Data Privacy Notice

We are pleased that you are visiting our website and appreciate your interest in our company and products. We would like to take this opportunity to inform you about which data we collect, use, and process, and how we handle your personal data.

Data Privacy Notice

We are pleased that you are visiting our website and appreciate your interest in our company and products. We would like to take this opportunity to inform you about which data we collect, use, and process, and how we handle your personal data.

1. Controller

The controller for the purposes of the General Data Protection Regulation (GDPR) is:

LUUK Brands Group I LUUK Studio I MHC&C GmbH
Website: https://www.luuk-studio.com
E-Mail: hello@luuk-studio.com
Address: MHC&C GmbH, Helene-Weber-Allee 12, 80637 Munich, Germany

The controller decides on the purposes and means of processing personal data.

2. General information on data processing

In principle, we process personal data of our users only to the extent necessary to provide a functional website as well as our content and services.

Legal bases may include in particular:
• Art. 6 (1) (a) GDPR – Consent
• Art. 6 (1) (b) GDPR – Performance of a contract
• Art. 6 (1) (c) GDPR – Legal obligation
• Art. 6 (1) (f) GDPR – Legitimate interests

Personal data will only be stored for as long as it is necessary for the respective purposes or as required by legal retention periods.

3. Hosting and platform (Shopify)

Our online shop is operated using the e-commerce platform Shopify.

Provider:
Shopify Inc.
151 O’Connor Street
Ottawa, Ontario K2P 2L8
Canada

Shopify provides the technical infrastructure for our online shop.

In this context, the following data may be processed:
• IP address
• Device information
• Browser information
• Order information
• Customer data
• Payment data

According to the EU Commission, Canada is considered a country with an adequate level of data protection.

4. Server log files

When accessing our website, Shopify automatically collects information in so-called server log files.

The following may be recorded:
• IP address
• Date and time of the request
• Browser type and version
• Operating system
• Referrer URL
• Pages accessed

The legal basis is Art. 6 (1) (f) GDPR.

5. Consent Management (Consentmo GDPR Banner)

Our website uses the Consentmo GDPR Banner to manage cookie consent.

In this context, the following may be processed:
• Consent status
• IP address (anonymized)
• Browser information
• Timestamp of consent

Legal basis:
• Art. 6 (1) (c) GDPR
• Art. 6 (1) (f) GDPR

Further information: https://www.consentmo.com

6. Cookies

Our website uses cookies. Cookies are small text files that are stored on your device.

We distinguish between:
• Technically necessary cookies
• Analytical cookies
• Marketing cookies

Management is handled via our consent management tool, Consentmo.

7. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited.

Google Analytics uses cookies to analyze the use of our website.

Collected data may include:
• IP address (shortened)
• Page views
• Click behavior
• Device information
• Duration of stay

Use is based exclusively on your consent in accordance with Art. 6 (1) (a) GDPR.

Further information: https://policies.google.com/privacy

8. Klaviyo (Email & SMS Marketing)

We use Klaviyo for email and SMS marketing purposes.

The following may be processed:
• Email address
• Phone number
• Open rates
• Click behavior
• Purchase history

Legal basis: Art. 6 (1) (a) GDPR.

9. Influencer & Affiliate Tracking (Linkster / GOAFFPRO)

We use services such as Linkster and GOAFFPRO to manage our affiliate and influencer marketing programs.

In this context, the following may be processed:
• Affiliate ID
• Tracking links
• Referrer information
• Transaction data
• IP address (shortened)

Legal basis: Art. 6 (1) (f) GDPR.

Creator Program (Linkster): We offer content creators and partners the opportunity to participate in our Creator Program. The program is managed via the service Linkster GmbH.

If you arrive at our online shop via a creator link or register for the Creator Program, information may be processed by Linkster and us in order to track the referral of a purchase and settle corresponding remuneration. This may specifically include information about clicks on a creator link, orders, and technical information (e.g., IP address, browser information, timestamps, and cookie IDs).

To the extent that cookies or similar technologies are used for this purpose, this is done exclusively on the basis of your consent according to Art. 6 (1) (a) GDPR, provided it is required by law. Further processing is carried out for the purpose of executing the Creator Program and on the basis of our legitimate interests pursuant to Art. 6 (1) (f) GDPR in a fair allocation of referral services.

Further information on data processing by Linkster can be found at: Privacy Policy – Linkster DE

10. Product reviews

We use the following services to display customer reviews:

• Judge.me
• Trusted Shops

In this context, the following may be processed:
• Name
• Review content
• Star ratings
• Order information

Legal basis: Art. 6 (1) (f) GDPR.

11. Analysis and optimization tools

We use various tools to analyze and improve our online shop, including:

• Sellerboard
• Stoq
• Propel Replays & Heatmaps
• Microsoft Clarity

In this context, anonymized usage data may be processed, e.g.:

• Mouse movements
• Click behavior
• Scrolling behavior
• Device information

Legal basis: Art. 6 (1) (a) GDPR or Art. 6 (1) (f) GDPR.

12. Video Commerce Tools

We use Whatmore Shoppable Videos to display interactive shopping videos.

In this context, the following data may be processed:

• Video interactions
• Usage behavior
• Device information
• IP address

Legal basis: Art. 6 (1) (f) GDPR.

13. ERP and interface systems

We use the following to manage orders and corporate processes:

• PlentyONE (ERP system)
• AccountOne (accounting and data interface)

In this context, the following may be processed:

• Order information
• Invoicing data
• Payment information
• Customer data

Legal basis: Art. 6 (1) (b) GDPR.

14. Payment providers

We work with various payment providers for payment processing, e.g.:

• Shopify Payments
• PayPal
• Klarna
• Credit card providers

In this context, the following data may be processed:

• Name
• Address
• Payment information
• Order information

Legal basis: Art. 6 (1) (b) GDPR.

15. Shipping service providers

We pass on data to shipping service providers for the delivery of our goods.

In this context, the following may be processed:

• Name
• Delivery address
• Email address
• Phone number
• Order information

Legal basis: Art. 6 (1) (b) GDPR.

16. Cancellation via the online cancellation form

On our website, we provide an electronic cancellation feature ("cancellation button") that you can use to cancel a concluded contract. If you use this feature, we will process the data you enter for the purpose of receiving, confirming, and processing your cancellation.

In this context, the following may be processed:
• Name
• Email address
• Order or contract number
• Content of the cancellation declaration
• Date and time of receipt

The legal basis is Art. 6 (1) (c) GDPR (fulfillment of a legal obligation) and Art. 6 (1) (b) GDPR (contract processing).

For the technical provision of the cancellation form, we use the service Anviara (Am Wesenitzbogen 7, 01847 Lohmen, Germany) as a data processor. The data is hosted on servers in Germany (Falkenstein) and stored for a period of 24 months, provided there are no legal retention obligations preventing deletion.

The legal basis for involving this service provider is Art. 6 (1) (f) GDPR (legitimate interest in the legally compliant and secure provision of the cancellation feature).

17. Shopify Apps

Our online shop uses various Shopify apps to extend functionality.

These include in particular:

• Linkster
• Sellerboard
• Stoq
• Judge.me
• Trusted Shops
• Whatmore
• GOAFFPRO
• Klaviyo
• Propel Replays & Heatmaps
• AccountOne
• PlentyONE
• Anviara (EU cancellation button)

These apps may process personal data to the extent necessary for their function.

18. Data transfer to third countries

Some of the service providers we use are based outside the European Union.

Data transfer only occurs on the basis of:

• An adequacy decision by the EU Commission
• Standard contractual clauses
• Or explicit consent.

19. Rights of data subjects

You have the following rights:

• Information about your stored data (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

20. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

21. Currency of the privacy policy

This privacy policy is currently valid and dated: June 2026

We reserve the right to adapt this privacy policy in the event of changes to our services or legal requirements.

Supplement: Payment methods in the Shopify checkout

In our online shop, we use the standard checkout of the Shopify platform.
Various payment methods are available to customers.
During payment processing, personal data may be transmitted to the respective payment providers to the extent necessary for the execution of the payment.

Offered payment methods include in particular:

• Credit card (Visa, Mastercard, American Express)
• Apple Pay
• Google Pay
• Shop Pay
• Klarna
• PayPal

During payment processing, the following data may be processed:

• Name
• Billing address
• Delivery address
• Email address
• Phone number
• Payment information
• Order information
• IP address
• Device information

Processing is carried out for the execution of the purchase contract in accordance with Art. 6 (1) (b) GDPR.

Depending on the chosen payment method, the necessary data will be forwarded to the corresponding payment service provider.
The respective payment providers process the data independently in accordance with their own data protection regulations.

The privacy policy was created using the Trusted Shops legal text generator in cooperation with Maier-Müller-Scholze Rechtsanwälte