Data Privacy

1. Controller and contact

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Flanacom GmbH
Marktstraße 3
38300 Wolfenbüttel
Germany

Phone: +49 (0)30 224 53 716
E-mail: hey@madebynami.de

Managing Directors: Alexander Flak, Hauke Julian Naporra
Registered in the commercial register of the Braunschweig District Court, HRB 205699

Made by Nami is a project of Flanacom GmbH.

2. What this policy covers

This policy informs you about which personal data we process when you visit our website, place orders with us, or otherwise get in touch with us. Personal data refers to any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR).

Your data is transmitted via an SSL/TLS-encrypted connection. You can recognize this by the lock symbol and the "https://" in your browser's address bar.

3. Rights of the data subject

You have the following rights with respect to us:

  • Information about the data stored about you (Art. 15 GDPR)
  • Correction of incorrect data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR), provided there are no legal retention obligations to the contrary
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Revocation of consent granted with effect for the future (Art. 7 para. 3 GDPR); the lawfulness of processing carried out prior to revocation remains unaffected
  • Complaint to a supervisory authority (Art. 77 GDPR); for us, this is the State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover

Right to object (Art. 21 GDPR)

If your data is processed on the basis of legitimate interests (Art. 6 para. 1 lit. f GDPR), you may object to the processing at any time for reasons arising from your particular situation. In the event of an objection, we will stop processing the data concerned, unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

If your data is processed for the purpose of direct marketing, you may object at any time without providing a reason. Once your objection is received, we will cease processing for this purpose.

You can send your objection informally to the contact details provided above.

4. Accessing the website (server log files)

When you access our pages, your browser transmits technically necessary information to our server. This is stored in so-called log files. The following is recorded:

  • URL accessed,
  • Date and time of access,
  • Amount of data transferred,
  • Browser type and operating system used,
  • Referrer URL (the site from which you arrived),
  • Truncated IP address.

This data processing is based on our legitimate interest in the stable, secure, and functional operation of the website (Art. 6 para. 1 lit. f GDPR). The log files are deleted after no more than 7 days, unless they are required to investigate specific security incidents.

5. Cookies and similar technologies

We use cookies and similar technologies (local storage, pixels) on our website. Cookies are small text files that your browser saves on your device.

5.1 Legal basis

The storage of information on your device and access to information already stored generally requires your consent under § 25 of the Telecommunications-Telemedia Data Protection Act (TDDDG). An exception applies only to cookies that are strictly necessary to provide a service you have explicitly requested (§ 25 para. 2 no. 2 TDDDG). These include, for example, the shopping cart, login, security functions, and the storage of your cookie consent decision.

To the extent that personal data is processed, the legal basis is:

  • for technically necessary cookies: Art. 6 para. 1 lit. f GDPR (legitimate interest in operating the website) or Art. 6 para. 1 lit. b GDPR (performance of a contract during the ordering process),
  • for all other cookies and cookie-like technologies: your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG.

5.2 Consent management with Pandectes

To obtain and manage your cookie consent, we use the "Pandectes GDPR Compliance" solution from Pandectes Ltd., Cyprus. When our website is accessed, a technically necessary cookie (_pandectes_gdpr) is set, in which your consent decision is stored for a period of one year. There is no transfer to a third country; the provider is based within the European Union.

The legal basis for setting the Pandectes cookie is § 25 para. 2 no. 2 TDDDG (technically necessary cookie); for the associated processing of personal data, Art. 6 para. 1 lit. c GDPR in conjunction with our legal obligation to obtain and demonstrably document your consent.

You can change or revoke your selection at any time by clicking the "Cookie Settings" link in the footer.

6. Shop platform and hosting (Shopify)

Our website is operated on the e-commerce platform of the following provider:

Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

In this context, data may be transferred within the corporate group to Shopify Inc., 150 Elgin St., Ottawa, ON K2P 1L4, Canada, as well as to US corporate subsidiaries.

All data generated in connection with accessing, using, and ordering from the website is processed via Shopify (in particular access data, order data, customer account data, payment data). The legal basis is Art. 6 para. 1 lit. b GDPR (order processing) or Art. 6 para. 1 lit. f GDPR (provision of a stable, secure shop).

A data processing agreement pursuant to Art. 28 GDPR is in place with Shopify. There is an adequacy decision from the EU Commission for transfers to Canada (Art. 45 GDPR). For supplementary US transfers, Shopify relies on its certification under the EU-U.S. Data Privacy Framework (adequacy decision of 10.07.2023) as well as EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR).

7. Contacting us

7.1 E-mail, contact form, and general inquiries

When you contact us by e-mail, via a contact form, or in a similar manner, we process the data you provide (at least e-mail address and name, possibly telephone number, subject, order reference) to answer your inquiry.

The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in responding); if your inquiry is aimed at a contract, an additional legal basis is Art. 6 para. 1 lit. b GDPR.

We delete the data once your request has been conclusively clarified and there are no legal retention obligations (in particular of a commercial or tax nature) to the contrary.

7.2 Zendesk ticketing system

Incoming inquiries are processed in a structured manner in our ticketing system. Provider:

Zendesk International Ltd., 55 Charlemont Place, Saint Kevin's, Dublin D02 F985, Ireland.

The name, e-mail address, and content of your inquiry are processed. The legal basis is Art. 6 para. 1 lit. f GDPR (efficient, traceable processing) or Art. 6 para. 1 lit. b GDPR if related to a contract. A data processing agreement is in place with Zendesk. As part of its use, transfers to Zendesk Inc. in the USA may occur; the provider is certified under the EU-U.S. Data Privacy Framework.

7.3 Contact via WhatsApp Business

You can contact us via WhatsApp. Provider:

WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (part of the Meta corporate group).

We use the business version of the service. Your WhatsApp mobile number, profile name, and message content are processed. The legal basis is Art. 6 para. 1 lit. b GDPR if the contact relates to an order, otherwise Art. 6 para. 1 lit. f GDPR (timely customer service).

As part of the usage, data is transferred to Meta Platforms, Inc. servers in the USA. Meta is certified under the EU-U.S. Data Privacy Framework.

If you do not wish for this processing to occur, please use one of the other contact methods (e-mail, phone). WhatsApp's privacy policy can be found at: https://www.whatsapp.com/legal/privacy-policy

8. Order processing

8.1 Order data

To process your order, we process the data provided during the ordering process (name, delivery address, billing address, e-mail address, possibly telephone number, payment data, order content). The legal basis is Art. 6 para. 1 lit. b GDPR. As far as necessary, we pass the data on to shipping and payment service providers (see below).

To the extent that statutory retention obligations exist (in particular § 257 of the German Commercial Code (HGB), § 147 of the German Fiscal Code (AO)), we store the data for the respective duration (usually up to 10 years). The legal basis for this is Art. 6 para. 1 lit. c GDPR.

8.2 Personalization of products

You have the option to have products personalized with text you provide. We process the personalization text entered during the order process exclusively for the manufacture of the ordered product. The legal basis is Art. 6 para. 1 lit. b GDPR. To the extent the text contains personal data (e.g., a name), this is also processed only for the fulfillment of the contract and passed on to any production service provider involved.

8.3 Information about updates

For goods with digital elements and for digital products, we process your contact data (name, address, e-mail address) on the basis of Art. 6 para. 1 lit. c GDPR in conjunction with § 327f of the German Civil Code (BGB) in order to inform you about updates that we contractually owe you.

8.4 Address validation via Google Maps

During the ordering process, we use address auto-complete via the Google Maps Platform, provided it is activated. Provider:

Google Ireland Limited, Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland.

When entering an address, the entered characters are transmitted to Google to generate completion suggestions. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in correct address capture to avoid delivery problems).

Servers in the USA may be involved in the transmission; Google is certified under the EU-U.S. Data Privacy Framework.

8.5 Returns and electronic withdrawal

To process returns and withdrawals, we use easyReturns, provided by 247APPS UG (haftungsbeschränkt), In der Goldgrube 28, 56073 Koblenz, Germany, and EU Widerrufsbutton, provided by 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Straße 1a, 40721 Hilden, Germany. The necessary contact and order information is processed, including your name, email address, order number, affected items and return or withdrawal details. This information is transmitted to the relevant provider to process your request, acknowledge receipt and document the return or withdrawal. Processing is based on Article 6(1)(b) GDPR where necessary to administer the contract and Article 6(1)(c) GDPR to meet legal obligations, particularly section 356a of the German Civil Code.

9. Shipping service providers

To deliver your order, we transmit your delivery data to the following shipping service providers. On the basis of Art. 6 para. 1 lit. b GDPR, they receive your name and delivery address as a standard. If you give your express consent during the ordering process in accordance with Art. 6 para. 1 lit. a GDPR, we will additionally pass on your e-mail address and/or telephone number for delivery notification purposes. You can revoke your consent at any time.

Depending on the order and country of delivery, we use:

  • DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn (domestic and EU)
  • DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn (international/Express)
  • DPD Deutschland GmbH, Wailandtstraße 1, 63741 Aschaffenburg
  • United Parcel Service Deutschland Inc. & Co. OHG, Görlitzer Straße 1, 41460 Neuss

10. Payment service providers

Depending on the payment method selected, we pass your payment and order data provided during the ordering process to the respective provider. The legal basis is Art. 6 para. 1 lit. b GDPR (contract execution). The disclosure is limited to what is necessary for payment processing.

10.1 Shopify Payments

Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Credit card payments, in particular, are processed via Shopify Payments. Card and transaction data are processed directly by Shopify or its acquirer; we do not store complete card data ourselves.

10.2 PayPal

PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose PayPal as your payment method, we transmit the data required for payment to PayPal.

10.3 Stripe

Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. If card payments are processed via Stripe, payment and transaction data are transmitted to Stripe.

10.4 Apple Pay and Google Pay

Apple Pay is provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Google Pay is provided by Google Ireland Limited, Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland. In both cases, payments are processed using a payment method stored on your device. We only receive confirmation of a successful payment, not the full card data.

10.5 Sofortüberweisung (Klarna)

Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. When selecting the "Sofortüberweisung" payment method, you will be redirected to Klarna, where you authenticate yourself to Klarna using your online banking credentials and authorize the payment. We receive confirmation of the successful payment from Klarna.

10.6 Klarna (invoice and installment purchase)

Provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.

If you choose a Klarna payment method where Klarna pays in advance (in particular invoice or installment purchase), you will be asked to provide certain personal data during the order process (including first and last name, address, date of birth, e-mail address, telephone number, and possibly data for an alternative payment method).

To safeguard our legitimate interest in determining the creditworthiness of our customers, we forward this data to Klarna in accordance with Art. 6 para. 1 lit. f GDPR. Based on this information and further data (e.g., shopping cart, invoice amount, order history, payment experience, and potentially information from credit agencies such as SCHUFA Holding AG) and using a scientifically recognized mathematical-statistical method (score values), Klarna checks whether the desired payment method can be offered.

You can object to this processing at any time by notifying us or Klarna. However, Klarna may still be entitled to further process your personal data to the extent required for contractual payment processing.

Further information can be found in Klarna's privacy policy: https://www.klarna.com/de/datenschutz/

11. Automated individual decision-making

As part of the Klarna credit check (Section 10.6), an automated decision on the acceptance or rejection of the selected payment method may occur within the meaning of Art. 22 GDPR. This decision is made by Klarna based on the score models stored there. You have the right to obtain human intervention on the part of Klarna, to express your point of view, and to contest the decision. Please contact Klarna directly for this purpose using the contact methods stated in the Klarna privacy policy.

Apart from this, we do not employ decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

12. Newsletter and direct marketing

12.1 E-mail newsletter

We use the following service providers to send our e-mail newsletters and promotional e-mails:

  • Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA
  • Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, Ireland

You can subscribe to the newsletter on our website using your e-mail address. The only mandatory field is the e-mail address; additional information is voluntary and serves to provide a personal greeting. We use the double opt-in procedure: after subscribing, you will receive a confirmation e-mail with a verification link; only after clicking the link will we add you to our distribution list.

The legal basis for sending the newsletter is your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 7 para. 2 no. 2 of the German Act Against Unfair Competition (UWG). For proof purposes (Art. 7 para. 1 GDPR), we log the time of your subscription and confirmation, as well as the IP address used for this.

The providers carry out the dispatch on our behalf as processors and analyze statistical indicators of the newsletter on the basis of your consent (Art. 6 para. 1 lit. a GDPR) (open and click rates, technical device information such as browser type and time). This analysis serves to optimize future mailings.

You can unsubscribe from the newsletter at any time via the unsubscribe link in each message or by notifying us. A data processing agreement is in place with both providers. Klaviyo is certified under the EU-U.S. Data Privacy Framework; for transfers to Shopify Inc. (Canada/USA), the adequacy decision for Canada and the DPF for US transfers apply.

12.2 Promotional e-mails to existing customers (§ 7 para. 3 UWG)

If you have provided your email address in connection with an order, we reserve the right to send you emails with offers for similar goods or services of our own. The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG (German Act Against Unfair Competition). You are informed of this during the ordering process and may object to this use at any time – both at the time of collection and in every email – free of charge.

12.3 Shopping cart reminder

If you abandon your ordering process, you have the option within the ordering flow to sign up for a one-time reminder email. We will then remind you of your open shopping cart. The legal basis is your express consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 7(2) No. 2 UWG. You can unsubscribe from these emails at any time via the link in the email or by notifying us.

12.4 Review reminders

After receiving your order, we would like to ask you to rate the product and your shopping experience. For this purpose, we use the following providers depending on the order:

  • Judge.me Ltd., c/o Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, United Kingdom
  • Trusted Shops AG, Subbelrather Str. 15c, 50823 Cologne, Germany
  • Trustpilot A/S, Pilestræde 58, 1112 Copenhagen, Denmark

We transmit your email address and, if applicable, your first name to the respective provider so that a review reminder can be sent. The legal basis is your express consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 7(2) No. 2 UWG. You can revoke this at any time.

With regard to Trusted Shops, we are joint controllers with the provider for the aforementioned processing pursuant to Art. 26 GDPR. You can find the agreement on joint controllership here: https://help.etrusted.com/hc/de/articles/4402587369105

For the transmission to Judge.me in the United Kingdom, there is an adequacy decision by the EU Commission (Art. 45 GDPR). Data processing agreements are in place with Judge.me and Trustpilot.

13. Web analysis

13.1 Shopify Analytics

Within our shop, we use the analysis functions integrated into the Shopify platform to generate usage statistics (e.g., number of visits, order processes). Provider: Shopify International Ltd. (see item 6).

Insofar as cookies or comparable technologies are used for this analysis, this occurs exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, which you can grant or refuse in the cookie banner. You can revoke your consent at any time via the cookie settings.

13.2 Google Analytics 4

Provider: Google Ireland Limited, Gordon House, 4 Barrow St., Dublin, D04 E5W5, Ireland.

When you visit our pages, cookies are stored in your browser—provided you have given your consent—which enable an analysis of your usage behavior (e.g., pages visited, duration of stay, conversions). For visits from the EU, Switzerland and the United Kingdom, Google uses IP addresses to derive approximate location information and then discards them before logging the data. Individual IP addresses are not logged or stored. Transfers to Google may also involve servers in the USA.

Processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can declare your revocation at any time via the cookie settings. Storage period of analysis data: 14 months.

A data processing agreement exists with Google; Google is certified under the EU-U.S. Data Privacy Framework. Further information: https://policies.google.com/privacy

13.3 Microsoft Clarity

Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA.

Microsoft Clarity creates pseudonymized session recordings and heatmaps (mouse movements, clicks, scrolling behavior) to identify usability issues. In particular, device information, IP address (in truncated form), and interaction data are processed.

Processing takes place exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You can declare your revocation at any time via the cookie settings.

A data processing agreement exists with Microsoft. Microsoft is certified under the EU-U.S. Data Privacy Framework.

14. Transmission to third countries (Overview)

Insofar as we transmit personal data to countries outside the European Economic Area (EEA), this is done on one of the following bases pursuant to Chapter V GDPR:

  • Adequacy decision by the EU Commission pursuant to Art. 45 GDPR – particularly for transmissions to the United Kingdom, to Canada, and to the USA to recipients certified under the EU-U.S. Data Privacy Framework (Decision of July 10, 2023). You can view the current certification status at https://www.dataprivacyframework.gov.
  • EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR, provided no adequacy decision applies.

We point out that even with certified US recipients, residual risks (especially access by US security authorities) cannot be completely excluded.

15. Storage duration

The storage duration depends on the purpose of the processing and any legal retention requirements:

  • Contract data (orders, invoices): up to 10 years pursuant to Section 257 HGB, Section 147 AO
  • Data based on consent: until revocation
  • Data based on legitimate interests: until a justified objection or until the purpose no longer applies
  • Log files: 7 days (longer in case of security incidents)
  • Newsletter data: until unsubscribed

As soon as the data is no longer required for the respective purpose and no retention obligation exists, it will be deleted.

16. Currency and amendments

This declaration is currently valid in the version specified below. Due to the further development of our website, changes in legal status, or official requirements, adjustments may become necessary. You can access the currently valid version on the website at any time.

As of: 21.10.2026

Declare withdrawal

Please fill out the following form to declare your withdrawal from the contract.