Privacy policy
Last updated: 22 September 2026
Who is responsible for your information
This Privacy Policy explains how Budka Shop handles personal information when you visit https://budka-shop.com, buy our products, request personalization, contact us, or subscribe to our marketing.
Store operator and data controller: Rokos Design UG (haftungsbeschränkt).
Postal address: Breitestr. 7 /1, 72147 Nehren, Germany.
Privacy contact email: info@budka-shop.com.
In this policy, “we”, “us” and “our” refer to that store operator. Shopify also processes certain information for its own purposes, as explained below.
Information we handle
The information involved depends on how you use the store:
- Contact and order information: your name, email, billing and shipping addresses, any telephone number you provide, products and variants selected, purchases, returns, and communications about your order.
- Personalization instructions: names, text or contact details you ask us to place on a product. Please provide only information you are entitled to share, and avoid unnecessary sensitive details.
- Payment and transaction information: payment status, transaction references and information made available by payment providers. Payment credentials are processed through the checkout and its payment providers; please do not send card details to our support email.
- Account and support information: account-related information, enquiries, messages, and any files or other information you choose to send us.
- Browsing and device information: IP address, browser and device information, approximate location, pages and products viewed, shopping-cart activity, referral information, and cookie or similar identifiers.
- Marketing and feedback information: subscription and consent preferences, interactions with marketing messages, and reviews or feedback you submit. Review content may be displayed publicly with the name you choose to provide.
We obtain information from you, from your interactions with the store, and from providers involved in payments, delivery, store operation and marketing. If you provide a recipient’s details for a gift or personalized product, please tell them that we will use those details to fulfil the order.
Why we use information
Where the GDPR applies, we rely on the following grounds for our own processing: performance of a contract (Article 6(1)(b)), legal obligations (Article 6(1)(c)), legitimate interests (Article 6(1)(f)), and consent (Article 6(1)(a)), as set out below:
| Purpose | Information involved | Legal basis |
|---|---|---|
| Respond to an enquiry about a prospective purchase; accept, personalize, fulfil and support an order; handle returns | Contact, order, payment-status, personalization and relevant support information | Taking steps at your request before a contract and performing our contract |
| Keep required accounting and transaction records; respond to legally binding requests | Relevant order, payment and correspondence records | Compliance with legal obligations |
| Protect the store, investigate fraud or misuse, resolve disputes, and handle general business enquiries | Relevant device, transaction and communication information | Our legitimate interests in secure operation, customer support and protecting legal rights, balanced against your rights |
| Send subscribed marketing messages and use optional analytics or advertising technologies where consent is required | Contact details, preferences, browsing and marketing-interaction information | Consent |
We need certain information to process and deliver your order. Without it, we may be unable to complete the purchase. Marketing consent is optional and is not required to buy from us.
You may object to processing based on legitimate interests. You may object to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting processing that was lawful before withdrawal.
Who receives information
Information is shared as needed for the relevant service, including with:
- Shopify, which hosts the store and provides checkout, customer-account, payment-related, security and other commerce services.
- Payment providers, including Shopify Payments and payment methods you select at checkout, to process transactions and address fraud or payment disputes.
- Delivery and fulfilment providers, with the information needed to deliver orders and handle returns; and professional advisers where necessary for legal obligations or claims. We administer our orders ourselves in Shopify.
- Production partners in Ukraine, who receive relevant product information and the personalization text requested for manufacture. We do not send customer names, addresses or telephone numbers as separate contact or delivery details to these partners. Personalization text may itself contain a name, telephone number or other personal information. We share that text to fulfil the personalization requested, on the basis of performing our contract.
- Google, which hosts our support correspondence, and Klaviyo and Shopify messaging services, for the email forms, communications and marketing features used by the store, subject to the relevant preferences and permissions.
- Google and Meta, through the store’s Google & YouTube and Facebook & Instagram integrations, for the advertising, measurement or related features in use, subject to applicable choices and consent requirements.
- Store application providers, such as providers of reviews, product offers, galleries and shipment tracking, to the extent their features require information. The store uses apps including Ryviu, Kaching, XO Gallery and CWILL/ParcelPanel.
- Public authorities or other parties where disclosure is legally required or necessary to establish, exercise or defend legal claims.
Provider information is available from Shopify, Klaviyo, Google and Meta. Their notices supplement the description here; they do not replace our responsibility for our own processing.
Shopify and Shopify Network Intelligence
Our store is hosted by Shopify. We share information with Shopify when you visit or purchase from us. With Shopify Network Intelligence enabled, Shopify also uses information from interactions with our store, other merchants and Shopify to provide enhanced services, including improving commerce services, security and advertising-related features.
For certain enhanced services Shopify determines how information is processed for its own purposes. Read the Shopify Consumer Privacy Policy for details. You can use the Shopify Privacy Portal to exercise rights and manage relevant Shopify choices, including objections, withdrawal of consent and advertising-related choices.
Information may be processed by Shopify and other providers in countries outside your own. Contacting Shopify about its processing does not replace your right to contact us about our processing.
Cookies, advertising and your choices
The store uses cookies and similar technologies for functions such as shopping carts, checkout, security and remembering preferences. Optional technologies can also support analytics, email personalization and advertising.
Use Cookie preferences in the LEGAL section of our website footer to reopen your choices, change the optional categories and select Save my choices, or select Decline all to refuse optional cookies. Where the cookie banner is displayed, you can also accept or decline optional cookies or review the available preferences. These controls let you give or withdraw consent for optional categories. Withdrawing consent does not affect processing that was lawful before withdrawal. Browser settings also let you delete or block cookies, although blocking necessary cookies can affect store functionality. Shopify describes its technologies in its Cookie Policy.
Advertising integrations may disclose identifiers, browsing information or purchase-related information in ways that qualify as “sale”, “sharing” or “targeted advertising” under applicable US state laws. Those terms can include advertising disclosures even where no payment is made for the information.
Depending on applicable law, you may opt out of these uses through our Your Privacy Choices page. The device-based opt-out control is available in the applicable US states. You can also contact our privacy email for help with requests concerning our store, and use the Shopify Privacy Portal for Shopify’s own processing.
You may unsubscribe from marketing emails using the unsubscribe link in the message. Necessary order or service messages may still be sent. Your choices on one service do not necessarily change preferences on every other service.
International transfers
Our service providers may process information outside the EEA, the UK or your home country, including in Canada and the United States. Where applicable law requires it, transfers must be covered by an appropriate mechanism, such as an applicable adequacy decision or contractual safeguards. You may contact us for information about safeguards relevant to our processing and how to obtain a copy. This includes the personalization information sent to production partners in Ukraine. Shopify explains its transfer arrangements in its Data Processing Addendum.
How long information is kept
We keep our order records in Shopify and do not maintain separate copies in spreadsheets or other order-record systems. Support correspondence is handled separately through our support inbox. Providers may also process information as described above.
Retention depends on why information is needed. Order, personalization and support information is kept for the period needed to provide the service and handle related issues. Relevant transaction records may need to be kept longer to meet accounting or tax duties, resolve disputes or protect legal claims. Marketing records are kept while the relevant subscription or permission remains in effect, with limited suppression or consent records where necessary to respect opt-outs and demonstrate compliance.
A deletion request does not override mandatory retention requirements. Once information is no longer needed for the purposes described above and no applicable retention obligation remains, it should be deleted or anonymized.
Your rights and requests
Subject to applicable law and its exceptions, you may request access to your information, correction, deletion, restriction of processing, or a portable copy. You may object to certain processing and withdraw consent. Depending on your US state, you may also have rights to opt out of sale, sharing or targeted advertising, and appeal a refusal of a request.
Use the privacy contact above to make a request or appeal. We may need proportionate information to verify the request. Where allowed, an authorized agent can act for you with evidence of authority. We will respond within the time required by applicable law and explain any applicable exception. For GDPR requests, this is normally within one month, subject to extensions permitted by law. Exercising a privacy right will not itself result in unlawful discrimination.
You may also complain to the competent data protection authority, including the authority where you live, work or believe an infringement occurred. For our establishment in Baden-Württemberg, you can contact the LfDI Baden-Württemberg. UK residents can contact the Information Commissioner’s Office.
Automated processing
Shopify and payment providers use automated tools for security and fraud assessment. If you have concerns about a payment or order decision, contact us so that the issue can be reviewed. Where applicable, you have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects, including requesting human intervention and contesting a decision.
Children, security and changes
Our store is intended for a general shopping audience, rather than services directed to children. If you believe a child has provided information that should not have been collected, please contact us.
We use safeguards appropriate to the services we operate, but no internet service can guarantee absolute security. Please avoid sending unnecessary sensitive information through store forms or email.
We may update this policy when our practices or relevant requirements change. The last-updated date appears at the top of this policy. We will provide additional notice where required.