Date: September 9, 2026
1. Controller
The controller responsible for the processing of personal data within the scope of this online service is:
Boxerino UG (limited liability)
Unterm Bild 10
87544 Blaichach
Germany
Represented by the Managing Director:
Maximilian Müller
Email: info@boxerino.de
Website: https://www.boxerino.de
Hereinafter also referred to as "we," "us," or "Boxerino."
2. General Information on Data Processing
The protection of your personal data is important to us. We process personal data exclusively within the scope of the applicable data protection provisions, in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications-Digital Services Data Protection Act (TDDDG).
Personal data is any information that relates to an identified or identifiable natural person. This can include, in particular, name, address, email address, telephone number, IP address, payment data, order data, and technical usage data.
We process personal data only insofar as it is necessary for the provision of our online shop, the processing of inquiries, the execution of orders and contracts, payment processing, the delivery of goods, the fulfillment of legal obligations, or based on valid consent.
3. Provision of Our Online Shop via Shopify
Our online shop is operated via the e-commerce platform Shopify. The provider for merchants based in Germany is:
Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland
Shopify provides us with the technical infrastructure required to operate our online shop. This includes, in particular, hosting, shop presentation, shopping cart, checkout, customer accounts, security functions, as well as functions for order and payment processing.
When using our shop, the following data in particular may be processed:
- IP address
- Device and browser information
- Date and time of access
- Pages and products accessed
- Shopping cart contents
- Order and transaction data
- Name and contact details
- Shipping and billing addresses
- Payment status and selected payment method
- Customer account and communication data
- Cookie and consent information
Shopify processes part of this data as our data processor. For certain services, in particular extended services, security, fraud prevention, analysis, personalization, or payment functions, Shopify may also process data under its own responsibility under data protection law.
The legal basis for processing that is necessary for the use of the shop, for initiating a contract, or for the performance of a contract is Art. 6(1)(b) GDPR. Insofar as data is processed to ensure technically reliable, secure, and user-friendly operation, this is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online shop. Insofar as processing is required to fulfill legal obligations, the legal basis is Art. 6(1)(c) GDPR. Insofar as consent is required, the processing is based on Art. 6(1)(a) GDPR and, if information is stored on or accessed from your end device, additionally based on Section 25(1) TDDDG.
Further information on the processing of personal data by Shopify can be found at:
https://www.shopify.com/legal/privacy/consumers
Data protection inquiries to Shopify can be made via the privacy portal:
4. Data Transfer by Shopify to Third Countries
In the course of using Shopify, personal data may be transferred to or processed by Shopify's affiliated companies and service providers outside the European Economic Area, particularly in Canada and the United States.
Shopify bases intra-group transfers of personal data from the European Economic Area in particular on binding internal data protection regulations approved by the responsible data protection authority, so-called Binding Corporate Rules. Where necessary, adequacy decisions of the European Commission, standard contractual clauses of the European Commission, or other legally recognized safeguards are used in addition or as an alternative.
Information on the sub-processors used by Shopify and transfer mechanisms can be found in Shopify's Data Processing Addendum:
https://www.shopify.com/legal/dpa
You can request further information or a copy of the relevant safeguards from Shopify or us.
5. Server Log Files and Technical Access Data
When visiting our online shop, technically necessary data is processed. This can include, in particular, IP address, date and time of access, page or file accessed, amount of data transferred, referrer URL, browser type, browser version, operating system, device information, as well as information about the success or failure of a page request.
Processing is carried out for the technical provision of the online shop, to ensure the stability and security of our systems, for error analysis, and to prevent abuse and attacks.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our online service.
The data is deleted or anonymized as soon as it is no longer required for the stated purposes, provided that no security-related retention or legal obligation prevents this.
6. Cookies and Similar Technologies
Our online shop uses cookies and similar technologies. Cookies are small pieces of information that are stored on or accessed from your end device.
Some cookies and technologies are absolutely necessary for the operation of the online shop. They may be required, for example, to store shopping cart contents, enable checkout, provide security functions, maintain a session, or save your privacy settings.
Insofar as the access to or storage of information on your end device is absolutely necessary for a digital service expressly requested by you, this is based on Section 25(2) TDDDG. The subsequent processing of personal data is based, depending on the purpose, in particular on Art. 6(1)(b) or (f) GDPR.
Non-essential cookies and similar technologies, in particular for analysis, personalization, marketing, or advertising, are only used after you have given your consent via our cookie or consent banner. The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
In the cookie banner or in the cookie settings, you will receive information about the services used, their purposes, and storage durations. You can change your selection there at any time with effect for the future or revoke consent already given. The legality of the processing carried out until the revocation remains unaffected.
7. Shopify Network Intelligence and Advanced Shopify Services
Shopify offers advanced services under the name "Shopify Network Intelligence." In this context, Shopify may combine data from the use of various Shopify services to improve, in particular, fraud prevention, analytics, shop functions, personalization, product recommendations, and advertising services.
Insofar as Shopify Network Intelligence or advanced services dependent on it are activated in our shop, Shopify may act as a separate controller under data protection law for certain processing operations. Non-essential access to your end device and associated processing only take place in the European Economic Area in accordance with the selection you made in the cookie banner.
You can change or revoke your consent at any time via the cookie settings of our shop. Information about your rights vis-à-vis Shopify as well as a way to exercise these rights can be found at:
8. Orders and Contract Processing
When you place an order via our online shop, we process the data required for the order. This includes, in particular:
- Name
- Billing and delivery address
- Email address
- If applicable, telephone number
- Products ordered and personalization requests
- Order value and time of order
- Selected payment method and payment status
- Shipping information
- Communication and complaint data
Processing is carried out for the purpose of processing your order, executing the purchase contract, payment processing, delivery, handling returns, complaints, and warranty claims, as well as communication in connection with your order.
The legal basis is Art. 6(1)(b) GDPR. Insofar as we are obliged to retain order and invoice data for commercial or tax law reasons, further processing is based on Art. 6(1)(c) GDPR.
9. Individual and Personalized Gift Boxes
Boxerino offers individually designed and personalized gift boxes and packaging solutions. If you submit additional information, texts, names, logos, images, design requests, or other content to us for this purpose, we process this data to advise on, design, manufacture, and execute the order you have requested.
Insofar as the information concerns you personally and is necessary for the performance of the contract, the legal basis is Art. 6(1)(b) GDPR. Insofar as information concerns other persons, the processing is generally based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper fulfillment of the personalization order placed with us.
Please only transmit personal data, images, logos, and other content for which you are authorized to transmit and use. Please do not provide us with any special categories of personal data within the meaning of Art. 9 GDPR unless this is expressly required and has been agreed with us in advance.
Design and personalization files are generally deleted after completion of the order as soon as they are no longer required for reorders, corrections, the handling of warranty claims, or the assertion or defense of legal claims. Legal retention obligations remain unaffected.
10. Data of Gift Recipients and Other Third Parties
If a gift recipient is involved, we process their name and delivery address to fulfill the delivery contract. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the delivery of the ordered gift to the intended recipient. If you provide us with other third-party data, please ensure that you are authorized to do so and that the third party is informed about the processing of their data.
11. Customer Account
You can create a customer account in our shop. The data stored in your account (e.g., name, addresses, order history) is used to simplify future orders and manage your account settings. The legal basis is Art. 6(1)(b) GDPR (contract performance or pre-contractual measures).
12. Inquiries and Contact
If you contact us (e.g., by email or via a contact form), we process the data provided to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR (if the inquiry concerns a contract) or Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper processing and answering of your inquiry.
Inquiries will be deleted once they have been conclusively processed and there are no legal retention obligations, contractual requirements, or legitimate interests in further storage. Business correspondence may be subject to legal retention obligations.
13. Payment Processing
To process payments, we transmit the required data to the payment service provider selected by you. This may include name, billing address, email address, order value, currency, transaction ID, payment status, and other information required for payment processing.
Processing is carried out for the performance of the contract concluded with you on the basis of Art. 6(1)(b) GDPR. Payment service providers may additionally process personal data under their own responsibility, in particular for payment processing, fraud prevention, risk assessment, identity verification, as well as to fulfill legal requirements. The privacy policy of the respective payment service provider applies to these processing activities.
13.1 PayPal
If you select PayPal as a payment method, the data required for carrying out the payment will be transmitted to the following provider:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
In principle, we only receive the information required for the assignment, confirmation, and processing of the payment or order.
Further information can be found in PayPal's privacy policy:
https://www.paypal.com/de/legalhub/paypal/privacy-full
13.2 Shopify Payments and Payment Methods Offered Therein
Insofar as Shopify Payments or payment methods provided via Shopify Payments are offered in the checkout and selected by you, payment processing is carried out via:
Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland
Shopify may use payment processors, financial service providers, and providers of the selected payment method for payment processing. Depending on the options available in the checkout and selected by you, this may include, in particular, credit and debit card payments, Shop Pay, Apple Pay, Google Pay, or other payment methods. You determine which payment method is used in the checkout.
Payment providers may process data under their own responsibility, in particular for payment processing, fraud and risk assessment, as well as to fulfill financial and anti-money laundering obligations.
Further information can be found at:
https://www.shopify.com/legal/privacy/consumers
https://www.shopify.com/legal/terms-shopify-payments
14. Shipping and Delivery
To deliver your order, we transmit the necessary personal data to the shipping or logistics company commissioned with the delivery. This regularly includes name and delivery address as well as, insofar as required for the selected shipping method or you have consented, email address or telephone number.
The legal basis for the transmission of the purchaser's data necessary for delivery is Art. 6(1)(b) GDPR. If the recipient of the delivery is a person other than the purchaser, the processing and transmission of the recipient's data are based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the execution of the shipping order and the proper delivery of the ordered gift.
The shipping service provider used is indicated in the shipping information or the shipping confirmation. A transmission of email address or telephone number for additional shipping notifications or flexible delivery options only occurs insofar as this is necessary for the selected service, you expressly wish this, or another legal basis exists.
15. Accounting, Tax Consulting, and Legal Obligations
We process order, contract, invoice, and payment data to fulfill legal commercial and tax law obligations. If necessary, data may be transmitted to tax consultants, accounting service providers, credit institutions, tax authorities, or other legally authorized bodies.
For digital accounting and document management, we may use services from Lexware Office. The provider is:
Haufe-Lexware GmbH & Co. KG
Munzinger Straße 9
79111 Freiburg
Germany
Processing is carried out on the basis of Art. 6(1)(c) GDPR and, insofar as necessary for the proper organization of our business processes, on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and efficient bookkeeping and corporate organization.
Documents that must be retained by law are stored for the applicable commercial or tax law retention period. Depending on the type of document, this can be six, eight, or ten years in particular.
16. Analysis and Improvement of Our Online Shop
Shopify provides us with functions for the technical and economic analysis of the use of our online shop. This allows us, for example, to understand how our shop is used, which pages or products are accessed, from which approximate region access occurs, and how visitors interact with our shop.
Insofar as exclusively technically necessary information or information permissible under data protection law without consent is processed for this purpose, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical, economic, and user-friendly optimization of our online shop.
Insofar as analysis functions use cookies, pixels, or similar technologies that are not absolutely necessary, their use only occurs after your consent in accordance with Section 25(1) TDDDG. Subsequent processing of personal data is based on Art. 6(1)(a) GDPR.
You can change or revoke your consent at any time via the cookie settings.
17. Newsletter and Electronic Advertising
To the extent that we offer a newsletter or other electronic marketing communications and you subscribe to them, we use your e-mail address and, if applicable, your name to send you the requested information.
Processing is based on your consent in accordance with Art. 6(1)(a) GDPR. Where required by law, we use a double opt-in procedure. In this process, you will receive a message after your registration asking you to confirm your subscription. To document consent, the time of registration, time of confirmation, IP address, and other technical information may be stored.
For sending newsletters, we may use the e-mail functions integrated into Shopify. In this case, Shopify processes the data necessary for the dispatch in accordance with the conditions described in Section 3.
You may revoke your consent at any time with effect for the future, for example, via the unsubscribe link in every marketing message or by notification to info@boxerino.de. The legality of the processing carried out until the revocation remains unaffected.
After unsubscribing, your address will be removed from the active distribution list. It may be stored on a blacklist to the extent necessary to permanently respect the revocation and prevent unwanted further mailings. The legal basis for this limited storage is Art. 6(1)(f) GDPR.
18. Social Media Presences and Links
Boxerino maintains presences on social networks and platforms, in particular on Instagram, Facebook, and TikTok.
If our online shop only contains a link to a social media platform, a connection to the respective platform is generally only established by clicking the link. From this point on, the platform provider may process personal data according to its own privacy policy.
When visiting our social media presences, the respective platform operators may process, in particular, IP addresses, device information, cookie and identifier data, usage and interaction data, and, if applicable, information from your user account. We have only limited influence on the scope, purposes, and storage duration of the processing by the platform operators.
If you contact us via a social media platform, we process the data you provide to handle your message. If your inquiry relates to a contract or pre-contractual measures, the legal basis is Art. 6(1)(b) GDPR. Otherwise, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in communicating with interested parties, customers, and business partners, as well as in public relations.
18.1 Instagram and Facebook
The provider for users in the European Economic Area is generally:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland
When operating our Facebook or Instagram presence, statistical evaluations, known as "Insights," may be made available to us. To the extent that joint controllership exists, it is governed by the agreements provided by Meta. The primary responsibility for the processing of platform data and the fulfillment of data subject rights lies with Meta.
Further information:
https://www.facebook.com/privacy/policy
https://www.facebook.com/legal/terms/page_controller_addendum
18.2 TikTok
For the processing of personal data of users in the European Economic Area, TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, is primarily responsible.
Further information:
https://www.tiktok.com/legal/page/eea/privacy-policy/de
19. Use of Artificial Intelligence and AI-Generated Content
We partially use artificial intelligence applications to assist in the creation and editing of general texts, images, image backgrounds, design drafts, and other creative content for our online offerings and advertising.
Personal order, customer, or recipient data, as well as images, names, messages, or other personal content submitted by customers for personalization, are not transmitted by us to external AI services for these purposes. Should the processing of personal data by an AI service be intended in the future, this privacy policy will be supplemented accordingly before processing begins, and consent will be obtained if necessary.
AI-supported content is reviewed by us before publication. To the extent that a transparency or labeling requirement exists under Regulation (EU) 2024/1689 on artificial intelligence, the so-called EU AI Act, we will provide the required information clearly and unambiguously immediately upon the first interaction or at the relevant content. This privacy policy does not replace any labeling that may be required for specific content.
If AI-generated images are used to present a product as an example, the specific product description and the scope of delivery stated therein remain authoritative. AI-generated decorations or backgrounds are not part of the scope of delivery unless expressly stated.
20. Recipients of Personal Data
We only pass on personal data if this is necessary for the performance of a contract, if there is a legal obligation, if you have consented, or if there is another legal basis under data protection law.
Recipients or categories of recipients may, in particular, be:
- Shopify and its subcontractors
- Payment service providers and payment processors
- Shipping and logistics companies
- IT, hosting, and communication service providers
- Newsletter and marketing service providers, if used and consented to
- Accounting and tax service providers
- Credit institutions
- Legal and business consultants
- Authorities, courts, and other legally authorized bodies
With service providers who process personal data exclusively on our behalf, we enter into data processing agreements in accordance with Art. 28 GDPR, as far as required by law.
21. Storage Duration
We only store personal data for as long as is necessary for the respective processing purpose. After the processing purpose ceases to exist, data will be deleted or its processing restricted, provided no statutory retention obligations, ongoing contractual relationships, limitation periods, or legitimate interests for further storage preclude this.
In particular, the following criteria apply:
- Customer account data is generally stored until the customer account is deleted.
- Contact inquiries are deleted after final processing, provided there is no other legal basis. For the documentation of business transactions or for the defense against possible claims, they may regularly be stored until the expiry of the statutory limitation period.
- Newsletter data is processed until the consent is withdrawn. Proof data and blacklist entries may be stored beyond this, to the extent necessary to fulfill legal evidentiary requirements or to respect the withdrawal.
- Design and personalization files are deleted as soon as they are no longer required for order fulfillment, agreed-upon reorders, warranty, or legal defense.
- Order, invoice, payment, and business documents are retained in accordance with the respectively applicable commercial and tax law retention periods. Depending on the type of document, these can be, in particular, six, eight, or ten years.
- Consent data is stored as long as necessary to provide proof of consent and to defend against potential claims.
22. Data Security
We implement appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, or other unauthorized processing.
Our online shop uses an encrypted SSL or TLS connection. As a result, data transmitted between your browser and our online shop is encrypted. Absolute protection during data transmission on the internet cannot be technically guaranteed.
23. Your Rights
Provided the legal requirements are met, you have the following rights under the GDPR in particular:
- Right of access pursuant to Art. 15 GDPR
- Right to rectification pursuant to Art. 16 GDPR
- Right to erasure pursuant to Art. 17 GDPR
- Right to restriction of processing pursuant to Art. 18 GDPR
- Right to data portability pursuant to Art. 20 GDPR
- Right to object pursuant to Art. 21 GDPR
- Right to withdraw consent pursuant to Art. 7(3) GDPR
- Right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR
To exercise your rights, you can contact us at:
Boxerino UG (haftungsbeschränkt)
Unterm Bild 10
87544 Blaichach
Germany
E-mail: info@boxerino.de
24. Right to Object
To the extent that we process personal data based on Art. 6(1)(f) GDPR due to legitimate interests, you have the right, under the conditions of Art. 21 GDPR, to object to this processing at any time for reasons arising from your particular situation.
If personal data is processed for the purpose of direct marketing, you may object to the processing for these purposes at any time. In this case, the personal data will no longer be processed for direct marketing.
25. Withdrawal of Consent
You may withdraw any consent given under data protection law at any time with effect for the future. The withdrawal does not affect the legality of the processing that took place based on your consent up to the point of withdrawal.
26. Right to Lodge a Complaint with a Data Protection Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection regulations.
For non-public companies based in Bavaria, the competent authority is, in particular:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
Internet: https://www.lda.bayern.de
In addition, you can generally also contact a data protection supervisory authority at your habitual residence, your place of work, or the place of the alleged data protection breach.
27. Obligation to Provide Data
For a normal visit to our online shop, you are generally not required to actively provide us with personal data.
However, for an order, we require the information necessary for the execution of the purchase contract, payment processing, and delivery. Without this information, we cannot fulfill the order or cannot fulfill it completely.
For voluntary information, we indicate, where possible, that it is not mandatory.
28. Automated Decisions
We generally do not make decisions based solely on automated processing that have legal effects on you or significantly affect you in a similar manner.
Shopify, payment service providers, and other platform or security service providers may use automated processes within the scope of their own responsibility, particularly for fraud, identity, and risk assessment. Further information on this can be found in the data protection information of the respective provider.
29. Changes to this Privacy Policy
We reserve the right to adapt this privacy policy if legal requirements change, if our online shop changes, if the services we use change, or if our data processing changes.
For your visit, the current version of this privacy policy as published in the online shop shall apply.