Privacy policy
Privacy Policy
**Last updated: August 2026**
1. Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Berner und Schwarz GbR
Am Kräherwald 239A
70193 Stuttgart
Germany
Email: pone@blacksales.de
We have not appointed a Data Protection Officer, as the statutory requirements for a mandatory appointment under Art. 37 GDPR in conjunction with Section 38 of the German Federal Data Protection Act (BDSG) are not met.
2. General Information on Data Processing
As a general rule, we process our users' personal data only to the extent necessary to provide a functional website as well as our content and services.
Depending on the respective processing activity, personal data are processed on the basis of:
your consent pursuant to Art. 6(1)(a) GDPR;
the performance of a contract or steps taken prior to entering into a contract pursuant to Art. 6(1)(b) GDPR;
compliance with a legal obligation pursuant to Art. 6(1)(c) GDPR; or
our legitimate interests pursuant to Art. 6(1)(f) GDPR.
3. Hosting and Shop Platform (Shopify)
Our online store is operated and hosted using the Shopify platform.
The provider for merchants in Europe is:
Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland
When you visit our online store or place an order, Shopify processes personal data required for the provision, security and operation of the store. This may include your IP address, device and browser information, contact details, order information and payment-related information.
Where Shopify acts as a processor on our behalf, the processing is governed by a Data Processing Addendum in accordance with Art. 28 GDPR.
The legal basis for processing in connection with orders and contractual services is Art. 6(1)(b) GDPR. Processing necessary for the secure and efficient operation of our online store is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR.
International Data Transfers
Shopify may process personal data within the European Economic Area as well as in third countries, including Canada and the United States.
Transfers of personal data within the Shopify group to countries outside the EEA are protected by Shopify's approved Binding Corporate Rules (BCRs). Transfers to Canada may additionally be based on the European Commission's adequacy decision for Canada. Where Shopify transfers personal data to third-party subprocessors outside the EEA, appropriate safeguards such as Standard Contractual Clauses may be used where required.
Further information can be found in Shopify's Privacy Policy and Data Processing Addendum.
4. Server Log Files
Whenever you access our website, certain information transmitted by your browser is automatically collected in server log files through the Shopify platform.
This may include:
IP address
date and time of the request
browser type and version
operating system used
referring URL
These data are processed to ensure the technical operation, stability and security of our website.
The legal basis for this processing is Art. 6(1)(f) GDPR, based on our legitimate interest in providing a secure and technically reliable online store.
We do not combine these data with other data sources for the purpose of identifying individual users.
5. Guest Checkout and Customer Accounts
Orders may be placed in our online store without creating a customer account.
Where we offer optional customer accounts, the information required to create and manage the account, including login and account information, will be processed for the purpose of providing the customer account and facilitating future orders.
The legal basis for this processing is Art. 6(1)(b) GDPR.
6. Data Processing in Connection with Orders
When you place an order, we process the personal data necessary to process and fulfil your purchase.
This may include:
name and address, including billing and delivery address;
email address;
telephone number, where required for delivery or order processing;
order information, including products ordered, prices and order number; and
payment-related information, depending on the payment method selected.
These data are processed for the purpose of fulfilling the contract pursuant to Art. 6(1)(b) GDPR. We use them in particular to process your order, send order confirmations and provide shipping information.
We currently do not operate a newsletter and do not use your email address for additional marketing purposes.
Order, accounting and business records are retained in accordance with applicable statutory commercial and tax retention requirements, in particular Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO).
Depending on the type of document, statutory retention periods are generally six, eight or ten years.
After the applicable retention period has expired, the relevant data will be deleted unless there is another legal basis requiring or permitting further storage.
7. Payment Service Providers
Depending on the payment method selected, we transmit the information required to process the payment to the respective payment service provider.
The legal basis for processing payment information for the purpose of completing your purchase is Art. 6(1)(b) GDPR.
We do not ourselves store complete credit card details. Card and payment information is processed directly by the respective payment service providers in accordance with the applicable security requirements.
Shopify Payments
Credit and debit card payments, including supported cards such as Visa, Mastercard and American Express, may be processed through Shopify Payments.
For merchants in Germany, Shopify Payments is provided by:
Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland
In connection with the provision of Shopify Payments, personal data may be transferred to other regions, including Canada and the United States. The safeguards described in Sections 3 and 14 of this Privacy Policy apply accordingly.
Further information can be found in Shopify's Privacy Policy.
PayPal / PayPal Express
Where you select PayPal as your payment method, payment information is processed by:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
Further information regarding the processing of personal data can be found in PayPal's Privacy Statement.
Apple Pay
Where Apple Pay is available and selected as a payment method, payment-related information may also be processed by:
Apple Distribution International Limited
Hollyhill Industrial Estate
Hollyhill
Cork
Ireland
Further information can be found in Apple's Privacy Policy.
Google Pay
Where Google Pay is available and selected as a payment method, payment-related information may also be processed by:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Further information can be found in Google's and Google Payments' privacy information.
8. Shipping Service Providers
To deliver your order, we transmit the personal data necessary for delivery to the shipping service provider commissioned by us.
Depending on the respective shipping service, this may include:
your name;
delivery address; and
where necessary, contact information required for delivery coordination or shipment notifications.
We currently use services provided by DHL / Deutsche Post for the delivery of orders.
The transmission of your name and delivery address is necessary for the performance of the contract pursuant to Art. 6(1)(b) GDPR.
Where additional contact details such as your email address or telephone number are transmitted for optional delivery notifications or similar services, this will only take place where legally permitted and, where required, on the basis of your consent pursuant to Art. 6(1)(a) GDPR.
9. Cookies and Consent Management
Our website uses cookies and similar technologies.
Cookies that are strictly necessary for the operation of the website, including functions required for the shopping cart and checkout process, may be stored or accessed without prior consent in accordance with Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
The subsequent processing of personal data is based, depending on the respective purpose, on Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
Cookies and similar technologies that are not strictly necessary, in particular those used for analytics, advertising or marketing purposes, are only activated after you have given your prior consent.
The legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future through the cookie settings available on our website.
We currently do not use separate third-party analytics or marketing tracking tools such as Google Analytics or the Meta Pixel.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, misuse, alteration, disclosure and unauthorised access.
Data transmitted through our online store are encrypted using SSL/TLS technology.
However, no method of transmitting information over the Internet can guarantee absolute security.
11. Children's Data
Our services are not directed at children under the age of 16.
We do not knowingly collect personal data from children under the age of 16.
If you are a parent or legal guardian and become aware that a child has provided us with personal data, please contact us so that we can take the appropriate steps to delete the information where required.
12. Your Rights as a Data Subject
Under the GDPR, you have the following rights, subject to the applicable legal requirements:
Right of access** pursuant to Art. 15 GDPR
Right to rectification** pursuant to Art. 16 GDPR
Right to erasure** pursuant to Art. 17 GDPR
Right to restriction of processing** pursuant to Art. 18 GDPR
Right to data portability** pursuant to Art. 20 GDPR
Right to object** pursuant to Art. 21 GDPR
Right to withdraw consent** at any time with effect for the future pursuant to Art. 7(3) GDPR
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.
To exercise any of these rights, please contact us at: pone@blacksales.de
We will respond to requests within the statutory period, which is generally one month.
13. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
The supervisory authority responsible for us is:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW)
Heilbronner Straße 35
70191 Stuttgart
Germany
You may also have the right to contact another competent supervisory authority, in particular the supervisory authority at your habitual place of residence, place of work or the place of the alleged infringement.
14. International Data Transfers
Where personal data are transferred to recipients outside the European Union or European Economic Area, we ensure that the requirements of Chapter V of the GDPR are met.
Depending on the recipient and destination country, transfers may be based on:
an adequacy decision by the European Commission pursuant to Art. 45 GDPR;
approved Binding Corporate Rules pursuant to Art. 47 GDPR;
Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR; or
another legally recognised safeguard.
In particular, personal data processed through Shopify services may be transferred to Canada, the United States or other countries in which Shopify group companies or subprocessors operate.
Further information regarding Shopify's international transfer mechanisms can be found in Shopify's Privacy Policy, Data Processing Addendum and Binding Corporate Rules.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect changes to our data processing practices, the introduction of new services or applications, technical developments or changes to applicable legal requirements.
The current version of this Privacy Policy is available on this page.
16. Contact
If you have any questions about this Privacy Policy or the processing of your personal data, please contact us at: pone@blacksales.de