Privacy Policy

Your privacy is important to us. This policy explains how we collect, use, and protect your personal data.

Last updated: March 6, 2026

1. Data Controller

The data controller responsible for processing your personal data on this website is:

Artecke GmbH

Richard-Kirchner-Strasse 22

34537 Bad Wildungen, Hesse, Germany

Email: contact@artecke.com

Phone: +49 (151) 12345678

2. Data Protection Officer

If you have any questions about data protection, please contact our Data Protection Officer:

Email: privacy@artecke.com

Artecke GmbH - Data Protection Officer

Richard-Kirchner-Strasse 22

34537 Bad Wildungen, Germany

3. What Data We Collect

We may collect and process the following categories of personal data:

a) Identity and Contact Data

First name and last name
Email address
Postal/delivery address
Telephone number

b) Financial and Transaction Data

Payment card details (processed securely by our payment provider)
Order history and transaction records
Billing address

c) Technical and Browsing Data

IP address
Browser type and version
Operating system
Pages visited and time spent on pages
Referral source
Device information

d) Communication Data

Emails, messages, and correspondence with us
Customer service inquiries
Newsletter subscription preferences

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR:

Contract performance (Art. 6(1)(b) GDPR): Processing necessary to fulfil your orders, manage your account, and provide customer support.
Consent (Art. 6(1)(a) GDPR): Processing based on your explicit consent, such as newsletter subscriptions, analytics cookies, and marketing cookies. You may withdraw consent at any time.
Legitimate interests (Art. 6(1)(f) GDPR): Processing necessary for our legitimate business interests, such as fraud prevention, website security, and improving our services.
Legal obligation (Art. 6(1)(c) GDPR): Processing necessary to comply with tax, accounting, and other legal requirements.

5. Cookies

Our website uses cookies. Cookies are small text files stored on your device that help us provide and improve our services. We categorise cookies as follows:

Essential cookies: Required for basic website functionality (e.g., shopping cart, session management). These are set without requiring consent as they are strictly necessary.
Analytics cookies: Help us understand how visitors use our website. These are only set after you give consent.
Marketing cookies: Used to deliver relevant advertisements and track campaign effectiveness. These are only set after you give consent.

You can manage your cookie preferences at any time via our cookie consent banner or on our Cookie Notice page.

6. Third-Party Services

We may share your data with the following types of third-party service providers:

Payment processors: To securely process your payments. Your payment data is handled directly by the payment provider and we do not store full card details.
Shipping partners: To deliver your orders. We share your name, delivery address, and order details.
Analytics providers: To help us analyse website traffic and usage (only with your consent).
Email marketing platforms: To send newsletters and marketing communications (only with your consent).
Hosting provider: Our website is hosted on servers within the European Union.

All third-party providers are contractually obligated to process your data in accordance with the GDPR. Where data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

Account data: Retained for the duration of your account and up to 30 days after account deletion.
Order and transaction data: Retained for 10 years to comply with German tax and commercial law (section 147 AO, section 257 HGB).
Marketing consent records: Retained for 3 years after your last interaction or until you withdraw consent.
Cookie consent records: Retained for 12 months, after which you will be asked to renew your preferences.
Server logs: Automatically deleted after 7 days.

8. Your Rights Under the GDPR

As a data subject, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether we process your personal data and to request a copy of that data.
Right to rectification (Art. 16 GDPR): You have the right to request correction of inaccurate personal data and completion of incomplete data.
Right to erasure (Art. 17 GDPR): You have the right to request deletion of your personal data, subject to legal retention obligations.
Right to restriction of processing (Art. 18 GDPR): You have the right to request restriction of processing in certain circumstances.
Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to object (Art. 21 GDPR): You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@artecke.com. We will respond within 30 days of receiving your request.

9. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

The supervisory authority responsible for us is:

Der Hessische Beauftragte fuer Datenschutz und Informationsfreiheit

Postfach 3163

65021 Wiesbaden, Germany

Website: https://datenschutz.hessen.de

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

SSL/TLS encryption for all data transmissions
Regular security audits and vulnerability assessments
Access controls and authentication for internal systems
Employee training on data protection
Regular backups and disaster recovery procedures

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions or concerns about this privacy policy or our data processing practices, please contact us:

Artecke GmbH

Richard-Kirchner-Strasse 22

34537 Bad Wildungen, Germany

Email: privacy@artecke.com

Phone: +49 (151) 12345678

Back to Homepage

3. What Data We Collect

We may collect and process the following categories of personal data:

a) Identity and Contact Data

First name and last name
Email address
Postal/delivery address
Telephone number

b) Financial and Transaction Data

Payment card details (processed securely by our payment provider)
Order history and transaction records
Billing address

c) Technical and Browsing Data

IP address
Browser type and version
Operating system
Pages visited and time spent on pages
Referral source
Device information

d) Communication Data

Emails, messages, and correspondence with us
Customer service inquiries
Newsletter subscription preferences

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR:

Contract performance (Art. 6(1)(b) GDPR): Processing necessary to fulfil your orders, manage your account, and provide customer support.
Consent (Art. 6(1)(a) GDPR): Processing based on your explicit consent, such as newsletter subscriptions, analytics cookies, and marketing cookies. You may withdraw consent at any time.
Legitimate interests (Art. 6(1)(f) GDPR): Processing necessary for our legitimate business interests, such as fraud prevention, website security, and improving our services.
Legal obligation (Art. 6(1)(c) GDPR): Processing necessary to comply with tax, accounting, and other legal requirements.

5. Cookies

Our website uses cookies. Cookies are small text files stored on your device that help us provide and improve our services. We categorise cookies as follows:

Essential cookies: Required for basic website functionality (e.g., shopping cart, session management). These are set without requiring consent as they are strictly necessary.
Analytics cookies: Help us understand how visitors use our website. These are only set after you give consent.
Marketing cookies: Used to deliver relevant advertisements and track campaign effectiveness. These are only set after you give consent.

You can manage your cookie preferences at any time via our cookie consent banner or on our Cookie Notice page.

6. Third-Party Services

We may share your data with the following types of third-party service providers:

Payment processors: To securely process your payments. Your payment data is handled directly by the payment provider and we do not store full card details.
Shipping partners: To deliver your orders. We share your name, delivery address, and order details.
Analytics providers: To help us analyse website traffic and usage (only with your consent).
Email marketing platforms: To send newsletters and marketing communications (only with your consent).
Hosting provider: Our website is hosted on servers within the European Union.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

Account data: Retained for the duration of your account and up to 30 days after account deletion.
Order and transaction data: Retained for 10 years to comply with German tax and commercial law (section 147 AO, section 257 HGB).
Marketing consent records: Retained for 3 years after your last interaction or until you withdraw consent.
Cookie consent records: Retained for 12 months, after which you will be asked to renew your preferences.
Server logs: Automatically deleted after 7 days.

8. Your Rights Under the GDPR

As a data subject, you have the following rights regarding your personal data:

Right of access (Art. 15 GDPR): You have the right to obtain confirmation as to whether we process your personal data and to request a copy of that data.
Right to rectification (Art. 16 GDPR): You have the right to request correction of inaccurate personal data and completion of incomplete data.
Right to erasure (Art. 17 GDPR): You have the right to request deletion of your personal data, subject to legal retention obligations.
Right to restriction of processing (Art. 18 GDPR): You have the right to request restriction of processing in certain circumstances.
Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to object (Art. 21 GDPR): You have the right to object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@artecke.com. We will respond within 30 days of receiving your request.

9. Right to Lodge a Complaint

The supervisory authority responsible for us is:

Der Hessische Beauftragte fuer Datenschutz und Informationsfreiheit

Postfach 3163

65021 Wiesbaden, Germany

Website: https://datenschutz.hessen.de

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

SSL/TLS encryption for all data transmissions
Regular security audits and vulnerability assessments
Access controls and authentication for internal systems
Employee training on data protection
Regular backups and disaster recovery procedures