Translation for orientation only
Privacy Policy
Protecting your personal data is important to us. Below we inform you in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) which personal data we process when you visit our website and use our services, for what purposes we do so, and which rights you have.
1. Controller
Controller within the meaning of Art. 4 (7) GDPR is: GRIDWEAR – Owner Georg Felszegi Schwalbacher Str. 3 50969 Cologne Germany Email: support@gridwear-partner.de VAT ID: DE203608481
2. Scope
This privacy policy applies to the website www.gridwear-partner.de and to all services offered through it, in particular the online shop, the customer account, the ordering process, the affiliate programme and the contact channels. External links to third-party offers are subject to their own privacy policies.
3. Server logs on visiting the website
Whenever you access our website, data is automatically processed in so-called server log files for technical reasons: the URL requested, date and time, amount of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL and your anonymised or truncated IP address. This processing serves to provide, stabilise and secure the website (Art. 6 (1) (f) GDPR). Log files are deleted regularly after no more than 30 days unless a security incident requires longer storage.
4. Cookies and local storage
We use only strictly necessary and functional first-party cookies. This includes in particular a cookie storing your language preference, a cookie confirming the cookie notice (gridwear-cookie-ack), a session cookie after login and – if you arrive via an affiliate link – the cookies gw_ref, gw_ref_c and gw_ref_ts to attribute the referral (see section 9). In addition, we use your browser's local storage to preserve the shopping cart between sessions and to mirror the affiliate attribution. Legal basis is § 25 (2) no. 2 TDDDG (strictly necessary cookies) and Art. 6 (1) (b) and (f) GDPR. There are no third-party tracking services, no advertising cookies and no cross-platform profiling.
5. Customer account and registration
To operate a customer account we process your email address, a name of your choice and – for payment by advance transfer or as a payout recipient in the affiliate programme – your bank details (account holder, IBAN, BIC and, where applicable, VAT ID). The processing serves to perform the contract and to take pre-contractual steps (Art. 6 (1) (b) GDPR). Your password is stored only as a non-reversible hash. You can delete your account at any time; statutory retention obligations (in particular §§ 147 AO, 257 HGB) remain unaffected.
6. Orders and contract performance
When you place an order we process billing and shipping address, first and last name, email address, optionally phone number and order data (products, prices, discounts, time of order, order number). Legal basis is Art. 6 (1) (b) GDPR (contract performance) and Art. 6 (1) (c) GDPR (compliance with statutory tax and commercial obligations). Order data is kept for the statutory retention period of generally 10 years.
7. Payment processing
We offer advance transfer and PayPal as payment methods. For advance transfer we process your order and contact data as well as the payment received on our business account. For payments via PayPal your payment data is transmitted directly to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. From PayPal we only receive the confirmation of the transaction, the transaction status, the PayPal order ID and – for Express Checkout – the name and shipping address you have stored with PayPal. Legal basis is Art. 6 (1) (b) GDPR. In addition, PayPal's privacy notice applies: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full.
8. Shipping
To deliver your order we forward your name and address and, where applicable, your phone number and email address (for parcel tracking) to the contracted shipping carrier. Legal basis is Art. 6 (1) (b) GDPR.
9. Affiliate programme and tracking
When you arrive via an affiliate link (e.g. ?ref=AF-XYZ, optionally &c=CAMPAIGN), we store the affiliate code in a functional first-party cookie (gw_ref, gw_ref_c, gw_ref_ts) and additionally mirror it in your browser's local storage. The sole purpose is to attribute your order to the referring partner for commission accounting (Art. 6 (1) (b) and (f) GDPR). Retention: 30 days from the first click, without automatic extension. If you click another affiliate's link within that window, the value is overwritten (last-touch attribution). In addition, when an affiliate link is opened, we store a server-side click record with a hashed IP address, user agent, referrer host and landing path in order to filter bots and to deduplicate clicks within one hour. If you apply as an affiliate partner, we additionally process your contact details, channel data (e.g. Instagram handle, website), VAT ID and bank details for the purpose of contract initiation and commission payout (Art. 6 (1) (b) GDPR). No cross-device tracking and no transfer to third parties takes place. You can object to this storage at any time by deleting the cookies or site data for this domain in your browser.
10. Email communication and transactional emails
For orders, status changes, password resets and commission payouts we send automated transactional emails to the email address you provided. Legal basis is Art. 6 (1) (b) GDPR. A newsletter or promotional emails are sent only after your express consent (Art. 6 (1) (a) GDPR, § 7 UWG), which you can revoke at any time.
11. Sign in with Google or Apple
You can optionally sign in via "Sign in with Google" (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) or "Sign in with Apple" (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland). In doing so, your email address, an anonymised user identifier and – where you allow it – your name are transmitted to us. Legal basis is Art. 6 (1) (b) GDPR (contract initiation/performance). The privacy notices of Google (https://policies.google.com/privacy) and Apple (https://www.apple.com/legal/privacy) apply in addition.
12. Hosting and data processing on our behalf
This website is operated on Lovable Cloud. As processors within the meaning of Art. 28 GDPR we use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) for content delivery and DDoS protection, and Supabase Inc. (970 Toa Payoh North, Singapore) for database, authentication and storage services in an EU region. Data processing agreements pursuant to Art. 28 GDPR have been concluded with these providers; for any transfers to third countries, EU standard contractual clauses (Art. 46 (2) (c) GDPR) have been signed.
13. Recipients and disclosure to third parties
Your personal data is disclosed only to: (a) the contracted shipping carrier for delivery, (b) the payment service provider PayPal if you choose it, (c) our tax advisor and the accounting service sevDesk (Sevdesk GmbH, Germany) to comply with tax obligations, (d) our email delivery provider for sending transactional emails, (e) the hosting processors listed in section 12, and (f) authorities where we are legally obliged to do so. Your data is not sold or rented.
14. Retention periods
We store your personal data only for as long as it is necessary for the stated purposes. Order and invoice data is retained for 10 years pursuant to §§ 147 AO, 257 HGB. Contract data outside tax retention obligations is deleted 3 years after the end of the contract (§§ 195, 199 BGB). Customer account data is processed until the account is deleted; thereafter it is deleted except for tax-relevant records. Affiliate click data is anonymised or deleted after at most 12 months.
15. Your rights
You have the following rights vis-à-vis us: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing based on legitimate interests (Art. 21 GDPR). An informal message to support@gridwear-partner.de is sufficient to exercise them. Where processing is based on consent, you can revoke it at any time with effect for the future.
16. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia Kavalleriestr. 2–4 40213 Düsseldorf, Germany https://www.ldi.nrw.de
17. Data security
We secure all data transmission via TLS encryption (HTTPS). Passwords are stored only as hashes. Access to personal data is restricted through role and permission concepts (row-level security in the database). Webhooks and cron endpoints are protected via signature verification or secret tokens. Security-relevant events are logged and reviewed.
18. Objection to direct marketing and legitimate interests
Where your data is processed on the basis of legitimate interests under Art. 6 (1) (f) GDPR, you may object at any time for reasons arising from your particular situation. Against processing for the purpose of direct marketing you can object at any time without giving reasons. An informal message to support@gridwear-partner.de is sufficient.
19. Automated decisions and profiling
We do not use purely automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or similarly significantly affect you. No profiling takes place.
20. Currency and changes to this privacy policy
This privacy policy is dated November 2026. As our website and services evolve or due to changes in legal or regulatory requirements, it may become necessary to update this privacy policy. The current version is always available on this page.
Version: November 2026. This privacy policy is updated when our services or the legal framework change.