Privacy policy

PRIVACY POLICY

Last updated: September 11, 2026

Thank you for your interest in IDekron and our online store. Protecting your personal data is important to us.

Below we explain which personal data we process when you use our website, submit inquiries, place orders, or request custom-made products, the purposes for which we process it, and the rights you have under the General Data Protection Regulation (GDPR).

1. CONTROLLER

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Farha Naz
Trading name: IDekron
Lenzenbergstraße 79
65931 Frankfurt am Main
Germany

Email: info@idekron.de

Our online store is provided through the Shopify e-commerce platform.

Our contractual partner for the provision of the Shopify platform is generally:

Shopify International Limited
Ireland

In connection with providing the online store, Shopify processes personal data in accordance with the applicable contractual and data-protection arrangements.

2. WHAT PERSONAL DATA DO WE PROCESS?

The data we process depends on how you use our website and our services.

a) Contact and master data

This may include in particular:

first and last name
shipping address
billing address
email address
telephone number, if you voluntarily provide it to us

b) Order and contract data

When you place an order with us, we process in particular:

products ordered
order number
order date
prices and discounts
shipping and billing information
order status
shipping information
returns
withdrawals
complaints
and, where applicable, other information required to perform the contract

c) Payment data

For the purpose of processing payments, payment information is processed by the payment service providers used for the respective transaction.

We may in particular receive information about:

selected payment method
payment status
payment amount
transaction or reference numbers
time of payment

For card payments, the complete payment or card details are generally processed directly by the relevant payment service provider. As a rule, we do not receive full access to your credit or debit card number.

d) Customer account

If you use a customer account, the following data may in particular be processed:

name
email address
address
order history
and other information stored in the customer account

Authentication and login data may be processed by Shopify or by the technical systems used to provide the customer-account function.

e) Communications and contact inquiries

If you contact us by email, contact form, or another method, we process the information you provide to us.

This may include, for example:

name
email address
content of your message
information about the requested product
attachments
and other information you voluntarily provide

f) Inquiries about custom-made products and custom rugs

If you request a custom-made product, we may additionally process data required for planning, preparing a quotation, and manufacturing the product.

This may include in particular:

requested dimensions
shape
material
manufacturing method
colors
design preferences
information about the intended room or space
reference links
drawings
sketches
photos or other reference images
communications concerning designs and samples
and your approval of the final version

Please avoid including personal data of third parties in reference images or other documents unless that data is necessary for us to process your inquiry.

g) Device, log, and usage data

When you visit our website, technically necessary information may be processed.

This may include in particular:

IP address
browser type and browser version
operating system
device information
date and time of access
pages accessed
technical log data
and information about your interaction with our online store

3. PURPOSES AND LEGAL BASES OF DATA PROCESSING

We process personal data only where there is a legal basis for doing so.

a) Performance of a contract and pre-contractual measures — Article 6(1)(b) GDPR

We process personal data in particular for:

processing orders
handling inquiries made before an order
preparing individual quotations
coordinating custom-made products
processing payments
manufacturing and delivering products
customer communications relating to an order
and handling withdrawals, returns, and complaints

b) Legal obligations — Article 6(1)(c) GDPR

We process data where necessary to comply with legal obligations, in particular tax, commercial-law, or other statutory documentation and retention obligations.

c) Legitimate interests — Article 6(1)(f) GDPR

Where necessary, we process personal data on the basis of our legitimate interests.

These may include in particular:

secure and reliable provision of our website
IT and information security
prevention of fraud and misuse
error analysis
establishment, exercise, or defense of legal claims
and improvement of our internal processes

Processing on this basis takes place only where your interests or fundamental rights and freedoms do not override those interests.

d) Consent — Article 6(1)(a) GDPR

Where consent is required, we process your data only after you have given that consent.

This may concern, for example:

non-essential cookies
certain analytics or marketing technologies
or newsletters and other electronic marketing communications

You may withdraw consent at any time with effect for the future.

4. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and comparable technologies.

Technically necessary cookies and technologies are used where required for operating the online store, security, the shopping cart, checkout, or comparable essential functions.

Where cookies or similar technologies used for analytics, personalization, or marketing purposes require consent, they are generally used only after you have made the corresponding selection through our cookie or privacy settings.

You may change or withdraw consent at any time with effect for the future through the privacy settings available on our website.

5. SHOPIFY

Our online store is provided through Shopify.

For merchants in the European Economic Area, Shopify International Limited is generally the primary Shopify contracting entity.

Shopify processes personal data, among other things, to technically provide and secure our online store, process orders, and provide other Shopify features that we activate.

Where Shopify processes personal data on our behalf, this takes place on the basis of the applicable data-protection and data-processing agreements.

In certain cases, Shopify may also process personal data for its own purposes and under its own responsibility under data-protection law. Shopify's respective privacy information applies to such processing.

6. DISCLOSURE OF DATA AND RECIPIENTS

We disclose personal data only where this is necessary for the purposes described above or is otherwise permitted by law.

Recipients may include in particular:

a) Shopify

Shopify provides the technical infrastructure for our online store.

b) Payment service providers

If you select a particular payment method, the data necessary to process the payment is transmitted to the payment service provider used for that transaction.

Depending on the payment method selected, the relevant payment service provider may process personal data partly under its own responsibility under data-protection law.

The payment methods available to you are shown as part of the relevant order or payment request.

c) Shipping and logistics service providers

To carry out delivery, we transmit the data required for shipping to the shipping, transport, or logistics service providers commissioned for the relevant delivery.

This includes in particular your name and shipping address and, where applicable, other contact details required for delivery.

d) Manufacturers and production partners

Where necessary for manufacturing an individual order, product-specific information may be transmitted to manufacturers or production partners engaged by us.

We limit the disclosure of personal data to what is necessary for manufacturing or performing the contract.

e) Authorities and other recipients

Data may also be transmitted where we are legally required to do so or where disclosure is necessary for the establishment, exercise, or defense of legal claims.

7. INTERNATIONAL DATA TRANSFERS

When Shopify and other service providers are used, personal data may also be processed outside the European Economic Area.

Shopify International Limited may transfer personal data in particular within the Shopify group of companies or to subcontractors it uses.

Where personal data is transferred to countries outside the European Economic Area, the transfer takes place only in compliance with the legal requirements of the GDPR.

Depending on the recipient, the safeguards used may include in particular:

an adequacy decision of the European Commission
or appropriate safeguards within the meaning of the GDPR, in particular Standard Contractual Clauses approved by the European Commission or other applicable transfer mechanisms

For transfers from Shopify International Limited to Shopify Inc. in Canada, the applicable adequacy arrangements and contractual data-protection mechanisms may in particular be used.

8. DATA SECURITY

We take appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, and other unlawful processing.

Shopify and the service providers used by Shopify also maintain technical and organizational security measures for the systems they operate.

Please note, however, that transmission of data over the internet can never be completely protected against all risks.

9. RETENTION PERIOD

As a rule, we retain personal data only for as long as is necessary for the relevant processing purposes.

After an order has been completed, data may continue to be retained where statutory retention obligations apply or where the data is required for the establishment, exercise, or defense of legal claims.

The specific retention period depends on the type of documents concerned and the applicable statutory requirements.

Under German tax and commercial law, retention periods of six, eight, or ten years may apply in particular, depending on the type of records concerned.

Data from non-binding inquiries or inquiries concerning custom-made products that do not result in a contract is generally retained only for as long as necessary to process the inquiry and for reasonable follow-up communication, unless another legal basis justifies longer retention.

Where processing is based on your consent, we generally process the relevant data until you withdraw your consent or until the relevant purpose no longer applies, unless there is a legal basis for further retention.

10. YOUR RIGHTS

If the statutory requirements are met, you have in particular the following rights:

Right of access under Article 15 GDPR

You may request information as to whether and which personal data we process about you.

Right to rectification under Article 16 GDPR

You may request correction of inaccurate personal data or completion of incomplete personal data.

Right to erasure under Article 17 GDPR

You may request erasure of your personal data where the statutory requirements are met.

Right to restriction of processing under Article 18 GDPR

You may request that the processing of your personal data be restricted where the statutory requirements are met.

Right to data portability under Article 20 GDPR

Where the statutory requirements are met, you may receive personal data that you have provided to us in a structured, commonly used, and machine-readable format or request that it be transmitted to another controller.

Withdrawal of consent under Article 7(3) GDPR

You may withdraw consent at any time with effect for the future.

The lawfulness of processing carried out on the basis of consent before the time of withdrawal remains unaffected.

Right to object under Article 21 GDPR

Where we process your personal data on the basis of Article 6(1)(e) or (f) GDPR, you may object to the processing on grounds relating to your particular situation.

Where personal data is processed for direct-marketing purposes, you may object to processing for such advertising purposes at any time.

To exercise your rights, you can contact us at:

info@idekron.de

11. RIGHT TO LODGE A COMPLAINT

Under Article 77 GDPR, you have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes data-protection law.

You may in particular contact a supervisory authority at your habitual residence, your place of work, or the place of the alleged infringement.

The supervisory authority generally responsible for us is:

The Hessian Commissioner for Data Protection and Freedom of Information
Wiesbaden
Germany