Privacy Policy

Last updated: November 2026

This is a translation for your convenience. In case of doubt, the German version applies.

1. Controller

The controller responsible for processing personal data in this online shop (asianbows.com) within the meaning of the General Data Protection Regulation (GDPR) is:

Asianbows Archeryshop
Owner: Ugur Eskicioglu
New-York-Ring 49
71686 Remseck am Neckar
Germany
Phone: +49 1577 8794210
Email: asianbows@gmail.com

We have not appointed a data protection officer, as there is no legal obligation to do so. If you have any questions about data protection, please contact us at the address above.

2. General information on data processing

We process personal data only to the extent necessary to provide our online shop, to process orders, to communicate with you, or on the basis of your consent. The legal bases are in particular:

• Art. 6(1)(a) GDPR (consent),
• Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures),
• Art. 6(1)(c) GDPR (legal obligation, e.g. retention obligations under commercial and tax law),
• Art. 6(1)(f) GDPR (legitimate interests),
• Section 25(1) and (2) of the German TDDDG (storing and accessing information on your device).

Personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations prevent deletion.

3. Hosting and shop system (Shopify)

Our online shop runs on the Shopify platform. The provider for customers in Europe is Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify provides the technical infrastructure (servers, database, checkout, customer accounts, email delivery) and processes all data you enter in the shop or that arises during your visit on our behalf. We have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR.

Data may also be transferred to Shopify Inc. (Canada) and to service providers in the USA. An adequacy decision of the European Commission exists for Canada. For transfers to the USA, Shopify relies on the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.

The legal basis is Art. 6(1)(b) GDPR insofar as processing serves the performance of the contract, and otherwise Art. 6(1)(f) GDPR (our legitimate interest in operating the shop securely and efficiently). More information: https://www.shopify.com/legal/privacy

4. Visiting the website and server log files

When you visit our shop, information transmitted by your browser is collected automatically, e.g. IP address, date and time of access, page visited, referrer URL, browser type and operating system. This data is needed to deliver the website, to ensure its stability and security, and to prevent misuse. The legal basis is Art. 6(1)(f) GDPR. Shopify deletes or anonymises the log data after a limited period.

5. Cookies and consent management

We use cookies and similar technologies. Technically necessary cookies (e.g. for the shopping cart, checkout, language setting, login and storing your cookie choice) are used on the basis of Section 25(2) No. 2 TDDDG and Art. 6(1)(b) or (f) GDPR.

All other cookies and tracking technologies (statistics, marketing, personalisation) are only used with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). To manage your consent, we use the cookie banner of the "Consentmo GDPR" app together with Shopify's customer privacy feature. Your choice, a timestamp and a pseudonymous identifier are stored so that we can document and respect your decision.

You can withdraw or change your consent at any time with effect for the future by reopening the cookie settings (link in the footer or the cookie banner icon). You can also delete or block cookies in your browser.

6. Contacting us and chat

If you contact us by email, phone, contact form or via chat (Shopify Inbox), we process your details (e.g. name, email address, message) to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in handling enquiries). The data is deleted once your enquiry has been fully dealt with, unless statutory retention obligations apply.

For email communication we use the Gmail service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the USA on the basis of the EU-U.S. Data Privacy Framework.

7. Orders, customer account and contract processing

To process your order, we process the data you provide (name, billing and delivery address, email address, telephone number if applicable, items ordered, payment information). Mandatory fields are marked; without this information we cannot conclude the contract. The legal basis is Art. 6(1)(b) GDPR.

You may voluntarily create a customer account. Your data is then stored for future orders and you can view your order history. You can have your customer account deleted at any time; a message to the address above is sufficient.

Due to commercial and tax law requirements (Section 257 HGB, Section 147 AO), we store order and invoice data for up to ten years or for the period prescribed by law (Art. 6(1)(c) GDPR). After that, it is deleted.

8. Payment service providers

Depending on the payment method you choose, we pass on the data required for payment processing (e.g. name, address, email, order amount, payment data) to the respective payment service provider. The legal basis is Art. 6(1)(b) GDPR. Some payment service providers are independent controllers for their processing.

• Shopify Payments (credit/debit card, Apple Pay, Google Pay, Bancontact, BLIK, eps, iDEAL | Wero, MB WAY, MobilePay, Bizum, Satispay, etc.): Processing is carried out by Shopify in cooperation with Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland. For fraud prevention, data may be transferred to Stripe, Inc. (USA) (EU-U.S. Data Privacy Framework or Standard Contractual Clauses). Privacy: https://stripe.com/privacy
• Apple Pay / Google Pay: When using these wallets, the privacy policies of Apple Distribution International Ltd. (Ireland) or Google Ireland Limited also apply.
• Klarna: If you choose a Klarna payment method (e.g. invoice, instalments, instant bank transfer), your data is transferred to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may carry out identity and credit checks, also using credit agencies. Klarna is the controller for this processing. Privacy: https://www.klarna.com/international/privacy-policy/
• PayPal: If you pay via PayPal (including card, direct debit or "Pay Later" via PayPal), your data is transferred to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal reserves the right to carry out a credit check for certain payment methods. Privacy: https://www.paypal.com/de/legalhub/privacy-full

9. Shipping service providers

For delivery, we pass your name and delivery address on to the commissioned shipping company (Art. 6(1)(b) GDPR):

• DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany
• Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany
• GLS Germany GmbH & Co. OHG, GLS Germany-Straße 1-7, 36286 Neuenstein, Germany

We only pass on your email address and/or telephone number to the shipping company if you have expressly consented to this during checkout (Art. 6(1)(a) GDPR), so that you can be notified of the delivery date. For shipments to countries outside the EU, your telephone number and email address must be passed on to the shipping company and customs authorities for customs clearance (Art. 6(1)(b) and (c) GDPR). You can withdraw your consent at any time.

10. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about products and offers. Subscription uses the double opt-in procedure: you receive an email in which you confirm your subscription. We store the time of subscription and confirmation as well as your IP address as proof. The legal basis is Art. 6(1)(a) GDPR. For sign-up forms and sending we use Shopify Forms and Shopify Messaging (Shopify Email). Open and click rates are recorded in order to improve the newsletter.

You can unsubscribe at any time via the unsubscribe link in every email or by sending us a message.

If you have bought goods from us and provided your email address, we may send you advertising for our own similar goods by email even without separate consent (Section 7(3) UWG, Art. 6(1)(f) GDPR). You can object to this use at any time without incurring any costs other than transmission costs at basic rates.

11. Product reviews (Yotpo)

To display and collect customer reviews, we use "Yotpo Product Reviews" provided by Yotpo Ltd. After an order you may be asked by email to leave a review; for this purpose we pass your name, email address and the items purchased on to Yotpo. The legal basis for the review request is your consent (Art. 6(1)(a) GDPR) or, where legally permitted, our legitimate interest in customer feedback (Art. 6(1)(f) GDPR, Section 7(3) UWG); you can object at any time. If you submit a review, it is published in the shop together with the name you provided (abbreviated if applicable). Yotpo also processes data in Israel (adequacy decision of the European Commission) and the USA (Standard Contractual Clauses). Privacy: https://www.yotpo.com/privacy-policy/

12. Other shop features (apps)

For certain features we use extensions (apps) integrated via Shopify that process data on our behalf:

• Rivo Loyalty Rewards Referrals (loyalty and referral programme): If you take part, your name, email address, orders and points balance are processed. Legal basis: Art. 6(1)(b) GDPR (participation in the programme).
• Enlistly – Affiliate Marketing (partner programme): If you reach the shop via a partner link, we store which partner referred you so that a commission can be paid. This only happens with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). For partners who register, Art. 6(1)(b) GDPR applies.
• Globo Product Options (product options), Lantern (arrow advisor/product finder), Search & Discovery and Bundles (search and product sets), Essential Trust Badges and Hoppy Free Shipping (display of notices): These apps only process your input and technical data to the extent required for the respective feature (Art. 6(1)(b) or (f) GDPR).
• Translate & Adapt (translations) and Shopify Flow (automation of internal processes): processing by Shopify as part of operating the shop.

Where providers are based outside the EU, transfers take place on the basis of an adequacy decision or EU Standard Contractual Clauses.

Shopify Claude Connector App (AI assistant for internal shop management): This app connects our shop to the AI assistant "Claude". For users in the EEA, the provider is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland; the parent company is Anthropic PBC, San Francisco, USA. We use the assistant exclusively internally, e.g. to maintain product texts and translations, to check shop settings and to evaluate orders. In doing so, the assistant may access shop data, which may include order and customer data (e.g. name, address, email address, items ordered). Data is only transmitted to the extent required for the respective task. The assistant does not interact with visitors to the shop and does not make any automated decisions about you. The legal basis is our legitimate interest in efficient and error-free shop management (Art. 6(1)(f) GDPR). Anthropic may also process data in the USA; transfers take place on the basis of EU Standard Contractual Clauses. Provider's privacy policy: https://www.anthropic.com/legal/privacy

13. Analytics and marketing services (only with consent)

We only use the following services if you have given your consent in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time via the cookie settings.

Shopify analytics: Shopify produces reports for us on the use of the shop (e.g. page views, traffic sources, purchases).

Google (Google Analytics, Google Ads, Google Tag Manager, Google Merchant Center via the "Google & YouTube" sales channel): The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google records your usage behaviour (e.g. pages viewed, clicks, purchases, shortened IP address, device information) in order to compile statistics, measure the success of ads and show ads on Google and YouTube (remarketing). Server-side events are also transmitted. Google Tag Manager itself is only used to manage tags. Data may be transferred to the USA on the basis of the EU-U.S. Data Privacy Framework. Privacy: https://policies.google.com/privacy

Meta (Meta Pixel and Conversions API via the "Facebook & Instagram" sales channel): The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta records which pages you visit and which actions you take (e.g. add to cart, purchase) in order to show ads on Facebook and Instagram and to measure their effectiveness; server-side events with hashed contact data are also transmitted. We and Meta are joint controllers for the collection and transmission of this data (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Data may be transferred to the USA on the basis of the EU-U.S. Data Privacy Framework. Privacy: https://www.facebook.com/privacy/policy

Product catalogue on Google, Facebook, Instagram, Microsoft Copilot and the Shop app: Our products are also shown on these platforms. If you shop there or interact with our offers, the privacy policies of the respective platform also apply.

14. Sales via online marketplaces

We may also offer our products on online marketplaces (connected via "Marketplace Connect"). If you order there, we receive the data required for processing from the marketplace (name, delivery address, items ordered) and process it in accordance with Art. 6(1)(b) GDPR. The marketplace operator is responsible for processing on the marketplace itself.

15. Our social media presence

We maintain profiles on Facebook and Instagram. When you visit them or interact with us there, Meta processes your data under its own policies. We and Meta are joint controllers for the creation of page statistics (Insights) (Art. 26 GDPR). The legal basis is Art. 6(1)(f) GDPR (communication with customers and prospects). You can also exercise your rights directly against Meta.

16. Transfers to third countries

Where we use services of providers outside the EU/EEA, data is only transferred if an adequacy decision of the European Commission exists for that country (e.g. Canada, Israel, Switzerland, the United Kingdom, or the USA for companies certified under the EU-U.S. Data Privacy Framework) or if appropriate safeguards such as EU Standard Contractual Clauses (Art. 46 GDPR) have been agreed.

17. Your rights

Under the GDPR you have the following rights with respect to us:

• access to your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR),
• lodging a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. Where your data is processed for direct marketing, you may object to such processing at any time without giving reasons; we will then no longer process your data for this purpose.

To exercise your rights, an informal message to asianbows@gmail.com is sufficient.

18. Automated decisions

We do not make any decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Payment service providers (Klarna, PayPal) may carry out their own automated credit checks for certain payment methods; please refer to their privacy notices for details.

19. Data security and changes

Our shop uses SSL/TLS encryption. We will update this privacy policy if the legal situation or our services change. The version published here applies.