Skip to content
Privacy Policy
We appreciate your interest in our shop. The protection of your personal data is important to us. Here you can find out what data we collect, what we use it for and what rights you have.
1. Controller
The controller in the sense of the General Data Protection Regulation (GDPR) is:
YW Commerce Ecomfly Limited
Office 3906, 39/F, The Center
99 Queen's Road Central
Central, Hong Kong
Business Registration Number (Hongkong): 79351125
E-Mail: support@alpenwarm.de
2. Hosting and Shop System
This shop runs on the Shopify platform. The provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes all data generated when visiting the shop and placing an order on our behalf.
We have concluded a data processing agreement with Shopify in accordance with Art. 28 GDPR. The legal basis is our legitimate interest in a secure and efficient shop operation (Art. 6 para. 1 lit. f GDPR) as well as the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR).
3. Server Log Files
When you access our pages, data transmitted by your browser is automatically collected: IP address, date and time of the request, page accessed, referrer URL, browser type and operating system. This data is used for technical provision, security and error analysis. No merging with other data sources takes place.
Legal basis: Art. 6 para. 1 lit. f GDPR.
4. Order and Contract Fulfilment
If you place an order, we process the data we need for processing: name, delivery and billing address, email address, if applicable phone number, order and payment data.
We pass this data on to:
- the payment company you selected for payment processing,
- the contracted shipping service provider for the delivery of your order,
- our tax advisor and the tax authorities, as far as legally required.
Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfilment) as well as Art. 6 para. 1 lit. c GDPR (legal obligation, in particular commercial and tax law retention periods of six to ten years).
5. Payment Service Providers
Depending on which payment method you choose, we pass the data necessary for payment processing to the respective provider, for example to PayPal, Apple, Google or the card processing service provider. These providers are independently responsible for the processing; their privacy policies also apply.
Legal basis: Art. 6 para. 1 lit. b GDPR.
6. Customer Account
You can order from us without creating an account. If you create one, we store the data stored there until you delete the account. Legal basis: Art. 6 para. 1 lit. b GDPR.
7. Contacting Us
If you write to us by email or via a form, we store your information to process your request. Legal basis: Art. 6 para. 1 lit. b GDPR for contract-related enquiries, otherwise Art. 6 para. 1 lit. f GDPR.
8. Newsletter and Email Dispatch via Klaviyo
If you subscribe to our newsletter, we process your email address to send you information about products and promotions. The registration takes place via a double opt-in procedure: you receive a confirmation email after registration and are only registered after clicking on the confirmation link.
Legal basis: your consent, Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time – via the unsubscribe link in every email or by sending a message to support@alpenwarm.de. The legality of the processing carried out until then remains unaffected.
We use Klaviyo for dispatch. The provider is Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Klaviyo processes your email address and other information you provide to us, as well as data on how you use our emails – whether and when you opened an email and which links you clicked – and data on your behaviour in our shop, such as viewed products and abandoned shopping carts, on our behalf. This helps us to tailor the newsletter to your interests and to measure the effectiveness of our emails.
We have concluded a data processing agreement with Klaviyo in accordance with Art. 28 GDPR. Klaviyo also processes data in the USA. We base the transfer on the EU-US Data Privacy Framework and additionally on the standard contractual clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR.
Your data remains stored with Klaviyo until you unsubscribe from the newsletter. After that, we delete it or add it to a blocking list so that you do not receive any further emails from us. More information can be found in Klaviyo's privacy policy: klaviyo.com/legal/privacy-notice.
9. Cookies and Consent Management
We use technically necessary cookies for the shop to function – for example, for the shopping cart and language settings. Legal basis: § 25 para. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR.
Cookies and technologies that are not technically necessary – in particular for analysis and marketing – are only used with your consent. Legal basis: § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. You can change your selection at any time.
10. Analysis and Marketing
The following services are only used if you have given your consent in the cookie banner. The legal basis in each case is § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by changing your cookie selection; the legality of the processing carried out until then remains unaffected.
Meta Pixel (Facebook and Instagram)
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
The Meta Pixel records which pages you visit in our shop and which actions you take – for example, viewing a product, adding it to the shopping cart or completing an order. Your IP address, device and browser information, online identifiers including cookie IDs, and this event data are processed. We use this to measure the effectiveness of our advertising and to display suitable ads to you on Facebook and Instagram.
Meta also processes the data for its own purposes. For the collection and transfer, we and Meta are joint controllers according to Art. 26 GDPR; for the subsequent processing, Meta is solely responsible. A transfer to the USA is possible and is based on the EU-US Data Privacy Framework and on standard contractual clauses. Storage period: generally up to 24 months. Further information: facebook.com/privacy/policy.
Google Analytics and Google Ads
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics evaluates how you use our shop: pages viewed, duration of stay, origin of the visit, approximate location based on the truncated IP address, device and browser data, and online identifiers. The IP address is truncated before evaluation. Via Google Ads and conversion tracking, we also measure whether an ad led to an order and can display ads to you on Google services and partner sites.
We have concluded a data processing agreement with Google. A transfer to the USA is possible and is based on the EU-US Data Privacy Framework and on standard contractual clauses. Storage period: up to 14 months for user and event data. Further information: policies.google.com/privacy.
TikTok Pixel
Provider for users in the European Economic Area: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
The TikTok Pixel records which pages you visit and which actions you take – for example, product view, shopping cart and purchase completion. IP address, device and browser data, online identifiers and this event data are processed. We use this to measure the effectiveness of our TikTok advertising and to target ads.
A transfer to TikTok group companies outside the European Union, including the USA, Singapore and China, cannot be ruled out. There is no adequacy decision by the European Commission for China; TikTok bases the transfer on standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR. A level of data protection equivalent to the European level cannot be guaranteed. Storage period: generally up to 13 months. Further information: tiktok.com/legal/privacy-policy-eea.
11. Data Transfer to Third Countries
Some of the services used also process data outside the European Union. In these cases, we base the transfer on an adequacy decision of the European Commission or on standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR.
12. Storage Period
We only store personal data for as long as it is necessary for the respective purpose or as required by legal retention periods. After that, we delete it or restrict processing.
13. Your Rights
You have the right to:
- Information about the data stored about you (Art. 15 GDPR),
- Rectification of incorrect data (Art. 16 GDPR),
- Erasure (Art. 17 GDPR),
- Restriction of processing (Art. 18 GDPR),
- Data portability (Art. 20 GDPR),
- Object to processing, insofar as it is based on a legitimate interest (Art. 21 GDPR),
- Withdraw consent given with effect for the future (Art. 7 para. 3 GDPR).
Simply write to us at support@alpenwarm.de.
14. Right to Complain
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR. The supervisory authority of your usual place of residence, your workplace or the place of the alleged infringement is competent.
15. Changes to this Declaration
We will adjust this privacy policy if our processing changes or if the legal situation requires it. The current version can always be found on this page.
Status: October 2026