Contract Processing and Orders

7.1 Order Data Name, billing and delivery address, email address, phone number (optional), ordered items, payment data. Legal basis: Art. 6(1)(b) GDPR.

7.2 Payment Processing Payment providers (e.g. Shopify Payments, PayPal, Klarna etc.). Payment data is transmitted solely for the purpose of processing the payment. Legal basis: Art. 6(1)(b) GDPR.

7.3 Shipping We transmit your name and delivery address to the shipping company we engage (e.g. DHL, UPS or the carriers used by our fulfilment partners). Legal basis: Art. 6(1)(b) GDPR.

7.4 Order Documents (MS Order Printers) We use the Shopify app MS Order Printers to generate invoices, delivery notes and other order documents. The app processes order, customer and address data within the Shopify environment to create PDF documents. Legal basis: Art. 6(1)(b), (c) GDPR.

7.5 Fulfillment and Manufacturing Partners

For certain products, we work with specialized third-party manufacturing and fulfillment service providers located in the United States.

These service providers may receive and process the personal information necessary to manufacture, process, package, and fulfill your order, including your name, delivery address, order details, and other information necessary to complete the transaction.

Such information is provided solely for the purpose of providing these services on our behalf and is not provided for independent marketing purposes.

We require our service providers to process personal information only as necessary to provide the contracted services and to maintain appropriate safeguards for the protection of personal information.

Where applicable, such service providers may qualify as service providers or contractors under applicable U.S. privacy laws and process personal information pursuant to contractual obligations and applicable privacy requirements.

Where the GDPR applies to the processing, the applicable legal basis for processing order information is generally Article 6(1)(b) GDPR, where processing is necessary for the performance of the contract. Where required by applicable law, appropriate data processing agreements are maintained with relevant service providers.

8. Right of Withdrawal and Withdrawal Form You can declare your withdrawal directly online in accordance with § 356a BGB using our withdrawal button. Data collected (order number, name, contact details and, where applicable, bank details for refunds) is used exclusively to process and document the withdrawal. Legal basis: Art. 6(1)(b), (c) GDPR.

9. Product Reviews (Judge.me) We use the review service Judge.me (Judge.me, Vardanyan and Manukyan Sole Partnership, Yerevan, Armenia).

  • Purpose: Customers can submit product reviews; after purchase a review request may be sent automatically by email.
  • Data processed: Name, email address, review text, star rating and any photos. For the review request: email address and order data.
  • Legal basis: Review request – Art. 6(1)(f) GDPR (you may object at any time); publication with name – Art. 6(1)(a) GDPR.
  • Third-country transfer: Judge.me may process data outside the EU/EEA. Details: judge.me/privacy-policy

10. Email & SMS Marketing (Klaviyo) We use Klaviyo (Klaviyo, Inc., USA) for email and SMS marketing, abandoned-cart reminders and customer communication.

Klaviyo processes the following data on our behalf:

  • Email address, name, phone number (for SMS)
  • Order history, purchase behaviour, website interactions (if consented)
  • Consent status and marketing preferences

Legal basis:

  • Marketing emails/SMS: Art. 6(1)(a) GDPR (consent)
  • Transactional messages (order confirmations, shipping updates): Art. 6(1)(b) GDPR

Data is transferred to the United States. Klaviyo is certified under the EU-U.S. Data Privacy Framework and uses Standard Contractual Clauses. A Data Processing Agreement pursuant to Art. 28 GDPR is in place.

You can unsubscribe at any time via the link in every email or by contacting us. More information: www.klaviyo.com/legal/privacy

11. Other Shopify Apps We also use the following Shopify apps that may process limited personal data in the context of shop operation:

  • Grouptify – product bundling (order-related data)
  • Translate & Adapt – language and content adaptation
  • Shopify Claude Connector App – AI-assisted functions within Shopify
  • Flow – automation of shop processes
  • Messaging – customer communication within Shopify

These apps primarily process data within the Shopify environment for the performance of the contract or legitimate interests (Art. 6(1)(b) or (f) GDPR). Where required, data processing agreements are in place.

12. Contact When you contact us by email or contact form, we store the information you provide in order to process your inquiry. Legal basis: Art. 6(1)(b), (f) GDPR.

13. Recipients of Data We only share data with:

  • Shopify (hosting & shop system)
  • Payment providers
  • Shipping companies and fulfilment partners (Supliful, Productifi)
  • Klaviyo (email/SMS marketing)
  • Judge.me (reviews)
  • Avada (cookie consent)
  • Authorities where legally required

14. Your Rights You have the following rights under the GDPR:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)
  • Right to withdraw consent (Art. 7(3))

To exercise your rights, please contact: euroroots@info.store

15. Right to Lodge a Complaint You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

16. Changes to This Privacy Policy We reserve the right to update this privacy policy to reflect current legal requirements or changes to our services.

Last updated: August 2026