Privacy policy

Table of Contents
1. Controller and contact
2. General information on data processing
3. Hosting and visiting the website
4. Cookies, consent and cookie banner
5. Abuse prevention (hCaptcha)
6. Customer account
7. KONZEPT+ membership
8. Orders and contract performance
9. Payment
10. Shipping
11. Withdrawal and returns
12. Contact
13. Newsletter and email marketing
14. Analytics and advertising
15. Social networks
16. Transfers to third countries
17. Storage period
18. Your rights
19. Right to object
20. Right to lodge a complaint with a supervisory authority
21. Version and changes


1) Controller and contact
1.1 The controller responsible for processing personal data on a-konzept.com and for orders placed through this shop is HOUSE OF KONZEPT GmbH, Am Sand 2, 91757 Treuchtlingen, Germany, represented by its managing directors Johannes Stumpf, Noah Schuster and Ediz Gökmen Yapici, registered with the Local Court (Amtsgericht) of Ansbach under HRB 8343, email: contact@a-konzept.com.
1.2 For any questions about data protection and to exercise your rights, you can reach us at the address or email address above.

2) General information on data processing
2.1 Personal data is any information relating to an identified or identifiable natural person, for example name, address, email address or IP address.
2.2 We process personal data on the following legal bases of the General Data Protection Regulation (GDPR):
– Art. 6(1)(a) GDPR, where you have given consent;
– Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract with you or for pre-contractual steps taken at your request;
– Art. 6(1)(c) GDPR, where we are legally obliged, for example under tax and commercial retention rules;
– Art. 6(1)(f) GDPR, where processing is necessary for our legitimate interests or those of a third party and your interests do not override them. We state the interest in each case.
2.3 Storing information on your device and accessing it (for example cookies, local storage, pixels) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Without your consent this is only permitted where it is strictly necessary to provide the service you have explicitly requested (Section 25(2) no. 2 TDDDG). We use everything else only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).
2.4 We use service providers who process data on our behalf and under our instructions (processors, Art. 28 GDPR). We have concluded data processing agreements with them. Other recipients, such as payment services or advertising platforms, partly process data under their own responsibility; we point this out in each case.
2.5 The website is encrypted with TLS. You can recognise this by “https://” and the padlock symbol in your browser’s address bar.
2.6 You are under no statutory or contractual obligation to provide personal data. Without the information marked as mandatory in the checkout, however, we cannot conclude and perform a contract; without the information in the contact form we cannot answer your enquiry.
2.7 We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Payment service providers may, under their own responsibility, make automated decisions about certain payment methods (see section 9).

3) Hosting and visiting the website
3.1 Our shop runs on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify provides servers, the shop system, checkout, customer accounts and order management and processes, as our processor, all data you enter in the shop or that arises during your visit. Shopify may transfer data to affiliated companies in Canada (Shopify Inc.; Canada is covered by an adequacy decision of the European Commission) and in the USA (see section 16). Shopify’s privacy information: shopify.com/legal/privacy.
3.2 Each time you visit the website, Shopify processes technically necessary data transmitted by your browser: IP address, date and time, page requested, referrer URL, browser type and version, operating system, language setting and amount of data transferred (server log files). The purpose is to deliver and display the website and to ensure stability and security, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and functioning operation of the shop. Shopify determines how long log files are kept.
3.3 Images, scripts and fonts of the shop are delivered via Shopify’s servers. The shop does not embed fonts from Google Fonts.
3.4 For error analysis and performance measurement, the Shopify platform sends technical telemetry data to Shopify servers. The legal basis is Art. 6(1)(f) GDPR (stable operation).

4) Cookies, consent and cookie banner
4.1 We use cookies and similar technologies (local storage, session storage, pixels). Cookies are small text files stored by your browser. Some are deleted when you close the browser (session cookies), others remain stored for a certain period.
4.2 Strictly necessary cookies are those without which the shop does not work, for example for the cart, checkout, signing in to your customer account, language and currency settings, abuse prevention and storing your cookie choice. We use them without consent under Section 25(2) no. 2 TDDDG; the subsequent processing is based on Art. 6(1)(b) GDPR (contract) or Art. 6(1)(f) GDPR (a functioning shop).
4.3 We use all other cookies and technologies for analytics, advertising and convenience features only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The individual services are described in section 14.
4.4 We obtain your consent through a cookie banner. The provider is Pandectes, Pudisoo küla, Männimäe/1, 74626 Kuusalu vald, Estonia (“Pandectes”). Your choice, a random consent ID, date and time, truncated IP address, country/region and device type are stored so that we can prove consent. The legal basis is Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (duty to demonstrate consent). Your choice is stored for 365 days. Pandectes’ privacy information: pandectes.io/privacy-policy.
4.5 You can change your choice or withdraw consent with effect for the future at any time via the “Cookie settings” link at the bottom of every page. You can also delete or block cookies in your browser; some shop features may then not work.

5) Abuse prevention (hCaptcha)
5.1 To protect our forms (for example contact, newsletter and sign-in forms) against automated input and spam, Shopify uses the hCaptcha service. The provider is Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA. hCaptcha uses data such as IP address, browser and device information and interactions with the page to check whether an input comes from a human. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the shop against abuse and spam. Where information is stored on or read from your device, this is strictly necessary for the secure submission of the form you are using (Section 25(2) no. 2 TDDDG). Intuition Machines is certified under the EU-U.S. Data Privacy Framework. Privacy information: hcaptcha.com/privacy.

6) Customer account
6.1 You can create a customer account. For this and for signing in, we process your email address and the data you store in the account (for example name, addresses, orders). You sign in with a one-time code that Shopify sends to your email address. The legal basis is Art. 6(1)(b) GDPR.
6.2 You can have your customer account deleted at any time by sending us an email. Data we must keep due to legal obligations will be restricted until the retention periods expire (see section 17).

7) KONZEPT+ membership
7.1 With KONZEPT+ we offer a membership programme in which your purchases earn you a membership status with corresponding benefits. Taking part requires a customer account. For the programme we use the Shopify app Appstle Loyalty by Appstle Inc., Vintage Oaks, Menlo Park, CA 94025, USA (“Appstle”), as a processor. For this purpose Appstle processes your customer ID, name, email address, your orders and order values as well as your status, points collected and benefits. The legal basis is Art. 6(1)(b) GDPR (participation in the programme).
7.2 When you open the KONZEPT+ page, scripts from Appstle are loaded; your IP address is transmitted to Appstle in the process. This is strictly necessary to display the programme you have requested (Section 25(2) no. 2 TDDDG); the legal basis is Art. 6(1)(b) GDPR.
7.3 Appstle processes data in the USA (see section 16). We store the programme data for as long as you take part in KONZEPT+; if you delete your customer account, it is deleted as well. Privacy information: appstle.com/privacy-policy.

8) Orders and contract performance
8.1 When you place an order, we process the data you enter in the checkout: name, billing and delivery address, email address, where applicable phone number and company, the items ordered, payment method and order history. The purpose is the performance of the contract, including order confirmation, invoice, shipping, payment, customer service, warranty and returns. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for retaining invoices and accounting records.
8.2 We pass invoices and accounting records to our tax advisers where necessary for bookkeeping and to meet tax obligations (Art. 6(1)(c) GDPR).

9) Payment
9.1 Depending on the payment method you choose, we pass the data required for payment (name, address, email address, order amount, order number, where applicable IP address and device data for fraud prevention) to the relevant payment service provider. The legal basis is Art. 6(1)(b) GDPR, and for fraud prevention Art. 6(1)(f) GDPR (protection against payment default and abuse). We do not receive your full card details.
9.2 Shopify Payments: we process card payments as well as Apple Pay and Google Pay via Shopify Payments. The payment service provider is Stripe Payments Europe, Limited, Ireland (“Stripe”). Stripe may transfer data to Stripe, LLC in the USA; Stripe, LLC is certified under the EU-U.S. Data Privacy Framework. For Apple Pay and Google Pay, the privacy terms of Apple or Google, with whom you have a separate agreement for this, also apply. Stripe’s privacy information: stripe.com/privacy.
9.3 Shop Pay: if you use Shop Pay, Shopify stores your data for faster checkout. Shopify is itself responsible for your Shop Pay account. Privacy information: privacy.shopify.com.
9.4 PayPal: if you pay with PayPal, we pass your payment data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). PayPal processes the data under its own responsibility and may, for certain payment methods (for example pay by invoice or instalments, where offered), carry out a credit check and transmit data to credit agencies for this purpose. PayPal’s privacy information: paypal.com/de/legalhub/paypal/privacy-full.
9.5 Klarna: if you choose a Klarna payment method, we pass your contact and order data (name, address, email address, where applicable phone number, order amount, items, delivery method) to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”). Klarna processes the data under its own responsibility. For pay later and instalments, Klarna checks your identity and creditworthiness, also using credit agencies and probability values (scores), and on that basis decides automatically whether you can use the selected payment method. You can ask Klarna to have a person review the decision, to express your point of view and to contest the decision (Art. 22(3) GDPR). Klarna’s privacy information: klarna.com/international/privacy-policy.

10) Shipping
10.1 We ship most orders ourselves from our warehouse. Some items are stored and shipped by Sellship GmbH, Gutenbergstraße 1, 91560 Heilsbronn, Germany, as our processor. For these orders we transmit name, delivery address, order number and items ordered to Sellship via the software Billbee by Billbee GmbH, Arolser Str. 10, 34477 Twistetal, Germany, which also acts as our processor. The legal basis is Art. 6(1)(b) GDPR. Billbee’s privacy information: billbee.io/en/legal/privacy-policy.
10.2 For delivery, we pass name and delivery address to DHL (DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany). The legal basis is Art. 6(1)(b) GDPR.
10.3 We pass your email address and phone number to DHL where this is necessary for delivery, for example to announce the delivery or for shipments to countries outside the EU where customs authorities require it (Art. 6(1)(b) GDPR).
10.4 For shipments to countries outside the EU, we transmit the data required for customs clearance (recipient, address, value of goods, contents) to DHL and the customs authorities. The legal basis is Art. 6(1)(b) and (c) GDPR.

11) Withdrawal and returns
11.1 For withdrawing from your contract, we use the Shopify app Revoq by Jonas Busch, Hofstraße 2-4, 51061 Cologne, Germany (“Revoq”), as a processor. Via the withdrawal function at a-konzept.com/pages/withdraw, we process the information you provide there (email address, order number, name, where applicable company, affected items, optionally a reason or a message), match it with your order and send you an acknowledgement of receipt by email.
11.2 The legal basis is Art. 6(1)(c) GDPR (statutory duty to provide the withdrawal function and to acknowledge receipt) and Art. 6(1)(b) GDPR (unwinding of the contract). We process voluntary information such as reasons on the basis of Art. 6(1)(f) GDPR; our legitimate interest is handling the withdrawal and improving our offering.
11.3 Revoq stores the data on servers in the EU (Frankfurt am Main and Amsterdam) and deletes it once the configured period has expired; Revoq sends the acknowledgement of receipt via an email service with processing in Ireland. Privacy information: consumer-withdrawal.eu/privacy.
11.4 You register returns in your customer account. We process your order, the affected items and, where applicable, your reason in order to handle the return (Art. 6(1)(b) GDPR).

12) Contact
12.1 If you write to us by email or via the contact form, we process your information (name, email address, where applicable phone number, order number and your message) to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or an order, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your request.
12.2 Emails to our addresses and messages from the contact form are stored with Google Workspace by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as our processor. Google may transfer data to Google LLC in the USA (see section 16).

13) Newsletter and email marketing
13.1 If you subscribe to our newsletter via the sign-up window on the website or in the checkout, we use your email address and, where applicable, your name to send you information about new products, collections, editorials, early previews and offers. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 of the German Act against Unfair Competition, UWG).
13.2 We store the time of your subscription and, where applicable, your confirmation so that we can prove consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
13.3 We send the newsletter with Klaviyo; the provider is Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, USA (“Klaviyo”), acting as our processor. Klaviyo analyses whether and when you open a newsletter and which links you click in order to improve the newsletter and tailor it to your interests; this is part of your consent. Klaviyo processes data in the USA; Klaviyo, Inc. is certified under the EU-U.S. Data Privacy Framework. Privacy information: klaviyo.com/legal/privacy-notice.
13.4 You can unsubscribe at any time via the unsubscribe link in every email or by contacting us. This does not affect the lawfulness of processing carried out until then. After you unsubscribe, we keep your email address on a suppression list so that you receive no further newsletters (Art. 6(1)(f) GDPR).
13.5 If we have received your email address in connection with a purchase, Section 7(3) UWG allows us to use it without consent to advertise our own similar goods, as long as you have not objected. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is direct marketing. You can object to this use at any time via the unsubscribe link in every email or by contacting us, without incurring any costs other than transmission costs at basic rates.
13.6 We only send reminder emails about an uncompleted checkout if you have consented to email marketing.

14) Analytics and advertising
14.1 We use the following services only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you give in the cookie banner and can withdraw at any time (see section 4). Data is passed to the services via Shopify’s customer events interface, which follows your choice in the cookie banner. Without your consent, the scripts of these services are not loaded.
14.2 Shopify analytics: Shopify collects statistics on the use of the shop for us (for example pages viewed, referral source, cart and purchase events) and sets the cookies _shopify_analytics and _shopify_marketing for this purpose, which are stored for one year. For provider and third-country transfers see section 3.1.
14.3 Google Ads: we use Google Ads (account AW-16607467315) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), with conversion tracking and remarketing. Conversion tracking measures whether you make a purchase after clicking one of our ads. Remarketing allows Google to show you our ads on other websites and in Google services after you have visited our shop. Google sets cookies for this, for example _gcl_au (90 days) and IDE on doubleclick.net (up to 13 months). When you complete a purchase, email address, phone number, name and address may additionally be transmitted to Google in encrypted (hashed) form for more accurate measurement (enhanced conversions). We use Google’s Consent Mode, which passes your choice in the cookie banner to Google.
14.4 Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Privacy information: policies.google.com/privacy. You can manage personalised advertising from Google at myadcenter.google.com.
14.5 Meta pixel: we use the Meta pixel by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), to measure the success of our ads on Facebook and Instagram and to show you relevant ads there (remarketing, audiences). Meta sets the cookie _fbp (90 days) for this and receives information about your visit and your purchases as well as a pseudonymous identifier of your browser. We are jointly responsible with Meta for collecting and transmitting this data to Meta (Art. 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. Meta alone is responsible for further processing. Meta may transfer data to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework. Privacy information: facebook.com/privacy/policy.
14.6 Pinterest tag: we use the Pinterest tag by Pinterest Europe Limited, Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland (“Pinterest”), to measure the success of our ads on Pinterest and to show you relevant ads there. Pinterest sets cookies for this (_pin_unauth and _pinterest_ct_ua, one year each) and receives information about your visit and your purchases. Pinterest may transfer data to Pinterest, Inc. in the USA; Pinterest, Inc. is certified under the EU-U.S. Data Privacy Framework. Privacy information: policy.pinterest.com/privacy-policy.
14.7 Klaviyo onsite tracking: Klaviyo (provider see 13.3) uses the cookie __kla_id (up to 13 months) to record which pages and products you view and what you add to your cart. If you are known as a newsletter subscriber, Klaviyo links this information to your profile so that we can send you relevant emails.

15) Social networks
15.1 Our website links to our profile on Instagram. This is a simple link; no data is transmitted to Instagram when you visit our website. Only when you click the link do Instagram’s privacy terms apply.

16) Transfers to third countries
16.1 Some of the service providers named process data outside the EU and the EEA or transfer it there, in particular to the USA. We only transfer data to third countries if the requirements of Art. 44 et seq. GDPR are met.
16.2 Canada is covered by an adequacy decision of the European Commission (Art. 45 GDPR). For the USA, an adequacy decision applies to companies certified under the EU-U.S. Data Privacy Framework; you can check whether a company is certified at dataprivacyframework.gov/list. With recipients without such a basis, we have agreed the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).
16.3 Despite these safeguards, there may be a risk in third countries that authorities access the data and that your rights are harder to enforce.

17) Storage period
17.1 We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods.
17.2 We store contract and order data until warranty and limitation periods have expired. Thereafter we keep data where commercial and tax law requires it (Section 257 German Commercial Code, HGB; Section 147 German Fiscal Code, AO): books and annual financial statements for ten years, accounting records such as invoices for eight years, commercial and business letters received and sent for six years, in each case from the end of the calendar year. During this time the data is restricted from other uses.
17.3 We store data processed on the basis of consent until you withdraw consent or the purpose no longer applies. We delete data from customer enquiries once the enquiry has been fully dealt with and no retention obligation applies.
17.4 We state the storage period of cookies for the respective services; you can also view it in your browser settings.

18) Your rights
18.1 Under the GDPR you have the following rights, provided the statutory requirements are met:
– access to the data stored about you (Art. 15 GDPR);
– rectification of inaccurate data (Art. 16 GDPR);
– erasure (Art. 17 GDPR);
– restriction of processing (Art. 18 GDPR);
– data portability (Art. 20 GDPR);
– objection to processing (Art. 21 GDPR, see section 19);
– withdrawal of consent with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before withdrawal.
18.2 To exercise your rights, write to contact@a-konzept.com or to the address in section 1.

19) Right to object
19.1 Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
19.2 Where we process your data for direct marketing, you have the right to object to this processing at any time; this also applies to related profiling. After your objection we will no longer process your data for direct marketing.
19.3 You can object informally, most easily by email to contact@a-konzept.com or via the unsubscribe link in our emails.

20) Right to lodge a complaint with a supervisory authority
20.1 You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de.

21) Version and changes
21.1 Version of this privacy policy: 19 October 2026.
21.2 We update this privacy policy when our data processing or the legal situation changes. The version published on this page applies.