Privacy policy

Last updated: September 10, 2026

Poop Patrol Babywear operates this online store and website, including the related information, content, features, tools, products, and services (together, the “Services”). Our store is powered by Shopify.

This Privacy Policy explains how personal data is processed when you visit our website, shop with us, use our Services, or communicate with us.

Using our website does not constitute blanket consent to the processing of your personal data. Where consent is required, it is obtained separately.

Controller and contact details

The controller responsible for the processing by Poop Patrol Babywear described in this policy is:

Christian Hans Richter
Poop Patrol Babywear
Anna-Nopper-Straße 17
70806 Kornwestheim
Germany
Email: service@pooppatrolbabywear.com

Where Shopify or other providers process data for their own purposes as independent controllers, their privacy notices also apply. Further information is provided in the relevant sections below.

What personal data do we process?

Personal data is information relating to an identified or identifiable individual. The data processed depends on the Services you use and the information you provide.

  • Contact details: for example, your name, billing address, shipping address, email address, and, where applicable, telephone number.
  • Payment and transaction information: for example, payment method, payment status, transaction references, billing information, and refunds. Depending on the payment method, the payment providers involved process additional payment information. The information available to us depends on the relevant payment service.
  • Account information: for example, information required to sign in, saved addresses, account settings, and order history.
  • Order information: for example, purchased products, variants, quantities, prices, returns, and exchange or cancellation requests.
  • Communication data: for example, customer service messages, inquiries, reviews, and attachments you submit.
  • Device and connection information: for example, IP address, browser, operating system, device information, and technical identifiers.
  • Usage information: for example, pages visited, products viewed, cart contents, and interactions with our website, where this processing is permitted.
  • Consent and privacy settings: for example, your cookie choices, marketing consents, and opt-out requests.

Where does the data come from?

  • Directly from you: for example, when you place an order, contact us, subscribe to our newsletter, or use a customer account.
  • Through your use of our website: for example, technical connection data and information from cookies and similar technologies, where their use is permitted.
  • From service providers involved: for example, payment confirmations, shipping updates, or technical information from Shopify and other providers involved in delivering our Services.
  • From integrations you choose to use: where you use a third-party feature and the provider shares information with us within the intended and legally permitted scope.

Why do we process data, and what are the legal bases?

Where the General Data Protection Regulation (“GDPR”) applies, processing is based in particular on the following grounds:

  • Orders and contract performance: We process necessary data to handle your order, payment, production, delivery, return, and refund, together with related communications. The legal basis is Article 6(1)(b) GDPR.
  • Customer accounts and pre-contractual inquiries: Where processing is necessary to provide requested features or handle a contract-related inquiry, it is based on Article 6(1)(b) GDPR.
  • Legal obligations: These include commercial and tax recordkeeping requirements. The legal basis is Article 6(1)(c) GDPR.
  • Security, abuse prevention, and legal claims: Where necessary, we process data under Article 6(1)(f) GDPR. Our legitimate interests are operating our store securely, preventing fraud and abuse, and establishing or defending legal claims. We take your rights and interests into account.
  • General communication: We handle inquiries unrelated to a contract on the basis of our legitimate interest in appropriate communication under Article 6(1)(f) GDPR, unless another legal basis applies.
  • Newsletters, consent-based analytics, and personalized advertising: Where consent is required, processing is based on Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Direct marketing without separate consent takes place only where the applicable legal conditions are met. In particular, the requirements governing advertising by electronic mail remain applicable.

Which information is required?

Information marked as required for an order is needed to enter into and perform the contract. Without this information, we may be unable to process or deliver your order.

Additional information identified as optional is generally not required. Consent to optional advertising or analytics is not a condition of making a purchase.

Cookies and similar technologies

Our website uses cookies and similar technologies, for example to provide the shopping cart, manage a session, remember privacy settings, and, where permitted, support analytics and advertising.

Where German law applies, storing information on your device or accessing information stored on it is governed by Section 25 of the German TDDDG. A statutory exemption from consent may apply to strictly necessary functions. Other access takes place only with the required consent.

Any subsequent processing of personal data also requires a legal basis under applicable data protection law.

You can manage your choices through the cookie settings provided on our website. Information about opting out of certain disclosures for targeted advertising is available on our privacy settings and data-sharing opt-out page. This opt-out mechanism is distinct from managing your cookie consent.

If you have questions or problems with your privacy settings, contact us at service@pooppatrolbabywear.com.

Newsletters and marketing communications

If you subscribe to our newsletter, we use the information you provide to send you information about our products, offers, and promotions. Where required, we do so on the basis of your consent.

You can unsubscribe at any time using the unsubscribe link in a newsletter email or by contacting service@pooppatrolbabywear.com.

We may continue to send necessary messages about your orders, payments, or customer account. These messages are independent of a newsletter subscription.

Who receives personal data?

We disclose personal data only where necessary for a lawful purpose or where appropriate consent has been provided. Recipients may include:

  • Shopify and technical service providers: to provide, maintain, and secure the online store.
  • Payment providers: to process payments, payment checks, and refunds.
  • Production, fulfillment, and shipping providers: to manufacture, process, and deliver your order.
  • Customer service, review, and communication providers: where they are involved in the relevant feature and the processing is legally permitted.
  • Analytics and advertising providers: within the scope of permitted processing and taking your consents and opt-out requests into account.
  • Tax advisers, legal advisers, authorities, and courts: where necessary to comply with legal obligations or pursue legal claims.

Any disclosure in connection with a business transfer or similar commercial change takes place only in accordance with applicable data protection law.

Where providers process data on our behalf, the necessary contractual arrangements are put in place. Other recipients may act as independent controllers for certain processing activities.

Relationship with Shopify

Our store is hosted by Shopify. Shopify processes data needed to operate the technical infrastructure, provide the store, and handle your interactions.

For certain Shopify features, Shopify may also process data for its own purposes, for example in connection with Shopify consumer services or enhanced features. The processing depends on the features used, your interactions, and your privacy settings.

Where Shopify acts as an independent controller, Shopify is responsible for that processing and for handling related privacy requests. Our responsibility for processing carried out at our direction remains unaffected.

Further information is available in the Shopify Consumer Privacy Policy. You can manage the privacy rights and settings offered by Shopify through the Shopify Privacy Portal.

Microsoft Clarity

We use Microsoft Clarity, a web analytics service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). Clarity helps us understand how visitors use our online store and supports improvements to usability, content, and functionality.

Clarity processes technical device and browser information, IP addresses, pseudonymous identifiers, pages visited, and interactions such as clicks, mouse movements, scrolling, and navigation. This information can be used to create session replays, heatmaps, and aggregated usage statistics.

Session replays are technical reconstructions of website interactions. They are not camera recordings or screen videos. Input fields and other content are hidden in accordance with technical requirements and the masking settings used.

Clarity may use cookies and similar technologies. For visitors from the European Economic Area, the United Kingdom, and Switzerland, cookies requiring consent may be used only after that consent has been provided. Where processing relies on consent, the legal basis is Article 6(1)(a) GDPR or the corresponding applicable data protection provision.

You can withdraw consent through our website’s cookie settings with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

According to Microsoft’s documentation, Clarity can technically operate with reduced functionality when cookie consent is absent and collect certain measurements without cookies. Such processing is not exempt from data protection requirements merely because it does not use cookies.

Data is processed through Microsoft systems. It may also be transferred to affiliated companies outside the EU, particularly in the United States. Microsoft describes the use of safeguards including Standard Contractual Clauses.

According to Clarity’s documentation, session recordings are normally available to us for up to 30 days. Favorite recordings, selected samples, and heatmap data may be available for up to nine months.

Further information is available in the Microsoft Privacy Statement and the Microsoft Clarity frequently asked questions.

Third-party websites and features

Our Services may contain links to websites or features provided by others. If you use those offerings, please review the relevant provider’s privacy notices.

If you publish content publicly, such as a review, other people may be able to read it. This does not give others an unrestricted right to use that content or personal data.

Our own responsibilities under data protection law, including those relating to the integration of third-party features, remain unaffected.

Children’s data

Our store is intended for adult purchasers, not children. Please do not send us children’s personal data that is unnecessary to handle your request.

If you are a parent or legal guardian and believe a child has provided personal data to us without the necessary authorization, please contact us. We will review the situation and take appropriate action.

As of the date of this policy, we do not have actual knowledge that we “sell” or “share” personal data belonging to individuals under 16, as those terms are defined under applicable US privacy laws.

Security and retention

We implement appropriate technical and organizational measures to protect personal data. Nevertheless, data transmission and storage cannot be guaranteed to be entirely risk-free.

We generally retain personal data only for as long as necessary for the relevant purpose. Relevant criteria include:

  • the time required to process and complete your order, return, or inquiry;
  • the duration of an existing customer account, where the data is needed for that account;
  • statutory retention and recordkeeping requirements, particularly for business and accounting records;
  • applicable limitation periods and the need to establish or defend legal claims;
  • the validity of consent and any necessary evidence of its provision or withdrawal.

Once the processing purpose no longer applies, data is deleted or anonymized unless a legal obligation or another lawful basis permits continued retention. The availability periods described above also apply to Clarity data.

Your rights

Where the GDPR applies, you have the following rights, subject to the respective legal requirements:

  • Access: You may request information about the personal data we process about you.
  • Rectification: You may request the correction of inaccurate data and completion of incomplete data.
  • Erasure: You may request deletion of your data where no statutory exception applies.
  • Restriction of processing: You may request that processing be restricted where the legal conditions are met.
  • Data portability: Where the legal requirements are met, you may request your data in a structured, commonly used, machine-readable format and, where applicable, its transmission to another controller.
  • Withdrawal of consent: You may withdraw consent at any time with effect for the future. This does not retrospectively make earlier processing unlawful.
  • Complaint: You may lodge a complaint with a data protection supervisory authority.

Right to object: Where we process data under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object at any time to processing for direct marketing, including related profiling. Following an objection to direct marketing, we will no longer use your data for that purpose.

Depending on where you live, you may have additional rights under other privacy laws, particularly in the United Kingdom, Switzerland, or individual US states.

Opting out of data sharing and targeted advertising

Under certain privacy laws, disclosing data for personalized advertising may be considered “selling,” “sharing,” or “targeted advertising.” Whether corresponding rights apply depends in particular on the relevant law and your place of residence.

Information and any available opt-out mechanisms are provided on our privacy settings and data-sharing opt-out page. You may also contact service@pooppatrolbabywear.com.

A transmitted Global Privacy Control signal is handled in accordance with applicable legal requirements. Information about this browser signal is available from Global Privacy Control.

Such a signal does not necessarily replace managing your cookie settings or separately unsubscribing from a newsletter.

How can you exercise your rights?

Please send your request to service@pooppatrolbabywear.com or to the postal address stated above.

We may request additional information where necessary to verify your identity appropriately. Authorized representatives may submit requests on your behalf where permitted by law; we may require evidence of their authorization.

We handle requests within the applicable legal deadlines. Where the GDPR applies, we generally inform you of the action taken within one month of receiving your request. If a legally permitted extension is necessary, we will inform you of the extension and its reasons within that period.

You will not be unlawfully disadvantaged for exercising your privacy rights. Where applicable law provides a right to appeal the refusal of a request, you may contact us using the details above.

Complaints

You may contact us directly with privacy questions or complaints. However, you are not required to contact us before lodging a complaint with a supervisory authority.

Where the GDPR applies, you may complain in particular to a supervisory authority in your place of habitual residence, your place of work, or the place of an alleged infringement.

The authority responsible for our business location is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg. An overview of other European supervisory authorities is available from the European Data Protection Board.

International data transfers

Using Shopify and other service providers may involve processing personal data outside your country of residence.

Transfers from the European Economic Area to third countries must meet the requirements of Articles 44 and following of the GDPR. Transfers may rely, in particular, on an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses. Additional protective measures must be considered where necessary.

Transfers from the United Kingdom or Switzerland are subject to the respective applicable requirements. Information about the safeguards used in a particular case and, where applicable, a copy of them can be requested using our contact details, subject to the protection of legitimate rights.

Changes to this Privacy Policy

We may update this Privacy Policy when our processing activities, Services, or legal requirements change. The current version will be published on this website, and the date at the beginning will be updated accordingly.

Where separate notice or renewed consent is required, we will address this in addition to publishing the revised policy. Publishing an updated Privacy Policy does not replace any required consent.

Contact

If you have questions about this Privacy Policy or would like to exercise your rights, contact us at service@pooppatrolbabywear.com.

Christian Hans Richter
Poop Patrol Babywear
Anna-Nopper-Straße 17
70806 Kornwestheim
Germany