Privacy policy

Last updated: 15 June 2026

Note on language: This English version is provided for convenience. The German version of this Privacy Policy is the authoritative version. In the event of any inconsistency between the English and German versions, the German version shall prevail.

This Privacy Policy explains how Geometree processes personal data when you visit our website geometree.de shop in our online store, communicate with us, use our forms, or otherwise use our services.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, telephone number, order data, payment information, IP address, cookie identifiers, and usage data.

1. Controller

The controller responsible for the processing of personal data is:

Geometree
Sascha Hatke
Aachener Straße 310
50933 Cologne
Germany
Email: verkauf@geometree.de
Website: www.geometree.de

If you have any questions about data protection or wish to exercise your data protection rights, you can contact us at any time.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide our website, process orders, communicate with you, comply with legal obligations, safeguard legitimate interests, or where you have given your consent.

The legal bases for processing arise in particular from Article 6(1) GDPR:

  • Article 6(1)(a) GDPR, where you have given us your consent, for example for certain cookies, tracking technologies, or marketing services.
  • Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to carry out pre-contractual measures, for example for orders, payments, shipping, or customer inquiries.
  • Article 6(1)(c) GDPR, where we are legally obliged to process data, for example due to tax or commercial retention obligations.
  • Article 6(1)(f) GDPR, where processing is necessary to safeguard our legitimate interests, for example to secure our website, to handle support requests, or to enforce legal claims.

3. Visiting Our Website and Technical Access Data

When you visit our website, technical data is automatically processed that your browser transmits to our server or to the technical service providers we use. This may include in particular:

  • IP address
  • date and time of access
  • pages and files accessed
  • referrer URL
  • browser type and version
  • operating system
  • device information
  • network connection information

This data is processed in order to provide the website technically, to ensure system security, to analyze errors, and to ensure the stability of our online store.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our website.

4. Shopify as Store Platform

Our online store is operated via Shopify. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides us with the technical e-commerce platform through which we present products, receive orders, prepare payments, manage customer accounts, and provide the checkout process.

In the course of using our store, personal data may be processed via Shopify, in particular:

  • contact data
  • billing and delivery addresses
  • order information
  • payment status and payment information
  • customer account information
  • device, browser, and usage data
  • communication data

Processing takes place in order to provide the online store and to process orders on the basis of Article 6(1)(b) GDPR and, where necessary, due to legal obligations pursuant to Article 6(1)(c) GDPR. Where data is processed to secure and optimize the store, this takes place on the basis of Article 6(1)(f) GDPR.

For more information on data processing by Shopify, please refer to Shopify's privacy notices.

5. Orders, Customer Account, and Contract Performance

When you place an order in our store, we process the data you provide in order to handle and fulfill the contract. This includes in particular:

  • name
  • email address
  • telephone number, if provided
  • billing address
  • delivery address
  • order data
  • payment status
  • information on returns, complaints, and withdrawals
  • communication relating to your order

Processing takes place for the performance of the contract pursuant to Article 6(1)(b) GDPR. Where we are required to retain data due to commercial or tax law requirements, processing additionally takes place on the basis of Article 6(1)(c) GDPR.

6. Payment Processing

To process your payment, we use different payment service providers depending on the payment method you select. The data required for payment processing is transmitted to these providers. This may include, in particular, your name, billing address, email address, order amount, payment reference, and payment information.

The processing is carried out for the purpose of handling your payment and therefore for the performance of the contract pursuant to Art. 6(1)(b) GDPR. Where payment data is processed for fraud prevention purposes or to comply with legal obligations, such processing is carried out on the basis of Art. 6(1)(c) and Art. 6(1)(f) GDPR.

We use the following payment service providers:

  • Shopify Payments: provided by Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. The technical payment processing is carried out by the payment processor Stripe Payments Europe, Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. In particular, the following payment methods are processed via Shopify Payments: credit card (Visa, Mastercard, Maestro, American Express), Apple Pay, Google Pay, Shop Pay, Bancontact, eps, BLIK, iDEAL, MobilePay, Wero, TWINT, and UnionPay.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg.
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.

When using Apple Pay or Google Pay, the payment data stored on your device is transmitted to the respective provider and to the payment service provider processing the payment in order to complete the transaction. If you select Klarna or PayPal as your payment method, you may be redirected to an environment operated by the respective provider. The privacy policies of the respective payment service provider also apply.

7. Shipping and Logistics

To deliver your order, we pass on the data required for this purpose to shipping and logistics service providers. For this, we use in particular DPD as well as technical shipping solutions such as easyDPD or easyPrint.

The data processed may include in particular:

  • name
  • delivery address
  • email address, where required for shipping notifications
  • telephone number, where provided or required for delivery
  • tracking number
  • information on shipping status

Processing takes place for the performance of the contract pursuant to Article 6(1)(b) GDPR. Where shipping data is required to comply with legal obligations or to handle complaints and transport damage, processing additionally takes place pursuant to Article 6(1)(c) and (f) GDPR.

8. Communication, Contact, and Customer Service

If you contact us by email, contact form, social media, telephone, or any other means, we process the data you transmit in order to handle your inquiry. This may include in particular name, email address, telephone number, order number, message content, and other information you provide.

Depending on the content of the inquiry, processing takes place to carry out pre-contractual measures or for the performance of the contract pursuant to Article 6(1)(b) GDPR, or on the basis of our legitimate interest in handling your inquiry pursuant to Article 6(1)(f) GDPR.

9. Electronic Withdrawal Form

If you use our electronic withdrawal form, we process the data you enter in order to handle and document your withdrawal. This includes in particular:

  • first and last name
  • email address
  • order number
  • details of the items to be withdrawn
  • time of form submission
  • technical information on the submission

Processing takes place in order to handle your withdrawal and to comply with legal obligations pursuant to Article 6(1)(c) GDPR and, where the withdrawal concerns an existing contract, pursuant to Article 6(1)(b) GDPR.

10. Shopify Forms, Metaobjects, and Form Processing

For certain forms on our website, we use Shopify Forms and related Shopify features such as Metaobjects. Through these features, form submissions can be captured and processed internally.

Depending on the form, in particular name, email address, order number, message content, form content, tags, time of submission, and technical metadata may be processed.

Depending on the purpose of the respective form, processing takes place on the basis of Article 6(1)(b) GDPR, Article 6(1)(c) GDPR, or Article 6(1)(f) GDPR.

11. Transactional Emails via FlowMail

For sending certain transactional emails, in particular to confirm receipt of withdrawal declarations, we use FlowMail.

The data required for sending may be processed, in particular:

  • name
  • email address
  • order number
  • content of the inquiry
  • time of form submission
  • content of the email sent

Processing takes place in order to handle your inquiry, to document receipt, and to comply with legal obligations pursuant to Article 6(1)(c) GDPR and, where the inquiry concerns a contract, pursuant to Article 6(1)(b) GDPR.

12. Accounting, ERP, and Internal Administration

For internal administration, order processing, invoicing, accounting, and tax documentation, we use internal systems and ERP or accounting solutions, in particular Odoo.

In this context, in particular customer master data, order data, invoice data, payment information, tax data, communication data, and accounting-related information may be processed.

Processing takes place for the performance of the contract pursuant to Article 6(1)(b) GDPR and to comply with statutory retention and documentation obligations pursuant to Article 6(1)(c) GDPR.

13. Newsletter and Email Marketing

If you subscribe to our newsletter or marketing emails, we process your email address and, where applicable, other data you provide in order to send you information about products, offers, news, and promotions.

Sending takes place only on the basis of your consent pursuant to Article 6(1)(a) GDPR, unless another legal basis applies. You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in the respective email.

Transactional emails, for example order confirmations, shipping information, responses to inquiries, or confirmations of receipt of withdrawals, are sent independently of a newsletter subscription.

14. Reviews and Review Requests

We may use services to display and manage customer reviews, in particular Judge.me. If you submit a review or receive a review request, depending on the feature, in particular name, email address, order information, product information, review text, star rating, time of the review, and technical metadata may be processed.

Where you submit a review yourself, processing takes place on the basis of your consent pursuant to Article 6(1)(a) GDPR or on the basis of our legitimate interest in displaying authentic customer reviews pursuant to Article 6(1)(f) GDPR. Where review requests are sent in connection with a purchase, this takes place only where a legal basis exists.

15. Cookies and Comparable Technologies

Our website uses cookies and comparable technologies. Cookies are small text files stored on your device. Comparable technologies may include pixels, local storage technologies, tags, scripts, software development kits, and similar tracking technologies.

We use cookies and comparable technologies to provide our website technically, to enable shopping cart and checkout functions, to store settings, to provide security functions, to analyze the use of our website, and to measure or personalize marketing measures.

The storage of information on your device and access to information already stored are governed by Section 25 TDDDG. The subsequent processing of the personal data obtained is governed by the GDPR.

Where cookies and comparable technologies are strictly necessary to provide the function you have expressly requested, for example for the shopping cart, checkout, security, and the technical operation of the website, access to your device takes place without consent on the basis of Section 25(2) No. 2 TDDDG. The subsequent data processing takes place on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our website.

Where cookies or comparable technologies are used for analysis, marketing, retargeting, or personalized advertising, access to your device takes place only on the basis of your consent pursuant to Section 25(1) TDDDG. The subsequent processing of personal data takes place on the basis of your consent pursuant to Article 6(1)(a) GDPR.

You can change or withdraw your consent at any time with effect for the future via the cookie settings on our website. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

16. Consent Management with Consentmo

To obtain, manage, and document consent for cookies and comparable technologies, we use the consent management tool Consentmo.

When you visit our website, Consentmo displays a cookie banner and allows you to determine which categories of cookies and services you wish to allow. You can change or withdraw your selection later.

In the course of using Consentmo, the following data may be processed in particular:

  • IP address
  • consent status
  • time of consent or withdrawal
  • browser and device information
  • language settings
  • selected cookie and data protection preferences

Processing takes place to comply with statutory proof and documentation obligations pursuant to Article 6(1)(c) GDPR and on the basis of our legitimate interest in legally compliant consent management pursuant to Article 6(1)(f) GDPR.

17. Data Protection Requests via Consentmo

We provide a data protection center via Consentmo through which you can submit data protection requests, for example for access, rectification, erasure, restriction of processing, objection, or withdrawal of consent.

When you submit a data protection request, we process the data you provide, in particular name, email address, type of request, content of the request, time of the request, and, where applicable, further information for identity verification.

Processing takes place to handle your data protection request and to comply with legal obligations pursuant to Article 6(1)(c) GDPR.

You can submit data protection requests via our data protection center or contact us directly.

18. Meta Pixel and Meta Conversions API

We may use the Meta Pixel and the Meta Conversions API on our website. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

With these services, we can measure the effectiveness of our advertisements on Facebook and Instagram, build audiences, evaluate conversion events, and optimize our advertising.

The following data, among others, may be processed and transmitted to Meta:

  • IP address
  • browser and device information
  • page views
  • clicks and interactions
  • shopping cart and purchase events
  • order information
  • hashed contact information, where transmitted

Processing takes place only on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie settings.

A transfer of personal data to third countries, in particular the USA, cannot be excluded. Meta is certified under the EU-US Data Privacy Framework. Where necessary, Meta additionally relies on EU Standard Contractual Clauses.

19. TikTok Pixel and TikTok Conversions API

We may use the TikTok Pixel and the TikTok Conversions API on our website. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.

With these services, we can measure the effectiveness of our TikTok advertisements, build audiences, evaluate conversion events, and optimize our advertising.

The following data, among others, may be processed and transmitted to TikTok:

  • IP address
  • browser and device information
  • page views
  • clicks and interactions
  • shopping cart and purchase events
  • order information
  • hashed contact information, where transmitted

Processing takes place only on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie settings.

A transfer of personal data to third countries, in particular the USA or Singapore, cannot be excluded. TikTok relies on appropriate transfer mechanisms for this, in particular EU Standard Contractual Clauses, where necessary.

20. Pinterest Ads and Pinterest Tag

We may use Pinterest advertising services and the Pinterest Tag on our website. The provider is Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.

With these services, we can measure the effectiveness of our Pinterest advertisements, build audiences, evaluate conversion events, and optimize our advertising.

In this context, in particular IP address, browser and device information, page views, clicks, interactions, shopping cart and purchase events, and order information may be processed.

Processing takes place only on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie settings.

21. Google Services: Google Analytics 4, Google Ads, Conversion Tracking, and Remarketing

We use services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Specifically, these are Google Analytics 4 as well as Google Ads with conversion tracking and remarketing functions.

Google Analytics 4 is a web analytics service that allows us to evaluate the use of our website and improve our offering. The following data, among others, may be processed:

  • truncated IP address
  • browser and device information
  • page views and time spent
  • click and interaction data
  • approximate location data
  • information on the source of access

Google Ads, conversion tracking, and remarketing are used to measure the effectiveness of our Google advertisements, evaluate conversion events, build audiences, and optimize our advertising. In this context, in particular IP address, cookie identifiers, browser and device information, page views, clicks, interactions, shopping cart and purchase events, and order information may be processed.

The use of these services takes place exclusively on the basis of your consent pursuant to Section 25(1) TDDDG for access to your device and pursuant to Article 6(1)(a) GDPR for the subsequent processing of personal data. You can withdraw your consent at any time with effect for the future via the cookie settings.

A transfer of personal data to the USA cannot be excluded. Google is certified under the EU-US Data Privacy Framework. Where necessary, Google additionally relies on EU Standard Contractual Clauses.

22. Social Media Profiles and External Links

We maintain profiles on social networks and platforms, in particular Instagram, Facebook, TikTok, LinkedIn, Pinterest, and YouTube. When you visit our profiles or interact with our content, personal data is processed by the respective platform operators.

We have only limited influence over the data processing carried out by these platforms. Please refer to the privacy notices of the respective providers.

Our website may contain links to external websites or platforms. When you open external links, the privacy policies of the respective provider apply.

23. Disclosure of Personal Data

We disclose personal data only where this is necessary for the respective purposes, where there is a legal permission, or where you have consented.

Recipients of personal data may include in particular:

  • Shopify and affiliated technical service providers
  • payment service providers
  • shipping service providers, in particular DPD
  • technical service providers for shipping labels and shipping processing
  • ERP, accounting, and invoicing service providers
  • email and communication service providers
  • consent management service providers
  • marketing and analytics providers, where you have consented
  • review service providers
  • tax advisors, legal advisors, and authorities, where necessary

Where service providers act as processors on our behalf, we engage them contractually in accordance with Article 28 GDPR.

24. International Data Transfers

Some of the service providers we use may process personal data outside the European Union or the European Economic Area, in particular in the USA or other third countries.

Where personal data is transferred to third countries, this takes place only where an appropriate legal basis exists, in particular an adequacy decision of the European Commission or appropriate safeguards such as EU Standard Contractual Clauses.

25. Retention Period

We store personal data only for as long as necessary for the respective processing purposes or as required by statutory retention obligations.

We store order, invoice, and accounting data in accordance with the statutory commercial and tax retention periods. We store communication data for as long as necessary to handle the inquiry, perform the contract, or for documentation purposes. We store consent data for as long as necessary to provide evidence of consent or withdrawal.

Where data is no longer required and no statutory retention obligations exist, it is deleted or anonymized.

26. Security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction.

Please note that no data transmission over the internet is completely secure. We therefore recommend that you transmit confidential information only via secure communication channels.

27. Children's Data

Our services are not directed at children. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us so that we can review and, where appropriate, delete the relevant data.

28. Your Data Protection Rights

Subject to the statutory requirements, you have in particular the following rights:

  • right of access pursuant to Article 15 GDPR
  • right to rectification pursuant to Article 16 GDPR
  • right to erasure pursuant to Article 17 GDPR
  • right to restriction of processing pursuant to Article 18 GDPR
  • right to data portability pursuant to Article 20 GDPR
  • right to object pursuant to Article 21 GDPR
  • right to withdraw consent given pursuant to Article 7(3) GDPR
  • right to lodge a complaint with a data protection supervisory authority

If you have given consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing up to the point of withdrawal remains unaffected.

You can exercise your rights via our data protection center or contact us directly.

Data protection center: Data protection requests

29. Right to Object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

Where we process personal data for direct marketing, you have the right to object to this processing at any time. In this case, we will no longer use your personal data for direct marketing.

30. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.

The authority responsible for North Rhine-Westphalia is in particular:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4
40213 Düsseldorf
Germany
Website: www.ldi.nrw.de

31. Changes to This Privacy Policy

We may amend this Privacy Policy from time to time, in particular where our data processing, the services we use, or the legal requirements change. The version published on our website at the relevant time applies.

32. Contact

If you have any questions about this Privacy Policy or the processing of your personal data, you can contact us:

Geometree
Sascha Hatke
Aachener Straße 310
50933 Cologne
Germany
Email: verkauf@geometree.de