Privacy policy
Last updated: 8 October 2026
This privacy policy explains which personal data we process when you visit our online store or place an order with us, for what purpose, on which legal basis, and what rights you have.
1. Controller
Rievolta
Owner: Dennis Riechmann
Barbaraweg 6
32479 Hille
Germany
Email: support@rievolta.de
We have not appointed a data protection officer because the legal requirements for doing so are not met. For any data protection questions, please contact us at the email address above.
2. Legal bases
We process personal data on the following legal bases of the General Data Protection Regulation (GDPR):
- Art. 6(1)(a) GDPR – your consent, for example to marketing cookies.
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual steps, for example processing your order.
- Art. 6(1)(c) GDPR – compliance with a legal obligation, for example retention duties under commercial and tax law.
- Art. 6(1)(f) GDPR – our legitimate interest, for example in operating the store securely and reliably.
Storing information on your device and accessing it (for example through cookies) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
3. Store system and hosting (Shopify)
Our store runs on the Shopify platform. For customers in the EU, the provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes on our behalf all data generated when you visit the store or place an order, and delivers the order emails.
Each time a page is loaded, technical data is processed automatically: IP address, date and time, page requested, referrer, browser type and operating system. This is necessary to deliver the store and protect it against misuse (Art. 6(1)(f) GDPR).
Shopify may also transfer data to Shopify Inc. in Canada and to service providers in the USA. For Canada, an adequacy decision of the European Commission exists. Transfers to the USA are based on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. We have concluded a data processing agreement with Shopify under Art. 28 GDPR. More information: https://www.shopify.com/legal/privacy.
4. Cookies and consent
Our store uses cookies and similar technologies. We use strictly necessary cookies – for example for the shopping cart, the checkout and saving your cookie choice – without consent (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) and (f) GDPR).
We use all other cookies, in particular for marketing and audience measurement, only if you have consented via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future by deleting the cookies in your browser and making a new choice in the banner on your next visit, or by sending us an email.
5. Orders and customer account
When you place an order, we process the information you enter at checkout: name, shipping and billing address, email address, phone number if provided, the items ordered and the payment method. We need this data to perform the contract (Art. 6(1)(b) GDPR). Without it we cannot accept your order.
If you create a customer account, we also store your data for future orders. You can have the account deleted at any time; a short email is sufficient.
6. Payment processing
Payments are processed via Shopify Payments, which works with Stripe Payments Europe Ltd. in Ireland. Depending on the payment method you choose, your payment data is passed on to the relevant provider, for example Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden), Apple Pay, Google Pay, Shop Pay or your card issuer. We do not see complete card data ourselves. The legal basis is Art. 6(1)(b) GDPR. If you choose Klarna, Klarna may, according to its own information, check your identity and creditworthiness; Klarna's privacy policy applies to this.
7. Shipping via our suppliers
Many of our items are shipped to you directly by our suppliers, mostly by merchants in the People's Republic of China, some from warehouses in the EU. For this purpose we pass on your name, your shipping address and, where needed for delivery, your phone number to the relevant supplier. The data is transmitted via the software DSers, which we use to forward orders to suppliers on the AliExpress platform. The supplier hands the parcel over to a carrier (for example Cainiao, DHL or another shipping company), which also receives your shipping address.
The legal basis is Art. 6(1)(b) GDPR. There is no adequacy decision of the European Commission for the People's Republic of China. However, the transfer is necessary for the performance of your purchase contract and is therefore permitted under Art. 49(1)(b) GDPR. Please note that a level of data protection comparable to the EU cannot be guaranteed in China. We only pass on the data needed for delivery.
8. Shipment tracking
So that you can track your order, we process the tracking number together with your order. For this we use the services 17TRACK (shipment tracking on our "Track your order" page) and TrackingMore (CHANNELWILL CO., LIMITED, Hong Kong). These services receive the tracking number and, where applicable, the destination country; where this is linked to your order, your name and email address are also affected. The legal basis is Art. 6(1)(b) GDPR, and for transfers outside the EU Art. 49(1)(b) GDPR.
9. Product reviews (Judge.me)
We use Judge.me (Judge.me Ltd., c/o Buckworths, 1-3 Worship Street, London EC2A 2AB, United Kingdom) for customer reviews. If you submit a review, Judge.me processes your name or display name, your email address, the review itself and any photos you upload. Your name is published together with the review. The legal basis is the consent you give by submitting the review (Art. 6(1)(a) GDPR).
You will only receive an email asking for a review if you have expressly agreed to this.
When product pages are loaded, images and content are retrieved from Judge.me servers, which transmits your IP address (Art. 6(1)(f) GDPR, legitimate interest in displaying reviews). For the United Kingdom, an adequacy decision of the European Commission exists.
10. Meta Pixel (Facebook and Instagram)
Only if you have consented in the cookie banner do we use the Meta Pixel and the data transfer via the "Facebook & Instagram" sales channel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel records which pages you visit and which actions you take (such as "Add to cart" or "Purchase"), together with your IP address, browser data and a cookie identifier. This allows us to measure the success of our advertising and to show ads on Facebook and Instagram to people who have shown interest in our products.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR); any further processing by Meta is Meta's own responsibility. Meta may transfer data to the USA; this is based on the EU-US Data Privacy Framework. More information: https://www.facebook.com/privacy/policy/.
11. Contact by email and chat
If you write to us by email, via the contact form or via chat (Shopify Inbox), we process your information to answer your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to an order, otherwise Art. 6(1)(f) GDPR.
Withdrawal via our online form: If you withdraw from your contract using the "Cancel contract" form, your name, email address, order number and any voluntary information you provide are processed via the app EU Widerruf Button of 401layers UG (haftungsbeschränkt), Germany, so that we can receive your withdrawal and confirm its receipt. The legal basis is Art. 6(1)(c) GDPR (legal obligation to confirm the withdrawal) and Art. 6(1)(b) GDPR.
12. Internal order overview (Make and Google Sheets)
For our internal order management, we automatically transfer order and customer data into a spreadsheet. For this we use the automation service Make (part of the Celonis SE group of companies), which reads orders from Shopify, and Google Sheets in Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), where the spreadsheet is stored. This concerns your name, shipping and billing address, email address, phone number if provided, and the order details.
The legal basis is Art. 6(1)(b) GDPR (processing your order) and Art. 6(1)(f) GDPR (our legitimate interest in clear order management). Both providers process the data on our behalf under Art. 28 GDPR. Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
13. Retention period
We store personal data only for as long as necessary for the relevant purpose. We retain order and invoice data because of obligations under commercial and tax law, usually for up to ten years (Art. 6(1)(c) GDPR in conjunction with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)). Requests unrelated to an order are deleted once they have been dealt with and no retention obligation applies. Data based on your consent is deleted when you withdraw your consent.
14. Your rights
You have the right at any time to
- access the data we hold about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR),
- withdraw any consent given, with effect for the future (Art. 7(3) GDPR).
Right to object (Art. 21 GDPR): Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.
An email to support@rievolta.de is sufficient.
Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
15. No automated decision-making
We do not make decisions about you based solely on automated processing, including profiling (Art. 22 GDPR).
16. Changes
We update this privacy policy when our processes or the services we use change. The version published here applies.