Privacy policy

Privacy Policy

Last updated: 25 September 2026

This Privacy Policy explains how personal data is processed when you visit www.vwelt.de, use our online shop, place an order or otherwise contact V Welt.

1. Controller

The controller within the meaning of the General Data Protection Regulation is:

Kaan Okcu – V Welt
Haroldstraße 20
40213 Düsseldorf
Germany

Email: info@vwelt.de

2. Principles of data processing

We process personal data only where there is a lawful basis for doing so.

Depending on the processing activity, we rely in particular on:

Article 6(1)(b) GDPR where processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;
Article 6(1)(c) GDPR where processing is necessary for compliance with a legal obligation;
Article 6(1)(f) GDPR where processing is necessary for our legitimate interests or those of a third party and your interests or fundamental rights do not override those interests;
Article 6(1)(a) GDPR where you have given consent.

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

3. Personal data we process

Depending on how you use our online shop, we may in particular process the following data:

name;
billing and delivery address;
email address;
telephone number, where provided by you;
order and transaction data;
payment status and information about the selected payment method;
customer account and login data;
information about returns, withdrawals and complaints;
communications with our customer service;
IP address;
device, browser and technical connection information;
usage, cookie and consent information;
information about your shopping cart, checkout and interactions with our shop.

Depending on the selected payment method, payment card or bank account details may be processed wholly or partly directly by the relevant payment service provider.

4. Shopify

Our online shop is operated using Shopify.

Shopify provides in particular the technical shop infrastructure, checkout functions, order management, customer accounts, security functions and other services necessary for operating the online shop.

This may involve the processing of IP addresses, device information, shop and usage data, contact information and order and transaction data.

Where processing is necessary for operating the shop or processing an order, it is based in particular on Article 6(1)(b) GDPR.

Security, abuse-prevention and fraud-prevention measures may additionally be based on our legitimate interest in a secure and functional online shop pursuant to Article 6(1)(f) GDPR.

Where Shopify or services integrated through Shopify process data for their own purposes as independent controllers, Shopify's respective privacy information also applies.

5. Orders and contract processing

When you place an order, we process the information required in particular for:

processing your order;
processing payment;
issuing invoices;
picking and shipping;
processing returns and withdrawals;
handling complaints;
fulfilling statutory warranty obligations;
communicating with you about your order.

The legal basis is generally Article 6(1)(b) GDPR.

Where order and invoice data must be retained under tax, commercial or other statutory obligations, further processing is based on Article 6(1)(c) GDPR.

6. Payments

We use the payment service providers offered at checkout to process payments.

The payment methods and payment service providers available to you are shown at checkout.

When you select a payment method, the information necessary for processing the payment is transferred to the relevant payment service provider or collected directly by that provider.

Processing is generally carried out for performance of the contract pursuant to Article 6(1)(b) GDPR.

Payment service providers may also process data as independent controllers on the basis of their own legal obligations, in particular for fraud prevention, anti-money-laundering measures or payment processing.

7. Shipping and DHL

To deliver your order, we transmit the information required for shipping to the shipping carrier used.

In particular, we use DHL and the Shopify app Post & DHL Shipping.

The following information may in particular be transmitted:

name;
delivery address;
order and shipment information;
where necessary for the selected shipping service, email address or other contact details.

The legal basis is Article 6(1)(b) GDPR.

8. Accounting and sevdesk

We use sevdesk to comply with our bookkeeping, invoicing and tax obligations.

This may involve processing invoice, order, payment and contact data.

Processing is carried out in particular on the basis of Article 6(1)(c) GDPR.

Where use of the service also serves the efficient organisation of our accounting, processing may additionally be based on Article 6(1)(f) GDPR.

9. Contact and customer service

If you contact us by email, contact form or another means, we process the information you provide in order to handle your enquiry.

If the enquiry relates to an order or steps prior to entering into a contract, processing is based on Article 6(1)(b) GDPR.

For other enquiries, processing is based on our legitimate interest in handling customer and other enquiries pursuant to Article 6(1)(f) GDPR.

10. Electronic withdrawal function

We provide an electronic “Withdraw from contract” function on our website.

We process the information required to identify the relevant contract or goods and to process the withdrawal.

This may in particular include:

name;
email address;
order number;
information about the products concerned;
where applicable, an optional message.

Processing is carried out to comply with our legal obligations and to process the withdrawal on the basis of Article 6(1)(c) GDPR and, where necessary, Article 6(1)(b) GDPR.

To protect the form against automated abuse and spam, we use technical services provided by Cloudflare, including Cloudflare Turnstile and the technical infrastructure used to process the form.

This may involve processing IP addresses, device and browser information and technical security data.

The processing serves the security and functionality of the withdrawal function and, insofar as personal data is concerned, is based on Article 6(1)(f) GDPR.

Where access to information on your terminal device is strictly necessary for this security service, such access is carried out in accordance with Section 25(2) TDDDG.

11. Customer account

If you use a customer account, we process the data necessary for setting up and using that account.

This may include in particular your contact information, order history and account settings.

Processing is based on Article 6(1)(b) GDPR.

A customer account is generally optional unless otherwise stated at checkout.

12. Reviews – Judge.me and Trustpilot

We use services for displaying and managing customer and product reviews, in particular Judge.me and Trustpilot.

If you submit a review, your name or chosen display name, review content, review information and technical information may in particular be processed.

Where review services require order data to verify a purchase or link a review invitation to an order, the necessary order and contact information may be processed.

The publication and technical management of reviews may be based on our legitimate interest in authentic customer reviews and informing other customers pursuant to Article 6(1)(f) GDPR.

Review invitations by email are sent only where consent has been given or another statutory permission applies.

Where processing is based on consent, the legal basis is Article 6(1)(a) GDPR.

13. Cookies and similar technologies

Our website uses cookies and similar technologies.

Strictly necessary technologies may be used where they are required for operating the shop, shopping cart, checkout, security functions, language settings or other functions expressly requested by you.

Where access to or storage of information on your terminal device is strictly necessary, this is carried out in accordance with Section 25(2) TDDDG.

Non-essential cookies and comparable technologies, in particular for analytics, marketing or personalised advertising, are generally used only after you have given consent.

The legal basis for access to the terminal device in such cases is Section 25(1) TDDDG.

Where personal data is subsequently processed, this is based on your consent pursuant to Article 6(1)(a) GDPR.

14. Consent management with Pandectes

We use Pandectes GDPR to obtain and manage your privacy and cookie preferences.

This involves processing in particular information about which consents you have given or refused, as well as technical information required to document and implement your choices.

Processing is carried out to comply with data-protection documentation and consent requirements on the basis of Article 6(1)(c) GDPR and, where necessary, our legitimate interest in legally compliant consent management pursuant to Article 6(1)(f) GDPR.

You can change your choices at any time using the Privacy Choices provided on our website.

15. Analytics and advertising – Google

Where you have consented, we may use Google services, in particular Google Analytics and Google Ads.

This may involve processing in particular:

IP address;
device and browser information;
pseudonymous identifiers;
information about pages visited and interactions;
shopping-cart and checkout events;
conversion information;
information about the origin of a visit.

This information may be used to analyse use of our online shop, measure the effectiveness of our advertising and deliver more targeted advertising.

Where non-essential cookies or similar technologies are used for this purpose, they are used only after your consent pursuant to Section 25(1) TDDDG.

The subsequent processing of personal data is based on your consent pursuant to Article 6(1)(a) GDPR.

Where functions such as customer matching or comparable audience functions are used, suitable customer information, for example technically protected or hashed contact information, may be transmitted to Google for matching purposes in accordance with your consent.

You may withdraw your consent at any time using our privacy choices.

16. Product feeds and Multifeeds

We use Multifeeds, among other services, to provide and manage product information for external sales and advertising channels.

This primarily involves processing product and shop data.

Where personal data is processed in connection with marketing, conversion or advertising functions, the legal bases described in this Privacy Policy apply, in particular consent pursuant to Article 6(1)(a) GDPR where consent is required.

17. Newsletter and marketing communications

If you expressly subscribe to a newsletter or comparable marketing communications, we use the contact details required for this purpose.

The legal basis is your consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, in particular using an unsubscribe link contained in the relevant message or by contacting us.

Transactional communications relating to an order are independent of this.

18. Fraud prevention and security

To protect our online shop, our customers and our systems, technical and transaction-related information may be processed to identify and prevent fraud, abuse, unauthorised access or other security incidents.

This may also involve security functions provided by Shopify, payment service providers or other technical service providers.

Where this processing is not already necessary for performance of the contract, it is based on our legitimate interest in the security of our online shop pursuant to Article 6(1)(f) GDPR.

19. Recipients and service providers

Personal data is disclosed only where this is necessary for the purposes described in this Privacy Policy or required by law.

Recipients or categories of recipients may in particular include:

Shopify and technical shop service providers;
payment service providers;
shipping and logistics providers, in particular DHL;
accounting and invoicing service providers, in particular sevdesk;
review service providers, in particular Judge.me and Trustpilot;
consent-management service providers, in particular Pandectes;
analytics and advertising service providers, in particular Google, where you have consented;
technical security and infrastructure providers, in particular Cloudflare;
IT and technical service providers;
tax advisers, public authorities and other bodies where disclosure is required by law.

We do not disclose personal data to third parties merely because they supposedly belong to a V Welt “group of companies”. No such group of companies exists at V Welt.

20. Transfers of data to third countries

Some of our service providers or their subcontractors may process personal data outside the European Union or European Economic Area.

Such transfers take place only where the statutory requirements are met.

This may in particular be based on an adequacy decision of the European Commission pursuant to Article 45 GDPR or appropriate safeguards pursuant to Article 46 GDPR, such as Standard Contractual Clauses.

For appropriately certified organisations in the United States, a transfer may be based on the EU-U.S. Data Privacy Framework.

21. Storage periods

We store personal data only for as long as is necessary for the relevant processing purpose or as statutory retention obligations require.

Order, invoice and accounting data may in particular be retained for eight years due to commercial and tax-law requirements.

Business correspondence may, where required by law, be retained for the longer periods prescribed by law.

In addition, data may be retained until statutory limitation periods expire where this is necessary to establish, exercise or defend legal claims.

Data processed solely on the basis of consent will be deleted or no longer processed for the relevant purpose after consent is withdrawn, unless another legal basis or a statutory retention obligation applies.

Customer account data is generally processed for as long as the customer account exists and further retention is necessary.

22. Your data protection rights

Subject to the statutory requirements, you have in particular the right to:

access the personal data we process about you pursuant to Article 15 GDPR;
rectification of inaccurate data pursuant to Article 16 GDPR;
erasure pursuant to Article 17 GDPR;
restriction of processing pursuant to Article 18 GDPR;
data portability pursuant to Article 20 GDPR;
object to certain processing pursuant to Article 21 GDPR;
withdraw consent with effect for the future.

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object to that processing on grounds relating to your particular situation.

You may object to processing for direct marketing purposes at any time.

To exercise your rights, contact us at:

info@vwelt.de

23. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

For V Welt, the competent authority is in particular:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

You may also contact another supervisory authority competent under Article 77 GDPR.

24. Provision of data

Certain personal data is required so that we can enter into a contract with you and process your order.

Without the required contact, delivery and payment information, we may be unable to process or fulfil an order.

Providing data for voluntary marketing, analytics or advertising purposes is not a requirement for purchasing from V Welt.

25. Automated decision-making

As a general rule, V Welt does not make decisions based solely on automated processing within the meaning of Article 22 GDPR that produce legal effects concerning you or similarly significantly affect you.

Payment service providers or other external providers may perform automated security or fraud checks under their own responsibility. Their respective privacy information applies to such processing.

26. Changes to this Privacy Policy

We may update this Privacy Policy if our data processing, the services we use or legal requirements change.

The current version is published on our website.

27. Data protection contact

If you have questions about data protection or wish to exercise your data protection rights, you can contact us at:

V Welt
Haroldstraße 20
40213 Düsseldorf
Germany