1. Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
Family & Service GmbH
Auf dem Kamp 1, 27721 Ritterhude, Germany
Email: service@graceroutine.com
WhatsApp: +49 160 3208448
2. General Information on Data Processing
We process personal data of our users only to the extent necessary to provide a functional website and our content and services.
Personal data is generally only processed after the user's consent. An exception applies in cases where prior consent is not possible for factual reasons and the processing of data is permitted by law.
3. Hosting and Server Log Files
Our website is hosted by an external service provider. Each time our website is accessed, the hosting provider automatically collects information in so-called server log files, including: browser type and version, operating system used, referrer URL, hostname of the accessing computer, date and time of the server request, IP address (anonymised).
This data is not merged with other data sources. The legal basis for data processing is Art. 6(1)(f) GDPR (legitimate interest in the secure and efficient provision of our website). Server log files are automatically deleted after 14 days.
4. Contact
When you contact us by email or via our contact form, the data you provide (name, email address, subject, message) will be processed for the purpose of handling your enquiry.
The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding to your enquiry). Your data will be deleted after the enquiry has been fully processed, unless statutory retention obligations apply.
5. Orders and Contract Processing
To process and fulfil your order, we process the following personal data: name, address, email address, phone number (if provided), payment information, order history.
Processing is based on Art. 6(1)(b) GDPR (contract performance). Data is only passed on to third parties to the extent necessary for contract fulfilment: payment service providers, shipping service providers, merchandise management system. Order data is stored in accordance with commercial and tax retention periods (generally 6 or 10 years) and then deleted.
6. Customer Account
If you create a customer account, we process the data you provide (name, email address, encrypted password, addresses if applicable) to manage your account and simplify future orders.
The legal basis is Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (contract performance). You can request deletion of your customer account at any time.
7. Newsletter
If you subscribe to our newsletter, we process your email address for the purpose of regularly sending information about products, news and offers from the Maison.
The legal basis is Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time with future effect by using the unsubscribe link in any email or by contacting us directly. Your email address will be removed from the mailing list immediately upon withdrawal of consent.
8. Cookies and Consent Management
Our website uses cookies — small text files stored on your device. Technically necessary cookies are set on the basis of Art. 6(1)(f) GDPR. All other cookies (statistics, marketing) are only set after your explicit consent pursuant to Art. 6(1)(a) GDPR.
You can adjust or withdraw your cookie settings at any time via the cookie banner at the bottom of the screen. Further information can be found in our Cookie Policy.
9. Payment Service Providers
We offer various payment methods processed via external payment service providers. The data required for payment processing is transmitted to the respective provider. The legal basis is Art. 6(1)(b) GDPR (contract performance). The privacy notices of the respective provider apply additionally.
Services and Third-Party Providers
Below we list all technically deployed services that may process personal data, including provider, purpose, legal basis, and any third-country transfers.
Shopify (Shop System, Checkout, Customer Accounts)
Provider: Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Our online shop, checkout, payment processing and customer accounts are fully provided by Shopify. Data processed includes order data, address data, payment information, communication data and technical data for fraud prevention. Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in secure shop operation). Transfer to the USA may occur; Shopify is certified under the EU-US Data Privacy Framework.
Klaviyo (Newsletter, Email Marketing, Behavioural Analytics)
Provider: Klaviyo Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA. We use Klaviyo for sending our newsletter and for server-side marketing tracking (e.g. "Viewed Product", "Added to Cart", "Started Checkout"). Data processed includes email address, first/last name (if provided), anonymous or identified profile ID, device and behavioural data, and consent status. Transmission is exclusively server-side via our backend functions. Legal basis: Art. 6(1)(a) GDPR (consent). Tracking events are only transmitted upon marketing consent. Third-country transfer to the USA on the basis of EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
Google Tag Manager, Google Analytics 4 & Google Consent Mode v2
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA. We use Google Tag Manager and Google Analytics 4 (Measurement ID G-N83LX8G6L6) for statistical analysis of website usage. IP addresses are anonymised (anonymize_ip); we additionally activate ads_data_redaction and url_passthrough. All storage categories (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to "denied" by default in Google Consent Mode v2 and are only activated after your consent in the cookie banner. Legal basis: Art. 6(1)(a) GDPR (consent). Third-country transfer to the USA on the basis of the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Meta Pixel (optional, only when actively configured)
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. Where activated, we use the Meta Pixel to measure the success of our advertisements on Facebook and Instagram. The pixel is only loaded after marketing consent has been granted. Legal basis: Art. 6(1)(a) GDPR (consent). Third-country transfer to the USA on the basis of the EU-US Data Privacy Framework.
Backend Infrastructure (Newsletter, Concierge, Returns)
We use an EU-hosted backend platform to provide server-side functions for newsletter sign-up, concierge chat, returns management and lead capture. Data processed depending on function: email address, name, order references, form inputs. Legal basis: Art. 6(1)(b) GDPR (contract performance) or Art. 6(1)(a) GDPR (consent, e.g. newsletter). Hosting within the EU (Frankfurt region).
Cloudflare (CDN, Security, Performance)
Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare is used as a content delivery network and to protect against attacks (DDoS, bot traffic). The visitor's IP address may be processed to secure the connection. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and performant provision). Third-country transfer to the USA on the basis of EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
ipapi.co (Geolocation, only after consent)
Provider: Kloudend, Inc. (ipapi), Wilmington, Delaware, USA. To display appropriate shipping information and region recommendations, we determine the country of origin based on the IP address. This request is only made after you have consented to the "Statistics" or "Marketing" category in the cookie banner. Without consent, no request is sent to ipapi.co. Legal basis: Art. 6(1)(a) GDPR (consent).
Fonts (Self-hosted)
All fonts used (Cormorant Garamond, Josefin Sans, Inter, Italiana, JetBrains Mono) are served locally from our own server. No requests are made to Google Fonts or other third-party CDNs; your IP address is not transmitted to third parties.
WhatsApp Business (Concierge Communication)
Provider: WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; parent company: Meta Platforms, Inc., USA. Our website contains links and buttons allowing you to contact our concierge via WhatsApp (phone number: +49 160 3208448). These are click-to-chat links (wa.me) only. No data is transmitted to WhatsApp merely by visiting our website. Data transmission to WhatsApp only occurs when you actively click the WhatsApp link and send a message yourself. In this case, WhatsApp processes your phone number, profile name, profile picture, timestamps and message content. We do not store WhatsApp conversations outside the WhatsApp Business application and use WhatsApp exclusively for individual responses to your enquiries. Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual communication) and Art. 6(1)(f) GDPR (legitimate interest in efficient customer service). Use of WhatsApp is voluntary; alternatively, you may contact us at service@graceroutine.com. Transfer to the USA may occur; Meta/WhatsApp is certified under the EU-US Data Privacy Framework, supplemented by EU Standard Contractual Clauses. WhatsApp's privacy policy applies additionally: https://www.whatsapp.com/legal/privacy-policy-eea.
10. Your Rights
You have the following rights with regard to your personal data: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR), right to object to processing (Art. 21 GDPR), right to withdraw consent (Art. 7(3) GDPR).
11. Right to Lodge a Complaint with a Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the GDPR. The supervisory authority competent for us is:
Die Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5, 30159 Hannover
https://www.lfd.niedersachsen.de
12. Electronic Withdrawal Function
You may also declare your withdrawal electronically via our withdrawal function at: https://graceroutine.com/widerruf.
13. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy to keep it in line with current legal requirements or to reflect changes to our services. The current version shall apply at all times.