Privacy Policy

We are pleased that you are interested in our shop. The protection of your personal data matters to us. Here you can find out what data we collect, what we use it for, and what rights you have.

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
YW Commerce Ecomfly Limited
Office 3906, 39/F, The Center
99 Queen's Road Central
Central, Hong Kong
Business Registration Number (Hong Kong): 79351125
Email: support@alpenwarm.de

Hosting and shop platform

This shop runs on the Shopify platform. The provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes, on our behalf, all data generated when you visit the shop or place an order.

We have concluded a data processing agreement with Shopify in accordance with Art. 28 GDPR. The legal basis is our legitimate interest in a secure and efficient shop operation (Art. 6 (1)(f) GDPR) and contract performance (Art. 6 (1)(b) GDPR).

Server log files

When you visit our pages, data your browser transmits is collected automatically: IP address, date and time of the request, the page visited, referrer URL, browser type and operating system. This data is used for technical provision, security and error analysis. It is not merged with other data sources.
Legal basis: Art. 6 (1)(f) GDPR.

Orders and contract processing

When you place an order, we process the data we need to handle it: name, delivery and billing address, email address, telephone number if provided, and order and payment details.

We pass this data on to:

• the payment provider you have chosen, to process the payment,
• the shipping carrier commissioned to deliver your order,
• our tax advisor and the tax authorities, where required by law.

Legal basis: Art. 6 (1)(b) GDPR (contract performance) and Art. 6 (1)(c) GDPR (legal obligation, in particular commercial and tax retention periods of six to ten years).

Payment service providers

Depending on the payment method you choose, we pass the data required for payment processing to the respective provider — for example PayPal, Apple, Google, or the card processor. These providers are independently responsible for their own processing; their privacy notices apply in addition.
Legal basis: Art. 6 (1)(b) GDPR.

Customer account

You can order from us without creating an account. If you create one, we store the data held there until you delete the account.
Legal basis: Art. 6 (1)(b) GDPR.

Contact

If you write to us by email or via a form, we store your details in order to handle your enquiry.
Legal basis: Art. 6 (1)(b) GDPR for contract-related enquiries, otherwise Art. 6 (1)(f) GDPR.

Newsletter and email delivery via Klaviyo

If you subscribe to our newsletter, we process your email address to send you information about products and promotions. Sign-up uses the double opt-in procedure: after you subscribe, you receive a confirmation email and are only subscribed once you click the confirmation link.

Legal basis: your consent, Art. 6 (1)(a) GDPR. You can withdraw your consent at any time — via the unsubscribe link in every email or by writing to support@alpenwarm.de. The lawfulness of the processing carried out until then remains unaffected.

We use Klaviyo to send these emails. The provider is Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. On our behalf, Klaviyo processes your email address and any other details you give us, as well as data about how you use our emails — whether and when you open an email and which links you click — and data about your behaviour in our shop, such as products viewed and abandoned carts. This helps us tailor the newsletter to your interests and measure the effect of our emails.

We have concluded a data processing agreement with Klaviyo in accordance with Art. 28 GDPR. Klaviyo also processes data in the USA. The transfers are based on the EU-US Data Privacy Framework and, in addition, on the European Commission's Standard Contractual Clauses under Art. 46 (2)(c) GDPR.

Your data remains stored with Klaviyo until you unsubscribe from the newsletter. Afterwards, we delete it or place it on a suppression list so that you do not receive further emails from us. See Klaviyo's privacy notice: klaviyo.com/legal/privacy-notice.

Cookies and consent management

We use strictly necessary cookies so the shop works — for example for the cart and the language setting. Legal basis: § 25 (2) TDDDG in conjunction with Art. 6 (1)(f) GDPR.

Cookies and technologies that are not strictly necessary — in particular for analytics and marketing — are only used with your consent. Legal basis: § 25 (1) TDDDG in conjunction with Art. 6 (1)(a) GDPR. You can change your choice at any time.

Analytics and marketing

We only use the following services if you have consented in the cookie banner. The legal basis in each case is § 25 (1) TDDDG in conjunction with Art. 6 (1)(a) GDPR. You can withdraw your consent at any time with effect for the future by changing your cookie choice; the lawfulness of the processing carried out until then remains unaffected.

Meta Pixel (Facebook and Instagram)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The Meta Pixel records which pages you visit in our shop and which actions you take there — such as viewing a product, adding to the cart or completing an order. Your IP address, device and browser information, online identifiers including cookie IDs and this event data are processed. We use this to measure the effect of our advertising and to show you relevant ads on Facebook and Instagram.

Meta also processes the data for its own purposes. For the collection and transmission, we and Meta are joint controllers under Art. 26 GDPR; for the subsequent processing, Meta is solely responsible. A transfer to the USA is possible and is based on the EU-US Data Privacy Framework as well as Standard Contractual Clauses. Storage period: usually up to 24 months. More information: facebook.com/privacy/policy.

Google Analytics and Google Ads

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics measures how you use our shop: pages visited, time spent, origin of the visit, approximate location based on the shortened IP address, device and browser data, and online identifiers. The IP address is shortened before evaluation. Via Google Ads and conversion tracking, we additionally measure whether an ad led to an order, and we can serve ads on Google services and partner sites.

We have concluded a data processing agreement with Google. A transfer to the USA is possible and is based on the EU-US Data Privacy Framework as well as Standard Contractual Clauses. Storage period: up to 14 months for user and event data. More information: policies.google.com/privacy.

TikTok Pixel

Provider for users in the European Economic Area: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

The TikTok Pixel records which pages you visit and which actions you take — such as product views, cart and purchase completion. IP address, device and browser data, online identifiers and this event data are processed. We use this to measure the effect of our TikTok advertising and to target ads.

A transfer to TikTok group companies outside the European Union — including the USA, Singapore and China — cannot be ruled out. There is no adequacy decision by the European Commission for China; TikTok bases the transfer on Standard Contractual Clauses under Art. 46 (2)(c) GDPR. A level of data protection equivalent to the European one cannot be guaranteed. Storage period: usually up to 13 months. More information: tiktok.com/legal/privacy-policy-eea.

Data transfers to third countries

Some of the services we use also process data outside the European Union. In these cases, we base the transfer on an adequacy decision of the European Commission or on Standard Contractual Clauses under Art. 46 (2)(c) GDPR.

Storage period

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. Afterwards, we delete it or restrict its processing.

Your rights

You have the right to:

• information about the data stored about you (Art. 15 GDPR),
• correction of inaccurate data (Art. 16 GDPR),
• deletion (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on a legitimate interest (Art. 21 GDPR),
• withdraw consent given, with effect for the future (Art. 7 (3) GDPR).

Simply write to support@alpenwarm.de to exercise any of these.

Right to lodge a complaint

You have the right to complain to a data protection supervisory authority if you believe that the processing of your data violates the GDPR. The competent authority is the one at your usual place of residence, your workplace, or the place of the suspected violation.

Changes to this notice

We adapt this privacy policy when our processing changes or the legal situation requires it. The current version can always be found on this page.

Last updated: September 2026

Privacy Policy — International

For customers in the UK, US, Canada, Australia and New Zealand

The section above is our GDPR-based privacy notice, written for customers in Germany, Austria, Luxembourg, Switzerland and Liechtenstein. This section is written for customers in the United Kingdom, the United States, Canada, Australia and New Zealand and describes the same practices in plain English, plus the rights that apply specifically in your country.

Who's responsible for your data

YW Commerce Ecomfly Limited
Office 3906, 39/F, The Center
99 Queen's Road Central
Central, Hong Kong
Hong Kong Business Registration Number: 79351125
Email: support@alpenwarm.de

Hosting and shop platform

This shop runs on Shopify. The platform provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes, on our behalf, all data generated when you browse the shop or place an order.

Server logs

Visiting our site automatically records data your browser sends: IP address, date and time of the request, page requested, referrer URL, browser type and operating system. We use this for technical delivery, security and troubleshooting. We don't combine it with other data sources.

Order and account data

When you order, we process what's needed to fulfil the order: name, billing and shipping address, email, phone number if given, and order and payment details. We share this with the payment provider you choose, the carrier delivering your order, and our accountant or tax authorities where the law requires it. If you create an account, we keep the data in it until you delete the account.

Payment providers

Depending on the payment method you choose, we pass the data needed to process payment to the relevant provider — for example PayPal, Apple, Google, or the card processor. These providers are independently responsible for their own processing, and their own privacy notices apply in addition to this one.

Getting in touch

If you email us or use a contact form, we keep what you send us to handle your query.

Newsletter (Klaviyo)

If you sign up for our newsletter, we process your email address to send you product and promotion updates. Sign-up uses double opt-in: you get a confirmation email and are only subscribed once you click the confirmation link. You can unsubscribe at any time using the link in every email or by writing to support@alpenwarm.de.

We use Klaviyo to send these emails. The provider is Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. On our behalf, Klaviyo processes your email address and any other details you give us, plus data on how you interact with our emails (opens, link clicks) and your shop activity (products viewed, abandoned carts), so we can tailor the newsletter and measure results. Your data stays with Klaviyo until you unsubscribe, after which we delete it or suppress it so you receive no further emails. See Klaviyo's own privacy notice: klaviyo.com/legal/privacy-notice.

Cookies and consent

We use strictly necessary cookies so the shop works — for example the cart and language setting. Where the law where you live requires your opt-in consent for cookies that aren't strictly necessary — including analytics and advertising — we only set them once you've agreed in our cookie banner, and you can change your choice at any time.

Analytics and advertising

The following services are used only where you've consented in the cookie banner (or, in jurisdictions that use an opt-out model rather than opt-in, until you opt out as described below).

Meta Pixel (Facebook and Instagram) — Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (for users outside the EEA/UK, Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA, may also be involved). The Meta Pixel records which pages you visit and actions you take in our shop — viewing a product, adding to cart, completing an order — along with your IP address, device and browser information, and cookie-based identifiers. We use this to measure and improve our advertising on Facebook and Instagram.

Google Analytics and Google Ads — Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and, for US users, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics measures how you use our shop — pages visited, time spent, approximate location from a truncated IP address, device and browser data. Google Ads and conversion tracking let us see whether an ad led to an order.

TikTok Pixel — Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and, for US users, TikTok Inc., 5800 Bristol Parkway, Culver City, CA 90230, USA. The TikTok Pixel records page views and actions (product view, cart, purchase) so we can measure and target our TikTok advertising.

Data transfers outside your country

Several of the services above process data in countries other than your own, including Ireland and the United States. Where required, we and our providers use recognised transfer safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses, for these transfers.

How long we keep data

We keep personal data only as long as it's needed for the purpose it was collected for, or as long as the law requires us to keep it (for example, accounting records), then delete it or restrict its processing.

Your rights, generally

Wherever you live, you can normally ask us to: tell you what data we hold about you; correct inaccurate data; delete your data; and object to or restrict certain processing. Write to support@alpenwarm.de to use any of these. We may need to verify your identity first.

Rights and regulators specific to your country

United Kingdom — UK GDPR and the Data Protection Act 2018 apply to your data. In addition to the rights above, you have the right to data portability and the right to withdraw consent at any time where processing is based on consent. You can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

United States — California — If you're a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the right to know what personal information we've collected about you, to request its deletion or correction, to opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising, and to limit use of sensitive personal information — and the right not to be discriminated against for exercising any of these. We don't sell personal information for money, but sharing data with advertising partners such as Meta, Google and TikTok as described above can count as a "sale" or "sharing" under California law. You can opt out on our privacy choices page, or by sending a Global Privacy Control signal from your browser.

Canada — The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to your data. You can ask to access or correct your information, and withdraw consent to processing that relies on it, by writing to support@alpenwarm.de. If we can't resolve your concern, you can complain to the Office of the Privacy Commissioner of Canada. If you're in Québec, Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) also applies, and you can complain to the Commission d'accès à l'information du Québec.

Australia — We handle your data in line with the Australian Privacy Principles under the Privacy Act 1988. You can ask to access or correct your information by writing to support@alpenwarm.de. If we can't resolve your complaint, you can raise it with the Office of the Australian Information Commissioner (OAIC).

New Zealand — We handle your data in line with the Information Privacy Principles under the Privacy Act 2020. You can ask to access or correct your information by writing to support@alpenwarm.de. If we can't resolve your complaint, you can raise it with the Office of the Privacy Commissioner.

European Economic Area and Switzerland — If you're in the EEA or Switzerland, the GDPR or the Swiss Federal Act on Data Protection applies to your data in the same way described in the German-language section above, regardless of which language you're reading this in.

Changes to this policy

We update this policy when our data practices change or the law requires it. The current version is always on this page.

Last updated: September 2026