Privacy policy
This is an English translation of our German legal text. The German version is the legally binding one; in case of any discrepancy, the German wording prevails.
1. Controller
The controller for data processing on this website is:
ninetyvintage
Simon Püschel
Peterstraße 36
20355 Hamburg
Germany
E-mail: ninetyvintage@gmx.net
Instagram: @ninetyvintage
We have not appointed a data protection officer; we are not legally required to do so.
2. Your rights at a glance
You have the following rights regarding your personal data:
- Access to the data stored about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR), unless a statutory retention obligation applies
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on a legitimate interest (Art. 21 GDPR)
- Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)
An informal message to ninetyvintage@gmx.net is sufficient to exercise these rights.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). You have the right to complain to a data protection supervisory authority. The authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
Telephone: +49 40 428 54 – 4040
Website: datenschutz-hamburg.de
3. Visiting our website
When you visit our website, technical data is transmitted to the server and stored in log files: IP address, date and time of access, page accessed, volume of data transferred, referring website, browser type and operating system.
Purpose: delivering the website, stability and security of operation, defence against attacks and fraud attempts.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and functioning operation of the shop.
Retention: log data is deleted or anonymised after 30 days at the latest.
4. Orders and performance of the contract
When you order from us, we process: first and last name, billing and delivery address, e-mail address, telephone number where applicable, order and payment data.
Purpose: conclusion and performance of the purchase contract, shipping, invoicing, handling of withdrawal, returns and warranty, communication about your order.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and, where tax or commercial law obligations are concerned, Art. 6 (1) (c) GDPR.
Retention: we keep order and invoice data because of the retention obligations under § 257 German Commercial Code and § 147 German Fiscal Code – six or ten years from the end of the calendar year, depending on the document. After that we delete it. Data not subject to a retention obligation is deleted as soon as it is no longer needed for the stated purpose.
5. Customer account
You can order from us without creating an account. If you voluntarily create a customer account, we store the data kept there until you delete the account. The legal basis is Art. 6 (1) (b) GDPR. Order data that we must retain under section 4 is not affected by the deletion.
6. Contacting us
If you write to us by e-mail, through the contact form or via Instagram, we process your details in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR if the enquiry concerns a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). We delete the correspondence once the matter is closed and no retention obligation applies.
7. Shop platform and hosting
Our shop runs on the Shopify platform. The provider is:
Shopify International Limited
The Sidings, 4th Floor, Grand Canal Quay
Dublin D02 E7K8, Ireland
Shopify processes all data arising from the operation of the shop on our behalf – in particular access and order data. The basis is a data processing agreement under Art. 28 GDPR. To operate the shop, Shopify also uses group companies outside the EU, among others in Canada and the United States. For Canada there is an adequacy decision of the European Commission for organisations subject to PIPEDA; transfers to the United States are based on the EU-US Data Privacy Framework and additionally on standard contractual clauses under Art. 46 (2) (c) GDPR.
The legal basis for using Shopify is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (f) GDPR (legitimate interest in a secure, professionally operated shop).
8. Cookies and comparable technologies
We use cookies that are technically necessary for the operation of the shop – for example to store your cart, the selected language and currency, and to secure the order process.
Legal basis: for storage on your device § 25 (2) no. 2 TDDDG (strictly necessary to provide the service you expressly requested), for the subsequent processing Art. 6 (1) (f) GDPR.
You can delete or block cookies in your browser. If technically necessary cookies are blocked, the order process may not work.
For services that are not technically necessary, we obtain your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR. You can withdraw consent at any time with effect for the future.
9. Reach measurement by Shopify
Shopify collects statistical data for us about the use of the shop – for example which pages are accessed and how visitors reach us. This analysis helps us improve what we offer. The legal basis is your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR, insofar as information is stored on or read from your device for this purpose.
10. Payment processing
We process payments through payment service providers. Which data arises depends on the payment method you choose. We do not receive your complete payment details – such as card numbers or bank access data; these are transmitted directly to the payment service provider.
Shopify Payments (card, Apple Pay, Google Pay, Shop Pay and others): Shopify International Limited, address as above.
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract). The payment service providers process data partly as controllers in their own right, in particular to meet their own legal obligations and for fraud prevention; their privacy notices then apply in addition.
11. Shipping
For shipping we pass on your name, the delivery address and – if you provided them – your e-mail address or telephone number to our shipping service provider so that it can deliver the parcel and inform you about its status.
DHL: Deutsche Post AG / DHL Group, Charles-de-Gaulle-Str. 20, 53113 Bonn, Germany.
Legal basis: Art. 6 (1) (b) GDPR.
12. Instagram feed on our website
On our website we embed posts from our Instagram profile using the service Instafeed. When the feed loads, a connection is established to the provider's servers and to Instagram; your IP address is transmitted in the process.
Legal basis: your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
Instagram is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta also transfers data to the United States, relying on the EU-US Data Privacy Framework.
13. Withdrawal form
For the online withdrawal function we use the service “EU Widerrufs-Button Pro”. If you use the form, the details you enter – e-mail address, name, order number and selected items – are processed in order to identify your order, receive your declaration of withdrawal and send you the statutory acknowledgement of receipt.
Legal basis: Art. 6 (1) (c) GDPR (compliance with our legal obligation under § 356a German Civil Code) and Art. 6 (1) (b) GDPR.
14. Product data at Google
We transmit our product data – title, description, image, price and availability – to Google so that our items appear in Google Search and Google Shopping. No personal data of our customers is transmitted in the process. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in advertising our offering).
15. Recipients of your data
Beyond the service providers named above, we only pass on your data where this is necessary to perform the contract or where we are legally obliged to do so – for example to our tax adviser, to tax authorities, or on the basis of an official or court order. We do not sell data.
16. Automated decision-making
Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place.
17. Obligation to provide data
Providing personal data is neither required by law nor by contract. However, without the details necessary for an order – in particular name, address and payment data – we cannot conclude and perform a contract with you.
18. Minors
Our offering is directed at persons of full age. We do not knowingly collect data from children.
19. Changes to this privacy notice
We adapt this privacy notice when our processing operations or the legal situation change. The version published on this page at the time applies.
Last updated: 5 September 2026