Privacy policy

Last updated: March 3, 2026

Paw & Soul operates this shop and this website, including all associated information, content, features, tools, products and services, to provide you, as a customer, with a personalised shopping experience (the “Services”). Paw & Soul is powered by Shopify, which enables us to provide you with the Services. This Privacy Policy describes how we collect, use or disclose personal data when you visit or use the website, make a purchase or other transaction using the Services, or otherwise communicate with us. If there is a conflict between our Terms and Conditions and this Privacy Policy, this Privacy Policy shall prevail with respect to the collection, processing and disclosure of your personal data.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and agree to the collection, use and disclosure of your data as described in this Privacy Policy.

Personal Information We Collect or Process

When we use the term “personal data”, we are referring to information that identifies you or another person, or that can be directly linked to you. Personal data does not include information that has been collected anonymously or anonymised in such a way that it is no longer possible to identify you or link it to you. Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process the following categories of personal data, including inferences drawn from such personal data:

• Contact details, including name, postal address, billing address, delivery address, telephone number and email address.
• Financial data, including credit and debit card numbers, financial account numbers, payment card information, financial account information, transaction details, payment method, payment confirmation and other payment details.
• Account information, including username, password, security questions, configurations and settings.
• Transaction information, including the items you view, add to your basket, add to your wishlist or purchase, return, exchange or cancel, as well as your past transactions.
• Communication with us, including the information you provide when communicating with us, for example when you submit a query to customer support.
  
• Device information, including information about your device, browser or network connection, IP address and other unique identifiers.
• Usage information, including information about your interaction with the Services, including how and when you interact with or browse the Services.

Personal Information Sources

We may collect personal information from the following sources:

• Directly from you We collect data, for example, when you create an account, access or use the Services, communicate with us, or otherwise provide us with your personal data.
• Automatically via the Services We collect data, for example, from your device or when you use our products or Services or visit our website, as well as through the use of cookies and similar technologies.
• When you visit our website, information is automatically collected and stored in so-called server log files. This includes, in particular, your IP address, the date and time of access, browser type and operating system. This processing is carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR to ensure the security and stability of the website.
• We use technically necessary cookies that are required for the operation of the website, as well as – subject to your express consent – analytics and marketing cookies. The storage of information on your device or access to it is carried out in accordance with Section 25 of the German Telemedia Act (TTDSG). You can withdraw or adjust your consent at any time via the cookie settings.
• From our service providers We collect data, among other things, when we commission service providers to activate certain technologies, and when they collect or process your personal data on our behalf.
• From our partners and other third-party providers

How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

• Provision, customisation and improvement of the Services. We use your personal data to provide you with the Services. This includes, amongst other things, fulfilling our contract with you, processing your payments, fulfilling your orders, storing your configurations and the items you are interested in, sending notifications relating to your account, creating, maintaining and otherwise managing your account, organising delivery, facilitating returns and exchanges, enabling you to leave reviews, and creating a personalised shopping experience for you, for example by recommending products based on your purchases. This may also include using your personal data to better tailor and improve the Services.
• Personalised products. When you order personalised products, we also process the individual content you provide (e.g. names, text, coordinates, image files). This data is:
  
  • used exclusively for the fulfilment of the contract,
  • not reused for marketing purposes,
  • not disclosed to unauthorised third parties,
  • transmitted only to production or shipping service providers to the extent necessary for the fulfilment of the contract.
    

Personal data will be deleted once the order has been completed and any warranty periods have expired, provided there are no legal retention obligations to the contrary. Retention periods under commercial and tax law are generally 6 and 10 years respectively. Legal basis: Article 6(1)(b) of the GDPR.

• Marketing and advertising. We use your personal data for marketing and advertising purposes, for example to send marketing and advertising communications by email, text message or post, and to display online advertisements for products or services relating to the Services or other websites, including on the basis of items you have previously purchased or added to your basket, as well as other activities relating to the Services.
• Use of analytics and marketing technologies. To analyse and optimise our website and to deliver personalised advertising, we use technologies and services from:
  • Google (including Google Analytics)
  • Meta Platforms (Facebook and Instagram)
  • Pinterest
  • TikTok

Cookies, pixel tags or similar technologies may be used to collect information about your usage behaviour (e.g. IP address, device information, interactions, conversions).& nbsp;The legal basis for this processing is your consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TTDSG. Consent is given via our cookie banner and may be withdrawn at any time.

• Meta Pixel and Custom Audiences. We use the so-called Meta Pixel from Meta Platforms. This allows us to track which actions users take after clicking on a Facebook or Instagram advertisement. This serves to measure the success and optimise our advertising measures. We also use so-called ‘Custom Audiences’ to define target groups for advertisements. In this context, the following may be:
  • Website visitors
  • Interactions
  • Hashed email addresses (where applicable, for customer lists)

are transmitted to Meta. Processing takes place exclusively on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. There may be a joint controller arrangement between us and Meta in accordance with Article 26 of the GDPR. The relevant agreement is available at: https://www.facebook.com/legal/controller_addendum

• Google Analytics. We use Google Analytics, a web analytics service provided by Google. Google Analytics uses cookies that enable an analysis of the use of our website. The information generated by the cookie regarding your use of this website (e.g. IP address, device data, page views, time spent on the site) is transmitted to Google’s servers and stored there. We use Google Analytics exclusively with IP anonymisation enabled. This means that your IP address is truncated within the European Union or the European Economic Area before being transferred to third countries. Processing takes place exclusively on the basis of your consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25 of the TTDSG. Data transfer to the USA cannot be ruled out. Google relies on the European Commission’s Standard Contractual Clauses and – where applicable – on the EU-US Data Privacy Framework. You may withdraw your consent at any time via the cookie settings.
• Security and fraud prevention. We use your personal data to authenticate your account, provide a secure payment and shopping experience, detect, investigate or take action against potential fraudulent, illegal, unsafe or malicious activities, protect public safety, and ensure the security of our services. If you decide to use the Services and register an account, you are responsible for protecting your account login details. We strongly recommend that you do not share your username, password or other login details with anyone else.
• Communication with you. We use your personal data to provide you with customer support and effective services, to respond promptly to your enquiries, and to maintain our business relationship with you.
• Legal reasons. We use your personal data to comply with applicable law or to respond to lawful legal processes, including requests from law enforcement or regulatory authorities, to investigate or participate in civil investigations, potential or actual legal disputes or other adversarial proceedings, and to investigate potential breaches of our terms and conditions or policies or to enforce those terms and conditions and policies.
• Where we process data on the basis of legitimate interests, these consist in particular of ensuring IT security, preventing misuse and optimising our offering from a business perspective.
  

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• In the case of Shopify, these are providers and other third parties who provide services on our behalf (e.g. IT management, payment processing, data analysis, customer support, cloud storage, fulfilment and shipping).
• For payment processing, we work with the following providers:
  • PayPal
  • Klarna
  • Shopify Payments

Shopify Payments includes, amongst others, credit cards (Visa, Mastercard, American Express, Maestro, UnionPay), Apple Pay, Google Pay, Shop Pay, Bancontact and EPS. Depending on the chosen payment method, the data required for payment processing is transmitted to the respective payment service provider. The legal basis is Article 6(1)(b) of the GDPR.

• We share personal data with business and marketing partners who provide marketing services to you and display advertisements to you. For example, we use Shopify to support personalised advertising through third-party services based on your online activity across various retailers and websites. Our business and marketing partners use your data in accordance with their own privacy policies. Depending on where you live, you may have the right to instruct us not to share information about you in order to show you targeted advertising and marketing based on your online activities across various retailers and websites.
• If you ask us or otherwise give your consent to share certain information with third parties, for example to deliver products to you, or if you use social media widgets or login integrations.
• We may share personal data with our affiliates or otherwise within our group of companies.
• In connection with a business transaction such as a merger or insolvency, to comply with applicable legal obligations (including responding to subpoenas, search warrants and similar requests), to enforce applicable terms of service or policies, and to protect or defend the Services, our rights and the rights of our users or others.
• We carefully assess requests for information from public authorities to ensure their legal validity. Personal data will only be disclosed where there is a legal obligation to do so or where a legally binding order from a public authority or court has been issued.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our Store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy . Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children's Data

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details set out below to request that it be deleted.As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

Security and Retention of Your Information

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide you with Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies.

Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

• Right to Access / Know. You may have a right to request access to personal information that we hold about you.
• Right to Delete. You may have a right to request that we delete personal information we maintain about you.
• Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you.
• Right of Portability. You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
• Managing Communication Preferences. We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or orders that you have made.

You may exercise any of these rights where indicated on the Services or by contacting us using the contact details provided below. To learn more about how Shopify uses your personal information and any rights you may have, including rights related to data processed by Shopify, you can visit https://privacy.shopify.com/en.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.

Complaints

If you have complaints about how we process your personal information, please contact us using the contact details provided below. Depending on where you live, you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority. For the EEA, you can find a list of the responsible data protection supervisory authorities here.

International Transfers

Please note that we may transfer, store and process your personal information outside the country you live in.

If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Where data is transferred to third countries, we rely on appropriate safeguards within the meaning of Article 44 et seq. of the GDPR, in particular:

• Standard contractual clauses of the European Commission
  Participation in the EU-US Data Privacy Framework (where certified)
• Changes to This Privacy Policy

Changes to this privacy policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please call or email us at care@pawandsoul.eu or contact us at Eichendorffweg 3, Jena, 07745, DE For the purpose of applicable data protection laws, we are the data controller of your personal information.