Privacy policy

GOODROLL – Privacy Policy

1. Controller
The controller responsible for processing personal data on goodroll.eu is:
Arte Suave UG (haftungsbeschränkt)
Pannierstrasse 34
12047 Berlin, Germany
Email: philipp@goodroll.eu
GOODROLL is a brand of Arte Suave UG (haftungsbeschränkt).

2. Purposes and legal bases
We process personal data to provide our online store, respond to enquiries, process orders and payments, and ship goods. Further processing serves security purposes and, subject to the relevant consent, analytics, personalisation and advertising.
The legal bases are Article 6(1)(b) GDPR for contracts and pre-contractual enquiries, Article 6(1)(c) GDPR for legal obligations, Article 6(1)(f) GDPR for legitimate interests, particularly secure store operations and the defence of legal claims, and Article 6(1)(a) GDPR for processing based on consent.

3. Shopify and technical provision of the store
Our store is provided through Shopify. Shopify processes, in particular, IP addresses, browser and device information, access times, pages visited and technical usage data. Purchases also involve contact, order, delivery and payment information. Processing serves the technical provision of the store, order processing, troubleshooting and security.
The legal bases are Article 6(1)(b) and (f) GDPR. Our legitimate interest is the reliable and secure operation of the store. Where Shopify processes data on our behalf, Shopify’s data processing terms apply.
For certain services of its own and the enhanced services described below, Shopify processes data as an independent controller.
Information: https://www.shopify.com/de/legal/privacy/consumers
Data processing terms: https://www.shopify.com/legal/dpa

4. Shopify Network Intelligence
Shopify Network Intelligence is enabled in our store. Shopify processes information about visits, interactions and purchases in our store together with information from interactions with other merchants and Shopify. This supports enhanced services, particularly analytics, improvements to the shopping experience, personalisation and relevant advertising.
For these purposes, information is shared with Shopify and the service providers used for these services, which may also be located outside the European Economic Area. Other merchants do not gain access to our individual customer data.
Where consent is required for non-essential analytics, personalisation or targeted advertising, processing is based on Article 6(1)(a) GDPR. Consent can be withdrawn through the cookie settings.
Shopify’s Consumer Privacy Policy applies to Shopify’s own processing. Rights in relation to Shopify can also be exercised through https://privacy.shopify.com.

5. Cookies and consent
Our store uses cookies and similar technologies, for example for the shopping cart, checkout, security and storing privacy preferences.
Strictly necessary storage of information on, or access to information on, your device takes place under section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Subsequent processing of personal data is based, in particular, on Article 6(1)(b) or (f) GDPR.
Non-essential cookies and similar technologies for analytics or marketing are used on the basis of consent under section 25(1) TDDDG; the processing of personal data is based on Article 6(1)(a) GDPR.
You can change your choices through the cookie settings and withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before withdrawal.
[Before publication: link to a permanently accessible way to reopen the cookie settings and include retention periods in the banner.]

6. Orders and customer accounts
When you place an order, we process, in particular, your name, billing and delivery addresses, email address, telephone number where applicable, products ordered, payment status and returns information. We need this information for the purchase contract, customer service and delivery (Article 6(1)(b) GDPR).
Where a customer account is used, we process the contact and account data required for that account and the associated orders to provide the account.
We comply with statutory documentation and retention obligations under Article 6(1)(c) GDPR. Required contractual data must be provided; otherwise, we cannot process the order.

7. Payments
Depending on the payment method selected, processing takes place through Shopify Payments, PayPal, Klarna or Shop Pay. We transmit to the relevant provider the contact, billing, order and transaction data necessary for payment and, where applicable, identity verification.
The legal basis for payment processing initiated by us is Article 6(1)(b) GDPR. Payment providers may additionally carry out statutory checks, fraud prevention and, for certain payment methods, credit checks under their own responsibility. Automated decisions made by these providers are governed by their terms and privacy notices.
Shopify Payments and Shop Pay: https://www.shopify.com/de/legal/privacy/consumers
PayPal: https://www.paypal.com/de/legalhub/paypal/privacy-full
Klarna: https://www.klarna.com/de/datenschutz/
[Add the contracting entities for the payment services based on the payment methods enabled.]

8. In-house fulfilment and delivery through DHL and Hermes
We process and pack orders ourselves. For delivery, we transmit the necessary name, delivery address and shipment information to DHL or Hermes. The legal basis is Article 6(1)(b) GDPR.
Email addresses or telephone numbers are shared for additional delivery notifications only where there is a legal basis for doing so, particularly consent where required.
Information: https://www.dhl.de/de/privatkunden/datenschutz.html and https://www.myhermes.de/datenschutz/

9. Invoices and order documents
We use Order Printer Pro by FORSBERG+two to create invoices and order documents. In particular, names, addresses, order items and transaction information may be processed.
Processing serves contract performance and compliance with statutory invoicing and documentation obligations (Article 6(1)(b) and (c) GDPR).
Information: https://www.forsbergplustwo.com/pages/privacy-policy
[Check the provider’s legal identity, data processing agreement and actual use of the app.]

9a. Other installed apps – internal review note
[The app overview confirms Translate & Adapt, Metafields Guru, Bundles, Forms, Flow and Messaging. Actual use determines what must be included in the published policy. On 4 October 2026, Philipp confirmed that Forms and Messaging are not actively used for discount pop-ups, sign-up forms or automated promotional emails. Metafields Guru is provided by 256 Development; access to customers and orders can be granted optionally. If personal customer or order data is processed through it, add the purpose, data categories, provider’s legal identity, legal basis and international transfers. For active Forms forms, describe their purposes and data fields; active Messaging and Flow marketing automations require corresponding disclosures, including consent and opting out. Do not infer active processing merely from installation.]
Information for review: https://www.metafields.guru/policies and https://help.shopify.com/en/manual/promoting-marketing/create-marketing/forms-app

10. Contact
When you contact us, we process your contact details and the content of your message to handle your enquiry. Article 6(1)(b) GDPR applies to contract-related enquiries; Article 6(1)(f) GDPR applies to other enquiries. Our legitimate interest is responding appropriately to enquiries.
We do not currently send a newsletter.

11. Facebook and Instagram
Our store uses the “Facebook & Instagram” integration with the “Maximum” data-sharing level. We use the Meta Pixel, advanced matching and the Conversions API. The pixel transmits events through the browser; the Conversions API enables additional transmissions between Shopify and Meta servers. The recipient is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
Page views, products viewed, cart actions, purchases, order values, device information, IP addresses and identifiers may be processed. For advanced matching, available names, email addresses, telephone numbers and location information may be processed to match individuals to Meta user accounts. Contact details are transmitted in hashed form where the relevant procedure provides for this. Hashing does not automatically make personal data anonymous.
Processing serves advertising performance measurement, audience creation and personalised advertising. Processing requiring consent is based on Article 6(1)(a) GDPR, and associated device access requiring consent is based on section 25(1) TDDDG. This also applies to server-side transmissions where they require consent.
Where collection and transmission fall within joint controllership with Meta, the relevant Meta terms apply; Meta is responsible for its subsequent processing for its own purposes.
Information: https://www.facebook.com/privacy/policy/
Terms: https://www.facebook.com/legal/terms/businesstools
[Before publication: specify the joint controllership agreement and retention periods based on current provider documentation; technically verify consent handling for the Conversions API and advanced matching as well.]

12. Google Analytics through Google & YouTube
Our store uses Google Analytics 4 through the “Google & YouTube” integration. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics is used to statistically analyse the use of our store and improve our offering. In particular, page views, product views, cart actions, purchases and order values, device and browser information, technical identifiers and approximate location information may be processed. Google Analytics 4 uses IP addresses for technical processing and to derive location information; according to Google, individual IP addresses are not logged or stored in the process.
Analytics is based on your consent under Article 6(1)(a) GDPR. Storage of information on, or access to information on, your device requiring consent is based on section 25(1) TDDDG. You can withdraw consent through the cookie settings.
Information: https://policies.google.com/privacy?hl=en
The retention period is two months for event data and 14 months for user data. The setting to reset retention on new user activity is enabled: renewed activity restarts the retention period for the relevant user identifier. These periods apply to the data covered by this setting; aggregated standard reports are not affected.
[Before publication: check and specify Google Signals, User-ID, data sharing and Consent Mode. According to Philipp, Google Ads is connected following the new setup. Conversion measurement, remarketing and enhanced conversions are active according to Philipp and described in section 12a. Potential GA4 imports and consent handling still require review.]

12a. Google Ads, conversion measurement and remarketing
We use Google Ads, including conversion measurement, remarketing and enhanced conversions. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Conversion measurement helps us identify whether advertisements lead to actions in our store, particularly purchases. Advertising interactions, pages visited, purchase events and order values, as well as technical device, browser and cookie identifiers, may be processed.
Remarketing is used to show visitors to our store interest-based advertisements on the Google advertising network based on previous interactions. Usage information and identifiers may be used to create audiences for this purpose.
For enhanced conversions, information you provide when placing an order, particularly your email address and, where applicable, telephone number, name and address, is additionally used for matching with Google accounts. The personal matching fields designated for hashing are hashed using SHA-256 before transmission. Certain location details, such as country, city and postcode, are not hashed, depending on the procedure. Hashing does not constitute anonymisation. Matching is used to attribute purchases to previous advertising interactions and improve measurement.
The advertising and measurement processing described above is based on your consent under Article 6(1)(a) GDPR; storage of information on, or access to information on, your device requiring consent is based on section 25(1) TDDDG. You can withdraw consent at any time through the cookie settings with effect for the future.
Information: https://policies.google.com/privacy?hl=en and https://support.google.com/google-ads/answer/9888656?hl=en
[Before publication: check the matching fields actually transmitted, Consent Mode configuration, potential GA4 imports, cookie lifetimes and audience retention periods. Technically verify that processing respects consent choices.]

13. Recipients and processing outside the EEA
Data is received only by recipients necessary for the relevant purpose, particularly store and IT service providers, payment providers, delivery companies, invoicing service providers and, where there is an appropriate legal basis, advertising platforms. Tax advisers and authorities may receive data where necessary to fulfil statutory obligations.
International service providers may process data outside the European Economic Area. The requirements of Articles 44 et seq. GDPR apply, particularly relevant adequacy decisions or appropriate safeguards such as EU Standard Contractual Clauses. For recipients in the United States, reliance on the EU–US Data Privacy Framework is possible only where the recipient holds the relevant valid certification.
Information about the safeguards actually used, and copies, can be requested at philipp@goodroll.eu.
[Before publication, verify the specific recipients, countries and applicable safeguards using provider documentation.]

14. Retention periods
We delete personal data once it is no longer necessary for the relevant purpose and no retention obligation or other legal basis requires continued storage.
Contractual data is retained for processing the contract, including returns and statutory warranty matters. Afterwards, only data necessary for statutory retention obligations or the establishment, exercise or defence of legal claims is retained. Invoices and accounting records are generally subject to eight-year retention periods; other documents may be subject to different periods.
Contact enquiries are deleted once they have been fully handled, unless there is another reason for retention. For security logs, technical necessity and the investigation of incidents determine the retention period. Consent records are retained for as long as necessary to provide evidence of consent.
[Add specific periods for logs, enquiries, accounts, tracking data and cookies based on the settings actually selected.]

15. Your rights
Subject to the applicable legal conditions, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20).
You may withdraw consent at any time with effect for the future.
RIGHT TO OBJECT: Where processing is based on legitimate interests, you may object on grounds relating to your particular situation (Article 21(1) GDPR). You may object at any time to direct marketing, including related profiling (Article 21(2) GDPR).
Please contact philipp@goodroll.eu to exercise these rights.
You may lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, place of work or the alleged infringement. The authority responsible for our company in Berlin is the Berlin Commissioner for Data Protection and Freedom of Information: https://www.datenschutz-berlin.de.