Privacy Policy
1. Controller
The controller responsible for the processing of personal data in connection with the APAERZ.de online shop is:
Penmacol GmbH
Sachsstr. 30
50259 Pulheim
Germany
Phone: 02234 9335 766
Email: info@apaerz.de
Managing Director: Ruijie Peng
Local Court of Cologne, HRB 65160
VAT ID No.: DE 263 860 312
2. General Information on Data Processing
The protection of personal data and transparent information about its processing are an essential part of operating APAERZ.de.
Personal data is processed only to the extent necessary to provide the online shop, process and fulfil orders, communicate with customers, comply with legal obligations, or on the basis of consent that has been given.
Processing is carried out in particular on the basis of the General Data Protection Regulation (GDPR), the German Telecommunications Digital Services Data Protection Act (TDDDG), and other applicable data protection regulations.
3. Hosting and Technical Provision by Shopify
The online shop is operated using Shopify. The provider is:
Shopify International Limited
2nd Floor, 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Shopify provides the technical infrastructure for the online shop and processes personal data generated when the shop is used. This may include, in particular, IP addresses, device and browser information, usage data, order and contact data, as well as information about interactions with the shop.
Processing is carried out for the technical provision, security and improvement of the online shop, as well as for processing orders and providing other shop functions.
Shopify processes personal data partly as a processor and, depending on the respective function, also as an independent controller.
Further information about the processing of personal data by Shopify can be found in the Shopify Consumer Privacy Policy.
4. Shopify Network Intelligence and Enhanced Services
Shopify Network Intelligence is enabled in the Shopify admin.
Shopify Network Intelligence enables the use of so-called Enhanced Services. In this context, Shopify may process customer data from the shop together with data from other Shopify merchants and data collected by Shopify in order to provide functions for improving, personalising, analysing, securing and further developing Shopify and merchant services.
This may include information from interactions with the online shop, orders, usage behaviour and other customer interactions.
Shopify states that personal data related to Enhanced Services may also be transferred to Shopify and to other service providers or third parties in other countries and processed there.
For customers in the European Economic Area, the United Kingdom and Switzerland, additional requirements apply to certain Enhanced Services, particularly with regard to consent and the possibility of withdrawing consent.
Where consent is required, the processing of non-essential data is carried out on the basis of the consent given.
Consent that has been given may be changed or withdrawn at any time with effect for the future via the cookie banner settings or the privacy options available there.
Further information about the Enhanced Services used by Shopify and the applicable data protection rights is available in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.
5. Visiting the Website and Server Log Data
When APAERZ.de is accessed, technically necessary data is processed in order to provide the website securely and reliably.
This may include, in particular:
• IP address
• date and time of access
• pages and content accessed
• browser and operating system used
• device type
• referrer URL
• technical connection information
Processing is carried out for the technical provision of the website, to ensure security and stability, and to detect and prevent misuse and attacks.
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and reliable provision of the online shop.
Where statutory retention obligations apply, the relevant data is stored for the legally required period.
6. Cookies and Similar Technologies
APAERZ.de uses cookies and similar technologies.
Technically necessary cookies are required in order to provide basic functions of the online shop, in particular the shopping cart, checkout, security and session management.
Non-essential cookies and similar technologies used for analytics, marketing or personalisation are used only where the necessary consent has been given.
When the online shop is visited for the first time, a cookie banner is displayed. In particular, the following options are available there:
• Accept all
• Reject all
• Save my selection / Manage settings
Cookie settings can be changed at any time via the available privacy or cookie settings.
Where consent is required for storing information on a user’s device or accessing information already stored there, this is carried out on the basis of Section 25(1) TDDDG. Subsequent processing of personal data is carried out, where required, on the basis of Art. 6(1)(a) GDPR.
Technically necessary storage is carried out on the basis of the statutory exception for technologies that are technically required.
7. Orders and Contract Fulfilment
When an order is placed, the data required for the performance and fulfilment of the contract is processed.
This includes, in particular:
• first and last name
• billing and delivery address
• email address
• telephone number, where provided
• order information
• payment and transaction information
• information relating to delivery and returns
Processing is carried out in order to process the order, deliver the goods, process payments, communicate with the customer, and handle returns, withdrawals and warranty claims.
The legal basis is Art. 6(1)(b) GDPR.
Where processing is necessary in order to comply with legal obligations, it is additionally carried out on the basis of Art. 6(1)(c) GDPR.
8. Payment Processing
For payment processing, the data required for this purpose is transmitted to the payment service provider selected by the customer.
Depending on the selected payment method, this may include, in particular, name, billing address, payment information, email address, order amount, order number and transaction data.
Processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR and, where required by law, for compliance with legal obligations pursuant to Art. 6(1)(c) GDPR.
The respective payment service provider’s own privacy policy also applies to processing carried out by that provider.
9. Shipping and Delivery
For the processing and fulfilment of shipments, the data required for delivery is transmitted to the respective shipping and logistics service providers.
This may include, in particular, name, delivery address, email address, telephone number and order or shipping information.
Processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.
10. Customer Communication and Contact
When you contact us by email, telephone or contact form, the data you provide is processed for the purpose of handling your enquiry.
Depending on the content of the enquiry, this may include, in particular, name, email address, telephone number, order number and other information voluntarily provided.
The legal basis is Art. 6(1)(b) GDPR where the enquiry is related to the performance of a contract or pre-contractual measures. In all other cases, processing is carried out on the basis of Art. 6(1)(f) GDPR or, where required, Art. 6(1)(a) GDPR.
11. Google Analytics 4
APAERZ.de uses Google Analytics 4, a web analytics service provided by Google Ireland Limited.
Google Analytics enables analysis of the use of the online shop and interactions with the content provided. In particular, information about page views, usage processes, devices, browsers, approximate location information and interactions with the online shop may be processed.
Google Analytics is integrated via the technical integrations used on the website.
Google Analytics is used only where the required consent has been given.
The legal basis is Art. 6(1)(a) GDPR. Where cookies or similar technologies are used on the user’s device, their use is based on Section 25(1) TDDDG.
Google Signals
Google Signals is enabled in Google Analytics.
Google Signals enables additional analytics and measurement functions where the relevant requirements are met. Information about the use of websites and devices may be linked with information from the Google accounts of signed-in Google users where those users have made the corresponding settings and provided the relevant consent to Google.
This may enable, among other things, cross-device analyses and audience functions.
Processing is carried out only within the scope of the required consents and settings.
Retention Period
The retention period currently configured in the Google Analytics account is:
• Event data: 2 months
• User data: 14 months
These settings may be changed in the future. Once the respective configured retention period has expired, the corresponding personal data is automatically deleted or anonymised unless another legal basis requires further storage.
Further information can be found in Google’s Privacy Policy.
12. Google Ads and Conversion Tracking
APAERZ.de uses Google Ads provided by Google Ireland Limited to advertise the online shop and measure the effectiveness of advertisements.
A Google tag is installed on APAERZ.de for this purpose.
As part of conversion tracking, the following website actions in particular are transmitted to Google Ads as conversion actions:
• purchase
• add to cart
• begin checkout
• add payment information
• page view
• product view
• search activity
Processing makes it possible to measure whether users perform certain actions on APAERZ.de after interacting with a Google advertisement.
The service is used only where the necessary consent has been given.
The legal basis is Art. 6(1)(a) GDPR. Where cookies or similar technologies are used on the user’s device, their use is based on Section 25(1) TDDDG.
Linking Google Analytics and Google Ads
Google Analytics 4 is linked to APAERZ’s Google Ads account.
The function for importing audiences from Google Analytics into Google Ads is enabled. App and web metrics are also enabled.
As a result, audiences or measurement data derived from the use of the online shop may be used for Google Ads functions.
Processing may be used, in particular, to analyse advertising performance, create audiences and optimise advertising campaigns.
For users in the European Economic Area, Google requires suitable consent signals to be transmitted for the relevant measurement, remarketing and personalisation functions.
No Enhanced Conversions
No Enhanced Conversions are currently configured for Google Ads.
Accordingly, the Google Ads Enhanced Conversions function is currently not used on the basis of additional customer data provided by users and transmitted to Google.
Further information about data processing by Google is available in Google’s Privacy Policy.
13. Newsletter and Email Marketing via Shopify
Shopify’s email marketing function is used to send newsletters and marketing emails.
When users subscribe to the newsletter, the data required for sending it, in particular the email address, is processed.
Processing is carried out for the purpose of sending information, offers and other promotional communications relating to APAERZ.
Where required, such communications are sent on the basis of consent pursuant to Art. 6(1)(a) GDPR.
Consent that has been given may be withdrawn at any time with effect for the future. In particular, the unsubscribe option included in every marketing email may be used for this purpose.
After unsubscribing, the email address is generally removed from the active newsletter distribution list. Further storage may take place where this is necessary to document consent that was given or withdrawn or in order to comply with legal obligations.
14. Product Reviews with Judge.me
Judge.me is used for product reviews and the display of customer reviews.
The provider is:
Judge.me Ltd.
London, United Kingdom
In connection with the submission, management and display of reviews, the following data in particular may be processed: name or display name, email address, order or product information, and the content of the submitted review.
Judge.me processes personal data of purchasers or reviewers within the scope of the review functions as a service provider for the merchant. Judge.me describes its role with regard to personal data transmitted by merchants as that of a processor.
Processing is carried out in order to provide and manage the review function and display product reviews in the online shop.
The legal basis is Art. 6(1)(f) GDPR where processing for the provision and management of the review function is based on legitimate interests, in particular to provide information about products and improve the transparency and quality of the offering.
Where consent is required for individual functions, processing is carried out on the basis of Art. 6(1)(a) GDPR.
Further information can be found in Judge.me’s Privacy Policy.
15. Billbee
Billbee is used for processing and managing order, shipping and fulfilment data.
In connection with its use, order information, customer and address data, shipping information and other data required for order fulfilment may be processed.
Processing serves, in particular, the central management and handling of orders, shipping fulfilment and the associated business processes.
Processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR and, where required by law, for compliance with legal obligations pursuant to Art. 6(1)(c) GDPR.
Where Billbee processes personal data on our behalf, such processing is carried out on the basis of an appropriate data processing agreement.
Billbee’s own privacy policy also applies to processing carried out by the provider.
16. Retention and Deletion of Personal Data
Personal data is stored only for as long as necessary for the respective purpose.
In addition, data may be stored where statutory retention obligations apply or where the data is required for the establishment, exercise or defence of legal claims.
Documents relevant under commercial and tax law are stored in accordance with statutory retention periods.
Once the respective purpose no longer applies or the statutory retention period has expired, the data is deleted unless another legal basis permits or requires further storage.
17. Recipients of Personal Data
Where necessary for the respective purposes, personal data may be transmitted to or processed by the following categories of recipients:
• Shopify as the provider of the shop infrastructure
• technical service providers and hosting providers
• payment service providers
• shipping and logistics service providers
• Billbee for order and shipping management
• Judge.me for providing the review function
• Google for analytics, measurement and advertising functions
• other service providers used for the technical or organisational operation of the online shop
Data is transmitted only where an appropriate legal basis exists.
18. Transfers of Data to Third Countries
When certain services are used, personal data may be processed outside the European Economic Area.
This applies, in particular, to services provided by internationally operating providers such as Shopify, Google and Judge.me where their respective infrastructure or subcontractors process data in third countries.
Where data is transferred to a third country, the applicable requirements of the GDPR are taken into account. These may include, in particular, adequacy decisions by the European Commission or appropriate safeguards such as Standard Contractual Clauses.
In connection with Enhanced Services, Shopify may also transfer personal data to Shopify and other service providers in other countries.
19. Rights of Data Subjects
Subject to the applicable legal requirements, data subjects have, in particular, the following rights:
Right of Access
You have the right to obtain information about the processing of your personal data and to receive a copy of the data being processed (Art. 15 GDPR).
Right to Rectification
You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data (Art. 16 GDPR).
Right to Erasure
Subject to the legal requirements, you may request the deletion of personal data (Art. 17 GDPR).
Right to Restriction of Processing
Subject to the legal requirements, you may request the restriction of processing (Art. 18 GDPR).
Right to Data Portability
Subject to the legal requirements, you have the right to receive personal data in a structured, commonly used and machine-readable format or to request that it be transmitted to another controller (Art. 20 GDPR).
Right to Object
Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object to processing at any time on grounds relating to your particular situation.
You may object at any time to the processing of personal data for direct marketing purposes.
Withdrawal of Consent
Consent that has been given may be withdrawn at any time with effect for the future. The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.
20. Exercising Data Protection Rights
To exercise your data protection rights, it is sufficient to send a message to:
Penmacol GmbH
Sachsstr. 30
50259 Pulheim
Germany
Email: info@apaerz.de
21. Right to Lodge a Complaint with a Supervisory Authority
Irrespective of any other administrative or judicial remedies, you have the right to lodge a complaint with a data protection supervisory authority.
In particular, the competent supervisory authority may be the data protection authority of the federal state in which the controller has its registered office.
For Penmacol GmbH, this is generally:
State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Further information and contact options are available on the LDI NRW website.
22. Data Security
Appropriate technical and organisational measures are used to protect personal data.
These include, in particular, measures to ensure the confidentiality, integrity and availability of personal data and to prevent unauthorised access.
The technical and organisational measures used are adapted in line with technological developments and the applicable security requirements.
23. Children’s Privacy
The online shop is not specifically directed at children.
Personal data relating to children is not knowingly collected for marketing purposes. Where legal requirements call for specific consent or authorisation, these requirements are observed.
24. Changes to This Privacy Policy
This Privacy Policy may be amended if legal requirements, technical procedures, services used or the processing of personal data change.
The version published at the time the online shop is visited shall apply.
Last updated: September 6, 2026