Privacy Policy

Last updated: 20 September 2026

This English translation is provided for convenience. Where legally permissible, the German version prevails in the event of discrepancies.

1. Controller

The controller responsible for processing personal data on this website is:

NovoSoxx GmbH
Hauptstr. 4
83395 Freilassing
Germany

Represented by Managing Director Rudolf Glavan
Telephone: +43 676 3834616
Email: contact@novosoxx.com

2. General Information on Data Processing

We process personal data only where necessary to operate our online shop, handle orders and enquiries, provide customer accounts and – with your consent – carry out analytics and marketing.

Depending on the processing activity, the legal basis is Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (contract or pre-contractual steps), Article 6(1)(c) GDPR (legal obligation) or Article 6(1)(f) GDPR (legitimate interests). Our legitimate interests include the secure and efficient operation of our shop, fraud prevention, customer communication and improving our services.

3. Hosting and Shop Operation through Shopify

Our online shop is operated through Shopify. The provider for merchants in the European Economic Area is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes information such as IP address, device and browser data, usage data and order, contact, payment and shipping information where required to provide the shop and process orders.

Processing is carried out under Article 6(1)(b) GDPR for pre-contractual steps and performance of the contract and under Article 6(1)(f) GDPR based on our legitimate interest in operating a secure and effective online shop. Shopify may also process data through affiliated companies and service providers outside the European Economic Area using the transfer mechanisms provided for under the GDPR.

Further information: Shopify Consumer Privacy Policy.

4. Server and Access Data

When you access our website, technically necessary information is processed, including your IP address, date and time of access, pages viewed, referrer URL, browser, operating system and device information. This data is used to deliver the website, maintain IT security, diagnose errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR.

5. Cookies and Consent Management

We use essential cookies and similar technologies so that the basket, checkout, language settings, login and security features work correctly. This processing is necessary to provide the service requested by you.

In the European Economic Area, analytics, personalisation and marketing technologies are generally used only after you have given consent through our cookie banner. The legal basis is Article 6(1)(a) GDPR together with Section 25(1) TDDDG. You can change your selection or withdraw your consent for the future at any time through the cookie settings in the footer. Essential cookies cannot be disabled.

6. Orders, Customer Accounts and Contact

When you place an order, use a customer account, register a return or contact us, we process the details you provide. These may include your name, billing and delivery address, email address, telephone number, order and product data, payment status and the content of your message.

Processing is carried out under Article 6(1)(b) GDPR to take pre-contractual steps and perform the contract. We retain documents relevant to commercial and tax law for the applicable statutory periods under Article 6(1)(c) GDPR. Other communication data is deleted when it is no longer required, unless statutory retention duties or legitimate interests require continued storage.

7. Payments

The payment methods available to you are displayed at checkout. Depending on your choice, the data required to process payment is sent to Shopify Payments or the relevant payment service provider, particularly PayPal or Klarna. This may include your name, billing address, order value, currency, payment status and payment-specific identifiers. We generally do not receive complete card or bank account details where these are collected directly by the payment provider.

The legal basis is Article 6(1)(b) GDPR. Legally required checks may additionally be based on Article 6(1)(c) GDPR and fraud prevention on Article 6(1)(f) GDPR. The privacy information of the payment provider selected at checkout also applies to its processing.

8. Shipping and Order Processing

To process, pick and deliver your order, we provide the necessary data to the inventory, fulfilment and shipping service providers we use, particularly Billbee and DHL. Only details needed to process and deliver the order are shared, such as your name, delivery address, email address, telephone number, order number and shipment information. The legal basis is Article 6(1)(b) GDPR.

9. Newsletter and Customer Communication through Klaviyo

If you subscribe to our newsletter, we process your email address and, where provided, your name, consent records and information about how you use our emails. We use Klaviyo for this purpose. The provider is Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA.

Sending and measuring the performance of the newsletter are based on your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time through the unsubscribe link in each marketing email or by contacting us. This does not affect transactional messages about orders, returns or accounts.

Klaviyo may process data in the United States. Transfers take place using the applicable safeguards, particularly an adequacy decision where the recipient is appropriately certified or the EU Standard Contractual Clauses.

10. Product Reviews through Judge.me

We use Judge.me for product reviews and review requests. Order and contact data, product information and the review you submit may be processed. Post-purchase review requests are based – where consent is not legally required – on our legitimate interest in authentic customer feedback and improving our products under Article 6(1)(f) GDPR. Where consent is obtained, the legal basis is Article 6(1)(a) GDPR.

11. Bundles and Product Presentation through Pumper

We use Pumper to present and configure product bundles. Technically required usage, basket and product data may be processed. Processing is carried out to provide the requested shop function and, where required for your order, under Article 6(1)(b) GDPR; otherwise it is based on our legitimate interest in a user-friendly presentation of our products under Article 6(1)(f) GDPR.

12. Audience Measurement and Shop Analytics

Google Analytics 4

With your consent, we use Google Analytics 4, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Pseudonymous online identifiers, cookie and device information, approximate location information and data about page views, interactions and purchases may be processed. Google states that IP addresses are not logged or stored in Google Analytics 4.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Google may also process data in the United States using the applicable safeguards.

Triple Whale

With your consent, we use Triple Whale to analyse shop and marketing performance and attribute orders to advertising activities. Pseudonymous identifiers, device, browser, usage, order and campaign data may be processed. The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG. Processing may take place in the United States using the applicable safeguards.

13. Online Advertising and Conversion Measurement

With your consent, we use marketing and conversion technologies from Google Ads, Meta (Facebook and Instagram), Microsoft Advertising and TikTok Ads. These services help us measure advertising performance, create audiences and show you more relevant advertising on other platforms.

Data processed may include IP address, cookie and device identifiers, browser data, pages visited, basket and purchase events and interests inferred from this information. Depending on how you use the relevant platform, this information may be associated with an existing account there.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Recipients may include Google Ireland Limited, Meta Platforms Ireland Limited, Microsoft Ireland Operations Limited and TikTok Technology Limited. Affiliated companies in third countries, particularly the United States, may process the data. Transfers are based on an applicable adequacy decision or other appropriate safeguards such as the EU Standard Contractual Clauses.

14. Recipients and International Data Transfers

We disclose personal data only where required to perform a contract, comply with a legal obligation, act on your consent or pursue legitimate interests. Recipients may include hosting and shop providers, payment, shipping, inventory, support, analytics, marketing and review service providers as well as tax and legal advisers or public authorities.

Some service providers process data outside the European Economic Area. Transfers take place only where the conditions in Articles 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, appropriate safeguards such as the EU Standard Contractual Clauses or a statutory exception.

15. Retention Periods

We retain personal data only for as long as required for the relevant purpose. Contractual and accounting documents are retained for the statutory commercial and tax-law periods. We retain consent records to demonstrate consent and for as long as claims may arise. Analytics and marketing data is deleted or anonymised in accordance with the settings of the relevant services and your consent. Data is then deleted unless legal duties or legitimate reasons require continued storage.

16. Your Rights

Subject to the statutory conditions, you have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and the right to object to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR). You may object to processing for direct marketing at any time.

You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact us at contact@novosoxx.com. You also have the right to lodge a complaint with a data protection supervisory authority. The Bayerisches Landesamt für Datenschutzaufsicht is generally the supervisory authority responsible for us.

17. Data Security

We use appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. Data transmitted through our website is encrypted using TLS.

18. Changes to this Privacy Policy

We update this Privacy Policy when our processing activities, services or legal requirements change. The version published on this website at the relevant time applies.