Privacy policy
Introduction
With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as 'data') that we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in connection with the execution of our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as 'online offering').
The terms used are not gender-specific.
Last updated: May 2026
Controller
Zwillingsherz GmbH
Modering 3
22457 Hamburg
Authorised representatives: Jonas Kölln and Justus Kölln
E-mail address: info@zwillingsherz.com
Legal Notice: https://zwillingsherz.com/impressum
Overview of Processing Activities
The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.
Types of Data Processed
• Master data
• Payment data
• Contact data
• Content data
• Contract data
• Usage data
• Meta/communication data
• Applicant data
• Social media data
• Tracking and event data
Categories of Data Subjects
• Customers
• Employees
• Prospective customers
• Communication partners
• Users
• Applicants
• Giveaway and competition participants
• Business and contractual partners
Legal Basis
Below you will find an overview of the legal basis under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or establishment.
• Consent (Art. 6(1)(a) GDPR): The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR): Processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps prior to entering into a contract.
• Legal obligation (Art. 6(1)(c) GDPR): Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1)(f) GDPR): Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
In addition, national regulations apply, in particular the German Federal Data Protection Act (BDSG).
Security Measures
We implement appropriate technical and organisational measures in accordance with the legal requirements, taking into account the state of the art, to ensure a level of protection appropriate to the risk.
The measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access. Furthermore, we take the protection of personal data into account from the outset when developing or selecting hardware, software, and procedures, in accordance with the principle of data protection by technical design and by data protection friendly default.
• IP masking: Where IP addresses are processed and the processing of a full IP address is not necessary, the IP address is shortened. The last two digits or the last part of the IP address are removed or replaced by placeholders.
• SSL encryption (https): To protect your transmitted data, we use SSL encryption. You can recognise encrypted connections by the https:// prefix in your browser's address bar.
Use of Cookies and Consent Management
Our website uses cookies and similar tracking technologies. We distinguish between technically necessary cookies, which are required for the operation of the website, and optional cookies, which are only set with your explicit consent.
Access to information on the user's terminal device or storage of information on the user's terminal device in the case of technically necessary cookies and comparable technologies is based on § 25(2) no. 2 TDDDG. The subsequent processing of personal data is based on Art. 6(1)(f) GDPR, as we have a legitimate interest in the secure and functional provision of our online shop.
For optional cookies and comparable technologies, in particular for analysis and marketing purposes, access to information on the terminal device or storage of information on the terminal device is carried out exclusively on the basis of your consent pursuant to § 25(1) TDDDG. The subsequent processing of personal data is based on Art. 6(1)(a) GDPR.
Technically necessary cookies are required for the operation of the online shop, e.g. for the shopping cart function, session management, website display, security functions, or the storage of your cookie settings.
Optional cookies and comparable technologies, in particular for analysis and marketing purposes, such as Google Analytics 4, Meta Pixel, or Google Ads, are only used after your prior, explicit consent.
We use a consent management tool to obtain and manage your consents. On your first visit to our website, you will have the option to accept or reject individual cookie categories. You can revoke your consent at any time with effect for the future by accessing the cookie settings via the corresponding link in the footer of our website.
Google Consent Mode V2
We use Google Consent Mode V2 to transmit your consent decisions made via our consent management tool to Google services. In particular, information is transmitted as to whether you have consented to processing for analytics purposes, advertising measurement, personalised advertising, and the sharing of advertising-related user data. Google tags are controlled in accordance with your consent.
If you do not provide consent, Google services will only be used in a restricted manner and without the storage and access operations you have rejected, to the extent technically provided. In this case, personal evaluation for analytics or marketing purposes will not be carried out on the basis of optional cookies or comparable technologies.
Payment Methods
In the context of contractual and other legal relationships, we offer the data subjects efficient and secure payment options and use banks and credit institutions as well as other service providers for this purpose.
The data processed by payment service providers include master data such as name and address, bank data such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract-, amount-, and recipient-related information. We do not receive account or credit card-related information, but only information confirming or declining payment.
Payment service providers used:
• Mollie: Service provider: Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands; Website: https://www.mollie.com; Privacy policy: https://www.mollie.com/privacy.
• PayPal: Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Website: https://www.paypal.com; Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
• Shopify Payments: Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Privacy policy: https://www.shopify.com/legal/privacy.
• Klarna: Service provider: Klarna Bank AB (publ), Svevägen 46, 111 34 Stockholm, Sweden; Website: https://www.klarna.com; Privacy policy: https://www.klarna.com/de/datenschutz.
For payment processing we use, depending on the selected payment method, Mollie, PayPal, Shopify Payments, and Klarna. Individual payment methods such as credit card, instant bank transfer, PayPal, purchase on account, or instalment payment can be processed via these providers.
Shipping and Delivery
For the delivery of ordered goods, we transmit the necessary personal data to the shipping service provider we use. This includes, in particular, name, delivery address, and any other information required for delivery.
Processing is carried out for the performance of the purchase contract pursuant to Art. 6(1)(b) GDPR.
If we transmit your email address or telephone number to the shipping service provider, this is only done insofar as this is necessary for delivery notification, parcel tracking, or the coordination of delivery, or where you have consented to this.
Shipping service provider used:
• DHL Paket GmbH: Sträßchensweg 10, 53113 Bonn, Germany; Website: https://www.dhl.de; Privacy policy: https://www.dhl.de/de/toolbar/footer/datenschutz.html.
Credit Assessment with Klarna
For certain payment methods, in particular purchase on account or comparable payment methods, the respective payment service provider may carry out an identity and credit check. This is used to verify whether the selected payment method can be offered and to prevent payment failures and fraud.
If you select a Klarna payment method, the check is carried out by Klarna. We ourselves do not carry out our own credit check and do not obtain information from credit reference agencies such as SCHUFA.
Klarna processes the necessary data in its own responsibility, in particular name, address, date of birth, contact details, order information, payment information, and where applicable information from previous payment transactions and from credit reference agencies. The decision on the provision of individual payment methods, in particular purchase on account, is made by Klarna according to its own criteria.
Further information on the processing of personal data by Klarna, in particular on identity and credit checks and the credit reference agencies used, can be found in Klarna's privacy information.
• Klarna: Service provider: Klarna Bank AB (publ), Svevägen 46, 111 34 Stockholm, Sweden; Website: https://www.klarna.com; Privacy policy: https://www.klarna.com/de/datenschutz.
Provision of the Online Offering, Domain, and Technical Services
For the technical provision of individual services, in particular domain, email, or hosting services, we use external service providers.
• STRATO: Service provider: STRATO AG, Pascalstraße 10, 10587 Berlin, Germany; Website: https://www.strato.de; Privacy policy: https://www.strato.de/datenschutz.
Shop System
For the operation of our online shop, we use the e-commerce platform Shopify. In connection with the operation of the shop and order processing, personal data is processed, including in particular name, billing and delivery address, email address, telephone number, payment information, order data, return information, and technical usage and communication data.
Shopify processes customer data in the context of shop operations primarily as a data processor pursuant to Art. 28 GDPR. Where Shopify provides individual services as an independent controller, processing is carried out in accordance with Shopify's privacy information.
• Shopify: Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Website: https://www.shopify.com; Privacy policy: https://www.shopify.com/legal/privacy.
A data processing agreement pursuant to Art. 28 GDPR has been concluded with Shopify. A transfer of data to third countries outside the EU/EEA may occur, in particular when other Shopify companies or service providers are involved. The transfer is carried out on the basis of appropriate safeguards, in particular EU standard contractual clauses, where required.
Shopify Payments
If you select a payment method offered via Shopify Payments at checkout, the data required for payment processing will be processed, including in particular name, billing address, payment data, order data, transaction data, and technical data. Processing is carried out for the purpose of payment processing and fraud prevention.
• Shopify Payments: Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Privacy policy: https://www.shopify.com/legal/privacy.
Inventory Management, Accounting, and Internal Business Processes
For internal order, inventory, returns, invoicing, and payment processing, we use inventory management, ERP, and accounting systems. Personal data necessary for the execution and management of orders is processed, including in particular name, billing and delivery address, email address, telephone number, order data, payment information, invoice data, return information, and communication data.
Processing is carried out for the performance of the purchase contract pursuant to Art. 6(1)(b) GDPR, for compliance with statutory retention and bookkeeping obligations pursuant to Art. 6(1)(c) GDPR, and on the basis of our legitimate interests in efficient internal business organisation pursuant to Art. 6(1)(f) GDPR.
Where we use external service providers for inventory management, accounting, invoicing, or technical interfaces, processing is carried out on the basis of appropriate data processing agreements pursuant to Art. 28 GDPR, insofar as the service providers act as data processors.
Service providers used:
• JTL Software: Inventory management and order processing; Service provider: JTL-Software-GmbH, Rheinstr. 7, 41836 Hückelhoven, Germany; Website: https://www.jtl-software.de; Privacy policy: https://www.jtl-software.de/datenschutz.
Registration, Login, and User Account
Users can create a user account. In the course of registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account. The data processed includes, in particular, login information (username, password, and an email address).
In the context of using our registration and login functions and the user account, we store the IP address and the time of the respective user action.
Contact and Enquiry Management
When contacting us (e.g. via contact form, email, telephone, or via social media), the information provided by the enquiring persons is processed insofar as this is necessary for responding to the contact enquiries and any requested measures.
Returns, Complaints, and Refunds
In the context of returns, complaints, refunds, and warranty cases, we process the necessary personal data. This includes, in particular, order number, name, contact details, delivery data, payment information, return reasons, communication content, and where applicable photos of damaged or defective goods.
Processing is carried out to handle your return or complaint, to process refunds, to examine and fulfil statutory warranty rights, and to communicate with you.
The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary for the performance or reversal of the purchase contract. Where we fulfil statutory retention or documentation obligations, processing is carried out on the basis of Art. 6(1)(c) GDPR. In addition, processing may be carried out on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR, in particular for the examination, documentation, and defence of legal claims.
Communication via Messenger
We use messenger services for communication purposes. Where content is end-to-end encrypted, the communication content is encrypted end-to-end. You should always use a current version of the messenger with encryption enabled.
• WhatsApp: WhatsApp Messenger with end-to-end encryption; Service provider: WhatsApp Ireland Limited, 4 Grand Canal Quay, Dublin 2, D02 KH28, Ireland; Website: https://www.whatsapp.com/; Privacy policy: https://www.whatsapp.com/legal.
Note on WhatsApp use: A data processing agreement exists with Meta Platforms Ireland Limited for the business use of WhatsApp. We do not transmit contact details to WhatsApp without the consent of the persons concerned. We recommend using alternative communication channels (email, telephone) for questions relating to sensitive contractual matters.
• Instagram: Message sending via the social network Instagram; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
• Facebook Messenger: Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy.
Newsletter and Electronic Notifications
We send newsletters, emails, and other electronic notifications only with the recipients' consent or on the basis of a statutory authorisation. Registration is carried out using a double opt-in procedure.
Where we have received your email address in connection with the sale of goods, we may send you advertising for our own similar goods, unless you have objected. The legal basis is Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG. You may object to this use at any time without incurring any costs other than the transmission costs at basic rates.
• Klaviyo: Email marketing service; Service provider: Klaviyo, Inc., 125 Summer St, Floor 6, Boston, MA 02111, USA; Website: https://www.klaviyo.com; Privacy policy: https://www.klaviyo.com/privacy/policy.
When you subscribe to our newsletter or receive electronic notifications from us, we process the data required for this purpose, in particular email address, where applicable first and last name, and technical data such as IP address, date and time of registration.
With the help of Klaviyo, we can send newsletters, automated emails, and other electronic notifications, e.g. welcome emails, product recommendations, shopping cart reminders, back-in-stock notifications, or information about promotions. Information about opening, click, purchase, and shopping cart behaviour may also be processed in order to make content more relevant, to measure the success of our email communications, and to create recipient groups.
Processing for newsletter delivery is based on your consent pursuant to Art. 6(1)(a) GDPR. Where we send existing customer advertising for similar own goods, processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG.
Data transfer to the USA, where applicable, is based on the EU-U.S. Data Privacy Framework and additionally on the EU standard contractual clauses.
Where we use Klaviyo for transactional messages, e.g. order, shipping, or returns information, processing is carried out for the performance of the contract pursuant to Art. 6(1)(b) GDPR.
You may revoke your consent at any time with effect for the future or object to receiving electronic notifications at any time, e.g. via the unsubscribe link in each email.
Web Analytics, Monitoring, and Optimisation
Web analytics is used to evaluate visitor flows on our online offering. We use IP masking to protect users. No clear-text data of users is stored; pseudonyms are used instead.
• Google Analytics 4: Reach measurement and web analytics; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy. Opt-out: https://tools.google.com/dlpage/gaoptout?hl=en
Online Marketing
We process personal data for the purposes of online marketing, in particular for the display of interest-based advertising content and for measuring its effectiveness.
Server-Side Tracking
Where we use server-side tagging, certain tracking and event data is first processed via a server environment controlled by us before being passed on to analytics or marketing providers such as Google or Meta. This may include, in particular, technical information, page views, click events, shopping cart and purchase events, pseudonymous identifiers, and consent information.
Data is only passed on to analytics or marketing providers within the scope of your granted consent, where this is required. Server-side tracking is used in particular to make data transmission technically more controlled, secure, and privacy-friendly.
• Meta Pixel: Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Privacy policy: https://www.facebook.com/about/privacy.
We use the Meta Pixel to measure the effectiveness of our advertisements on Facebook and Instagram, to create target audiences for advertisements, and to show users interest-based advertising, provided they have consented to this.
When using Meta Business Tools, in particular the Meta Pixel, joint controllership between us and Meta Platforms Ireland Limited pursuant to Art. 26 GDPR may exist. The basis is the controller addendum provided by Meta. Processing is only carried out on the basis of your prior consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as cookies or comparable technologies are used.
• Google Ads: Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Privacy policy: https://policies.google.com/privacy.
We use Google Ads to place advertisements in Google Search, in the Google advertising network, and on other Google services, and to measure their success. In particular, clicks on advertisements, page views, purchase events, shopping cart events, and technical information may be processed. Processing is only carried out on the basis of your prior consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as cookies or comparable technologies are used.
Presences in Social Networks (Social Media)
We maintain online presences within social networks. User data may be processed outside the territory of the European Union.
• Instagram: Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Privacy policy: https://instagram.com/about/legal/privacy.
• Facebook: Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Privacy policy: https://www.facebook.com/about/privacy.
• LinkedIn: Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; Privacy policy: https://www.linkedin.com/legal/privacy-policy.
• Pinterest: Service provider: Pinterest Inc., 635 High Street, Palo Alto, CA, 94301, USA; Privacy policy: https://about.pinterest.com/privacy-policy.
• TikTok: Service provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland; Website: https://www.tiktok.com; Privacy policy: https://www.tiktok.com/privacy-policy.
• YouTube: Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Privacy policy: https://policies.google.com/privacy.
Prize Draws and Promotions
When we run prize draws, competitions, or comparable promotions, we process the personal data of participants necessary for their conduct. This may include, in particular, name, social media profile, contact details, communication data, prize draw entries, and, in the event of winning, the postal address.
Processing is carried out for the conduct of the prize draw, for identifying and notifying winners, for verifying eligibility to participate, and for sending the prize. The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary for the conduct of the prize draw. Where processing is necessary for organisation, documentation, or the prevention of abuse, it is carried out on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR.
Where the prize draw is conducted via social networks such as Instagram or Facebook, the privacy terms of the respective platform operator may additionally apply. Unless expressly stated otherwise, the prize draw has no connection to the respective social network and is not sponsored, endorsed, or organised by it.
Data processed in the context of a prize draw will be deleted after the prize draw has ended, unless statutory retention obligations preclude this or longer storage is required for the assertion, exercise, or defence of legal claims.
Cloud Services
We use cloud services for document storage, communication, and organisational tasks.
• Dropbox: Service provider: Dropbox, Inc., 333 Brannan Street, San Francisco, California 94107, USA; Privacy policy: https://www.dropbox.com/privacy.
Retention Periods and Deletion
We store personal data only for as long as necessary for the respective processing purposes or as required by statutory retention obligations. Thereafter, data is routinely deleted or blocked.
The following retention periods apply in particular:
• Tax and accounting-relevant records (e.g. invoices, order data): 10 years pursuant to § 147 AO and § 257 HGB.
• Commercial and business correspondence (e.g. order confirmations, correspondence): 6 years pursuant to § 257 HGB.
• Warranty claims: Data relating to purchases is stored for the duration of the statutory warranty period of 2 years.
• Newsletter registrations: Data required for newsletter delivery is stored until consent is revoked. After revocation, we delete the data unless statutory retention or documentation obligations preclude this. Email addresses may be stored in a blocklist to ensure that no further mailings are sent and that the revocation is permanently respected.
• Contact enquiries: Enquiries submitted via the contact form or by email are deleted after full processing, unless a statutory retention obligation precludes this, and at the latest after 3 years.
• Applicant data: In the event of rejection, applicant data is deleted after 6 months, unless longer retention is required for legal reasons.
• Usage data / web analytics: Data collected by Google Analytics 4 is automatically deleted after 14 months.
Rights of Data Subjects
As a data subject, you have various rights under the GDPR, arising in particular from Art. 15 to 21 GDPR:
• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(e) or (f) GDPR.
• Right to withdraw consent: You have the right to withdraw consent given at any time.
• Right of access: You have the right to request confirmation as to whether data concerning you is being processed, and to access that data as well as further information and a copy of the data in accordance with the statutory requirements.
• Right to rectification: You have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: You have the right to request the immediate erasure of data concerning you.
• Right to data portability: You have the right to receive data concerning you in a structured, commonly used, and machine-readable format.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, if you consider that the processing of personal data concerning you infringes the GDPR.
Definitions
In this section you will find an overview of the terms used in this privacy policy. Many of the terms are taken from the law and defined in particular in Art. 4 GDPR. The statutory definitions are binding. The terms are listed in alphabetical order.
• Controller: The 'controller' means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Conversion measurement: Conversion measurement (also referred to as 'visit action evaluation') is a procedure used to determine the effectiveness of marketing measures. A cookie is typically stored on users' devices on websites where the marketing measures take place, and is then retrieved on the target website.
• Credit assessment: Automated decisions are based on automatic data processing without human involvement (e.g. in the case of an automatic rejection of purchase on account). Such automated decisions are only permissible under Art. 22 GDPR where the data subject consents, where they are necessary for the performance of a contract, or where national laws permit such decisions.
• Personal data: 'Personal data' means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or an online identifier.
• Processing: 'Processing' means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and encompasses virtually any handling of data, whether collection, evaluation, storage, transmission, or erasure.
• Profiles with user-related information: The processing of 'profiles' encompasses any form of automated processing of personal data which involves the use of such data to evaluate, analyse, or predict certain personal aspects of a natural person (e.g. interests in certain content or products, click behaviour, location).
• Reach measurement: Reach measurement (also referred to as web analytics) is used to evaluate visitor flows to an online offering and may encompass the behaviour or interests of visitors in relation to certain information. With the help of reach analysis, website operators can recognise at what time visitors access their website and what content they are interested in.
• Remarketing: 'Remarketing' or 'retargeting' refers to the practice of noting, for advertising purposes, which products a user has shown interest in on a website, in order to remind the user of those products on other websites, e.g. in advertisements.
• Targeting: 'Targeting' (also referred to as 'custom audiences') refers to the process of defining target audiences for advertising purposes. For example, based on a user's interest in certain products or topics on the internet, it may be inferred that this user is interested in advertisements for similar products. 'Lookalike audiences' refers to the display of content deemed suitable to users whose profiles are presumed to correspond to the users for whom the profiles were created.
Changes and Updates to the Privacy Policy
We ask you to regularly inform yourself about the content of our privacy policy. We update the privacy policy as soon as changes to the data processing we carry out make this necessary.
