Privacy policy
Last updated: 27 September 2026
This privacy policy is also available in German. Recoil Merchandising is established in Germany; this policy is governed by the EU General Data Protection Regulation (GDPR) and German data protection law. Where German statutes are cited, the German short form is given, as that is the binding designation.
1. Controller
The controller within the meaning of Art. 4 (7) GDPR is:
Recoil Merchandising
c/o Michael Grosicar
Ruhrlandbogen 2
45257 Essen
Germany
Telephone: +49 177 4681154
E-mail: info@recoil-merchandising.com
VAT identification number: DE814977949
2. Data protection officer
We have not appointed a data protection officer. The conditions of Art. 37 GDPR and of § 38 (1) of the German Federal Data Protection Act (BDSG) are not met, as our business does not permanently employ at least twenty people in the automated processing of personal data. For any question concerning data protection, please contact us using the details in section 1.
3. General information on our processing
As a rule, we process personal data only where this is necessary to provide a functioning website and our content and services. Any processing beyond that generally takes place only with your consent or where a statutory provision permits it.
We erase your personal data as soon as the purpose of storage ceases to apply. Data are stored beyond that point where European or national law to which we are subject requires it. Data are also blocked or erased once a statutory retention period expires, unless there is a continued need to store the data for the conclusion or performance of a contract.
We do not operate our own servers. Our website and shop run on the e-commerce platform of Shopify International Limited, which acts as a processor on our behalf. See section 14 for details.
4. Visiting our website and server log files
Each time our website is accessed, the system automatically collects data and information from the computer system of the accessing device:
- the IP address of the requesting device
- date and time of access
- the page or file requested
- the volume of data transferred and notification of successful retrieval
- browser type, browser version and operating system used
- the referrer URL, that is, the website from which the access originated
Purpose: delivering the website to your device, ensuring system security and stability, and detecting and preventing attacks and abusive use.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically faultless operation and the security of our shop. These data are not analysed for marketing purposes.
Storage period: the log files are stored by our platform provider and erased at regular intervals. We do not combine these data with other data sources.
5. Cookies and management of your consent
We use cookies and comparable technologies such as pixels and local storage on our website. Cookies are small text files stored on your device.
Strictly necessary cookies are required for the shop to work at all. They cover in particular session management, the shopping cart, the choice of language and currency, and security functions during checkout.
- Legal basis for storage on your device: § 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Storage is strictly necessary in order for us to provide the service you have expressly requested. No consent is required for this.
- Legal basis for the subsequent processing: Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR in the case of orders.
All other cookies — in particular those used to measure reach, to analyse your behaviour or for advertising purposes — are used only if you have given us your prior consent.
- Legal basis for storage on your device: § 25 (1) TDDDG (consent).
- Legal basis for the subsequent processing: Art. 6 (1) (a) GDPR (consent).
You give your consent through our consent banner, which appears the first time you visit our website. You are under no obligation to consent; the shop is fully usable without consent.
Consent management platform we use: to obtain, manage and document your consent we use the service consentmanager provided by consentmanager AB, Håltegelvägen 1b, 723 48 Västerås, Sweden. This stores your consent decision, an anonymised identifier for your device, the time and scope of your consent, and information about your browser and device. This storage serves to demonstrate your consent, which we are required to do under Art. 7 (1) GDPR, and therefore does not itself require consent. The service is operated within the European Union; no transfer to a third country takes place in this respect.
Withdrawing your consent: you may withdraw any consent given at any time with effect for the future, without any disadvantage to you. To do so, open the consent banner settings again and change your selection. Alternatively, a message to info@recoil-merchandising.com is sufficient. The lawfulness of processing carried out up to the point of withdrawal is unaffected.
You may additionally delete or block cookies in your browser settings. We expressly point out that browser settings do not replace consent under § 25 (1) TDDDG — we set cookies requiring consent only after you have consented via the banner, irrespective of your browser settings.
6. Customer account
You may create a customer account in our shop. In doing so we process the data you provide, in particular your name, e-mail address, delivery and billing address, and your order history.
Purpose: administering your account, simplifying future orders, giving you access to your orders.
Legal basis: Art. 6 (1) (b) GDPR. Maintaining the customer account is the subject matter of the user relationship concluded with you.
Storage period: until your customer account is deleted. You may have your account deleted at any time; a message to us is sufficient. Data subject to commercial or tax retention obligations are unaffected (see section 16).
7. Orders and performance of the contract
When you place an order with us, we process the data required to perform the contract:
- first and last name
- delivery and billing address
- e-mail address
- telephone number, if provided
- items ordered, sizes, prices and order number
- payment method and payment status
Purpose: forming, performing and settling the purchase contract, shipping, invoicing, handling withdrawal, returns, warranty claims and refunds, and communicating with you about your order.
Legal basis: Art. 6 (1) (b) GDPR (performance of the contract and steps prior to entering into a contract). Where we retain data to comply with commercial and tax obligations, the legal basis is Art. 6 (1) (c) GDPR.
Whether provision is required: providing your name, delivery address, billing address, e-mail address and payment details is necessary in order to conclude the contract. Without them we cannot enter into the purchase contract and cannot deliver the goods. Providing a telephone number is voluntary; it only helps us if we have questions about the delivery. Not providing voluntary information has no disadvantage for you.
8. Payment processing
Several payment providers are available. Depending on your choice, we pass the data required for settlement to the relevant payment provider. That provider is independently responsible for processing the payment; the provider's own privacy notices apply in addition.
We use:
- Shopify Payments, provided by Shopify International Limited, 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. This handles card payments and the wallet payment methods offered in the shop.
- PayPal, provided by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
- Klarna, provided by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
We do not receive complete card details or bank account details. These are collected and processed directly by the payment provider. We hold only the payment method, the payment status, the amount and a transaction reference.
Legal basis: Art. 6 (1) (b) GDPR for settling the payment method you have chosen. Where the payment provider processes data for fraud prevention or — in the case of invoice and instalment purchase — for a credit assessment, this is based on Art. 6 (1) (f) GDPR or, in Klarna's case, on Klarna's own terms; please refer to that provider's notices.
9. Shipping, parcel tracking and returns
To deliver your order we pass your name, your delivery address and — where necessary for delivery — your e-mail address and telephone number to the shipping service provider engaged. Shipping is carried out by Spring GDS and the delivery partners it uses.
For shipping status and parcel tracking we additionally use the service AfterShip provided by AfterShip Limited. Order and shipment data together with your contact details are processed in order to provide you with status updates on your parcel.
To handle returns and withdrawals we use the service easyReturns, provided by 247APPS UG (haftungsbeschränkt), In der Goldgrube 28, 56073 Koblenz, Germany. Where you register a return or exercise your right of withdrawal, we process your order number, your name, your contact details and the items concerned in order to process the return and, where applicable, to generate a return label. Where a return label is issued, your e-mail address may be passed to the carrier used for that label.
Legal basis: Art. 6 (1) (b) GDPR. Passing data to the shipping service provider, providing parcel tracking and handling returns and withdrawals are necessary to perform the purchase contract. Where we process returns in order to comply with statutory withdrawal rights, the legal basis is additionally Art. 6 (1) (c) GDPR.
10. Print-on-demand production
A large part of our range is produced individually for you only after you have placed your order. This production and the subsequent dispatch are carried out on our behalf by:
ALLYOURBANDNEEDS (AYBN)
Im Giesdorfer Grund 5
50997 Cologne
Germany
Telephone: +49 221 630616750
E-mail: info@aybn.com
For this purpose we transfer the order and delivery data — name, delivery address, items ordered and order number — to AYBN and to Myze, the production platform AYBN uses. Without this transfer the goods cannot be manufactured and cannot be shipped to you.
Legal basis: Art. 6 (1) (b) GDPR.
11. Invoices and accounting
We process your order and billing data in order to issue invoices and for accounting purposes. For this we use the services sevdesk (accounting) and Order Printer Pro (generating invoice and delivery documents).
Legal basis: Art. 6 (1) (c) GDPR in conjunction with our commercial and tax obligations under § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB), and Art. 6 (1) (b) GDPR for invoicing as part of performing the contract.
12. Newsletter
You may subscribe to our newsletter and will then receive information about new items, repressings and special offers.
Subscription by double opt-in: after you subscribe we send you an e-mail containing a confirmation link. Only once you click that link do we add you to the recipient list. This ensures that nobody can subscribe someone else's e-mail address. To evidence your subscription we store the time of subscription and of confirmation.
Data processed: e-mail address, name where provided, and the time of subscription and confirmation.
Legal basis: Art. 6 (1) (a) GDPR (your consent). For documenting that consent we additionally rely on Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR.
You may unsubscribe at any time and thereby withdraw your consent. Every newsletter e-mail contains an unsubscribe link. Alternatively, a message to info@recoil-merchandising.com is sufficient. You incur no costs other than transmission costs at basic rates. After you unsubscribe we delete your data from the recipient list; we retain the record of your former consent in order to defend against possible claims.
13. Contacting us and customer service
If you contact us by e-mail, through a contact form or via the chat function in our shop, we process the data you send us in order to answer your enquiry. For the chat and messaging function we use the service Shopify Messaging.
Legal basis: Art. 6 (1) (b) GDPR where your enquiry concerns an existing or prospective contract; otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in answering enquiries addressed to our business.
Storage period: we delete the correspondence once your matter has been conclusively resolved and no statutory retention obligations apply.
14. Recipients and processors
We disclose your data only where this is necessary and a legal basis exists. We have concluded data processing agreements under Art. 28 GDPR with every service provider that processes personal data on our instructions.
| Recipient | Role and purpose | Location |
|---|---|---|
| Shopify International Limited / Shopify Inc. | Processor – operation of the shop platform, hosting, checkout, customer accounts, statistics | Ireland / Canada |
| ALLYOURBANDNEEDS (AYBN) and Myze Software | Print-on-demand production and dispatch preparation | Germany |
| Spring GDS and its delivery partners | Independent recipient – transport and delivery of your parcel | Netherlands / international |
| AfterShip Limited | Processor – parcel tracking and shipping notifications | outside the EU |
| 247APPS UG (haftungsbeschränkt) – easyReturns | Processor – processing of returns and withdrawals, issuing return labels | Germany |
| Shopify Payments (Shopify International Limited) | Payment processing | Ireland |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Independent recipient – payment processing | Luxembourg |
| Klarna Bank AB (publ) | Independent recipient – payment processing | Sweden |
| sevdesk | Processor – accounting | Germany |
| Order Printer Pro | Processor – generating invoice and delivery documents | outside the EU |
| consentmanager AB | Processor – obtaining, managing and evidencing your cookie consent | Sweden |
| Tax advisers, tax authorities, legal advisers | Recipients on the basis of statutory obligations or to exercise our rights | Germany |
We do not pass your data to third parties for advertising purposes. We do not sell your data.
15. Transfers to third countries
Some of the service providers we use process data outside the European Union and the European Economic Area. This concerns in particular the recipients designated as "outside the EU" in section 14, and Shopify Inc., which is established in Canada.
A transfer takes place only where one of the following instruments applies:
- an adequacy decision of the European Commission under Art. 45 GDPR. Such a decision exists for Canada in respect of recipients subject to Canadian private-sector data protection legislation. For recipients in the United States an adequacy decision applies where the recipient is certified under the EU-US Data Privacy Framework.
- otherwise the standard contractual clauses adopted by the European Commission under Art. 46 (2) (c) GDPR, supplemented by additional safeguards based on a case-by-case assessment.
Copy of the safeguards: you have the right to obtain a copy of the standard contractual clauses and the supplementary safeguards we use. Please send a request to info@recoil-merchandising.com. We will provide the documents free of charge, where applicable with business secrets redacted.
We point out that where data are processed in third countries, a level of protection comparable to European law cannot be guaranteed in every case, and access by state authorities cannot be entirely ruled out.
16. Storage periods
We store your data only for as long as is necessary for the purposes described or as long as we are legally required to do so.
| Data | Period | Basis |
|---|---|---|
| Invoices, accounting records, commercial correspondence | 10 years from the end of the calendar year in which they arose | § 147 (3) AO, § 257 (4) HGB |
| Commercial letters received and sent | 6 years | § 257 (4) HGB |
| Customer account | until deleted by you | Art. 6 (1) (b) GDPR |
| Newsletter data | until withdrawal; record of consent beyond that | Art. 6 (1) (a), Art. 7 (1) GDPR |
| Customer service correspondence | until the matter is conclusively resolved | Art. 6 (1) (b) or (f) GDPR |
| Cookie consent record | until withdrawal, at most for the lifetime of the relevant cookie | § 25 (1) TDDDG, Art. 7 (1) GDPR |
Data subject to a statutory retention obligation are blocked from further use once their purpose has been achieved and erased once the period expires.
17. No automated decision-making
Automated decision-making in individual cases, including profiling, within the meaning of Art. 22 GDPR does not take place. We do not take decisions about your order based solely on automated processing that have legal effect for you.
Our payment providers do use automated checks as part of fraud prevention, for example to detect unusual payment patterns. In the case of invoice or instalment purchase, the payment provider may additionally carry out an automated credit assessment and refuse the payment method on that basis. These procedures are the responsibility of the relevant provider; further information can be found in that provider's privacy notices.
18. Your rights
You have the following rights against us in respect of your personal data. Exercising them is free of charge.
- Right of access under Art. 15 GDPR — you may request information about which of your data we process, for what purposes, to which recipients we disclose them and for how long we store them.
- Right to rectification under Art. 16 GDPR — you may request that inaccurate data be corrected and incomplete data completed.
- Right to erasure under Art. 17 GDPR — you may request erasure of your data unless a statutory retention obligation prevents it.
- Right to restriction of processing under Art. 18 GDPR — you may request that we process your data only in a restricted manner.
- Right to data portability under Art. 20 GDPR — you may request that we provide the data you have given us in a structured, commonly used and machine-readable format, or transmit them to another controller.
- Right to object under Art. 21 GDPR — see the separate section 19.
- Right to withdraw consent under Art. 7 (3) GDPR — where you have given us consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out up to the point of withdrawal is unaffected.
To exercise your rights, a message to info@recoil-merchandising.com or to the address given in section 1 is sufficient. We will respond without undue delay and at the latest within one month. For the security of your data we may need to verify your identity before providing information.
19. Your right to object under Art. 21 GDPR
Objection to processing based on a legitimate interest (Art. 21 (1) GDPR)
Where we process your data on the basis of Art. 6 (1) (f) GDPR, you have the right to object at any time to that processing on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Objection to direct marketing (Art. 21 (2) GDPR)
We process your data for direct marketing purposes only with your consent. Irrespective of this, you have the right to object at any time to the processing of your personal data for the purposes of such marketing. This also applies to profiling to the extent that it is related to direct marketing. If you object, we will no longer process your data for those purposes. Objecting is free of charge for you, requires no reasons and no particular form.
Please address your objection to: info@recoil-merchandising.com or to Recoil Merchandising, c/o Michael Grosicar, Ruhrlandbogen 2, 45257 Essen, Germany. For e-mail marketing, the unsubscribe link in the relevant message is also sufficient.
20. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. You may contact the authority of your habitual residence, your place of work or the place of the alleged infringement.
The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Germany
Telephone: +49 211 38424-0
Website: www.ldi.nrw.de
We would be glad if you came to us first — in most cases a matter can be resolved directly.
21. Data security
Our website and the checkout process are secured by TLS encryption. You can recognise an encrypted connection by the padlock symbol in your browser's address bar and by the address beginning with "https://". We also take appropriate technical and organisational measures under Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access.
We point out that the transmission of data over the internet can never be entirely secure. Please do not send us particularly sensitive information by unencrypted e-mail.
22. Changes to this privacy policy
We will amend this privacy policy if our processing activities, the service providers we use or the legal framework change. The version published on this page applies in each case. The date of the most recent change is shown at the top of this policy.
We recommend reading this policy from time to time before using our shop again. Where a change requires it, we will obtain fresh consent.