Privacy policy
1. Controller Plan A GmbH, Metzer Straße 50, 66117 Saarbrücken, Germany · hello@wearetomorrowpeople.com
2. Hosting and shop platform (Shopify) Our online shop runs on the Shopify platform (Shopify International Limited, Ireland; Shopify Inc., Canada). Shopify processes the data collected through the shop (including order, contact and usage data) on our behalf as a processor. Legal basis: Art. 6(1)(f) GDPR and Art. 6(1)(b) GDPR. Transfers to third countries are based on the EU Standard Contractual Clauses.
3. Server log files When you visit the shop, information transmitted by your browser is collected automatically (including IP address, date/time, page accessed, browser type). Legal basis: Art. 6(1)(f) GDPR.
4. Order processing To fulfil the contract we process your name, billing/shipping address, email, phone number where provided, order and payment data. Legal basis: Art. 6(1)(b) GDPR.
5. Payment processing Payment data is passed to the payment service provider you select, which processes it as an independent controller under its own terms. Legal basis: Art. 6(1)(b) GDPR.
6. Shipping For delivery we pass your name and shipping address and, where applicable, your email (tracking) to DHL (DHL Group / Deutsche Post AG). Legal basis: Art. 6(1)(b) GDPR.
7. Invoice and accounting data Due to commercial and tax law requirements (Sec. 257 HGB, Sec. 147 AO) we retain invoice and accounting data for the statutory periods (generally 6 or 10 years). Legal basis: Art. 6(1)(c) GDPR.
8. Waiting list and newsletter (Klaviyo) We process your email address to inform you about launches and availability. Emails are sent via Klaviyo (Klaviyo, Inc., USA) as a processor; transfers to the USA are based on the EU Standard Contractual Clauses. Double opt-in. Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link in every email; withdrawal takes effect for the future.
9. Cookies and consent Technically necessary cookies: Art. 6(1)(f) GDPR / Sec. 25(2) TDDDG. Non-essential cookies and tracking only with your consent via the consent banner: Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG. Withdrawal possible at any time with effect for the future.
10. Meta Pixel (Facebook/Instagram) Only with your consent we use the Meta Pixel of Meta Platforms Ireland Ltd. Data (including IP address, device/browser information, events) is transmitted to Meta and may be transferred to the USA (EU Standard Contractual Clauses, EU-US Data Privacy Framework). Joint controllership (Art. 26 GDPR). Legal basis: Art. 6(1)(a) GDPR. Withdrawal possible at any time with effect for the future.
11. Google Analytics 4 Only with your consent we use Google Analytics 4, a web analytics service by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse how our shop is used (e.g. pages viewed, time on site, approximate location, device/browser, traffic source, events such as add to cart and purchase). IP addresses are truncated by Google and not stored. The integration runs via Shopify; data may be transferred to Google LLC in the USA (EU Standard Contractual Clauses; Google is certified under the EU-US Data Privacy Framework). Google processes the data on our behalf (Art. 28 GDPR). Retention of analytics data: 14 months. Legal basis: Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG. You can withdraw consent at any time with effect for the future via the cookie settings in the footer. More information: https://policies.google.com/privacy
12. Google Merchant Center / Google Shopping We transmit product data (title, price, image, availability) to Google Merchant Center (Google Ireland Limited) so that our products can appear in Google Search and Google Shopping. No personal data of yours is transmitted. Legal basis: Art. 6(1)(f) GDPR (interest in product visibility).
13. Product reviews (Judge.me) We use Judge.me (Judge.me Ltd., 1 Ropemaker Street, London EC2Y 9HT, United Kingdom) for product reviews. After an order you will receive an email invitation to review the product you bought. For this we share your name, email address, order number and ordered product with Judge.me as a processor (Art. 28 GDPR); the United Kingdom is covered by an EU adequacy decision. Legal basis for the invitation: Art. 6(1)(f) GDPR (interest in genuine customer reviews; Sec. 7(3) UWG). You can object at any time (link in every email or hello@wearetomorrowpeople.com). Published reviews show your first name and, where applicable, the initial of your last name, as well as any photos you upload; legal basis: Art. 6(1)(a) GDPR. Reviews are collected only from customers who actually purchased the product from us ("verified purchase").
14. Post-purchase survey (Zigpoll) On the order confirmation page we show a voluntary short survey (e.g. "How did you hear about us?"). The provider is Zigpoll (Zigpoll LLC, USA). Your answer and the order number are processed; transfers to the USA are based on the EU Standard Contractual Clauses. Legal basis: Art. 6(1)(a) GDPR (participation is voluntary). If you do not answer, no data is transmitted.
15. Your rights Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)). Contact: hello@wearetomorrowpeople.com
16. Right to lodge a complaint Competent supervisory authority: Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, Germany.
17. Changes The version published on this page at any given time applies.