Privacy policy

Privacy Policy

This is a translation for your convenience. The German version is legally binding.

Thank you for visiting our shop. We take the protection of your personal data seriously. Below we explain which data we process when you visit our online shop and place orders.

1. Controller

Philipp Hartmann – PokéPrinz
Dürener Str. 118
50931 Köln, Germany
Email: info@pokeprinz.de

2. General information

We only process personal data to the extent necessary for the stated purposes. The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (performance of a contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interests). We delete your data as soon as it is no longer required for the purpose and no statutory retention obligations apply. We retain commercial and tax records for 6 to 10 years depending on their type.

Some of the service providers named below are based outside the EU or transfer data there, in particular to the USA and Canada. Such transfers are based on adequacy decisions of the European Commission (for Canada and for US companies certified under the EU-US Data Privacy Framework) or on EU standard contractual clauses.

3. Hosting and shop system (Shopify)

Our online shop is operated via Shopify. The provider for customers in the EU is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores our shop data, i.e. product, order and customer data, and processes technically necessary access data when you visit the website (e.g. IP address, browser type, date and time of access, pages visited). Shopify processes this data on our behalf; a data processing agreement is in place. The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interest lies in the secure and stable operation of the shop. More information: https://www.shopify.com/legal/privacy

4. Orders and customer account

When you place an order with us, we process the data required for this, in particular your name, delivery and billing address, email address, telephone number if applicable, as well as order and payment information. The legal basis is Art. 6(1)(b) GDPR and, for retention obligations under tax and commercial law, Art. 6(1)(c) GDPR.

You can optionally create a customer account to view your orders. You can have your account deleted at any time; a short email to us is sufficient.

5. Payment processing

To process payments, we pass on the necessary payment and order data to the payment service provider you have chosen (Art. 6(1)(b) GDPR). The payment service providers partly process your data under their own responsibility, for example for fraud prevention or, for purchase on account or instalments, also to verify your identity and creditworthiness. Their privacy policies also apply.

  • Shopify Payments (credit card, Apple Pay, Google Pay, Shop Pay and other payment methods): Shopify International Limited, Dublin, Ireland; processing is carried out via payment partners such as Stripe Payments Europe Ltd., Dublin, Ireland. For Apple Pay or Google Pay, Apple Distribution International Ltd. or Google Ireland Limited are also involved.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Privacy policy: https://www.paypal.com/de/legalhub/privacy-full
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Privacy policy: https://www.klarna.com/international/privacy-policy/

6. Shipping (DHL)

For shipping, we pass on your name and delivery address to Deutsche Post AG or DHL Paket GmbH, Bonn, Germany. We create the shipping labels via the Shopify app “Post & DHL Shipping”. The legal basis is Art. 6(1)(b) GDPR.

7. Accounting (Lexware Office)

For invoicing and accounting, order and invoice data are transferred via an interface app to Lexware Office (Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany). The legal basis is Art. 6(1)(c) GDPR (statutory bookkeeping and retention obligations).

8. Withdrawal via our website

If you declare a withdrawal using the button “Withdraw from contract”, we process the data you provide (name, email address, order number, affected items) in order to process the withdrawal and confirm its receipt. For this we use the app “EU Widerrufs-Button & Formular” by 401layers UG (haftungsbeschränkt), Germany, with whom a data processing agreement is in place. The legal basis is Art. 6(1)(b) and (c) GDPR.

9. Pre-orders and availability notifications

For pre-orders and the “Notify me when available” function, we use the Shopify app “Preorder, Restock Duck”. If you sign up for a notification, we process the email address or telephone number you provide in order to inform you as soon as the item is available again. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

10. Contacting us

If you contact us via the contact form or by email, we process your details in order to handle your request (Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR).

11. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about new products and offers. The newsletter is sent via Shopify (Shopify Messaging). The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email or by sending us a message.

12. Cookies and consent

We use cookies and similar technologies. We set technically necessary cookies (e.g. for the shopping cart, checkout, security and storing your cookie choice) on the basis of Section 25(2) TDDDG and Art. 6(1)(b) or (f) GDPR. All other cookies, for example for statistics and marketing, are only set with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you give via our cookie banner. You can change or withdraw your choice at any time via the cookie settings.

13. Web analytics and advertising (Google)

With your consent, we use Google Analytics 4 and Google Ads conversion tracking to analyse the use of our shop and to measure the success of our advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Usage data such as pages visited, device information, shortened IP address and, where applicable, purchase events are processed; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time via the cookie settings. More information: https://policies.google.com/privacy

14. Protection against spam and abuse

To protect our forms (e.g. contact, newsletter, customer account, checkout) against automated access, Shopify uses services such as Google reCAPTCHA (Google Ireland Limited) and hCaptcha (Intuition Machines, Inc., USA). In doing so, the IP address and information about usage behaviour, among other things, are processed. The legal basis is our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).

15. Links to social networks

On our website we link to our profiles on Instagram, TikTok, YouTube, Twitch and Discord. These are simple links; no data is transferred to these providers when you visit our website. Only when you click a link are you taken to the respective provider, whose privacy policy then applies.

16. Your rights

Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). An email to info@pokeprinz.de is sufficient for your requests.

Right to object: Insofar as we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation (Art. 21 GDPR). You can object to processing for direct marketing purposes at any time without giving reasons.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

17. Automated decision-making

We do not engage in automated decision-making, including profiling, within the meaning of Art. 22 GDPR. For credit checks by payment service providers, see section 5.

Last updated: October 2026