Privacy Policy

1. Controller and Contact

The controller responsible for processing your personal data under the General Data Protection Regulation (GDPR) is the individual owner of the online store “This Is Complete Bullshirt”, based in Göttingen, Germany.

If you have any questions about this Privacy Policy or about how we process your data, or if you wish to exercise your data protection rights, please contact us.

2. What Data We Collect

We only collect the data we need to run our store and provide our services. In particular, we may process the following types of personal data:

• Order data: first and last name, billing and shipping address, email address, ordered products, payment status, and order-related communication.
• Account data (optional): if you create a customer account, we store your login email address and your order history associated with the account.
• Newsletter / marketing data: email address and your consent information if you sign up for our newsletter or marketing updates (for example via a form on this site).
• Contact data: information you provide when you contact us, such as your name, email address, and the content of your message.
• Technical and usage data: IP address (shortened where possible), device and browser information, pages visited, time and date of access, and similar data collected via cookies and similar technologies.

3. Why We Use Your Data (Legal Bases)

We process your personal data for the following purposes and on the following legal bases under the GDPR:

• To process and fulfill your orders (Art. 6(1)(b) GDPR – performance of a contract): we use your order and contact details to handle your purchase, produce and ship your items, manage payments, and deal with returns or complaints.
• To respond to your inquiries (Art. 6(1)(b) and (f) GDPR – contract and legitimate interests): when you reach out with questions or requests, we use your data to reply and keep track of our conversation.
• To send newsletters and marketing communications (Art. 6(1)(a) GDPR – consent): if you actively sign up for our newsletter or ask to receive updates, we use your email address to send you information about our products, offers, and news. You can unsubscribe at any time.
• To operate and secure our website and shop (Art. 6(1)(f) GDPR – legitimate interests): we use technical and usage data, including cookies, to ensure the site works properly, to keep it secure, and to understand how visitors use it so we can improve it.
• To meet legal obligations (Art. 6(1)(c) GDPR – legal obligation): we store certain data for tax, accounting, and commercial law requirements under German law.

4. Who We Share Your Data With

We do not sell your personal data. We only share it with third parties where this is necessary to run our store, fulfill your orders, or comply with the law.

• Printful (fulfillment partner): We use Printful to print and ship our products. For this, we share your name, shipping address, the products you ordered, and, where necessary, your contact details so your order can be fulfilled. Printful acts as our data processor. You can find more information in Printful’s privacy policy: https://www.printful.com/policies/privacy.
• Hosting and shop platform (WordPress.com / WooCommerce): Our website and online store are operated on a WordPress/WooCommerce-based platform. The operator provides hosting, technical infrastructure, and certain analytics and security functions and therefore processes technical and usage data as well as order data on our behalf.
• Payment service providers: When you choose a specific payment method (for example credit card, PayPal, or other services), your payment data is processed primarily by the respective payment service provider. The exact providers and further details are shown during checkout.
• Service providers and authorities: In addition, we may share data with IT service providers, accountants, or legal advisors where necessary, and with public authorities or courts if we are legally required to do so.

5. International Data Transfers

Some of our service providers, including Printful and parts of the WordPress/WooCommerce infrastructure, may process data outside the European Union (EU) or the European Economic Area (EEA), for example in the United States. When this happens, we make sure that appropriate safeguards are in place, such as adequacy decisions by the European Commission or standard contractual clauses, so that your data remains protected under GDPR-level standards.

6. How Long We Store Your Data

We only keep your personal data for as long as it is needed for the purposes described in this Privacy Policy, or as long as we are legally required to keep it.

• Order and invoice data: Under German tax and commercial law, we are required to store invoice and financial records for 10 years. Order data that falls under these rules will be kept for this period.
• Customer account data: If you create a customer account, we store your data until you request deletion or until the account has been inactive for a longer period and there are no legal retention obligations that require further storage.
• Newsletter data: We store your email address for newsletter purposes until you unsubscribe or withdraw your consent.
• Contact inquiries: We store messages and related contact data as long as necessary to handle your request and for a reasonable retention period to answer follow-up questions, unless legal retention rules require longer storage.
• Technical and usage data: Cookies and similar technologies are stored for different periods (see below under “Cookies and similar technologies”), typically from the duration of a session up to several months, unless you delete them earlier.

7. Cookies and Similar Technologies

Like most online shops, we use cookies and similar technologies. Cookies are small text files that are stored on your device and that your browser sends back to our site on later visits.

We use in particular:

• Necessary cookies: These are required so the website and shop can function. For example, they keep track of the items in your cart, remember your language and privacy preferences, and maintain your session during checkout.
• Functional and preference cookies: These help to make your experience more convenient, for example by remembering login information or previous choices.
• Analytics cookies: These help us understand how visitors use our website (for example which pages are viewed most often) so we can improve our content and shop. Where required, we only set these cookies with your consent.

You can configure your browser to block cookies, to only allow certain types, or to delete cookies. Please note that if you reject or delete cookies, some functions of our online shop may not work properly.

8. Your Rights Under the GDPR

As a data subject under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request confirmation as to whether we process your personal data and receive a copy of that data and further information.
• Right to rectification (Art. 16 GDPR): You can ask us to correct inaccurate data or complete incomplete data.
• Right to erasure (Art. 17 GDPR): You can request that we delete your personal data, for example when it is no longer needed or where you have withdrawn your consent and there is no other legal basis for processing.
• Right to restriction of processing (Art. 18 GDPR): You can request that we restrict processing of your data in certain circumstances, for example while we check the accuracy of data or assess an objection.
• Right to data portability (Art. 20 GDPR): You can receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and have the right to transmit that data to another controller, where technically feasible.
• Right to object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if processing is necessary for the establishment, exercise, or defence of legal claims.
• Right to withdraw consent (Art. 7(3) GDPR): Where we process data based on your consent (for example for newsletters), you can withdraw this consent at any time with effect for the future, for example by using an unsubscribe link or by contacting us.

To exercise your rights, please contact us. We will handle your request in accordance with legal requirements and within the applicable deadlines.

9. Right to Lodge a Complaint

If you believe that we are not processing your personal data in accordance with data protection laws, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place.

For our place of business in Göttingen, Germany, the competent authority is the respective Landesdatenschutzbehörde in the federal state of Lower Saxony.