Privacy policy

Privacy policy

This English version is provided for convenience. The German version is legally binding.

Last updated: October 2026

1. Controller

Vintageonfriday
Owner: Daniel Dieser
Moosacher Str. 79
80809 München
Germany
Email: info@vintageonfriday.com

We have not appointed a data protection officer, as we are not required to do so. If you have any questions about data protection, simply write to us at the email address above.

2. Overview

We only process your personal data to the extent necessary for operating our shop, processing your order or – with your consent – for analytics and marketing. The legal bases are the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Hosting and shop system (Shopify)

Our shop runs on Shopify. The provider for the EEA is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores the data generated during visits and orders (e.g. IP address, browser data, order and contact data). Data may also be processed in Canada and the USA. Shopify is certified under the EU-US Data Privacy Framework; standard contractual clauses are also in place. The legal basis is Art. 6(1)(b) GDPR (contract) and (f) GDPR (legitimate interest in a secure, functioning shop). A data processing agreement is in place with Shopify.

Shopify's privacy notice: https://www.shopify.com/de/legal/datenschutz

4. Server log files

When you visit our pages, technical data is collected automatically (IP address, date and time, page accessed, browser, operating system, referrer). We need this data to operate the shop stably and securely (Art. 6(1)(f) GDPR). It is not merged with other data.

5. Order and customer account

When you place an order, we process the data you provide at checkout: name, delivery and billing address, email, phone number if applicable, ordered items and payment method. We use it to perform the contract, ship the goods and inform you about your order (Art. 6(1)(b) GDPR). If you create a customer account, we store your data for future orders until you delete the account.

Due to commercial and tax law obligations, we retain order and invoice data for up to 10 years (Art. 6(1)(c) GDPR).

6. Shipping

For delivery, we pass on your name and delivery address and – so that you receive notifications about your shipment – your email address to the shipping service provider, usually DHL (Deutsche Post AG / DHL Paket GmbH, Charles-de-Gaulle-Str. 20, 53113 Bonn). Some of our items are shipped directly by suppliers from their warehouses; for this purpose, they receive the data required for shipping (Art. 6(1)(b) GDPR).

7. Payment

Depending on the payment method you choose, we pass on the data required for payment to the respective provider (Art. 6(1)(b) GDPR):

  • Credit card, Apple Pay, Google Pay, Shop Pay via Shopify Payments (Shopify International Ltd., Dublin, with the payment service provider Stripe Payments Europe Ltd., Dublin). Apple Pay: Apple Distribution International Ltd., Cork, Ireland. Google Pay: Google Ireland Ltd., Dublin.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy: https://www.paypal.com/de/legalhub/privacy-full
  • Klarna (invoice, instalment purchase, Sofort bank transfer): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may check your identity and creditworthiness in this context. Privacy: https://www.klarna.com/de/datenschutz/

To prevent fraud, Shopify may automatically check payment attempts and temporarily block them if suspicious patterns are detected.

8. Cookies and consent

We use cookies and similar technologies. We use technically necessary cookies (e.g. shopping cart, checkout, login, language and country settings, storage of your cookie choice) without consent (§ 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR).

All other cookies for analytics and marketing are only loaded once you give your consent in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the "Cookie settings" link at the bottom of the page.

9. Analytics and advertising (only with consent)

Google Tag Manager: We use it to manage the integration of analytics and marketing services. The Tag Manager itself does not evaluate any user data. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics 4: We analyse how our shop is used (e.g. pages viewed, time spent, purchases) in order to improve it. IP addresses are truncated by Google in the EU. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. Storage period: 14 months.

Google Ads and Google Merchant Center: We show our items in Google Search and Google Shopping and measure whether an ad leads to a purchase (conversion tracking, remarketing).

Google privacy: https://policies.google.com/privacy

Meta Pixel (Facebook/Instagram): We measure the success of our advertising on Facebook and Instagram and can show ads there to visitors of our shop. Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. An agreement with Meta is in place for the joint processing (Art. 26 GDPR). Data may be transferred to the USA; Meta is certified under the EU-US Data Privacy Framework. Privacy: https://www.facebook.com/privacy/policy

Shopify Analytics: Shopify creates statistics for us on visits and purchases (e.g. cookies _shopify_y, _shopify_s). Insofar as they are not technically necessary, only with consent.

10. Newsletter and emails (Omnisend)

If you sign up for our newsletter, we will send you information about new bags, drops and offers. Sign-up uses double opt-in: you confirm it via a link sent by email. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email.

If you have purchased from us, we may also send you information about similar items without separate consent (§ 7(3) UWG, German Act Against Unfair Competition). You can object to this at any time without incurring any costs other than the transmission costs according to the basic rates.

If you have added items to your cart and not completed the order, we may remind you of this by email if you have consented to this or are already a customer.

For sending emails, we use Omnisend (Omnisend UAB, Gedimino pr. 20, 01103 Vilnius, Lithuania). Omnisend measures whether emails are opened and links are clicked so that we can improve our emails. A data processing agreement is in place with Omnisend. Privacy: https://www.omnisend.com/privacy-policy/

11. Reviews (Trustpilot)

After an order, we may invite you by email to review us on Trustpilot. For this purpose, we transmit your name, email address and order number to Trustpilot A/S, Pilestræde 58, 5th Floor, 1112 Copenhagen, Denmark (Art. 6(1)(f) GDPR, our interest in genuine customer reviews). You can object to this at any time. We display our Trustpilot reviews in our shop. Privacy: https://de.legal.trustpilot.com/for-reviewers/end-user-privacy-terms

12. Translation (GTranslate)

So that you can read our shop in other languages, we use GTranslate (Translation Services USA LLC, USA). During translation, page content and technical data such as your IP address are processed. The legal basis is Art. 6(1)(f) GDPR (our interest in addressing international customers in their language).

13. Instagram feed

On some pages, we show images from our Instagram account. When loading, data (e.g. IP address) is transmitted to Meta Platforms Ireland Ltd. or the feed's service provider. The legal basis is your consent (Art. 6(1)(a) GDPR).

14. Contact form and email

When you write to us, we process your details in order to respond to your enquiry (Art. 6(1)(b) or (f) GDPR). We delete them when they are no longer needed and there is no retention obligation.

15. Transfers to third countries

Some of the providers mentioned also process data outside the EU, especially in the USA. There, we only work with providers that are certified under the EU-US Data Privacy Framework or with whom EU standard contractual clauses are in place.

16. Storage period

We only store your data for as long as is necessary for the respective purpose or as required by statutory retention periods (generally 6 or 10 years for business records). We delete data that we process on the basis of your consent as soon as you withdraw your consent.

17. Your rights

You have the right to:

  • Access to your stored data (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): If we process your data on the basis of a legitimate interest, you can object at any time on grounds relating to your particular situation. You can object to the use of your data for direct marketing at any time without giving reasons.

Simply write to us at info@vintageonfriday.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

18. Changes

We will update this privacy policy if our shop or the legal requirements change. The version published here at any given time applies.