Privacy policy
This English translation is provided for information only. The German version is legally binding.
Privacy policy
Last updated: 31 October 2026
In this privacy policy, we inform you which personal data we process when you visit our online shop cottonbabe.com and when you place an order, for what purposes and on what legal basis, and what rights you have.
1. Controller
Cottonbabe Interior GmbH
Riegelgartenstr. 13
76703 Kraichtal
Germany
Represented by its Managing Director, Jens Liebhauser
Phone: +49 7258 210
Email: info@cottonbabe.com
For all questions about data protection and to exercise your rights, you can contact us at the email address above.
2. Provision of the website and server log data
When you access our website, your browser transmits data to the server of our shop system for technical reasons: IP address, date and time of access, page accessed, referrer URL, browser type and version, operating system, language setting and amount of data transferred. These data are necessary to display the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR; access to your terminal device is strictly necessary in this respect under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
3. Shopify as shop system
Our online shop is operated on the e-commerce platform Shopify. The contractual partner for merchants in the EEA is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. On our behalf, Shopify processes the data arising when you visit the shop, in the customer account, in the shopping cart and at checkout (e.g. name, address, email address, telephone number if provided, order and payment information, technical usage data). Data may also be transferred to Shopify Inc. (Canada) and to sub-processors in the USA and other third countries (see section 14). Canada is covered by an adequacy decision of the EU Commission.
Shop Pay or Shopify’s Shop app may be offered at checkout. If you use these functions, Shopify additionally processes your data under its own terms.
The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in a secure and functional online shop). Further information: https://www.shopify.com/legal/privacy
4. Orders, customer account and contacting us
When you place an order with us or create a customer account, we process the information required for this (in particular name, billing and delivery address, email address, telephone number if applicable, order and payment data) in order to perform the contract, to inform you about the status of your order and to handle warranty cases (Art. 6(1)(b) GDPR). To comply with obligations under tax and commercial law, we retain order and invoice data (Art. 6(1)(c) GDPR). For accounting and inventory management, we use software service providers as processors for this purpose.
If you contact us by email or via the contact form, we process your details in order to handle your enquiry (Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR).
5. Shipping
To deliver the goods, we pass on your name, delivery address and – where necessary for shipment tracking or delivery notification – your email address or telephone number to the commissioned shipping company (e.g. Deutsche Post / DHL). The legal basis is Art. 6(1)(b) GDPR; the transfer of the email address or telephone number for delivery notification is based, where necessary, on Art. 6(1)(f) GDPR.
6. Payment service providers
Depending on the payment method selected, we pass on the data required for payment processing (e.g. name, address, email address, order amount, order number) to the respective payment service provider, such as Shopify Payments (with its processing partners), PayPal, Klarna, Apple Pay, Google Pay or other providers displayed at checkout. For purchases on invoice or by instalments, the payment provider may carry out an identity and credit check. Some payment providers process the data under their own responsibility in accordance with their own privacy notices. The legal basis is Art. 6(1)(b) GDPR.
7. Cookies and consent (cookie banner)
We use cookies and similar technologies (e.g. local storage, pixels, scripts). We use technically necessary cookies, for example for the shopping cart, checkout, language setting, security and storing your cookie selection, on the basis of Section 25(2) No. 2 TDDDG and Art. 6(1)(b) or (f) GDPR.
We only use all other technologies for statistics (analytics), personalisation and marketing if you have consented via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The cookie banner is provided by our shop system Shopify. There you can accept or reject all categories on an equal footing or select them individually; marketing and statistics are not preselected. Your selection is stored in a cookie so that the banner does not reappear each time you visit.
Withdrawal: You can withdraw or change your consent at any time with effect for the future. To do so, click on the “Cookie settings” link (“Cookie-Einstellungen”) in the footer of our website; there you can adjust your selection at any time. Alternatively, an email to info@cottonbabe.com is sufficient. The lawfulness of the processing carried out until the withdrawal remains unaffected.
8. Google services
We use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Data may be transferred to Google LLC in the USA (see section 14). General information: https://policies.google.com/privacy and https://business.safety.google/privacy/.
8.1 Google Tag Manager
We use Google Tag Manager (container GTM-5WR9MBJ). Tag Manager is a tool we use to manage measurement and marketing tags on our website. It does not itself set any cookies for analytics purposes, but your IP address is transmitted to Google when it loads. The tags delivered via Tag Manager (in particular Google Analytics) are controlled via Google Consent Mode according to your selection in the cookie banner. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in efficient, consent-controlled management of tags); for the tags delivered, the legal basis stated below applies.
8.2 Google Analytics 4
With your consent (category “Analytics”), we use Google Analytics 4 to evaluate the use of our shop statistically and to improve our offering. Two measurements are currently integrated: one via Google Tag Manager (measurement ID G-ZYQ0WGB3R0) and one via the Shopify app “Google & YouTube” (measurement ID G-H72PRC10HG). In particular, the following are processed: shortened IP address or the approximate location derived from it, device and browser information, pages viewed, time spent, clicks, traffic source and shop events such as product view, cart and purchase. Google Analytics 4 does not store complete IP addresses. Depending on the setting, the analytics data are deleted after 2 or 14 months. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
8.3 Google Ads conversion tracking and remarketing
With your consent (category “Marketing”), we use Google Ads (account AW-18142201066) including conversion tracking and remarketing. This records whether you have carried out certain actions after clicking on one of our ads (e.g. product view, cart, purchase), and remarketing lists may be created in order to show you interest-based ads on websites and services of Google and its partners. For this purpose, cookies or identifiers are set and usage data are transmitted to Google. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can additionally manage personalised advertising at https://adssettings.google.com.
8.4 Google Merchant Center / Google Shopping
We present our products in Google Shopping and free product listings via Google Merchant Center (MC-CTG2YP93TZ). For this purpose, we transmit product data (no personal customer data) to Google. With your consent (category “Marketing”), events such as page view, product view and purchase are also transmitted to Merchant Center in order to measure the performance of our product listings. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
8.5 Google Consent Mode v2
We use Google Consent Mode v2. It transmits your selection from the cookie banner to the Google services. As long as no consent has been given, the settings for analytics and advertising storage (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to “denied”. In this state, the Google services do not set any analytics or advertising cookies; however, Google tags may send cookieless signals (e.g. time stamp, page URL, browser information, consent status) to Google, which Google uses for aggregated modelling. Only after your consent are the settings set to “granted”. The legal basis for transmitting the consent status is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent) and Art. 6(1)(f) GDPR.
8.6 Google Hosted Libraries
To display certain functions, our website loads the JavaScript library jQuery from the server ajax.googleapis.com. In the process, your IP address is transmitted to Google. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a functional presentation of the website).
9. Meta Pixel and Conversions API
With your consent (category “Marketing”), we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), integrated via the Shopify integration of Facebook & Instagram. This allows us to measure the effectiveness of our ads on Facebook and Instagram (conversion tracking) and to show visitors to our shop interest-based ads there (Custom Audiences). In addition, events such as product view, cart and purchase may be transmitted to Meta server-to-server via the Conversions API; hashed contact data (e.g. email address, telephone number) may be transmitted in the process. Meta may link these data to your Facebook or Instagram account. We are jointly responsible with Meta for the collection and transmission (Art. 26 GDPR); information on this: https://www.facebook.com/legal/controller_addendum. Data may be transferred to Meta Platforms, Inc. in the USA (see section 14). The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Meta’s privacy policy: https://www.facebook.com/privacy/policy/
10. TikTok Pixel
With your consent (category “Marketing”), we use the TikTok Pixel of TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, integrated via the Shopify integration of TikTok. This allows us to measure the effectiveness of our ads on TikTok and to create target groups for advertising. For this purpose, cookies or identifiers are set and events such as page view, product view, cart and purchase are transmitted to TikTok. A transfer to third countries is possible (see section 14). The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Privacy policy: https://www.tiktok.com/legal/privacy-policy-eea
11. Pinterest Tag
With your consent (category “Marketing”), we use the Pinterest Tag of Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland, integrated via the Shopify integration of Pinterest. This allows us to measure the effectiveness of our ads on Pinterest and to create target groups for advertising. For this purpose, cookies or identifiers are set and events are transmitted to Pinterest; a transfer to Pinterest, Inc. in the USA is possible (see section 14). The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Privacy policy: https://policy.pinterest.com/en/privacy-policy
12. Newsletter
If you subscribe to our newsletter, we use your email address to send you information about our products and offers. We use the double opt-in procedure: after registering, you receive an email in which you confirm your registration. We store the time of registration and confirmation as well as the IP address in order to be able to prove the registration. The newsletter is sent via the marketing functions of our shop system Shopify. The legal basis is your consent under Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by email to info@cottonbabe.com. After you unsubscribe, we delete your email address from the mailing list unless we need to retain it to prove your earlier consent or for other legal reasons.
13. Other integrated services
Online withdrawal function (app “EU Adress-Check & Widerruf Pro”): For the statutory online withdrawal function (“Vertrag widerrufen” – withdraw from contract, Section 356a of the German Civil Code (BGB)), we use the Shopify app “EU Adress-Check & Widerruf Pro” provided by Martini & Radl OG (ECOMBEAT), Garnisongasse 4/11, 1090 Vienna, Austria. If you declare a withdrawal using this function, your name, your email address, the order number, the items selected, where applicable, and the date and time of receipt (timestamp) are processed; to match the withdrawal to your order, the order date and the items ordered are retrieved from our shop system. Your IP address may also be processed for abuse prevention and in server logs. The purpose is to receive and process your withdrawal, including the legally required acknowledgement of receipt by email, and to document its receipt. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 356a BGB and Art. 6(1)(b) GDPR (unwinding of the contract). The provider processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. As sub-processors, it uses Railway Corporation (USA; servers in the EU, Amsterdam) for hosting and Plus Five Five, Inc. (“Resend”, USA) for sending emails; processing in the USA is possible in this context (see section 14). In the app, withdrawal cases are deleted automatically after 90 days. We keep our records of the withdrawal for as long as they are required to process it and to prove its receipt, generally until the end of the regular limitation period of three years (Sections 195 and 199 BGB), and beyond that only insofar as retention obligations under commercial or tax law apply (see section 15).
Judge.me (product reviews): We use the Judge.me app to display and collect customer reviews. After an order, you may be asked by email to leave a review; for this purpose, your name, email address and the products purchased are transmitted to Judge.me. The legal basis for review requests by email to existing customers is Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition (UWG); you can object to this at any time. Interaction with the review widgets is only measured with your consent (category “Analytics”, Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
WhatsApp chat button: You can contact us via WhatsApp using a button (app “BeeApp WhatsApp”). When the button loads, your IP address is transmitted to the app provider. WhatsApp only opens when you click on the button; the privacy notices of WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, then apply. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a simple means of contact) or, when you contact us, Art. 6(1)(b) GDPR.
Elfsight: We use the Elfsight platform for a website widget. When the widget loads, your IP address and technical browser data are transmitted to Elfsight’s servers. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in presenting website content).
Instagram feed (Instafeed): We use the Instafeed app to display posts from our Instagram profile. The images are loaded via the servers of the app provider (nfcube.com); in the process, your IP address is transmitted to it. A connection to Instagram is only established when you click on a post. The legal basis is Art. 6(1)(f) GDPR.
Product bundles (widebundle): We use the widebundle app to display product bundles and volume discounts. When the page loads, a script is loaded from the provider’s servers; in the process, your IP address is transmitted. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in presenting our offers).
Social media links: On our website, we link to our profiles on social networks. These are simple links; data are only transmitted when you click on a link.
14. Transfers to third countries, in particular the USA
Some of the providers mentioned or their sub-processors process data outside the EU or the EEA, in particular in the USA. For the USA, an adequacy decision of the EU Commission on the EU-US Data Privacy Framework (DPF) has been in place since 10 July 2023. Transfers to companies certified under the DPF (e.g. Google LLC, Meta Platforms, Inc.) are based on this decision (Art. 45 GDPR). Where a recipient is not certified or data are transferred to other third countries without an adequacy decision, the transfer is based on the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). The list of certified companies is available at https://www.dataprivacyframework.gov/list.
15. Storage period
We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist. We retain order and invoice data for up to 8 or 10 years in accordance with commercial and tax law (in particular Section 257 HGB, Section 147 AO); during this time, processing is limited to fulfilling these obligations. We store customer accounts until you request their deletion. We delete data from contact enquiries once the enquiry has been finally dealt with and no retention obligations apply. Data that we process on the basis of consent are deleted after withdrawal of consent unless another legal basis exists. The storage period of cookies depends on the respective cookie and can be viewed in the cookie settings and in your browser.
16. Your rights
Under the GDPR, you have the following rights:
- Access to the data we store about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.
To exercise your rights, an email to info@cottonbabe.com is sufficient.
17. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Email: poststelle@lfdi.bwl.de
Website: https://www.baden-wuerttemberg.datenschutz.de
18. Data security
Our website and checkout are encrypted using TLS/SSL (recognisable by “https://” and the padlock symbol in your browser). With unencrypted email communication, complete confidentiality cannot be guaranteed.
19. Changes to this privacy policy
We adapt this privacy policy when our data processing or the legal situation changes. The version published on this page applies.