Privacy policy

Last updated: 16 February 2026

 

Responsible for data processing :

Sonja Schauer / Growing Heroes

An der Krückau 9a

Kaltenkirchen

Email: support@growingheroes.de

Telefon: 01781313105

Privacy Policy

1. Access data and hosting

You may visit our websites without providing any personal information. Each time a webpage is accessed, the web server automatically stores a so-called server log file, which may include, for example, the name of the requested file, your IP address, date and time of access, the amount of data transferred, and the requesting provider (access data), and documents the access. This access data is evaluated solely for the purpose of ensuring the smooth operation of the site and improving our offering. This serves to safeguard our overriding legitimate interests in a correct presentation of our offering pursuant to Art. 6(1) sentence 1 lit. f GDPR. All access data is processed only for as long as is necessary to achieve the purposes stated above.

Hosting

The services for hosting and displaying the website are provided in part by our service providers on our behalf (processing on our behalf). Unless otherwise explained in this Privacy Policy, all access data as well as all data collected in forms provided on this website are processed on their servers. If you have questions about our service providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

Our service providers are located in and/or use servers in the following countries for which the European Commission has determined an adequate level of data protection by decision: Canada.

2. Data processing for contract handling and for contacting us

2.1 Data processing for contract handling

For the purpose of contract handling (including inquiries relating to and processing of any warranty and performance claims, as well as any statutory update obligations) pursuant to Art. 6(1) sentence 1 lit. b GDPR, we collect personal data if you voluntarily provide it to us as part of your order. Mandatory fields are marked as such, as we require this data for contract handling and cannot ship your order without it. Which data is collected can be seen from the respective input forms.

Further information about the processing of your data, in particular regarding disclosure to our service providers for order, payment and shipping processing, can be found in the following sections of this Privacy Policy. After the contract has been fully processed, your data will be restricted for further processing and deleted after the expiry of the statutory retention periods under tax and commercial law pursuant to Art. 6(1) sentence 1 lit. c GDPR, unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this where permitted by law and as explained in this Privacy Policy.

2.2 Customer account

If you have given your consent pursuant to Art. 6(1) sentence 1 lit. a GDPR by choosing to open a customer account, we will use your data for the purpose of creating the customer account and storing your data for future orders on our website. You can delete your customer account at any time either by sending a message to the contact option described in this Privacy Policy or via the function provided in your customer account. After deletion of your customer account, your data will be deleted unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this where permitted by law and as explained in this Privacy Policy.

Your data may be transferred to and processed in third countries outside the EU, in particular Canada and the United States. For Canada, an adequacy decision of the European Commission exists. For the USA, an adequacy decision of the European Commission exists, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This transfer is based on contractual obligations comparable to the European Commission’s Standard Contractual Clauses.

Contacting us

As part of customer communication, we collect personal data to process your inquiries pursuant to Art. 6(1) sentence 1 lit. b GDPR if you voluntarily provide it to us when contacting us (e.g. via contact form or email). Mandatory fields are marked as such, as we require this data to process your inquiry. Which data is collected can be seen from the respective input forms. After your inquiry has been fully processed, your data will be deleted unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this where permitted by law and as explained in this Privacy Policy.

3. Data processing for shipping purposes

To fulfil the contract pursuant to Art. 6(1) sentence 1 lit. b GDPR, we pass your data on to the shipping service provider commissioned with delivery, insofar as this is necessary to deliver ordered goods. If you have questions about our service providers and the basis of our cooperation with them, please contact us using the contact option described in this Privacy Policy.

4. Data processing for payment handling

When processing payments in our online shop, we work with the following partners: technical service providers, credit institutions, payment service providers.

4.1 Data processing for transaction handling

Depending on the payment method selected, we pass the data necessary for processing the payment transaction on to our technical service providers, the commissioned credit institutions, or the selected payment service provider, insofar as this is necessary for payment processing. This serves contract fulfilment pursuant to Art. 6(1) sentence 1 lit. b GDPR. In some cases, payment service providers collect the data required for payment processing themselves, e.g. on their own website or via technical integration in the ordering process. In this respect, the privacy policy of the respective payment service provider applies.

Depending on the payment method selected, data may be transferred to third countries outside the EU/EEA for which the European Commission has determined an adequate level of data protection by decision. Where data is transferred to third countries outside the EU/EEA without an adequacy decision, the cooperation is based on the European Commission’s Standard Contractual Clauses.

If you have questions about our partners for payment processing or the basis of our cooperation with them, please contact us using the contact option provided in this Privacy Policy.

Payment service providers

Use of PayPal Express
We use the payment service PayPal Express provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg; “PayPal”). The data processing serves the purpose of offering payment via PayPal Express. To integrate this service, PayPal must collect, store and analyse data when you access the website (e.g. IP address, device type, operating system, browser type, device location). Cookies may also be used. The cookies enable recognition of your browser. The use of cookies or comparable technologies takes place with your consent on the basis of § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1) lit. a GDPR. Your personal data is processed with your consent on the basis of Art. 6(1) lit. a GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
When selecting and using PayPal Express, the data required for payment processing is transmitted to PayPal in order to fulfil the contract with you using the selected payment method (Art. 6(1) lit. b GDPR).
Further information: PayPal privacy policy (as linked in the German version you provided).

Use of PayPal Checkout
We use PayPal Checkout provided by PayPal (Europe) S.à r.l. et Cie, S.C.A. (“PayPal”). The data processing serves the purpose of offering payment via PayPal. When selecting and using PayPal, credit card via PayPal, direct debit via PayPal, or “Pay Later” via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfil the contract with you using the selected payment method (Art. 6(1) lit. b GDPR).
Cookies may be stored that enable recognition of your browser. The resulting data processing is based on Art. 6(1) lit. f GDPR due to our overriding legitimate interest in offering customer-friendly payment methods. You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Art. 6(1) lit. f GDPR.

Credit card via PayPal, direct debit via PayPal & “Pay Later” via PayPal
For certain payment methods, PayPal may obtain a credit assessment based on mathematical-statistical procedures using credit agencies. For this purpose, PayPal transmits the personal data necessary for a credit check to a credit agency and uses the information received regarding the statistical probability of payment default for a balanced decision on the establishment, execution or termination of the contractual relationship. The credit assessment may include probability values (score values) calculated on the basis of scientifically recognised mathematical-statistical procedures and may include address data. Your legitimate interests are taken into account in accordance with legal requirements. The processing serves the purpose of creditworthiness assessment for contract initiation and is based on Art. 6(1) lit. f GDPR due to PayPal’s overriding legitimate interest in protection against payment default when PayPal pays in advance. You have the right to object at any time, on grounds relating to your particular situation, to this processing by notifying PayPal.
Providing the data is required for concluding the contract with the payment method you requested. Failure to provide the data means the contract cannot be concluded using that payment method.

Third-party payment methods
When paying via a third-party payment method, the data required for payment processing is transmitted to PayPal (Art. 6(1) lit. b GDPR). PayPal may then forward the data to the respective provider to process the payment method (Art. 6(1) lit. b GDPR). Local third-party providers may include, for example:

  • Apple Pay (Apple Distribution International Ltd., Cork, Ireland)

  • Google Pay (Google Ireland Limited, Dublin, Ireland)

Invoice purchase via PayPal
When paying via “invoice purchase”, the data required for payment processing is first transmitted to PayPal. To execute this payment method, PayPal then transmits the data to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin, Germany; “Ratepay”) in order to fulfil the contract with you (Art. 6(1) lit. b GDPR). Ratepay may carry out a credit assessment as described above. Processing is based on Art. 6(1) lit. f GDPR due to Ratepay’s overriding legitimate interest in protection against payment default if Ratepay pays in advance. Further information is available in Ratepay’s privacy information (as linked in the German version you provided).

Further information on PayPal’s processing can be found in PayPal’s privacy policy (as linked in the German version you provided).

Use of Klarna payment options
We use Klarna’s payment services provided by Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden; “Klarna”). When selecting and using payment via Klarna, the data required for payment processing is transmitted to Klarna to fulfil the contract with you using the selected payment method (Art. 6(1) lit. b GDPR). Cookies may be stored to recognise your browser. The resulting processing is based on Art. 6(1) lit. f GDPR due to our overriding legitimate interest in offering customer-friendly payment methods. You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you.

“Pay Later” (invoice), “Pay Now” (direct debit/credit card/instant transfer), “Financing” (installments)
For certain payment methods, Klarna may obtain a credit assessment using credit agencies and may transmit personal data for identity and credit checks (e.g. name, address, gender, email address, IP address, and order-related data). Processing is based on Art. 6(1) lit. f GDPR due to Klarna’s overriding legitimate interest in protection against payment default if Klarna pays in advance. You have the right to object at any time, on grounds relating to your particular situation, to this processing by notifying Klarna.
Providing the data is required for concluding the contract with the payment method you requested. Failure to provide the data means the contract cannot be concluded using that payment method. Further information is available in Klarna’s resources (as linked in the German version you provided).

Use of Stripe
We use the payment service Stripe provided by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The data processing serves the purpose of offering payment via Stripe. When selecting and using Stripe, the data required for payment processing is transmitted to Stripe to fulfil the contract with you using the selected payment method (Art. 6(1) lit. b GDPR). Stripe may obtain a credit assessment using credit agencies. Processing is based on Art. 6(1) lit. f GDPR due to Stripe’s overriding legitimate interest in protection against payment default if Stripe pays in advance. You have the right to object at any time, on grounds relating to your particular situation, to this processing by notifying Stripe.
Providing the data is required for concluding the contract with the payment method you requested. Failure to provide the data means the contract cannot be concluded using that payment method.
All Stripe transactions are subject to Stripe’s privacy policy (as linked in the German version you provided).

4.2 Data processing for fraud prevention and optimisation of our payment processes

Where applicable, we provide the service providers listed above with additional data, which they use together with the data necessary for processing the payment for the purposes of fraud prevention and optimisation of our payment processes (e.g. invoicing, handling of disputed payments, accounting support). This serves to safeguard our overriding legitimate interests in protecting ourselves against fraud and in efficient payment management pursuant to Art. 6(1) sentence 1 lit. f GDPR.

5. Advertising by email

5.1 Email newsletter subscription

Use of your email address for sending newsletters
We use your email address, independently of contract handling, exclusively for our own advertising purposes to send newsletters, provided that you have expressly consented. Processing is based on Art. 6(1) lit. a GDPR. For this purpose, your data is transferred to Shopify (Shopify Inc., 151 O’Connor Street, Ottawa, ON K2P 2L8, Canada). For transfers to Canada, an adequacy decision of the European Commission exists.

You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You can unsubscribe from the newsletter at any time via the link provided in the newsletter or by notifying us. Your email address will then be removed from the mailing list.

5.2 Sending review requests by email

If you have given your express consent during or after your order pursuant to Art. 6(1) sentence 1 lit. a GDPR, we use your email address to ask you to submit a review of your order via the review system we use. You can withdraw this consent at any time by sending a message to the contact option described in this Privacy Policy or via a link provided in the review request. After withdrawal, we delete your email address from the recipient list unless you have expressly consented to further use of your data pursuant to Art. 6(1) sentence 1 lit. a GDPR or we reserve the right to use data beyond this where permitted by law and as explained in this Privacy Policy.

6. Cookies and other technologies

General information

To make visiting our website attractive and to enable the use of certain functions, we use technologies on various pages including so-called cookies. Cookies are small text files that are automatically stored on your device. Some of the cookies we use are deleted at the end of the browser session, i.e. after you close your browser (session cookies). Other cookies remain on your device and allow us to recognise your browser on your next visit (persistent cookies). The storage duration can be found in the cookie settings overview of your web browser.

Protection of privacy on end devices

When using our online services, we use strictly necessary technologies to provide the telemedia service expressly requested by you. Storing information on your device or accessing information already stored on your device does not require consent in these cases.

For non-essential functions, storing information on your device or accessing information already stored on your device requires your consent. Please note that if you do not grant consent, parts of the website may not be fully usable. Any consent you have given remains valid until you adjust or reset the settings on your device.

Downstream data processing by cookies and other technologies

We use technologies that are strictly necessary for the use of certain functions of our website. Through these technologies, IP address, time of visit, device and browser information, and information about your use of our website are collected and processed. This serves to safeguard our overriding legitimate interests in an optimised presentation of our offering pursuant to Art. 6(1) sentence 1 lit. f GDPR.

Cookie settings

You can find information on how to manage (including disable) cookies for major browsers at the following links:

  • Chrome: (as linked in the German version you provided)

  • Microsoft Edge: (as linked in the German version you provided)

  • Mozilla Firefox: (as linked in the German version you provided)

  • Safari: (as linked in the German version you provided)

If you have consented to the use of technologies pursuant to Art. 6(1) sentence 1 lit. a GDPR, you may withdraw your consent at any time by sending a message to the contact option described in this Privacy Policy.

Use of the Shopify consent tool (Shopify Privacy & Compliance)
We use the consent tool “Shopify Privacy & Compliance” provided by Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; “Shopify”). Shopify is affiliated with Shopify Inc. (151 O’Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada).
The tool enables you to grant consent to data processing on the website, in particular the setting of cookies, and to exercise your right to withdraw consent already granted. The processing serves the purpose of obtaining and documenting required consents and thus complying with legal obligations. Cookies may be used for this purpose. User information, including your IP address, is collected and transmitted to Shopify.
Your data may be transferred to third countries outside the EU, in particular Canada and the USA. For Canada, an adequacy decision exists. For the USA, an adequacy decision exists (TADPF). Shopify is not certified under the TADPF. The transfer is based on contractual commitments comparable to the European Commission’s Standard Contractual Clauses.
Processing is carried out to fulfil a legal obligation on the basis of Art. 6(1) lit. c GDPR. Further information: Shopify privacy information (as linked in the German version you provided).

Use of Shopify Network Intelligence
We use the Shopify Network Intelligence function provided by Shopify International Ltd. (150 Elgin Street, Suite 800, Ottawa, ON, K2P 1L4, Canada; “Shopify”). This function serves to analyse and improve our offering as well as to optimise advertising and website performance. Certain personal data, such as IP address, technical device information, transaction and behavioural data, is processed in aggregated form together with data from other merchants.
Processing is based on Art. 6(1) lit. f GDPR due to our legitimate interest in improving our online shop and the user experience. Shopify may also be (jointly) responsible for processing personal data as part of this function.
Data may be transferred to Shopify servers in Canada and possibly the USA. For Canada, an adequacy decision exists. Shopify is currently not certified under the TADPF. The transfer is based on contractual agreements pursuant to the European Commission’s Standard Contractual Clauses.
You have the right to object to the use of your personal data for these purposes at any time. Further information and an opt-out option can be found at: (as linked in the German version you provided).
Further information on Shopify data processing: (as linked in the German version you provided).

Use of Google Analytics 4
We use Google Analytics provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; “Google”). Processing serves the purpose of analysing this website and its visitors as well as marketing and advertising purposes. Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, compile reports on website activity and provide other services related to website usage and internet usage to the website operator.
The following information may be collected: IP address, date and time of page access, click path, browser and device information, pages visited, referrer URL, location data, and purchase activities. Your data may be linked by Google with other data such as your search history, your personal accounts, usage data from other devices, and any other data Google has about you.
Your IP address is shortened by us on our own servers beforehand. Google therefore receives only pseudonymised data.

Google uses technologies such as cookies, browser web storage and tracking pixels that enable analysis of your use of the website. The use of cookies or comparable technologies is based on your consent pursuant to § 25(1) sentence 1 TDDDG in conjunction with Art. 6(1) lit. a GDPR. Processing of your personal data is based on your consent pursuant to Art. 6(1) lit. a GDPR. You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

We use the enhanced implementation of Consent Mode (Advanced Consent Mode). Even if consent is not granted, usage data is transmitted to Google in the form of “pings”. These pings may include, among other things: IP address to derive the IP country (the IP address is not logged), date and time of page access, URL of visited pages, user agent, referrer URL, or information on the triggering of website events such as a conversion. Based on this information, Google models user data to enable comprehensive usage analysis despite refusal of consent.

The information generated about your use of this website is generally transmitted to and stored on a Google server in the USA. For the USA, an adequacy decision exists (TADPF). Google has certified under the TADPF and is therefore committed to complying with European data protection principles. Both Google and US authorities may have access to your data.

Further information on terms of use and privacy can be found at: (as linked in the German version you provided).

7. Social media

Our online presence on Facebook (by Meta), Instagram (by Meta), LinkedIn

If you have granted your consent to the respective social media operator pursuant to Art. 6(1) sentence 1 lit. a GDPR, your data will be automatically collected and stored for market research and advertising purposes when visiting our online presence on the social media platforms listed above, and user profiles will be created using pseudonyms. These can be used, for example, to place ads within and outside the platforms that presumably correspond to your interests. Cookies are generally used for this purpose. Detailed information on the processing and use of data by the respective social media operator, as well as a contact option and your related rights and settings options to protect your privacy, can be found in the data protection notices of the providers linked below. If you still need help, you can contact us.

Facebook (by Meta) is provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). Information collected by Meta Platforms Ireland about your use of our Facebook presence is generally transmitted to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. Data processing in connection with visiting a Facebook fan page takes place on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR. Further information (information on Insights data) can be found in the provider’s information (as linked in the German version you provided).

Our service providers are located in and/or use servers in countries with an adequacy decision: USA, Canada, Japan, South Korea, New Zealand, United Kingdom, Argentina.
The adequacy decision for the USA applies as a basis for transfers to third countries insofar as the respective service provider is certified. Certification exists.

Our service providers are located in and/or use servers in: Australia, Hong Kong, India, Indonesia, Malaysia, Singapore, Thailand, Taiwan, Brazil, Mexico.
No adequacy decision exists for these countries. Our cooperation is based on the European Commission’s Standard Contractual Clauses.

Instagram (by Meta) is provided by Meta Platforms Ireland Ltd., Block J, Serpentine Avenue, Dublin 4, Ireland (“Meta Platforms Ireland”). Information collected by Meta Platforms Ireland about your use of our Instagram presence is generally transmitted to and stored on a server of Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. Data processing in connection with visiting an Instagram fan page takes place on the basis of an agreement between joint controllers pursuant to Art. 26 GDPR. Further information (information on Insights data) can be found in the provider’s information (as linked in the German version you provided).

(Providers/third countries wording as above.)

LinkedIn is provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). Information automatically collected by LinkedIn about your use of our LinkedIn presence is generally transmitted to and stored on a server of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Our service providers are located in and/or use servers in countries with an adequacy decision: USA.
The adequacy decision for the USA applies as a basis for transfers to third countries insofar as the respective service provider is certified. Certification exists.

8. Contact options and your rights

8.1 Your rights

As a data subject, you have the following rights:

  • pursuant to Art. 15 GDPR, the right to request information about your personal data processed by us to the extent described therein;

  • pursuant to Art. 16 GDPR, the right to request without undue delay the correction of inaccurate or completion of your personal data stored by us;

  • pursuant to Art. 17 GDPR, the right to request deletion of your personal data stored by us, unless further processing is required

    • for exercising the right of freedom of expression and information;

    • for compliance with a legal obligation;

    • for reasons of public interest; or

    • for the establishment, exercise or defence of legal claims;

  • pursuant to Art. 18 GDPR, the right to request restriction of processing of your personal data, insofar as

    • you contest the accuracy of the data;

    • the processing is unlawful but you oppose deletion;

    • we no longer need the data, but you require it for the establishment, exercise or defence of legal claims; or

    • you have objected to processing pursuant to Art. 21 GDPR;

  • pursuant to Art. 20 GDPR, the right to receive your personal data you have provided to us in a structured, commonly used and machine-readable format, or to request transmission to another controller;

  • pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your habitual residence, your place of work, or the registered office of our company.

Right to object

Where we process personal data as explained above to safeguard our overriding legitimate interests based on a balancing of interests, you may object to such processing with effect for the future. If processing is carried out for direct marketing purposes, you may exercise this right at any time as described above. If processing is carried out for other purposes, you have a right to object only on grounds relating to your particular situation.

After you exercise your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

This does not apply where processing is carried out for direct marketing purposes. In that case, we will no longer process your personal data for that purpose.

8.2 Contact options

If you have questions regarding the collection, processing or use of your personal data, requests for information, correction, restriction or deletion of data, or withdrawal of consents granted, or objection to a particular use of data, please contact us directly using the contact details provided in our Imprint.