Privacy policy

Last updated: September 2026

This is an English translation of our German privacy policy.

1. Controller

The controller responsible for the processing of personal data on this website and in our online shop fuzzplay.de is:

FuzzPlay - Tiermöbel aus Filz
Owner: Lars Ratschke
Sperberweg 3
34128 Kassel
Germany
Phone: +49 561 76606217
Email: info@fuzzplay.de

We have not appointed a data protection officer, as there is no legal obligation to do so. If you have any questions about data protection, you can reach us using the contact details above.

2. Overview

We process your data primarily to handle orders, answer your enquiries and comply with legal obligations. We only use analytics and advertising services (Google, Pinterest, Shopify Collabs) with your consent. You can change or withdraw your consent at any time in the cookie settings. Our shop is operated on the Shopify platform; data may also be processed in Canada and the USA. Shopify also uses certain data under its own responsibility for its own services such as Shop Pay (details in section 4).

3. Legal bases, recipients, third countries and storage period

Legal bases. We process personal data on the basis of your consent (Art. 6(1)(a) GDPR), to perform a contract or to take steps prior to entering into a contract (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR) or to protect legitimate interests (Art. 6(1)(f) GDPR). Where information is stored on or read from your device (e.g. cookies), this is done with your consent pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) or, where strictly necessary for the service you have requested, pursuant to Section 25(2) No. 2 TDDDG.

Recipients. We use service providers that process data on our behalf and in accordance with our instructions (processors, Art. 28 GDPR). Other recipients, such as payment service providers and shipping service providers, process the data under their own responsibility insofar as this is necessary for performing the contract.

Third countries. We only transfer data to countries outside the EU and the EEA if there is an adequacy decision of the European Commission (e.g. for Canada or for companies in the USA certified under the EU-U.S. Data Privacy Framework), if appropriate safeguards are in place (e.g. standard contractual clauses or binding corporate rules) or if an exception under Art. 49 GDPR applies.

Storage period. We delete personal data as soon as the purpose of processing no longer applies, you withdraw your consent or you validly object, unless statutory retention obligations prevent this. Under German commercial and tax law, we retain accounting records such as invoices for eight years, commercial and business letters for six years, and books and annual financial statements for ten years, in each case from the end of the relevant calendar year.

4. Hosting and shop system (Shopify)

Our online shop is operated on the e-commerce platform Shopify. The provider is Shopify International Limited, c/o Intertrust Ireland, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify hosts our shop, provides the shopping cart, checkout and customer account, and in doing so processes on our behalf the data generated during visits and orders (Art. 28 GDPR).

We have chosen the European Union as the storage location for our shop's data at Shopify. Shopify may nevertheless transfer data to Shopify Inc. in Canada and to service providers in the USA and other countries. There is an adequacy decision of the European Commission for Canada. Otherwise, Shopify bases transfers on binding corporate rules (Art. 47 GDPR) and other appropriate safeguards pursuant to Art. 46 GDPR.

Each time our shop is accessed, Shopify processes technically necessary access data: IP address, date and time, page accessed, previously visited page (referrer), browser type and version, and operating system. The processing serves to deliver the website and to ensure stability and security, including protection against misuse and fraud. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and functional operation of the shop.

Shopify Network Intelligence. Shopify additionally processes data about your visits and orders in our shop under its own responsibility and may combine it with data from your interactions with other Shopify merchants and with Shopify. Shopify uses this data to provide and improve services, such as Shop Pay and the Shop app, a faster checkout, the optimisation of payment processing, protection against fraud, personalisation, and the email marketing and creator collaboration features that we use. For this purpose, data may be passed on to Shopify and other third parties, including in countries outside the EU. The legal basis for passing data on to Shopify is Art. 6(1)(f) GDPR; our legitimate interest lies in a secure and convenient shopping experience. Shopify only uses your data for advertising based on your activities in our shop, with other merchants and with Shopify if you have given your consent in the cookie settings (Art. 6(1)(a) GDPR). Details: Shopify Consumer Privacy Policy, https://www.shopify.com/legal/privacy/app-users. You can exercise your rights vis-à-vis Shopify, such as withdrawing consent, objecting, access or erasure, via https://privacy.shopify.com.

Further information: https://www.shopify.com/legal/privacy

5. Cookies and consent management

We use cookies and similar technologies (e.g. the browser's local storage, pixels). We use technically necessary cookies without consent, for example for the shopping cart, language and country settings, checkout, security and storing your privacy choices (Section 25(2) No. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). We only use all other cookies and services, in particular for statistics and marketing, with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). An overview of Shopify cookies can be found at https://www.shopify.com/legal/cookies.

We use Shopify's cookie banner to manage your consent (section 4). Your choice is stored in a cookie on your device. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

You can change or withdraw your consent at any time with effect for the future by reopening the settings via the "Cookie settings" link at the bottom of every page or directly at cookie settings. This does not affect the lawfulness of processing carried out before the withdrawal.

6. Customer account

You can use a customer account; you can also order without an account. You log in using a one-time code that we send to you by email. Your contact details, addresses and orders are stored in the customer account. The legal basis is Art. 6(1)(b) GDPR. You can request the deletion of your account at any time; statutory retention obligations remain unaffected.

7. Orders and contract processing

To process your order, we process your name, billing and delivery address, email address, telephone number if applicable, ordered goods, payment method and payment status, as well as communication relating to the order. We use the data for concluding the contract, shipping, payment, customer service and handling withdrawals and warranty cases. The legal basis is Art. 6(1)(b) GDPR; retention under commercial and tax law is based on Art. 6(1)(c) GDPR.

After your order, you will receive an order confirmation by email to which our general terms and conditions and our instructions on withdrawal are attached as PDF files. To prevent payment fraud, Shopify subjects orders to an automated risk assessment. We decide ourselves how to handle an order. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against fraud.

8. Payment processing

Your payment data is processed by the respective payment service providers. We do not receive complete card or account details. The legal basis is Art. 6(1)(b) GDPR, for statutory verification obligations of the payment service providers (e.g. anti-money laundering) Art. 6(1)(c) GDPR, and for fraud prevention Art. 6(1)(f) GDPR.

Shopify Payments. We process payments by credit and debit card (Visa, Mastercard, American Express, Maestro, UnionPay), Apple Pay, Google Pay, Shop Pay, Klarna as well as Bancontact, BLIK, EPS, iDEAL, MB WAY and MobilePay via Shopify Payments. The provider is Shopify International Limited (address see section 4); other payment service providers are involved in the processing, including Stripe Payments Europe, Limited, Ireland, and the respective card organisations.

Apple Pay is provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Google Pay is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Shop Pay is a Shopify service that allows you to save payment and shipping details in your Shop account for faster orders, if you wish.

Klarna. If you pay with Klarna, Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, processes your data under its own responsibility. Klarna may carry out an identity and credit check and exchange data with credit agencies for this purpose. Details: https://www.klarna.com/de/datenschutz/

PayPal. If you pay with PayPal, we pass the data required for payment on to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Depending on the PayPal payment method selected, PayPal may carry out a credit check. Details: https://www.paypal.com/de/legalhub/privacy-full

9. Shipping

For delivery, we transmit your name and delivery address to our shipping service provider DHL (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany). We only pass on your email address or telephone number insofar as this is necessary for delivery, for example for customs clearance for shipments outside the EU. For deliveries to countries outside the EU, the responsible delivery services and customs authorities in the country of destination also receive the necessary shipment and customs data; the legal basis for this transfer is Art. 49(1)(b) GDPR. Otherwise, the legal basis is Art. 6(1)(b) GDPR.

10. Withdrawal function ("Cancel contract")

For the legally required electronic withdrawal function (Section 356a of the German Civil Code, BGB), we use the app "EU Widerruf Button" of 401layers UG (haftungsbeschränkt), Hilden, Germany, as a processor. The withdrawal form is loaded from the provider's server; in the process, your IP address is transmitted to the provider. If you declare a withdrawal, we process your name, email address, order number, the items concerned if you so wish, and the date and time of receipt. You will automatically receive an acknowledgement of receipt by email.

The legal bases are Art. 6(1)(c) GDPR in conjunction with Section 356a BGB, Art. 6(1)(b) GDPR for processing the withdrawal, and Art. 6(1)(f) GDPR for proof and the defence against claims. We store the information until the end of the regular limitation period of three years from the end of the year in which the withdrawal was processed; retention obligations under commercial and tax law remain unaffected.

11. Contact

If you contact us by email, telephone or via the contact form, we process your details (e.g. name, email address, telephone number, message) in order to handle your enquiry. The contact form is provided via Shopify. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the data once the enquiry has been dealt with, unless retention obligations apply.

12. Newsletter

You can subscribe to our newsletter via the sign-up form on our website or, where offered, at checkout. We use the double opt-in procedure: after signing up, you will receive an email in which you confirm the subscription. Only then will we send you the newsletter. As proof, we store the time of sign-up and confirmation.

For sending and management we use Shopify Messaging, a Shopify service (section 4). The newsletter contains tracking pixels and links with which Shopify Messaging records whether and when an email was opened and which links were clicked. We use this evaluation to improve the newsletter; it is part of your consent.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every email or by sending us a message. After you unsubscribe, we delete your email address from the mailing list. We retain proof of your previous consent for up to three years (Art. 6(1)(f) GDPR).

13. Analytics and advertising (only with consent)

We only use the following services if you have given your consent in the cookie settings (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). The services are integrated via Shopify's customer events. Shopify transmits events such as page views, product views, cart and purchase events (product, value, order number) both from your browser and from Shopify's servers to the respective provider. For orders, Shopify may additionally provide these services with contact data such as email address, telephone number, name and address so that purchases can be matched to the providers' user accounts; according to the providers, they use hashed (encrypted) values for this purpose. Without your consent, these services are not loaded and no data is transmitted to them.

Google Analytics 4, Google Ads and Google Merchant Center. Via the "Google & YouTube" app, we use Google Analytics 4 to analyse the use of our shop, Google Ads conversion tracking to measure the success of ads, remarketing to show ads to visitors to our shop, and Google Merchant Center for product ads. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. In particular, online identifiers (cookie IDs), device and browser information, approximate location and the events mentioned above are processed. Google Analytics 4 does not store complete IP addresses. We delete the usage data in Google Analytics after no more than 14 months; Google cookies are deleted after up to two years, depending on their type. Details: https://policies.google.com/privacy

Pinterest Tag and Pinterest Conversions API. To measure the success of our Pinterest advertising and to show ads on Pinterest to visitors to our shop, we use the Pinterest Tag and server-side transmission of events. The provider is Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland. Data may be transferred to Pinterest, Inc. in the USA; Pinterest is certified under the EU-U.S. Data Privacy Framework. Details: https://policy.pinterest.com/de/privacy-policy

Shopify Collabs. With Shopify Collabs we work with creators. If you come to our shop via their referral link, Shopify records whether this results in an order so that the commission can be allocated. The referral identifier, online identifiers, and order value and order number are processed.

14. Orders via trading platforms and trading partners

We also sell our products via retail and wholesale platforms (Faire, Orderchamp, Ankorstore, Etsy, Spocket, Buddify). If you buy there or from a retailer who obtains our products via such a platform and has us deliver them directly to you, we receive from the platform or the retailer the data required for shipping (name, delivery address, ordered goods). We only process this data for shipping and processing (Art. 6(1)(b) and (f) GDPR; our legitimate interest is fulfilling our delivery obligation towards the retailer). The operator of the platform is responsible for the processing on the platform itself.

Our products may also be displayed via Shopify in the shopping features of third-party AI assistants. If you order there, we receive the data required for the order via Shopify (Art. 6(1)(b) GDPR). The provider of the assistant is responsible for the processing within the assistant.

15. Links to social networks

On our website we link to our profiles on Facebook, Instagram and Pinterest. These are simple links; data is only transmitted when you click on a link. After that, the data protection provisions of the respective network apply.

16. Privacy settings for visitors from the USA

For visitors from US states with corresponding data protection laws, Shopify provides the page "Your privacy choices", through which they can object to the sharing of data for targeted advertising. To protect against misuse, the hCaptcha service of Intuition Machines, Inc., USA, is used on this page (Art. 6(1)(f) GDPR).

17. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, simply contact us using the contact details above.

Right to object under Art. 21 GDPR: Insofar as we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation. You may object to the processing of your data for direct marketing purposes at any time without giving reasons; we will then no longer process your data for this purpose.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 31 63, 65021 Wiesbaden, Germany, https://datenschutz.hessen.de. You can also contact the supervisory authority at your place of residence.

18. Obligation to provide data and automated decisions

We need the information marked as mandatory in the ordering process in order to conclude the contract; without it, we cannot accept your order. All other information is voluntary. We do not carry out solely automated decision-making within the meaning of Art. 22 GDPR. Payment service providers such as Klarna or PayPal may carry out credit and risk assessments under their own responsibility (see section 8).

19. Data security and changes

Our website is encrypted throughout using TLS. We adapt this privacy policy when our data processing or the legal situation changes. The version published here applies.