Privacy policy

This English translation is provided for convenience. The German version is the legally binding version.

Last updated: 26 July 2026

1. Controller

GravaM Germany
Owner: Ilgar Schäffer
Petristraße 7
86405 Meitingen
Germany
Telephone: +49 172 646 84 94
Email: shop@gravam.de

2. General information about data processing

We process personal data only to the extent necessary to provide the online store, initiate and perform contracts, communicate with you, comply with legal obligations, or on the basis of consent.

Depending on the processing activity, we rely in particular on Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract and pre-contractual measures), Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interests). Where information is stored on or read from end devices, Section 25 TDDDG also applies.

3. Hosting and operation of the store by Shopify

Our online store is operated using Shopify. In particular, IP addresses, device and browser information, access and log data, cart and order data, and communication data are processed. The provider for the European region is Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Other companies within the Shopify group, in particular Shopify Inc. in Canada, may be involved as sub-processors.

The processing serves to provide the store securely, reliably and functionally and to perform contracts. The legal bases are Article 6(1)(b) GDPR and our legitimate interest in operating a secure and commercially viable online store pursuant to Article 6(1)(f) GDPR.

4. Orders and personalization

When you place an order, we process in particular your name, billing and shipping address, email address, telephone number where applicable, products ordered, personalization details, payment and transaction information, and information required for shipping and returns.

For personalized products, we may also process names, text, dates, images or files provided by you. The Easify app may be used to collect and assign this personalization information. Processing is necessary to perform the contract and is based on Article 6(1)(b) GDPR.

5. Customer account

If you use a customer account, Shopify and we process the login, contact, order and account data required for this purpose. The customer account is used to manage your orders, returns, cancellations and account settings. The legal basis is Article 6(1)(b) GDPR. A customer account is required only where a function selected by you depends on it.

6. Payment processing

For payment processing, the required order, transaction and payment information is transmitted to the payment service provider selected at checkout. The providers available in each case are shown before the order is completed. To the extent necessary, payment data is processed directly by the payment service provider. The legal basis is Article 6(1)(b) GDPR; statutory retention obligations are based on Article 6(1)(c) GDPR.

7. Shipping and delivery

For shipping and delivery, we transmit the required recipient, address and shipment data to DHL and, where applicable, to other carriers expressly shown at checkout. Processing is carried out for performance of the contract pursuant to Article 6(1)(b) GDPR.

8. Contacting us

If you contact us by email, telephone or through a contact form, we process the information you provide in order to handle your enquiry. Where the enquiry relates to a contract or pre-contractual measures, the legal basis is Article 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in appropriate communication pursuant to Article 6(1)(f) GDPR.

9. GravaM Points loyalty program / Smile.io

If you voluntarily participate in the GravaM Points loyalty program, account, contact, order and points data in particular are processed. We use Smile.io for this purpose. The processing serves to manage your loyalty account and redeem benefits. The legal basis is Article 6(1)(b) GDPR. Where optional analytics or marketing functions are used, this takes place only on the basis of your consent pursuant to Article 6(1)(a) GDPR.

10. Newsletter

If you subscribe to our newsletter, we process your email address and the data required to document your subscription. Processing is based on your consent pursuant to Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future by using the unsubscribe link in the newsletter or by emailing shop@gravam.de. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Cookies and similar technologies

We use technically necessary cookies and similar technologies where required to operate the store, provide cart and checkout functionality, maintain security and provide functions requested by you. In this respect, information is stored on or accessed from your end device pursuant to Section 25(2) TDDDG. Depending on the purpose, subsequent processing of personal data is based on Article 6(1)(b) or (f) GDPR.

Non-essential analytics, convenience or marketing technologies are used only with your consent. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may change or withdraw your consent at any time with effect for the future using the cookie settings provided in the store.

12. Recipients and processors

Recipients of personal data may include, in each case only to the extent necessary, Shopify and its sub-processors, payment service providers, DHL, providers of personalization and loyalty program functions, IT and hosting service providers, communication and newsletter service providers, and public authorities, tax advisers or legal advisers where a legal basis exists.

Where service providers act as processors, they are contractually bound in accordance with Article 28 GDPR.

13. Transfers to third countries

When Shopify and certain app or payment services are used, processing may take place outside the European Economic Area, in particular in Canada or the United States. Data is transferred only where the legal requirements are met, for example on the basis of an adequacy decision, appropriate safeguards such as the EU Standard Contractual Clauses, or a statutory exception.

14. Retention periods

We retain personal data only for as long as necessary for the relevant purpose. Contract and billing data is retained in accordance with statutory commercial and tax retention obligations. Enquiry data is deleted after the enquiry has been fully handled unless statutory retention obligations, warranty or limitation periods, or other legitimate reasons require continued storage. Data processed on the basis of consent is processed until consent is withdrawn or the purpose no longer applies.

15. Your rights

Subject to the statutory requirements, you have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR), and the right to object to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR). You may withdraw consent at any time with effect for the future.

To exercise your rights, simply email shop@gravam.de. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for our business is, in particular, the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

16. Automated decision-making

We do not carry out decision-making based solely on automated processing that produces legal or similarly significant effects within the meaning of Article 22 GDPR.

17. Updates to this Privacy Policy

We update this Privacy Policy when the legal situation, the services used or our processing activities change. The version published in the online store at the relevant time applies.