Privacy Policy

Last updated: June 24, 2026

We appreciate your interest in our online shop. Protecting your personal data is important to us. Below, we inform you about which personal data we process when you use our online shop, the purposes for which this is done, the legal basis for such processing, and the rights you are entitled to.

1. Data Controller

The entity responsible for data processing on this website is:

Koi-Area eGbR
Tomphecke 25
41169 Mönchengladbach
Germany

Email: info@koi-area.de
Phone: +49 152 27783926

Authorized representatives:
Tobias von Komorowski and Andreas von Komorowski

Further information about our company can be found in our Legal Notice (Impressum).

2. General Information on Data Processing

Personal data is any information that relates to an identified or identifiable natural person. This includes, for example, your name, address, email address, telephone number, IP address, order and payment data, as well as usage data.

We only process personal data if it is necessary for providing our online shop, processing inquiries, fulfilling orders, complying with legal obligations, analyzing and improving our services, or based on your consent.

Processing is carried out in particular based on the following legal foundations:

• Art. 6 (1) (a) GDPR, if you have given us your consent,
• Art. 6 (1) (b) GDPR, if the processing is necessary for the performance of a contract or for the implementation of pre-contractual measures,
• Art. 6 (1) (c) GDPR, if we are legally obligated to process the data,
• Art. 6 (1) (f) GDPR, if we have a legitimate interest in the processing.

3. Server Log Files and Technical Provision

When you visit our website, your browser automatically transmits information to our server or our hosting and IT service providers. In this process, the following data may be processed:

• page accessed,
• date and time of access,
• IP address,
• browser type and version,
• operating system used,
• referrer URL,
• volume of data transferred,
• requesting provider.

Processing is carried out to ensure the technical provision, security, and stability of our website. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure, stable, and fault-free operation of our online shop.

4. Shopify as Shop Platform

Our online shop is operated via Shopify. The provider is Shopify International Limited or Shopify Inc. Shopify provides us with the e-commerce platform, the technical infrastructure, and various shop functions.

As part of the operation of our online shop, Shopify may process the following data in particular:

• contact information,
• order data,
• payment and transaction data,
• device information,
• usage data,
• technical log data.

Processing is carried out for the provision and operation of our online shop and for processing orders. The legal basis is Art. 6 (1) (b) GDPR, insofar as the processing is necessary for the performance of a contract, as well as Art. 6 (1) (f) GDPR for the secure and functional operation of our online shop.

Shopify may also process data in Canada, the USA, or other countries. Insofar as personal data is processed outside the European Union or the European Economic Area, this is done in accordance with applicable data protection requirements, in particular on the basis of an adequacy decision or appropriate safeguards such as standard contractual clauses.

5. Hosting, Security, and Technical Service Providers

For the technical provision, security, and optimization of our online shop, we may use hosting, security, and infrastructure service providers. These may include, in particular, Shopify, IONOS, Cloudflare, jsDelivr, or comparable technical providers.

These services may process IP addresses, technical usage data, device information, and log data. Processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure, fast, and stable provision of our online shop.

6. Contacting Us

If you contact us via email, telephone, contact form, or by other means, we process the data you provide. This may include your name, email address, telephone number, and the message text.

The processing serves the purpose of handling your inquiry. If your inquiry is directed at concluding a contract or concerns an existing contract, processing is based on Art. 6 (1) (b) GDPR. In all other cases, processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in processing and answering your inquiry.

Your data will be deleted as soon as your inquiry has been definitively resolved, provided there are no legal storage obligations to the contrary.

7. Customer Account

If you create a customer account, we process the necessary personal data. This may include your name, address, email address, telephone number, login data, order history, and other details.

The processing serves to provide you with a customer account, to process orders more easily, and to allow you an overview of your orders. The legal basis is Art. 6 (1) (b) GDPR, insofar as the customer account is used for contract fulfillment. Insofar as the customer account is created voluntarily, the processing may additionally be based on your consent pursuant to Art. 6 (1) (a) GDPR.

You can have your customer account deleted at any time, provided no legal storage obligations stand in the way.

8. Orders and Contract Fulfillment

When you order in our online shop, we process the data necessary to fulfill your order. This includes in particular:

• name,
• billing and delivery address,
• email address,
• telephone number, if provided,
• order contents,
• payment data,
• shipping data,
• communication regarding the order.

The processing is necessary to accept your order, execute the sales contract, deliver the goods, process payments, create invoices, and handle customer inquiries. The legal basis is Art. 6 (1) (b) GDPR.

Your data will only be passed on to third parties if necessary for contract fulfillment. Recipients may include shipping service providers, payment service providers, inventory and accounting service providers, IT service providers, and shop system providers.

9. Shipping and Delivery

To deliver your order, we pass on the necessary data to shipping service providers. This includes your name, delivery address, email address, and if applicable, your telephone number, insofar as required for delivery or shipping notifications.

Processing is carried out for contract fulfillment based on Art. 6 (1) (b) GDPR.

10. Payment Service Providers

We use external payment service providers for payment processing. Depending on the chosen payment method, personal data may be transmitted to the respective payment provider. This may include your name, address, email address, order data, invoice amount, payment information, and transaction data.

We may use the following payment services in particular:

• Shopify Payments,
• Shop Pay,
• PayPal,
• Klarna,
• Apple Pay,
• Google Pay,
• Visa,
• Mastercard,
• Maestro,
• American Express,
• Stripe, or technical payment providers in connection with Shopify Payments.

Processing is carried out for payment execution and contract fulfillment based on Art. 6 (1) (b) GDPR. Depending on the payment provider, separate data processing may be carried out by that provider. The respective payment service provider is independently responsible for this processing.

11. Inventory Management, Accounting, and Internal Administration

To process orders, inventory management, accounting, invoicing, and commercial processes, we may use external systems and service providers. This may include an inventory management or accounting system.

Insofar as we use Haufe-Lexware or comparable systems, the personal data required for the order is processed for contract fulfillment and commercial administration. The legal basis is Art. 6 (1) (b) GDPR for contract fulfillment and Art. 6 (1) (c) GDPR for legal storage and documentation obligations.

12. Newsletter and Direct Marketing

12.1 Newsletter

If you sign up for our newsletter, we will use your email address to send you regular information about our products, offers, and news. Processing is based on your consent pursuant to Art. 6 (1) (a) GDPR.

You can revoke your consent at any time with future effect, for example via the unsubscribe link in the newsletter or by sending us a message.

12.2 Direct Marketing to Existing Customers

If we have received your email address in connection with the sale of a product or service, we may use it for direct marketing of our own similar products or services, unless you have objected to this.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in marketing to existing customers. You can object to this use at any time. There are no costs other than the transmission costs at the basic rates.

13. Reviews and Customer Feedback

We may use services to collect and display customer reviews, for example, Judge.me or comparable providers. If you provide a review or are invited to provide one, your name, email address, order data, review content, and technical usage data may be processed.

Processing serves the purpose of displaying customer reviews, improving our offerings, and building trust with other customers. Depending on the specific process, the legal basis is Art. 6 (1) (a) GDPR, if you have consented, Art. 6 (1) (b) GDPR, if the review is in connection with an order, or Art. 6 (1) (f) GDPR, if we have a legitimate interest in displaying authentic customer reviews.

14. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device. Similar technologies can include pixels, tags, local storage technologies, or other tracking mechanisms.

We distinguish in particular between technically necessary cookies and non-essential cookies.

14.1 Technically Necessary Cookies

Technically necessary cookies are required for our online shop to function. These include, for example, shopping cart functions, login functions, security features, language settings, or the storage of your cookie settings.

The use of technically necessary cookies is based on Section 25 (2) TDDDG (Telecommunications Digital Services Data Protection Act) as well as Art. 6 (1) (f) GDPR. Our legitimate interest lies in the functional and secure provision of our online shop.

14.2 Non-essential Cookies and Tracking Technologies

We only use non-essential cookies and similar technologies, particularly for statistics, marketing, remarketing, or personalized advertising, if you have given your consent via our cookie banner. The legal basis is Section 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR.

You can change or revoke your consent at any time via the cookie settings on our website.

15. Consent Management with Complianz

We use the consent management tool Complianz to obtain, manage, and document consent for cookies and similar technologies.

Complianz allows visitors to grant or refuse consent for certain categories such as necessary services, statistics, marketing, or external media. In this process, the following data may be processed:

• consent status,
• date and time of consent,
• technical information about the browser and device,
• IP address in abbreviated or pseudonymized form,
• page accessed,
• cookie or consent ID.

Processing is carried out to fulfill legal obligations based on Art. 6 (1) (c) GDPR as well as Art. 6 (1) (f) GDPR. Our legitimate interest lies in the legally compliant management and documentation of consent.

16. Google Consent Mode v2

We use Google Consent Mode v2. This enables the technical transmission of your consent decision made in the cookie banner to Google services.

In this process, the following consent signals may be processed:

• analytics_storage,
• ad_storage,
• ad_user_data,
• ad_personalization.

These signals indicate to Google whether you have consented to the use of analytics cookies, advertising cookies, user data for advertising purposes, or personalized advertising.

If you do not provide consent, Google services may function only to a limited extent or without cookies, depending on the settings. Aggregated or modeled measurements may occur to the extent permitted by the selected settings and legal requirements.

Processing is based on your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG, unless only technically necessary processes are involved.

17. Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics 4 helps us understand how visitors use our online shop. The following data may be processed in particular:

• page views,
• clicks,
• scrolling and usage behavior,
• device information,
• browser information,
• approximate location data,
• referrer URL,
• session data,
• e-commerce events such as product views, shopping cart, checkout, and purchases,
• purchase value and product information.

According to Google, Google Analytics 4 only uses IP addresses on a short-term basis to derive technical and geographical information. According to Google, the IP address is not stored permanently.

Processing is carried out only on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG, insofar as cookies or similar technologies are used.

We use Google Analytics 4 to analyze the use of our online shop, to improve our services, to evaluate e-commerce processes, and to optimize our marketing measures.

18. Google Ads, Conversion Tracking, Enhanced Conversions, and Remarketing

We use Google Ads and related functions such as conversion tracking, enhanced conversions, and remarketing. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use Google Ads to measure the success of our advertisements and to display our ads more specifically. In this process, the following data in particular may be processed:

• Ad clicks,
• Page views,
• Conversion events,
• Purchases and purchase values,
• Shopping cart and checkout events,
• Technical device and browser data,
• Cookie and tag information,
• Hashed contact details, if applicable, when enhanced conversions are used.

Remarketing makes it possible to address visitors to our online shop again with advertising at a later time, provided they have given their consent accordingly.

Enhanced conversions can be used to better attribute purchases to an advertisement. Certain customer data, such as email addresses, may be hashed before being transmitted to Google.

The use of Google Ads, conversion tracking, remarketing, and enhanced conversions occurs only on the basis of your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, insofar as cookies, tags, or comparable technologies are used.

You can change or withdraw your consent at any time via our cookie settings.

19. Google Signals and personalized advertising

Provided you have consented accordingly, we may use Google Signals and functions for personalized advertising. This allows data from Google Analytics and Google Ads to be used more effectively for cross-device analysis, audience building, conversion measurement, and remarketing.

Processing takes place only on the basis of your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

20. Meta Pixel and Meta Events Manager

We may use services from Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, on our website, in particular Meta Pixel, Meta Events Manager, or comparable Meta services.

These services can be used to analyze the use of our website, measure the success of advertising campaigns on Facebook and Instagram, and re-address visitors with interest-based advertising.

In this process, the following data in particular may be processed:

• Page views,
• Clicks,
• Purchase and conversion events,
• Device information,
• Browser information,
• IP address,
• Cookie and pixel information.

Processing takes place only on the basis of your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, insofar as Meta services are actively used and cookies or comparable technologies are employed.

Insofar as Meta services are used, Meta and we may be jointly responsible for certain processing operations. Further information can be found in Meta's data privacy information.

21. Microsoft Ads / Microsoft UET

We may use Microsoft Advertising and Universal Event Tracking, or UET for short. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Microsoft UET can be used to measure the success of advertisements, record conversions, and enable remarketing functions.

Processing takes place only on the basis of your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, insofar as Microsoft Ads or UET is actively used.

22. Amazon Services and marketplace connections

We may use Amazon services, Amazon Seller Central, Amazon Ads, Amazon Marketplace Connect, or comparable marketplace and advertising services, insofar as this is necessary for the sale, advertising, or evaluation of products via Amazon.

Depending on the service used, order, product, revenue, advertising, or usage data may be processed.

Insofar as Amazon services use tracking technologies directly on our website, this only occurs on the basis of your consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

23. External content and integrations

Our website may integrate content from external providers, for example, reviews, videos, maps, product feeds, payment widgets, or other external functions. When accessing such content, personal data may be transmitted to the respective provider, in particular IP address, browser information, device information, and usage data.

Insofar as external content is not technically necessary, it will only be loaded after you have provided your consent. The legal basis is Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

24. Social media links

Our website may contain links to our profiles on social networks such as Facebook, Instagram, or TikTok. If you click on these links, you leave our website and are redirected to the respective provider.

The respective provider is generally responsible for data processing on the pages of the social networks. Further information can be found in the privacy notices of the respective platform.

25. Data transfer to third countries

Some of the service providers we use may process personal data outside the European Union or the European Economic Area, in particular in Canada, the USA, or other countries.

Insofar as an adequacy decision of the European Commission exists for a country, the transfer takes place on the basis of this adequacy decision. Insofar as there is no adequacy decision, the transfer takes place on the basis of appropriate safeguards, in particular standard contractual clauses, additional protective measures, or your explicit consent, as far as necessary.

26. Storage duration

We only store personal data for as long as is necessary for the respective purpose.

We store data in connection with orders and invoices in accordance with statutory commercial and tax law retention periods. We store communication data for as long as necessary to process the request and provided there are no statutory retention obligations to the contrary. We store consent data as long as necessary to prove consent. Tracking and analysis data are stored according to the settings of the respective services and subsequently deleted or anonymized.

27. Obligation to provide data

The provision of certain personal data is necessary for the conclusion and performance of a contract. Without this data, we cannot process an order or provide certain services.

The provision of data for analysis, marketing, remarketing, or personalized advertising is voluntary. You can withdraw your consent at any time.

28. Your rights

In accordance with statutory provisions, you have the following rights:

• Right of access to the personal data we store,
• Right to rectification of incorrect data,
• Right to erasure of your data,
• Right to restriction of processing,
• Right to data portability,
• Right to object to certain processing operations,
• Right to withdraw given consent with effect for the future,
• Right to lodge a complaint with a data protection supervisory authority.

If the processing is based on your consent, you can withdraw this consent at any time with effect for the future. The lawfulness of processing before the withdrawal remains unaffected.

29. Right to object

Insofar as we process personal data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation.

If we process personal data for the purpose of direct marketing, you may object to this processing at any time. After your objection, we will no longer use your personal data for direct marketing.

30. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data is not lawful.

For North Rhine-Westphalia, the following supervisory authority is responsible:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestr. 2–4
40213 Düsseldorf
Phone: 0211 / 38424-0
Email: poststelle@ldi.nrw.de

31. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy if legal requirements, technical functions, or services used change. The current version published on our website applies.

32. Information on the cookie policy

Further information on the specific cookies, trackers, and services used can be found in our cookie policy or in the cookie settings of our cookie banner. There, you can view, change, or withdraw your consent at any time.