Privacy policy

This English version is provided for your convenience. The German version is legally binding.

Privacy Policy

Last updated: October 2026

1. Controller

The controller responsible for data processing in this online shop is:
Immanuel Brown, Curated Attire, Tittardsfeld 68, 52072 Aachen, Germany
Email: info@curatedattire.store

We have not appointed a data protection officer, as we are not legally required to do so.

2. Overview: what data we process and why

We process personal data only to the extent necessary to operate the shop, process your orders and communicate with you, where we are legally obliged to do so, where we have a legitimate interest or where you have given your consent. The legal bases are in particular Art. 6(1)(a) (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interest) of the General Data Protection Regulation (GDPR).

3. Hosting and shop system (Shopify)

Our online shop runs on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). On our behalf, Shopify processes all data generated when you visit the shop and place orders (e.g. IP address, browser and device information, time of access, order, contact and payment data) and stores it on servers that may also be located outside the EU, in particular in Canada and the USA. For Canada, there is an adequacy decision of the European Commission. For transfers to the USA, Shopify relies on the EU-US Data Privacy Framework or on EU standard contractual clauses. We have concluded a data processing agreement with Shopify (Art. 28 GDPR).

The legal basis is Art. 6(1)(b) GDPR insofar as the processing serves the performance of the contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in a secure and functional online shop). Further information: https://www.shopify.com/legal/privacy.

Shopify's own processing: We also use Shopify features in which Shopify additionally processes certain data (e.g. your interactions with our shop, order and device information) under its own responsibility – in particular “Shopify Network Intelligence” and the Shop app. Shopify uses this data, also across shops together with data from other merchants, to improve its own products and services, target advertising and personalise shopping experiences; users of the Shop app may, depending on their Shop settings, for example be reminded by Shopify of items in their cart. Shopify itself is the controller for this processing. The basis for providing the data to Shopify for these purposes is our legitimate interest in improving and marketing our shop (Art. 6(1)(f) GDPR); you may object to this at any time. You can also exercise your rights in this respect directly with Shopify: https://privacy.shopify.com. Further information: Shopify Consumer Privacy Policy.

4. Cookies and consent

Our shop uses cookies and similar technologies. We use technically necessary cookies (e.g. for the cart, checkout, language settings and security) on the basis of Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(b) or (f) GDPR. We use all other cookies and technologies (e.g. for statistics, personalisation or marketing purposes) only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you give via our cookie banner. You can withdraw or adjust your consent at any time with effect for the future via the “Cookie settings” or “Privacy settings” link in the footer.

5. Orders and customer account

When you place an order with us, we process the data you provide (e.g. name, delivery and billing address, email address, telephone number if applicable, ordered items, payment method) to perform the contract, including shipping, payment, customer service, returns and withdrawals (Art. 6(1)(b) GDPR). Mandatory fields are marked in the checkout; without them we cannot conclude the contract.

You may optionally create a customer account. Your data will then be stored for future orders and you can view your order history. You can have your customer account deleted at any time; just send us an email.

6. Payment service providers

To process payments, we pass the necessary data (e.g. name, address, order amount, payment details) to the payment service provider you have chosen (Art. 6(1)(b) GDPR). The payment service providers process some of the data under their own responsibility, e.g. for fraud prevention or to fulfil legal obligations. Their privacy notices also apply:

Shopify Payments (credit/debit card, Apple Pay, Google Pay, Shop Pay): Payments are processed via Shopify and the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. If you use Apple Pay or Google Pay, the privacy notices of Apple or Google also apply.
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy notice: https://www.paypal.com/de/legalhub/privacy-full
Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may carry out an identity and credit check to assess the payment method. Privacy notice: https://www.klarna.com/de/datenschutz/

7. Shipping

To deliver your order, we pass your name and delivery address to the shipping company we use, DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (Art. 6(1)(b) GDPR). We only pass your email address or telephone number to the shipping company if you have expressly consented to this during checkout, so that it can notify you about the delivery (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.

8. Contact by email

If you contact us by email or via a contact form, we process your details to handle your enquiry (Art. 6(1)(b) GDPR insofar as your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR).

9. Newsletter

If you subscribe to our newsletter, we use your email address to send you regular information about new items, drops and promotions. The basis is your consent (Art. 6(1)(a) GDPR). Subscription uses the double opt-in procedure: after signing up, you will receive an email with a confirmation link. We log the sign-up and confirmation so that we can prove them. The newsletter is sent via Shopify's email marketing feature (Shopify Messaging); Shopify may analyse whether a newsletter was opened and which links were clicked. You can unsubscribe at any time via the unsubscribe link in every email or by sending us a message.

10. Withdrawal via the online withdrawal function

For the online withdrawal function (“Withdraw from contract”), we use the Shopify app “Revoq – EU Withdrawal Button”. We process the data entered there (e.g. name, order number, email address, content of the withdrawal statement) in order to match your withdrawal, confirm its receipt and process the withdrawal (Art. 6(1)(b) and (c) GDPR).

11. Instagram

Our website links to our Instagram profile. This is a simple link; data is only transferred to Instagram (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland) once you click the link.

12. Storage period

We store personal data only for as long as necessary for the respective purpose. Due to statutory retention obligations (in particular Section 147 of the German Fiscal Code, AO), we retain contract and invoice data for up to ten years. We delete newsletter data after you unsubscribe, unless we need it to prove your earlier consent.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR), as well as the right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR). Simply contact us by email.

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You may object to processing for direct marketing purposes at any time without giving reasons.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.