Privacy Policy

As of: November 2026

We are pleased that you are interested in our online shop. Protecting your personal data is important to us. Below, we provide detailed information about how we handle your data in accordance with the General Data Protection Regulation (GDPR).

 

1. Controller

The controller within the meaning of the GDPR is:

VEOLO UG (haftungsbeschränkt)
Georg-Schwarz-Straße 109
04179 Leipzig, Germany
Telephone: +49 157 83453571
Email: info@veolo.de
Represented by: Johann Schmidt

We are not legally required to appoint a data protection officer; therefore, no data protection officer has been appointed. If you have any questions about data protection, you can contact us using the contact details provided above.

2. Your rights as a data subject

You have the following rights with regard to your personal data vis-à-vis us:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)

To exercise these rights, an informal notification to info@veolo.de is sufficient.

Withdrawal of consent: Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object: Where your data is processed on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without stating reasons.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: The Saxon Commissioner for Data Protection and Transparency, Devrientstraße 5, 01067 Dresden.

3. Legal bases for processing

We process personal data on the following legal bases:

  • Art. 6(1)(a) GDPR – Consent (e.g., newsletters, analytics and marketing cookies, embedded videos and maps).
  • Art. 6(1)(b) GDPR – Performance of a contract and pre-contractual measures (e.g., order processing, payment, shipping).
  • Art. 6(1)(c) GDPR – Compliance with legal obligations (e.g., statutory retention obligations under tax and commercial law).
  • Art. 6(1)(f) GDPR – Safeguarding legitimate interests (e.g. secure and functional provision of the website, fraud prevention).

4. Hosting & Website Provision (Shopify)

Our online shop is operated on the platform of the provider Shopify (Shopify International Ltd., Ireland; parent company Shopify Inc., Canada). Shopify processes, on our behalf, the data required to provide the shop and process orders (including inventory, contact, order, and usage data). Fonts, images, videos, and program libraries for our shop are also delivered via Shopify’s servers. The legal basis is Art. 6(1)(b) and (f) GDPR. We have entered into a data processing agreement with Shopify. Further information: shopify.com/legal/privacy. For Shop Pay and “Login with Shop,” see Shopify’s information.

Reminders via the Shop app: If you use the Shopify app or service “Shop” and are logged in there, Shopify may send you reminders by email or push notification based on your activity in our shop, for example about an incomplete shopping cart, when a viewed item is back in stock, when a price drops, or when you have repeatedly shown interest in our products. For this purpose, usage data (e.g. products viewed, shopping cart contents) is linked to your Shop account. These reminders are sent only to Shop users who have consented to them with Shopify; you can unsubscribe at any time in the Shop app settings. The legal basis is the consent you have given to Shopify (Art. 6(1)(a) GDPR) or our legitimate interest in marketing our products (Art. 6(1)(f) GDPR). Further information: shop.app/privacy.

5. Server Log Files

Each time you visit, information is automatically collected and stored in server log files: browser type/version, operating system used, referrer URL, hostname of the accessing computer, time of the server request, and IP address. This data is used to ensure technical provision, security, and stability. The legal basis is Art. 6(1)(f) GDPR.

6. Cookies & Consent Management

We use cookies and similar technologies. Technically necessary cookies (e.g. shopping cart, session) are required for operation; the legal basis is Art. 6(1)(f) GDPR or § 25(2) TDDDG.

For all non-essential cookies and services (analytics, marketing, embedded third-party content), we obtain your consent via the Shopify consent banner (Customer Privacy/Consent Management). The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. You can change your selection at any time via the cookie settings and withdraw your consent with effect for the future. An overview of the cookies used can be found on our Cookie page.

7. Order processing & customer account

To process your order, we process the data you provide (name, billing and delivery address, email address, telephone number if applicable, and payment details). The processing is necessary to perform the contract under Art. 6(1)(b) GDPR. We share data with payment providers, shipping providers and the accounting system insofar as necessary to process the contract. You may optionally create a customer account; you can view and request deletion of the data stored there yourself.

8. Payment service providers

Depending on the payment method selected, we provide the necessary payment details to the respective provider. The legal basis is Art. 6(1)(b) GDPR. The payment methods used include:

  • PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg.
  • Klarna – Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may conduct a credit check to enable payment by invoice or in installments. Further information is available in Klarna’s privacy notice.
  • Credit card, Apple Pay, Google Pay, etc. via Shopify Payments – processed by Shopify.

The privacy notices of the respective providers also apply.

9. Shipping

To deliver your order, we provide your delivery details (name, address and, where applicable, email address/telephone number for tracking) to the shipping provider commissioned to handle the delivery. The legal basis is Art. 6(1)(b) GDPR. Shipping providers include, in particular:

  • DPD – DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg.
  • DHL / Deutsche Post – DHL Group / Deutsche Post AG, Bonn.
  • UPS – United Parcel Service Deutschland S.à r.l. & Co. OHG (for deliveries to countries outside Europe).

If we provide your email address to the shipping provider for shipment notifications, we will obtain your separate consent where required (Art. 6(1)(a) GDPR).

10. Accounting (Lexware Office)

To create invoices and maintain proper accounting records, we use Lexware Office (Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg). Order, invoice, and contact data are processed. The legal basis is Art. 6(1)(c) GDPR (tax and commercial law obligations) and Art. 6(1)(f) GDPR.

11. Newsletter

If you sign up for our newsletter, we use the double opt-in procedure: After signing up, you will receive an email with a confirmation link, and you will only be added to the mailing list after clicking it. This ensures that no one can sign up using someone else’s email address. We store your email address and the time of sign-up and confirmation as proof of your consent. Administration and delivery are handled through Shopify’s marketing features (see Section 4). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time using the unsubscribe link in each email or by sending us a message.

12. Web Analytics & Session Analysis

The following services are activated only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Google Analytics 4

We use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to analyze user behavior. This involves processing, among other things, truncated IP addresses, device and usage data, and a pseudonymous identifier. Transfer to Google LLC (USA) is possible.

Microsoft Clarity

We use Microsoft Clarity (Microsoft Ireland Operations Ltd., Dublin, Ireland) to analyze usage through session recordings and heatmaps. Interactions such as mouse movements, clicks, and scrolling behavior, as well as device and usage data, are processed in pseudonymized form. Transfer to Microsoft Corporation (USA) is possible.

13. Online Marketing

The following services are activated only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Google Ads & Conversion Tracking

We use Google Ads (Google Ireland Ltd.) to promote our offers and measure campaign success (conversion tracking). Cookies may be set and data may be transferred to Google to determine whether an ad led to a purchase.

Meta Pixel (Facebook/Instagram)

We use the Meta Pixel (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) to measure reach and for interest-based advertising on Meta’s platforms. Usage and interaction data may be transferred to Meta and matched with your Meta account. Transfer to Meta Platforms, Inc. (USA) is possible.

14. Product reviews (Judge.me)

We use Judge.me (Judge.me Ltd.) to collect and display product reviews. If you receive a review request after a purchase and submit a review, we process the data you provide (e.g., name/initials, review text). To display reviews, your browser loads content from Judge.me’s servers; your IP address is transmitted to Judge.me in the process. The legal basis for displaying reviews is Art. 6(1)(f) GDPR; for sending review requests by email, it is your consent or Section 7(3) UWG.

15. Embedded videos, maps and dealer search

YouTube

On some pages, we display videos hosted on YouTube (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). The videos are embedded in enhanced privacy mode (youtube-nocookie.com) and are only loaded if you have consented to marketing in the cookie banner or clicked “Load video.” Before then, no connection to YouTube is established; you will only see a preview image from our own servers. When the video is loaded, your IP address, device information and the page visited, among other data, are transmitted to Google; YouTube may use cookies or similar technologies. A transfer to Google LLC (USA) is possible. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Google Maps

On the “About us” page, you can display a Google Maps map (Google Ireland Ltd.). The map is only loaded if you have consented to marketing in the cookie banner or clicked “Load map.” In that case, your IP address and device information, among other data, are transmitted to Google; a transfer to Google LLC (USA) is possible. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The “Plan route” button is a simple link and only transmits data to Google when clicked.

Dealer map (OpenStreetMap, OpenFreeMap, Nominatim)

Our dealer map displays map data from OpenStreetMap. When you visit the page, your browser loads the map tiles from the servers of OpenFreeMap (openfreemap.org); your IP address is transmitted in the process. No cookies are set for this purpose. We load the required program libraries from Shopify’s servers. The legal basis is our legitimate interest in providing a functional dealer search (Art. 6(1)(f) GDPR).

When you enter a location or postal code in the dealer search and start the search, this search term, together with your IP address, is transmitted to the Nominatim service of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) to convert it into coordinates. The European Commission has adopted an adequacy decision for the United Kingdom. The legal basis is Art. 6(1)(f) GDPR.

If you use the location feature on the dealer map, your browser will first ask for your permission. Your location is used only in your browser to calculate the distance to dealers and is not transmitted to us or third parties.

16. Availability notification (“Back in stock”)

We use a corresponding service (Zooomy) to notify you when items become available again. If you sign up for a notification, we store your email address and the item concerned so we can notify you once. The legal basis is your consent under Art. 6(1)(a) GDPR.

17. Contact

If you contact us by email, telephone, or via a messaging function, we process the information you provide to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR (for contract-related inquiries) or Art. 6(1)(f) GDPR, based on our legitimate interest in handling inquiries efficiently. Messages you send us via Shopify Inbox are processed by Shopify on our behalf as part of the platform (see Section 4). We store your inquiries until the matter has been conclusively resolved and provided that no statutory retention obligations apply.

18. Data transfers to third countries

Some of the services mentioned may transfer data to countries outside the EU/EEA, particularly the United States. Where providers are certified under the EU-U.S. Data Privacy Framework (including Google, Meta, and Microsoft), transfers take place on the basis of the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise, we base transfers on the European Commission’s standard contractual clauses (Art. 46 GDPR) or your explicit consent (Art. 49(1)(a) GDPR). An adequacy decision applies to Shopify (Canada) and the OpenStreetMap Foundation (United Kingdom).

19. Storage period

We store personal data only for as long as necessary for the respective purposes. Order and invoice data are subject to statutory retention periods (generally 10 years under § 147 AO, § 257 HGB). We store data processed on the basis of consent (e.g., newsletters, analytics) until consent is withdrawn or the purpose no longer applies.

20. Changes to this Privacy Policy

We update this Privacy Policy whenever changes to our processing activities or the legal situation make it necessary. The version published on this page at any given time applies.