Privacy Policy (Datenschutzerklärung)

Controller responsible for data processing:

Note on data protection officers: Locher & Landwehr GbR has not appointed a data protection officer (Datenschutzbeauftragter) under § 38 BDSG (Federal Data Protection Act), as the company employs fewer than 20 persons in the regular, automated processing of data. For data protection questions, you can contact us directly at the contact address given above.

We process your personal data on the basis of the General Data Protection Regulation (GDPR / DSGVO) and the Federal Data Protection Act (BDSG). Data is only processed insofar as this is justified by one of the legal bases named below — in particular by the provision of our services (contract), your consent, legal obligations or our legitimate business interests.

Processing does not regularly take place on the basis of consent, but primarily for the performance of the contract (order, shipping, payment) and to comply with legal obligations.

When you access our website, the following data is automatically stored in server log files:

• IP address (shortened/pseudonymised by removing the last octet)
• Date and time of access
• Browser type and operating system
• Referrer (the page from which you came to us)
• Sub-pages visited

Storage period: Server log files are automatically deleted after 30 days.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in security and system administration).

Our online shop is hosted on the e-commerce platform of Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify is a processor (Auftragsverarbeiter) under Art. 28 GDPR. A data processing agreement (Auftragsverarbeitungsvertrag / Data Processing Addendum) governs the processing.

Transmitted data: Order data (name, address, payment information, order history) is stored with Shopify.

Third-country transfer: Shopify may transmit data to third countries, in particular the USA and Canada. For transfers to the USA, Shopify relies on the adequacy decision (Angemessenheitsbeschluss / EU-US Data Privacy Framework) and, additionally, on standard contractual clauses (Standardvertragsklauseln) under Art. 46 GDPR.

Storage period: Customer data is deleted after the expiry of statutory retention obligations (up to 10 years).

Subcontractors: A current list of Shopify subprocessors can be found at Shopify Subprocessors.

When you place an order, we store the following data for the performance of the contract:

• Surname, first name
• Billing and delivery address
• Email address
• Phone number
• Products ordered and quantity
• Payment information

Legal basis: Art. 6 (1) (b) GDPR (performance of contract) and Art. 6 (1) (c) GDPR (commercial and tax law).

Storage period: Order data and invoices are retained for 10 years in accordance with the German Commercial Code (HGB) and Fiscal Code (AO).

Categories of recipients: To perform the contract, data is passed on to the following categories of recipients:

• Fulfilment partner (Intermail AG)
• Logistics partner (DHL)
• Payment providers (see below)
• Other service providers (tax advisor, IT administration) for accounting and system management

For shipping, we work with Intermail AG (Munich) as fulfilment service provider and DHL for transport. We transmit name, delivery address and order data for the purpose of performing the contract (Art. 6 (1) (b) GDPR). Data processing agreements exist with both service providers.

Storage period: After successful delivery, data is deleted after the expiry of retention obligations under commercial law.

When you contact us by email or contact form, we store: email address, name, phone number and message content.

Legal bases: Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in customer communication).

Storage period: After answering your enquiry, the data is deleted, insofar as no further statutory retention obligations exist. Business-relevant correspondence is retained for up to 3 years (business letters / Geschäftsbriefe).

You can apply for our membership area (L&L Club) via an application form. In doing so, we process your name, email address and any further information you voluntarily provide (e.g. an Instagram handle). We store this information as a customer record in our Shopify system (see item 5) and mark it internally as an application, a membership or a rejection.

Once approved, you receive an email with a personal, time-limited access link ("magic link"). You sign in via this link without a password; only a signed session cookie is set. A discount code may be assigned to your customer account.

Service providers used: The membership area is a separate application hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, connected to our shop via a Shopify app proxy interface. We send invitation and access emails via the email service provider Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures / performance of the membership relationship) and Art. 6 (1) (a) GDPR, insofar as you voluntarily provide additional information.

Third-country transfer: Vercel and Resend (also) process data in the USA. The transfer is based on the EU-US Data Privacy Framework and, additionally, on standard contractual clauses under Art. 46 GDPR. We are entering into data processing agreements under Art. 28 GDPR with both providers.

Storage period: If no membership results, we delete the application data once no further enquiries are to be expected. If a membership exists, we store the data for as long as it continues; afterwards item 17 applies.

To exercise your statutory right of withdrawal (§ 355, § 356a BGB), you may use our online form as an alternative to an informal letter. In doing so, we process your first name, last name, order number and email address.

Your information is processed via our application hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered by email via the service provider Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA — both to us (info@locherlandwehr.com) and as an acknowledgement of receipt to you.

Legal basis: Art. 6 (1) (c) GDPR (legal obligation to accept and confirm the withdrawal) in conjunction with Art. 6 (1) (b) GDPR (reversal of the purchase contract).

Storage period: Same as order and invoice data, as the withdrawal forms part of our commercial and tax-law retention obligations (10 years, see item 6).

Third-country transfer: As described under item 10.

For sending newsletters, we use Klaviyo Inc., 125 Summer Street, Boston, MA 02111, USA. Registration takes place using the double opt-in procedure: after entering your email address, you will receive a confirmation email that you must confirm.

Legal basis: Art. 6 (1) (a) GDPR (consent) in conjunction with § 7 (2) no. 3 UWG (Act Against Unfair Competition).

Tracking: The newsletter contains tracking elements (open and click rates) and uses email tracking pixels. This data serves to measure newsletter effectiveness and is deleted after you unsubscribe, in accordance with Klaviyo’s privacy policies.

Storage period: Your subscriber data is stored for as long as you are subscribed to the newsletter. After unsubscribing, proof of consent is stored for 3 years (due to the UWG limitation period), then deleted.

Third-country transfer: Data transfer to the USA on the basis of the EU-US Data Privacy Framework + standard contractual clauses. A data processing agreement with Klaviyo is in place. Klaviyo privacy

Withdrawal: You can withdraw your consent at any time by clicking the unsubscribe link in the newsletter or by email to info@locherlandwehr.com.

Our website offers an AI-powered chat assistant ("James") that you can use to ask questions about products, sizing and orders. James is embedded on every page of our shop but only becomes active once you open the chat and enter a message.

Data processed: Your chat input, together with technical context of the page currently displayed (e.g. the product name), is transmitted to our backend and from there to the Anthropic API in order to generate a reply. Please do not share special categories of personal data (e.g. health data) or payment information in the chat.

Provider: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. The backend that forwards the request to Anthropic is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in fast, low-threshold customer communication) and Art. 6 (1) (a) GDPR, insofar as you voluntarily provide personal data in the chat.

Storage period: We do not permanently store your chat conversations ourselves; requests are not kept in a database of our own after the reply has been generated. According to its own information, Anthropic processes your input to answer the request and, for a limited period, for abuse-detection purposes; details at Anthropic privacy.

Third-country transfer: Anthropic and Vercel process data in the USA. The transfer is based on standard contractual clauses under Art. 46 GDPR. We are entering into data processing agreements under Art. 28 GDPR with both providers.

This website uses Google Analytics 4 (Google Ireland Limited, Dublin). Google Analytics 4 anonymises IP addresses inherently — these are not stored in reports. Cookies enable the analysis of page views, user duration and conversions.

Legal basis: Art. 6 (1) (a) GDPR (consent) in conjunction with § 25 (1) TTDSG.

Storage period: Anonymised usage data is automatically deleted after 14 months.

Third-country transfer: EU-US Data Privacy Framework + standard contractual clauses. A data processing agreement with Google is in place.

Automated decision-making / profiling: Google Analytics creates user profiles and audiences for analysis purposes. Within the meaning of Art. 22 GDPR, this is statistical profiling for data analysis, not automated individual decisions that legally bind you.

Withdrawal: You can withdraw your consent at any time via the cookie settings. Google privacy

This website uses the Meta Pixel (Meta Platforms Ireland Limited, Dublin). The pixel tracks user behaviour after clicking on Facebook/Instagram advertisements in order to enable conversion measurement and audience creation.

Legal basis: Art. 6 (1) (a) GDPR (consent) in conjunction with § 25 (1) TTDSG.

Storage period: Meta stores the collected data in accordance with Meta’s privacy policies; the specific storage period can be viewed on Meta’s page.

Joint controllership: With Meta there is an agreement on joint controllership (gemeinsame Verantwortlichkeit / Art. 26 GDPR). Although the data is not traceable for us, it is treated as personal in the overall context of the joint processing.

Automated decision-making: Meta creates user profiles and audiences for advertising purposes (profiling). This does not affect you through automated individual decisions in our shop.

Third-country transfer: EU-US Data Privacy Framework + standard contractual clauses.

Withdrawal: You can withdraw your consent at any time via the cookie settings. Meta privacy

Insofar as no more specific storage period is stated in this policy, we follow this principle:

• Contract data (orders): 10 years (commercial and tax law obligation)
• Contact enquiries: Up to 3 years (for business letters); then deletion
• Log files: 30 days
• Cookies: Depending on type, 90 days to 12 months; deletion immediately upon withdrawal
• Newsletter subscribers: As long as subscribed; after unsubscribing, 3 years of proof, then deletion
• Club applications/membership: Application data until a decision is made; for as long as a membership continues
• Withdrawal form: Same as contract data (10 years)
• James chat: No permanent storage on our own systems
• Other data: After the purpose ceases and statutory retention periods expire

You have the following rights vis-à-vis us:

• Right of access (Auskunftsrecht, Art. 15 GDPR): Information about your personal data
• Right to rectification (Berichtigungsrecht, Art. 16 GDPR): Correction of inaccurate or incomplete data
• Right to erasure (Löschungsrecht, Art. 17 GDPR): „right to be forgotten"
• Right to restriction (Einschränkungsrecht, Art. 18 GDPR): Restriction of processing
• Data portability (Datenübertragbarkeit, Art. 20 GDPR): Receipt of your data in a structured format
• Withdrawal of consent (Widerruf der Einwilligung, Art. 7 (3) GDPR): At any time without giving reasons

To exercise these rights, an email to info@locherlandwehr.com or a letter to the address given above is sufficient.

This applies in particular to:

• Objection to security and fraud prevention (log files)
• Objection to reach analysis (Google Analytics) — more easily via the cookie settings
• Objection to marketing and audiences (Meta Pixel) — more easily via the cookie settings
• Objection to direct marketing by email or telephone

To lodge an objection, please write to info@locherlandwehr.com and state which processing you are objecting to.

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR.

Competent authority for Locher & Landwehr GbR:

We protect our website and systems against loss, destruction and unauthorised access through technical (SSL/TLS encryption, firewalls) and organisational measures (access control, staff training).

Order data is transmitted SSL/TLS-encrypted at checkout. Complete payment information is not stored on our servers (processing via payment providers).

This privacy policy is dated September 2026. Due to the further development of our website or changed legal requirements, an adjustment may become necessary. You can find the respective current version at www.locherlandwehr.com/datenschutz.