Privacy policy

1. Privacy at a glance

The following notes provide an overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

2. Controller

The controller responsible for data processing on this website is:

GÜTTEN fashion e.K.
Owner: Jeanine Dulava
Venloer Strasse 120-122
50259 Pulheim
Germany

Phone: +49 22 38 7 20 44
E-mail: store@gutten-collection.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

A data protection officer is not required for this website, as fewer than 20 people are permanently engaged in the automated processing of personal data.

3. Hosting

This website is hosted by Shopify Inc., 151 O'Connor Street, Ground floor, Ottawa, Ontario, K2P 2L8, Canada.

Shopify processes personal data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Processing also takes place outside the European Union. An adequacy decision of the European Commission exists for Canada in respect of recipients subject to the Canadian PIPEDA. Where data is transferred to further third countries, this is done on the basis of the European Commission's Standard Contractual Clauses.

For details, please see Shopify's privacy policy: https://www.shopify.com/legal/privacy

4. General information

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose of the processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted, unless we have other legally permissible grounds for storing your personal data, such as retention periods under commercial or tax law.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser's address bar changes from http:// to https:// and by the padlock symbol in your browser bar.

Server log files

The provider of this website automatically collects and stores information in so-called server log files, which your browser transmits automatically. These are:

  • Browser type and browser version
  • Operating system used
  • Referrer URL
  • Host name of the accessing computer
  • Time of the server request
  • IP address

This data is not merged with other data sources. The collection of this data is based on Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website.

Transfer of data to third countries

Where we process data in a third country, i.e. outside the European Union or the European Economic Area, or where processing takes place in the context of using third-party services, this is done only in accordance with the statutory requirements.

Subject to your express consent or a transfer required by contract or by law, we process data in third countries only where a recognised level of data protection exists, such as Canada on the basis of an adequacy decision, or on the basis of contractual obligations through the European Commission's Standard Contractual Clauses.

Please note that in third countries the level of protection may not correspond to the level within the European Union. In particular, authorities there may access personal data under certain conditions without effective legal remedies being available against this.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected.

You can change or withdraw your cookie settings at any time via the "Cookie settings" link in the footer of this website.

5. Cookies and consent management

Our website uses cookies and comparable technologies such as the browser's local storage. Cookies are small text files that are stored on your device.

We distinguish between the following categories:

  • Strictly necessary cookies: These cookies are essential for the operation of the shop, for example for the shopping cart, session management, language settings and security. The legal basis is § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR. These cookies cannot be deselected.
  • Analytics cookies: These cookies help us understand how visitors use our website. They are only set with your consent.
  • Marketing cookies: These cookies are used to display advertising and to measure its success. They are only set with your consent.

The storage of cookies that are not strictly necessary, as well as access to information on your device, takes place exclusively on the basis of your consent pursuant to § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You give this consent via our consent banner and can withdraw it at any time with effect for the future.

The consent management tool used is Shopify's integrated cookie banner solution.

6. Data collection on this website

Orders and payment processing

When you place an order, we process the following data for the performance of the contract pursuant to Art. 6 (1) (b) GDPR: name, address, e-mail address, telephone number, payment data and order history.

Once the contract has been fully performed, your data will be restricted for further use and deleted after the expiry of retention periods under commercial and tax law, unless you have expressly consented to further use.

Payment service provider — PayPal

PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, is responsible for processing payments by PayPal. The legal basis is Art. 6 (1) (b) GDPR.

Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Payment service provider — Shopify Payments and credit card

Shopify Inc. is responsible for processing payments by credit card and Shopify Payments. Payment data is transmitted in encrypted form and is not stored on our servers. The legal basis is Art. 6 (1) (b) GDPR.

Privacy policy: https://www.shopify.com/legal/privacy

TikTok Pixel and TikTok Events API

On our website we use the marketing tools "TikTok Pixel" and the server-side interface "TikTok Events API" provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (hereinafter "TikTok").

Interactions on our website are transmitted to TikTok both via your browser using cookies and directly via our servers. The events recorded include page views, product views, adding items to the shopping cart, initiating checkout and completed purchases.

In addition, so-called "Advanced Matching" is used. This means that personal data you enter on our website is transmitted to TikTok in pseudonymised form (hashing). This concerns in particular your e-mail address, telephone number, first and last name, postal code, city and country, as well as order data and shopping cart values.

The purpose of this processing is to address website visitors with targeted advertising on TikTok (TikTok Ads), to measure conversion results, to carry out audience analyses and to optimise the performance of our advertising campaigns.

This data processing takes place exclusively on the basis of your express consent pursuant to Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Without your consent, these technologies are not executed. You can withdraw your consent at any time with effect for the future via the consent management tool on our website.

The data collected is transmitted to and stored on TikTok's servers and may also be forwarded to its parent company ByteDance and to servers in third countries, such as the United States or China. For transfers of data to third countries, TikTok relies on the European Commission's Standard Contractual Clauses.

Further information on data processing by TikTok can be found in TikTok's privacy policy: https://www.tiktok.com/legal/privacy-policy-eea

Customer account

You can create a customer account on our website. In doing so, we process the data you provide in order to manage your account and your orders. The legal basis is Art. 6 (1) (b) GDPR. You can have your customer account deleted at any time.

Contacting us

If you contact us by e-mail, telephone or via the contact form, your details will be stored by us in order to process the enquiry and in case of follow-up questions. The legal basis is Art. 6 (1) (b) GDPR, where your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries pursuant to Art. 6 (1) (f) GDPR or on your consent pursuant to Art. 6 (1) (a) GDPR.

Newsletter

If you wish to receive the newsletter offered on the website, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter.

Registration takes place using the double opt-in procedure: after signing up, you will receive an e-mail in which you must confirm your registration.

Processing takes place exclusively on the basis of your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw your consent at any time, for example via the unsubscribe link in every newsletter e-mail. After unsubscribing, your e-mail address will be deleted from the newsletter distribution list.

We use the integrated Shopify Email service provided by Shopify Inc. to send our newsletter. Data processing takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

7. Your rights as a data subject

As a person affected by data processing, you have extensive rights vis-à-vis the controller under the GDPR. You can exercise these rights at any time using the contact details given above:

  • Right of access (Art. 15 GDPR): You have the right to request information about the personal data we process concerning you.
  • Right to rectification (Art. 16 GDPR): You may request the immediate rectification of inaccurate data or the completion of the data we hold about you.
  • Right to erasure (Art. 17 GDPR): You have the right to request the erasure of the personal data we hold about you, unless statutory exceptions such as retention obligations under tax law prevent this.
  • Right to restriction of processing (Art. 18 GDPR): You may request the restriction of the processing of your data, for example while the accuracy of the data is being verified or if the processing is unlawful.
  • Right to data portability (Art. 20 GDPR): You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
  • Right to object (Art. 21 GDPR): Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to the processing.
  • Right to withdraw consent (Art. 7 (3) GDPR): You may withdraw consent you have given at any time with effect for the future.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged infringement. This right to lodge a complaint is without prejudice to other administrative or judicial remedies.

The supervisory authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Website: https://www.ldi.nrw.de

Last updated: October 2026

This is a convenience translation. The German version of this privacy policy is the legally binding one.