PRIVACY POLICY

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Overthink the Label
c/o Alexandra Krietzsch
Pistoriusstr. 109
13086 Berlin
Germany

Email: overthinkthelabel@gmail.com
Telephone: [Telephone Number]

2. General Information on Data Processing

The protection of your personal data is of particular importance to us. We process personal data exclusively in accordance with the applicable provisions of data protection law, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data means any information relating to an identified or identifiable natural person.

3. Hosting

Our website is hosted by:

Squarespace

For the purpose of operating, securing and optimizing the website, the hosting provider processes server log data including:

  • IP address

  • Date and time of access

  • Requested page

  • Browser type and version

  • Operating system

  • Referrer URL

  • Host name of the accessing device

The processing is carried out on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the stability, security and functionality of our website.

A data processing agreement pursuant to Art. 28 GDPR has been concluded where required.

4. Server Log Files

When accessing our website, information is automatically collected and temporarily stored in server log files.

The processing is necessary for:

  • technical provision of the website,

  • system security,

  • prevention of misuse,

  • troubleshooting.

The legal basis is Art. 6(1)(f) GDPR.

5. Cookies and Consent Management

Our website uses cookies and similar technologies.

Technically necessary cookies are used on the basis of Section 25(2) TDDDG and Art. 6(1)(f) GDPR.

Cookies used for analytics, marketing or personalization purposes are only stored after obtaining your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

You may withdraw your consent at any time with future effect through our cookie settings.

6. Contacting Us

If you contact us by email, contact form, telephone or social media, we process the information you provide to handle your inquiry.

The legal basis is:

  • Art. 6(1)(b) GDPR where your inquiry relates to a contract or pre-contractual measures;

  • Art. 6(1)(f) GDPR for general inquiries.

7. Customer Account and Orders

When creating a customer account or placing an order, we process:

  • Name

  • Billing address

  • Shipping address

  • Email address

  • Telephone number (if provided)

  • Order details

  • Customer account credentials

Processing is carried out pursuant to Art. 6(1)(b) GDPR for the performance of the purchase contract.

Commercial and tax law retention obligations remain unaffected.

8. Dropshipping and Order Fulfilment

To fulfil orders, we may transmit the data required for order processing and shipment to carefully selected suppliers, manufacturers, wholesalers, fulfilment providers and logistics partners.

Depending on the product ordered, the goods may be shipped directly by a third-party supplier ("dropshipping").

The following categories of data may be transferred:

  • Name

  • Delivery address

  • Contact information where necessary for shipment

  • Ordered products

The processing is necessary for the performance of the contract pursuant to Art. 6(1)(b) GDPR.

Where suppliers are located outside the European Union, data transfers shall only take place in accordance with the requirements of Chapter V GDPR.

9. Payment Processing

Payments are processed through the payment service providers offered during checkout.

Depending on the selected payment method, personal data may be transferred to:

  • Squarespace Payments

  • Stripe Payments Europe Ltd.

  • PayPal (Europe) S.à r.l. et Cie, S.C.A.

  • Klarna Bank AB

  • Apple Pay

  • Google Pay

  • Sofort GmbH

The transfer takes place exclusively for payment processing pursuant to Art. 6(1)(b) GDPR.

The respective provider acts as an independent controller for subsequent processing operations.

10. Shipping Service Providers

To deliver orders, personal data is transmitted to shipping providers such as:

  • DHL Paket GmbH

  • Deutsche Post AG

  • UPS Europe SA

The processing is based on Art. 6(1)(b) GDPR.

Only data required for delivery is transferred.

11. Newsletter

If you subscribe to our newsletter, we process your email address and any additional information voluntarily provided.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

Registration is carried out using the double opt-in procedure.

You may withdraw your consent at any time by clicking the unsubscribe link included in every newsletter.

Newsletter services may include:

  • Squarespace Email

  • Klaviyo

  • Mailchimp

12. Analytics Services

Where activated, analytics services are used exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Possible analytics services include:

  • Google Analytics 4

  • Squarespace Analytics

Data may be transferred to servers located in the United States.

Where applicable, such transfers are based on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

13. Marketing and Retargeting

Subject to your consent, we may use marketing and retargeting technologies.

This may include:

  • Meta Pixel

  • TikTok Pixel

  • Pinterest Tag

The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Consent may be withdrawn at any time.

14. Social Media Profiles

Our website may contain links to social media platforms.

No data is transmitted to these providers merely by visiting our website.

Data processing by the respective platform only occurs when you actively visit the corresponding profile.

15. Embedded Third-Party Content

If external content such as videos, maps, reviews or fonts is integrated, personal data may be transmitted to the respective provider.

Such integrations are only activated where legally permissible and, where required, after obtaining consent.

16. Retention Period

Personal data is stored only for as long as necessary to fulfil the respective purpose or to comply with statutory retention obligations.

Commercial and tax law retention periods generally require storage for up to ten years.

17. Recipients of Personal Data

Personal data may be disclosed to:

  • Hosting providers

  • Payment service providers

  • Shipping companies

  • Dropshipping suppliers and fulfilment partners

  • IT service providers

  • Government authorities where legally required

Disclosure takes place only where a legal basis exists.

18. International Data Transfers

Where personal data is transferred to countries outside the European Economic Area (EEA), such transfers are carried out only where the requirements of Art. 44 et seq. GDPR are fulfilled.

Appropriate safeguards may include:

  • EU adequacy decisions,

  • Standard Contractual Clauses,

  • EU-U.S. Data Privacy Framework certification.

19. Data Subject Rights

You have the following rights under the GDPR:

  • Right of access (Art. 15 GDPR)

  • Right to rectification (Art. 16 GDPR)

  • Right to erasure (Art. 17 GDPR)

  • Right to restriction of processing (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)

  • Right to object (Art. 21 GDPR)

  • Right to withdraw consent at any time (Art. 7(3) GDPR)

20. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

21. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy where required due to legal, technical or operational changes.

The version published on this website at the time of your visit shall apply.