Privacy Policy

 

1. Controller

Controller responsible for data processing within the meaning of the GDPR:

SIDEEYE NYC LLC, [Name of the German branch office] 30 N Gould St, Ste R Sheridan, WY 82801 United States

[Street and house number] [Postal code, city] Germany

Email: info@sideeye.com Phone: [phone number]

EU Representative Pursuant to Art. 27 GDPR

[Name, address, email]

Data Protection Officer

With a total headcount of 10 or fewer, a data protection officer has not been appointed.

2. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functioning website and our content and services. Personal data is generally processed only with the user's consent, except in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by law.

Legal Bases (Art. 6(1) GDPR)

• Art. 6(1)(a): Consent (e.g., tracking, marketing)
• Art. 6(1)(b): Performance of a contract (e.g., order processing)
• Art. 6(1)(c): Legal obligation (e.g., tax record-keeping)
• Art. 6(1)(f): Legitimate interest (e.g., fraud prevention, reduced-scope reach measurement)
  

3. Hosting and Shop Platform (Shopify)

This website is operated on the Shopify platform, provided by Shopify International Limited, Dublin, Ireland (for EU customers) and/or Shopify Inc., Ottawa, Canada.

On our behalf, Shopify processes server log files, order data, customer data, and other data necessary for operating the shop. This processing takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Further information: [link to Shopify's privacy policy]

 

4. Server Log Files

Each time our website is accessed, the system automatically collects data and information from the accessing system (IP address, date/time, browser type, operating system, referrer URL). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the technically error-free presentation and optimization of our website).

 

5. Order Processing, Shipping, and Warehousing

To perform the contract, we process name, shipping address, billing address, email address, payment data, and order details.

Warehousing and shipping of goods are handled exclusively through our warehouse in Germany, including for orders placed within Germany. Data is shared with shipping providers only to the extent necessary for delivery.

Recipients/Processors Involved in Order Processing

• [Name of the fulfillment/warehousing provider in Germany]
• [Name of the shipping provider, e.g., DHL, DPD]
• [Payment provider, e.g., Shopify Payments, PayPal, Klarna]

Legal basis: Art. 6(1)(b) GDPR.

 

6. Tax Processing (OSS Scheme)

For the VAT treatment of orders from within the EU, we use the One-Stop-Shop (OSS) scheme administered by the German Federal Central Tax Office (Bundeszentralamt für Steuern). For this purpose, order and delivery data is processed to determine the destination country and the applicable tax rate. The legal basis is Art. 6(1)(c) GDPR (legal obligation).

 

7. Cookies and Consent Management

Storing information on your device or accessing information already stored there is only permitted if you have given consent based on clear and comprehensive information. An exception applies only to cookies that are strictly technically necessary (e.g., shopping cart, login session).

We use cookies, some of which are technically necessary and some of which serve analytics and marketing purposes. Non-essential cookies and comparable technologies are set only after you have actively given consent via our consent tool. Rejecting them is just as easy as accepting them at the first level of our consent banner. Consent can be withdrawn at any time with effect for the future.

[Name of the consent management tool]

 

8. Tracking and Analytics

Google Analytics 4 (GA4)

We use Google Analytics 4, provided by Google Ireland Limited, Dublin, to analyze user behavior. Data collection only begins after consent has been given, managed via Google Tag Manager with Consent Mode v2 enabled.

Where Google Signals is enabled, data from the Google accounts of signed-in users may be combined across devices (e.g., for remarketing and audience reporting).

Legal basis: Art. 6(1)(a) GDPR. Withdrawal: possible at any time via our cookie banner.

Google Search Console

We use Google Search Console, provided by Google Ireland Limited, Dublin, to analyze our website's visibility in Google Search. No cookies are set on visitors' devices for this purpose; aggregated search and click data relating to our domain is processed.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in analyzing and optimizing our search engine visibility).

Google Merchant Center

We use Google Merchant Center, provided by Google Ireland Limited, Dublin, to make our product data available for Google Shopping and related ad formats. Product data is transmitted, along with, where the Merchant Center's ratings and purchase-protection features are enabled, order-related data (e.g., email address, order value).

Legal basis: Art. 6(1)(a) or (f) GDPR, depending on the feature.

Google Tag Manager

Google Tag Manager itself does not set any cookies but is used to manage the tracking services listed above and below.

Google Ads / Conversion Tracking

We use Google Ads to advertise our products off our website, as well as conversion tracking to measure performance, provided by Google Ireland Limited, Dublin. Processing by Google LLC, USA, cannot be ruled out; it takes place on the basis of Standard Contractual Clauses and, to the extent Google is certified for the relevant service, additionally on the basis of the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(a) GDPR.

Meta/Instagram Ads (Meta Pixel, possibly Conversions API)

We use services provided by Meta Platforms Ireland Limited, Dublin, to advertise our products and measure performance on Instagram and Facebook. Data may be transferred to Meta Platforms, Inc., USA. This transfer takes place on the basis of Standard Contractual Clauses and, to the extent Meta is certified for the relevant service, additionally on the basis of the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(a) GDPR.

Klaviyo (Email Marketing)

We use Klaviyo, provided by Klaviyo Inc., USA, for email marketing and newsletter automation. Data transferred to the USA is based on Standard Contractual Clauses and, where Klaviyo is certified under the EU-US Data Privacy Framework, additionally on that basis.

Legal basis: Art. 6(1)(a) GDPR (newsletter consent, double opt-in).

Other Integrated Tools

[Instafeed – embedding Instagram content] [Uploadery / Customer Photo Uploader – user uploads] [Aftersell – post-purchase upsells] [Axe Checkbox Upsell] [WhatsApp Business / messaging tool]

 

9. Newsletter

If you sign up for our newsletter, we use the data required for that purpose, or data you separately provide, to send you our newsletter (double opt-in procedure). You may unsubscribe at any time via the link in the newsletter.

Legal basis: Art. 6(1)(a) GDPR.

 

10. Contact

When you contact us by email or contact form, the data you provide is stored to process your inquiry.

Legal basis: Art. 6(1)(b) or (f) GDPR.

 

11. Withdrawal and Returns

In connection with the exercise of the statutory right of withdrawal, including via the electronic withdrawal function, we process the data required to process the withdrawal (order data, contact data, and reason for withdrawal, if voluntarily provided). Data is retained only for as long as necessary to process the withdrawal and to comply with statutory retention obligations.

Legal basis: Art. 6(1)(b) and (c) GDPR.

 

12. Recipients and Third-Country Transfers

In connection with our use of Shopify, Google services, Meta, and Klaviyo, data may be transferred to third countries, in particular the USA.

To the extent the respective providers are certified under the EU-US Data Privacy Framework (DPF), we rely on the European Commission's adequacy decision of July 10, 2023 (Art. 45 GDPR) as the basis for the transfer. In addition, and as a fallback, we use Standard Contractual Clauses issued by the European Commission (Art. 46 GDPR) where offered by the respective provider.

 

13. Retention Period

Personal data is deleted once the purpose of processing no longer applies, unless statutory retention periods (in particular under commercial and tax law, 6 to 10 years) preclude deletion.

 

14. Data Subject Rights

You have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object (Art. 21 GDPR)
• Withdraw consent already given, with effect for the future

You also have the right to lodge a complaint with a data protection supervisory authority.

Competent supervisory authority: [state data protection authority at the location of the German branch office]