We take the protection of your personal data very seriously. This Privacy Policy explains which data we collect, how we use it, and what rights you have. It applies to the website sveason.com.

Last updated: May 2026

1. Controller

The controller responsible for data processing on this website is:

SVEASØN GbR
Shirin Benkus & Svea Beckedorf
Bachstelzenweg 2, 21217 Seevetal
mail@sveason.com

2. Hosting – Shopify

This website is hosted by Shopify Inc., 151 O'Brien Street, Ottawa, Ontario K1N 5W7, Canada.

When visiting the website, Shopify automatically collects technical data including IP address, browser type, operating system, date and time of access, and visited pages.

Legal basis: Art. 6 (1) lit. f GDPR.
Data may be transferred to the USA based on Standard Contractual Clauses (SCCs).

https://www.shopify.com/legal/privacy

3. Orders & Customer Data

When placing an order, we collect your name, shipping address, email address, payment details (processed by payment providers – we do not store card details ourselves), and order details.

Legal basis: Art. 6 (1) lit. b GDPR.
Retention period: 10 years according to § 257 HGB.

4. Payment Providers

Shopify Payments (Stripe)

When paying by credit/debit card, Apple Pay, or Google Pay, payments are processed via Shopify Payments (Stripe). Card data is transmitted directly to Stripe and is not stored by us.

For payment processing in our shop, we use Shopify Payments / Stripe. Payments may be processed via credit card as well as services such as Apple Pay or Google Pay.

During payment processing, personal data such as name, payment information, billing address, and transaction amount may be processed.

Processing is carried out for the performance of a contract in accordance with Art. 6 (1) lit. b GDPR.

Data may be transferred to the USA. Stripe uses EU Standard Contractual Clauses to protect personal data.

Further information about Stripe’s privacy practices can be found here:
https://stripe.com/privacy ✨

PayPal

When paying via PayPal, you will be redirected to the PayPal website. PayPal processes your payment data according to its own privacy policy.

For payment processing via PayPal, we use the service PayPal (Europe) S.à r.l. et Cie, S.C.A.

Personal data such as name, email address, PayPal account information, and transaction amount may be processed.

Processing is carried out for the performance of a contract in accordance with Art. 6 (1) lit. b GDPR.

Data processing may take place in Luxembourg as well as in the USA.

Further information about PayPal’s privacy practices can be found here:
https://www.paypal.com/webapps/mpp/ua/privacy-full ✨

5. Shipping – DHL

To deliver your order, we transmit your name and shipping address to Deutsche Post DHL Group. Depending on the shipping destination, we use DHL Paket (Germany and Europe) or DHL Express (worldwide shipping). DHL may inform you via email or SMS about the status of your shipment. By placing an order, you agree to the transfer of your contact details to DHL for shipping purposes.

Deutsche Pøst AG / DHL Paket GmbH

For shipping our orders, we work with Deutsche Pøst AG / DHL Paket GmbH.

Personal data such as name, shipping address, email address, and, where applicable, telephone number are processed in order to enable national and European parcel shipping as well as shipment tracking.

Processing is carried out for the performance of a contract in accordance with Art. 6 (1) lit. b GDPR.

Data processing takes place within Germany and the EU.

Further information about DHL’s privacy practices can be found here:
https://www.dhl.de/de/meta/datenschutz.html ✨

DHL Express – Wørldwide Shipping

DHL Express Germany GmbH

For international express deliveries, we work with DHL Express Germany GmbH.

Personal data such as name, shipping address, email address, and, where applicable, telephone number are processed in order to enable international express shipping, shipment tracking, and services such as On Demand Delivery.

Processing is carried out for the performance of a contract in accordance with Art. 6 (1) lit. b GDPR.

Data processing may take place within Germany, the EU, and worldwide.

Further information about DHL’s privacy practices can be found here:
https://www.dhl.de/de/meta/datenschutz.html ✨

6. Email Marketing – Klaviyø

We use Klaviyø for sending our newsletter and transactional emails. When subscribing to the newsletter, your email address and, if applicable, your name are stored by Klaviyø.

Newsletter Unsubscription

Newsletter subscription is voluntary. You can unsubscribe at any time via the link included in every newsletter email.

Klaviyø Inc.

For sending our newsletter as well as transactional emails such as order confirmations or shipping updates, we use Klaviyø Inc.

Personal data such as email address, name (if provided), order history, and information about shop behavior may be processed.

Processing is carried out:

• in accordance with Art. 6 (1) lit. a GDPR based on your consent for newsletter distribution
• and in accordance with Art. 6 (1) lit. b GDPR for the performance of a contract regarding transactional emails

Data processing may take place in the USA. Klaviyø uses EU Standard Contractual Clauses to protect personal data.

Further information about Klaviyø’s privacy practices can be found here:
https://www.klaviyo.com/legal/privacy-notice ✨

7. Søcial Media – Instagram

We maintain a profile on Instagram (Meta Platforms Ireland Ltd.). On this website, we only link to our Instagram profile. There is currently no direct integration (no tracking pixel, no Instagram Shopping).

https://privacycenter.instagram.com/policy

8. Cøøkies

Our website uses technically necessary cookies from Shopify (for example shopping cart and session management). These do not require consent.

We currently do not use any analytics, advertising, or tracking cookies.

9. Yøur Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object (Art. 21)
• Right to withdraw consent (Art. 7 (3))

To exercise these rights, please contact:
mail@sveason.com

Competent supervisory authority:

The State Commissioner for Data Protection Lower Saxony
Prinzenstraße 5, 30159 Hanover
https://www.lfd.niedersachsen.de

10. Cøntact – Data Prøtectiøn

SVEASØN GbR
Shirin Benkus & Svea Beckedorf
mail@sveason.com ✨