Privacy policy
Privacy Policy – SPIRIT DREAMS
Last updated: 25 October 2026
1. Controller
The controller responsible for processing personal data on this website is:
SPIRIT DREAMS
Owner: Elena De Marco
Tulbeckstraße 50
80339 Munich
Germany
Phone: +49 179 1603018
Email: info@spirit-dreams.net
2. General information on data protection
The protection of your personal data is important to us.
We process personal data exclusively in accordance with the applicable legal provisions, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Personal data is any information that can be used to identify you personally, for example your name, address, email address or IP address.
We process such data only to the extent necessary to operate our online shop, process orders, communicate with you or comply with legal obligations, or where another legal basis applies.
3. Hosting and shop system Shopify
Our online shop is operated on the Shopify platform.
The provider is Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, Ontario K2P 2L8, Canada. Other companies of the Shopify group may also be involved in providing Shopify services.
Shopify provides the technical infrastructure for our online shop and processes personal data in doing so, in particular:
- IP addresses and technical connection data
- Browser and device information
- Information about the use of our shop
- Customer and order data
- Payment and transaction information, where required for the respective function
Processing takes place to provide our online shop, to perform contracts, to ensure security and on the basis of our legitimate interests in a functional and secure online offering.
The legal bases are in particular Art. 6(1)(b) and (f) GDPR.
Shopify may also process data outside the European Economic Area. Where necessary, the safeguards provided by law for international data transfers are used.
Further information:
https://www.shopify.com/legal/privacy
4. Collection and processing of personal data
We process personal data when you visit our online shop, place an order, use a customer account or contact us.
This may include:
- First and last name
- Billing and delivery address
- Email address and phone number
- Products ordered and order history
- Payment method and payment status
- Information on delivery and returns
- Messages and customer enquiries
- Technical information about the use of our website
We use this data in particular to perform purchase contracts, process payments, organise delivery, handle returns and communicate with our customers.
The legal basis is Art. 6(1)(b) GDPR.
Where a legal retention obligation exists, processing is based on Art. 6(1)(c) GDPR.
5. Orders and contract processing
When you order in our online shop, we process the personal data required to carry out your order.
This includes in particular your contact details, delivery address, the items ordered and information on payment status.
This information is used to process your order, allocate payments, organise delivery and, where applicable, handle returns or complaints.
The legal basis is Art. 6(1)(b) GDPR.
6. Payment processing
Our online shop offers the payment methods shown at checkout.
When you use PayPal, the data required for payment processing is transmitted to the responsible PayPal payment service provider.
In particular, your name, billing information, payment amount, order information and other data required to carry out or secure the payment may be processed.
Payment processing is additionally subject to the privacy policy of the respective payment service provider.
Information on PayPal:
https://www.paypal.com/de/legalhub/paypal/privacy-full
The legal basis for the data processing required to perform the contract is Art. 6(1)(b) GDPR.
If further payment methods are offered, the privacy information of the respective payment service providers also applies.
Payment processing via Shopify Payments: We offer payments via Shopify Payments. Depending on your selection at checkout, these include, for example, credit card, Shop Pay, Apple Pay, Google Pay, Klarna or other payment methods. The data required for payment (for example name, billing and delivery address, email address, payment amount and payment data) is transmitted to and processed by Shopify and the payment service providers involved. We ourselves do not receive full card details. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). When you use Shop Pay, the Shop Pay privacy notices also apply.
7. Shipping and dropshipping
SPIRIT DREAMS works with selected trading, shipping and logistics partners to deliver products.
Depending on the product ordered, the goods may be shipped directly from a trading partner to the delivery address you provided.
For this purpose we transmit only the data required to process and deliver the order.
This may include:
- Name of the recipient
- Delivery address
- Phone number or email address, where required for delivery
- Information about the products ordered
We do not arrange for our delivery partners to use this data for their own advertising purposes.
The legal basis is Art. 6(1)(b) GDPR.
8. Contact and email communication
If you contact us by email, phone or via a contact function, we process the data you send us in order to handle your enquiry.
For our business email communication we use the address:
Processing is based on Art. 6(1)(b) or (f) GDPR, depending on the occasion.
Personal data may be processed by our email service provider for the technical provision of our email service.
9. Customer account
Where our online shop allows you to set up or use a customer account, the data required for this is processed.
This may include name, email address, delivery addresses and order information.
The processing serves to provide and manage the customer account and to simplify future orders.
The legal basis is Art. 6(1)(b) GDPR.
You can contact us if you wish to have your personal account data deleted. Statutory retention obligations remain unaffected.
10. Cookies and similar technologies
Our online shop uses cookies and comparable technologies.
Technically necessary cookies serve in particular to provide the shopping cart, security, login and the basic functionality of the website.
Where cookies or similar technologies are used for non-essential purposes, in particular analytics, personalised advertising or marketing, this is done only in compliance with the applicable legal consent requirements.
Consent that has been given can be withdrawn with effect for the future.
The legal bases under data protection law depend on the respective purpose, in particular Art. 6(1)(a) and (f) GDPR. For storing and reading information on end devices, the requirements of Section 25 TDDDG also apply.
11. Analytics, advertising and marketing
Where we use analytics or marketing services, technical usage data may be processed for this purpose.
This may include in particular information about pages visited, devices used and interactions with our online shop.
Non-essential analytics and marketing technologies are used only where the required consent has been given.
We send promotional emails only where this is legally permitted.
You can object to receiving advertising or withdraw consent at any time.
11a. Customer reviews (Judge.me)
We use the Shopify app Judge.me for customer reviews. After your purchase, we may ask you by email to review the products you ordered. Judge.me processes your email address, your name, the products ordered, the time of the order and – if you submit a review – your review text, your star rating and, where applicable, photos or videos. Your review is published on our website under the name you provide.
The legal basis for the review request is our legitimate interest in quality assurance and customer feedback (Art. 6(1)(f) GDPR). Your review is published on the basis of your consent (Art. 6(1)(a) GDPR), which you give by submitting the review. You can object to the review request at any time, for example via the unsubscribe link in the email or by message to info@spirit-dreams.net, and you can have your review deleted on request.
A transfer of data to third countries (for example the United Kingdom or the USA) cannot be ruled out and takes place on the basis of adequacy decisions or standard contractual clauses. Further information can be found in the Judge.me privacy policy.
11b. Newsletter
If you subscribe to our newsletter, we process your email address in order to send you information about our shop, new products, offers and promotions by email. Subscription is voluntary. The legal basis is your consent (Art. 6(1)(a) GDPR). Shopify handles the sending and management of subscriptions as a technical service provider. You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every email or by message to info@spirit-dreams.net. We store your email address for the newsletter until you unsubscribe.
12. Disclosure of data to third parties
We disclose personal data only where this is necessary to perform a contract, a legal obligation exists, consent has been given or another legal basis applies.
Recipients may in particular be:
- Shopify and technical service providers
- Payment service providers
- Review service (Judge.me)
- Trading and dropshipping partners
- Shipping and logistics companies
- Email and communication service providers
- Tax advisors and competent authorities, where required
Personal data is not disclosed for third-party advertising purposes without a corresponding legal basis.
13. International data transfers
When using Shopify and other technical service providers, personal data may be processed outside the European Union or the European Economic Area.
Where no adequate level of data protection has been established for the respective recipient country by an adequacy decision, such transfers take place only under the legal requirements, in particular using suitable safeguards such as the European Commission's standard contractual clauses.
14. Storage period
We store personal data only for as long as necessary for the respective processing purposes or as legal retention obligations require.
Documents relevant to business and tax law are retained in accordance with the applicable statutory periods.
Data that is no longer needed for the original purposes and is not subject to a legal retention obligation is deleted or anonymised.
15. Data security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or unlawful disclosure.
Our online shop uses encrypted connections where necessary for the secure transmission of data.
16. Your data protection rights
Subject to the legal requirements, you have in particular the following rights:
- Access to your personal data under Art. 15 GDPR
- Rectification of inaccurate data under Art. 16 GDPR
- Erasure of your data under Art. 17 GDPR
- Restriction of processing under Art. 18 GDPR
- Data portability under Art. 20 GDPR
- Objection to certain processing under Art. 21 GDPR
- Withdrawal of consent given, with effect for the future, under Art. 7(3) GDPR
To exercise your rights, please contact us at:
17. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
For private companies based in Bavaria, the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht) is generally responsible.
Website:
18. Data protection for children
Our online shop also offers products for children. However, use of the shop and the processing of orders are intended for persons who can validly conclude purchase contracts.
We do not intend to collect personal data from children without a corresponding legal basis.
If such data has been transmitted to us improperly, parents or guardians can contact us so that we can review it and, where appropriate, delete it.
19. Changes to this privacy policy
We reserve the right to amend this privacy policy if legal requirements, the technologies used or the data processing in our online shop change.
The current version is available on our website.
20. Data protection contact
If you have questions about data protection or the processing of your personal data, please contact:
SPIRIT DREAMS
Owner: Elena De Marco
Tulbeckstraße 50
80339 Munich
Germany
Phone: +49 179 1603018
Email: info@spirit-dreams.net
SPIRIT DREAMS
Because what is special lives in each of us!