Privacy policy
1. Controller
The controller responsible for the processing of personal data on this website and in the course of our business relationships is:
Essentials by Freifrau GmbH, Gildestraße 9, 32657 Lemgo, Germany, represented by its managing directors Marc A. Helweg and Jan Niklas Helweg. Phone: +49 5261 97 13 30 43 (Mon–Fri 9 am–5 pm CET), e-mail: privacy@essentials-freifrau.com.
No data protection officer has been appointed, as the statutory requirements for this are not met.
2. Overview: what data we process and why
We process personal data only to the extent necessary to provide the website, process orders, communicate with you, carry out marketing with your consent, or comply with legal obligations. The legal bases are Art. 6(1) GDPR: (a) consent, (b) contract and pre-contractual measures, (c) legal obligation and (f) legitimate interests. For storing and accessing information on your device (cookies and similar technologies), Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies in addition.
Where we use service providers that process data on our behalf (processors, Art. 28 GDPR), we have concluded data processing agreements with them. For transfers to countries outside the EU/EEA, we rely on an adequacy decision of the European Commission (in particular the EU-US Data Privacy Framework for certified US companies) or on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).
3. Visiting the website
3.1 Hosting and server log files (Shopify)
Our website and online shop run on the Shopify platform, provided by Shopify International Ltd., Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (part of the Shopify group headquartered in Canada; an adequacy decision of the European Commission exists for Canada, and Shopify Inc. is also certified under the EU-US Data Privacy Framework). When you access the website, data are automatically stored in server log files: IP address, date and time, page accessed, referrer URL, browser type and version, operating system. These data are required for the technical operation and security of the website (Art. 6(1)(f) GDPR). Shopify processes the data as our processor under the Shopify Data Processing Addendum. Further information: https://www.shopify.com/legal/privacy.
3.2 Cookies and consent management (Cookiebot)
We use technically necessary cookies without which the shop does not work (e.g. shopping cart, session, language setting, consent status). The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. All other cookies and technologies (statistics, marketing) are only used with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time via the “Cookie settings” link in the website footer.
We manage consents with Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark, as a processor. Cookiebot stores your consent status in the “CookieConsent” cookie for 12 months and logs the consent (time, scope, anonymised IP address, browser) as evidence (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). After 12 months we ask for your consent again. Further information: https://www.cookiebot.com/en/privacy-policy/.
3.3 Fonts and media
Fonts are loaded from Shopify servers. Embedded videos or posts (e.g. YouTube, Instagram, Vimeo) are only loaded after you have consented to the respective service in the cookie settings.
4. Customer account, orders and contract processing
4.1 Orders and customer account
When you place an order, we process the data required to conclude and perform the contract: name, billing and delivery address, e-mail address, telephone number (for delivery queries), order data, payment method and payment status and, for businesses, company name and VAT identification number (Art. 6(1)(b) GDPR). If you create a customer account, we also store your login details and order history until you delete the account. You can have your account deleted at any time by e-mail to privacy@essentials-freifrau.com; data subject to statutory retention obligations remain stored in restricted form.
Shop Pay: if you use Shopify’s Shop Pay, Shopify stores your payment and address data in your Shop Pay account for future orders; Shopify is the independent controller for this (https://www.shopify.com/legal/privacy/shop).
4.2 Trade customers
Retailers, interior designers, architects and other business customers send their enquiries to service@essentials-freifrau.com. In doing so, we process company data, register number, VAT identification number, evidence of business status and the name, position and contact details of contact persons (Art. 6(1)(b) and (f) GDPR). We verify VAT identification numbers via the confirmation procedure of the German Federal Central Tax Office or the EU VIES system (Art. 6(1)(c) GDPR). Business customers pay in advance via a payment link; the information under section 4.6 applies.
4.3 Order processing and invoicing (Billbee)
For order processing, invoices, delivery notes, inventory management and the hand-over to our accounting, we use Billbee, Billbee GmbH, Paulinenstraße 4, 32756 Detmold, Germany, as a processor. Order, address, contact and payment status data are transferred (Art. 6(1)(b) and (c) GDPR). We pass invoice data to our tax advisor Florian Burg, DHS Steuerberater, via Billbee’s DATEV export (Art. 6(1)(c) GDPR).
4.4 Shipping (DHL)
For delivery, we transfer your name, delivery address and, where necessary for delivery, your telephone number to our carrier DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (Art. 6(1)(b) GDPR). We only pass your e-mail address to DHL for delivery notifications and tracking if you agreed to this in the shopping cart by selecting the corresponding option (Art. 6(1)(a) GDPR); you can withdraw this consent at any time with effect for the future. DHL privacy notice: https://www.dhl.de/en/toolbar/footer/datenschutz.html. Shipping labels are created via the DHL business customer portal.
4.5 Returns
Returns are requested via your customer account or the return function of our shop (Shopify); processing and refunds are handled via Billbee (see section 4.3). Order number, contact details, reason for return and refund data are processed (Art. 6(1)(b) GDPR).
4.6 Payment service providers
Depending on the payment method selected, we transfer the data required for payment (name, billing address, amount, order number and, where applicable, e-mail address) to the respective payment service provider (Art. 6(1)(b) GDPR). Payment data such as card numbers are processed exclusively by the payment service provider, not by us.
- Shopify Payments (credit and debit cards: Visa, Mastercard, American Express, Maestro, UnionPay; Shop Pay; Apple Pay; Google Pay; EPS; Klarna): processed by Shopify International Ltd. and Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland, which act as independent controllers for payment processing. Privacy notices: https://stripe.com/privacy and https://www.shopify.com/legal/privacy.
- Klarna (pay later by invoice, instalments, pay now): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna is an independent controller and carries out an identity and credit check to decide on the payment method; in doing so, Klarna may transfer data to and receive data from credit agencies. The credit check is an automated decision within the meaning of Art. 22 GDPR taken by Klarna. Privacy notice: https://www.klarna.com/international/privacy-policy/.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal is an independent controller; privacy notice: https://www.paypal.com/legalhub/privacy-full.
- Payment link for business customers: the payment link leads to the Shopify checkout; the information on Shopify Payments above applies. For bank transfers, our bank, Sparkasse Lemgo, processes your transfer data as part of payment transactions.
5. Communication and customer service
5.1 Contact by e-mail, telephone or contact form
If you contact us, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR). Our e-mail communication runs via Microsoft 365 (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as a processor; any transfer to Microsoft Corporation (USA) is safeguarded by the EU-US Data Privacy Framework.
5.2 Customer service system (Gorgias)
We handle enquiries by e-mail, contact form and chat with the helpdesk system Gorgias, Gorgias, Inc., 180 Sansome Street, San Francisco, CA 94104, USA, as a processor. Gorgias links your enquiry with your order data from Shopify so that we can help you quickly (Art. 6(1)(b) and (f) GDPR). The transfer to the USA is safeguarded by the European Commission’s Standard Contractual Clauses, which form part of the data processing agreement with Gorgias (https://www.gorgias.com/legal/data-processing-agreement). We delete enquiries three years after they are closed, unless retention obligations apply.
5.3 Post-purchase survey (Fairing)
After an order, we may ask you a voluntary question on the order confirmation page (e.g. how you heard about us). Answers are linked to the order number and processed by Fairing, Inc., 228 Park Avenue South, PMB 38031, New York, NY 10003, USA, as a processor (Art. 6(1)(f) GDPR, interest in improving our marketing). The transfer to the USA is safeguarded by the European Commission’s Standard Contractual Clauses under the data processing agreement with Fairing. Answering is voluntary.
6. Marketing
6.1 Newsletter and e-mail marketing (Klaviyo)
With your consent, we send you our newsletter with information on new objects, designers, editions and events (Art. 6(1)(a) GDPR). Registration uses a double opt-in procedure: you receive an e-mail in which you must confirm your registration. We log the registration, confirmation, time and IP address as evidence. You can unsubscribe at any time via the link in every e-mail or by sending us a message.
Existing customers: if you have purchased from us and provided your e-mail address in doing so, we may send you e-mail recommendations for our own products similar to those you purchased (Section 7(3) German Act against Unfair Competition, UWG; Art. 6(1)(f) GDPR). We point this out when collecting your e-mail address during checkout. You can object to this use at any time without incurring any costs other than transmission costs at basic rates – via the unsubscribe link in every e-mail or by sending a message to privacy@essentials-freifrau.com.
Sending and analysis are carried out via Klaviyo, Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, as a processor (certified under the EU-US Data Privacy Framework). Klaviyo creates a profile for each recipient with order history, website activity (if you have consented to marketing cookies), open and click rates. We use this analysis to tailor content to your interests. If you do not want this analysis, you can unsubscribe from the newsletter.
Transactional e-mails (order, shipping and delivery confirmations, returns information, product care instructions) are also sent via Klaviyo; they are part of the performance of the contract (Art. 6(1)(b) GDPR) and are not a newsletter.
6.2 Abandoned cart reminders
If you abandon the ordering process after entering your e-mail address and have consented to e-mail marketing, we send you a reminder about your cart (Art. 6(1)(a) GDPR).
6.3 Audience measurement and advertising (only with consent)
We only use the following services if you have consented via the cookie settings (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The services use cookies, pixels or comparable technologies and may combine your data with data from other sources. For US providers, transfers are based on the certification of the respective US parent company under the EU-US Data Privacy Framework.
- Google Analytics 4 and Google Ads (including conversion tracking, remarketing and Google Shopping / Performance Max): Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. We use Google Consent Mode v2 (advanced mode): as long as you have not consented, the Google services do not set cookies and do not read information from your device. Only cookieless signals without personal identifiers are transmitted to Google (page accessed, time, consent status, browser type, truncated IP address), which Google uses only in aggregated form for statistical modelling (Art. 6(1)(f) GDPR; our interest in measuring the reach of our advertising without identifying individuals). Cookies are set and personal usage data processed only after you have consented. IP addresses are not stored in Google Analytics 4. Privacy notice: https://policies.google.com/privacy.
- Meta Pixel and Conversions API (Facebook, Instagram): Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. Via the Conversions API we transmit events (e.g. purchase, add to cart) server-side; contact data are transmitted in hashed form (“advanced matching”). For processing in the context of audience measurement, we and Meta are joint controllers (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Privacy notice: https://www.facebook.com/privacy/policy.
- Pinterest Tag: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. Privacy notice: https://policy.pinterest.com/en/privacy-policy.
6.4 Product feeds
For Google Shopping, the Meta catalogue and the Pinterest catalogue, we transmit product data (no personal data) to the providers named above.
6.5 Social media presences
We operate profiles on Instagram, Facebook and Pinterest. When you visit these profiles, the respective provider processes your data according to its own privacy notices; we only receive aggregated statistics. For Instagram and Facebook page insights, we and Meta are joint controllers (https://www.facebook.com/legal/terms/page_controller_addendum).
7. Photos and press
If you provide us with photos of your objects for publication (e.g. by tagging us on Instagram), we only publish them with your express consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
8. Retention periods
We store personal data only for as long as necessary for the respective purpose. Contract and invoice data are retained in accordance with German commercial and tax law (Section 257 HGB, Section 147 AO): eight years for accounting records including invoices, ten years for books of account, inventories and annual financial statements, and six years for commercial correspondence. Customer account data are stored until the account is deleted. Newsletter data are stored until consent is withdrawn; evidence of consent for up to three years thereafter. Server log files are deleted after 30 days. Customer service enquiries are deleted three years after they are closed. Order data in Billbee are anonymised after 365 days unless subject to retention obligations.
9. Your rights
You have the following rights with regard to your personal data: access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. Where we process your data for direct marketing, you may object at any time without giving reasons.
To exercise your rights, simply send a message to privacy@essentials-freifrau.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, https://www.ldi.nrw.de.
10. Obligation to provide data
Providing the data required for an order is contractually necessary; without them we cannot perform the contract. All other information is voluntary.
11. Automated decision-making
We ourselves do not take automated individual decisions within the meaning of Art. 22 GDPR. An automated credit check is carried out solely by Klarna if you choose a Klarna payment method (see section 4.6).
12. Changes
We will update this privacy policy if our processing or the legal situation changes. The version published on the website applies. Last updated: 30 October 2026.