Privacy policy

Privacy Policy

Last updated: 24 September 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and, for customers in the United Kingdom, the UK GDPR is:

Dieter Ulber
Cat Boutique
Kastanienstr. 10
61449 Steinbach (Taunus)
Germany
Email: support@cat-boutique.com

We have not appointed a data protection officer, as the requirements of Art. 37 GDPR and § 38 of the German Federal Data Protection Act (BDSG) do not apply to us.

2. Processing, purposes and legal bases

Order processing. We process your name, delivery and billing address, email address and order details in order to perform the purchase contract. Legal basis: Art. 6(1)(b) GDPR.

Payment processing. Payment data is processed by the respective payment service providers. We do not receive full card details. Legal basis: Art. 6(1)(b) GDPR.

Customer account. If you create an account, we process the data stored there in order to provide the account. Legal basis: Art. 6(1)(b) GDPR.

Returns and shipment tracking. To handle returns and to show the status of your shipment, we process your order and shipment data. Legal basis: Art. 6(1)(b) GDPR.

Support. We process your email enquiries in order to deal with your request. Legal basis: Art. 6(1)(b) or (f) GDPR.

Operation and security of the website. To operate the website securely, we process server log data and IP addresses, among other things to limit abusive access. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning and secure service).

Newsletter and marketing emails. Only with your consent. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every email.

Analytics and advertising. Audience measurement and advertising and conversion measurement take place only after you have given your consent. Legal basis: Art. 6(1)(a) GDPR and § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) for storing information on, or accessing information in, your device. Without your consent, these services are not loaded.

Product reviews. To display reviews, we process the information belonging to the review. Legal basis: Art. 6(1)(f) GDPR or your consent.

3. Recipients

We use carefully selected service providers that process data on our behalf:

  • Shopify — shop system, orders, customer accounts, checkout and payment processing.
  • Vercel — hosting of the online shop, technical log data.
  • Upstash — limiting abusive access; IP addresses are processed briefly for this purpose.
  • CJ Dropshipping — fulfilment; receives your name and delivery address in order to send your order.
  • 17TRACK — shipment tracking; receives only the tracking number — no name, no address, no email address.
  • Klaviyo — sending marketing emails (only with consent).
  • Google Ireland Ltd. — Google Analytics 4 and Google Ads (only with consent).
  • Meta Platforms Ireland Ltd. — Meta pixel for conversion and audience measurement (only with consent).
  • Microsoft Ireland Operations Ltd. — Microsoft Clarity: recordings of how our pages are used (scrolling, clicks, mouse movement) and heatmaps, to find and fix usability problems; text you type into form fields is masked and not recorded (only with consent).
  • Vercel Inc. (USA; certified under the EU-U.S. Data Privacy Framework) — Vercel Web Analytics: anonymous counting of page visits (page address without parameters, referring website, country, device type, browser) so that we know how many people visit our shop. No cookies are set and no IP addresses are stored; individual visitors cannot be identified. Legal basis: our legitimate interest in measuring our shop's reach (Art. 6(1)(f) GDPR).
  • Google Workspace — operation of our support mailbox.
  • Shipping carriers — the carriers entrusted with delivery and with handling returns (currently YunExpress and, for the last mile, DHL; Parcel2Go for return labels in the United Kingdom) receive the details required for transport.

All data is transmitted exclusively via encrypted connections. Beyond this, we disclose data only where we are legally obliged to do so. We do not sell your personal information.

4. Transfers to third countries

Some of the service providers named above process data outside the European Union.

Shipping from China. Your order is dispatched by our fulfilment partner CJ Dropshipping. For this purpose, your name and full delivery address are transferred to China. There is no adequacy decision of the European Commission (or of the UK government) for the People's Republic of China.

The transfer is based on Art. 49(1)(b) GDPR (and the corresponding provision of the UK GDPR), because it is necessary for the performance of the purchase contract concluded with you: without passing your address on to the dispatching partner, the goods you ordered cannot reach you. Only the data required for shipping is transferred — name, delivery address and the details of the goods ordered; payment data is not transferred.

In third countries, the level of data protection may differ from the European one, and enforcing your rights may be more difficult. We will answer any questions about this at support@cat-boutique.com.

Transfers to the USA. Where service providers process data in the USA, we base these transfers on an adequacy decision (EU-US Data Privacy Framework and, for the United Kingdom, the UK Extension) where the provider is certified, and otherwise on standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

5. Storage period

We retain order and invoice data in accordance with the retention periods under commercial and tax law; depending on the document, these are six or ten years. We process the data in your customer account for as long as the account exists. We process consent-based data until consent is withdrawn. Technical log data is stored only briefly. Otherwise, we delete data as soon as the purpose no longer applies and no statutory retention obligation prevents deletion.

6. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

You also have the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). You can object to direct marketing at any time without giving reasons.

Where processing is based on consent, you can withdraw it at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

A message to support@cat-boutique.com is sufficient to exercise your rights.

7. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany

If you live in the United Kingdom, you can also complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, www.ico.org.uk.

8. Whether you are required to provide data

We need the information required for order processing in order to conclude and perform the contract with you. Without this information, an order is not possible. All other information is voluntary.