Privacy policy

Last updated: September 22, 2026

REGUNG operates this shop and website, including the associated content, features, products, and services (the “Services”). Our shop is provided through Shopify. This privacy policy describes how we process personal data when you visit our website, place an order, subscribe to our newsletter, or contact us.

The controller responsible for processing personal data at REGUNG is Dr. Inka Valeska Braun, c/o POSTFLEX PFX-727-170, Emsdettener Str. 10, 48268 Greven, Germany. You can contact us at hallo@regung.com or by telephone on +49 6131 4896779. Simply visiting our website does not constitute consent to processing that requires your consent.

What personal data do we collect or process?

Personal data is information relating to an identified or identifiable person. The data we process depends on how you use our Services. In particular, it may include:

Contact details: your name, email address, billing and delivery addresses, and telephone number where applicable.
Order and payment data: products ordered, prices, payment method, payment status, transaction identifiers, and information about returns and refunds. The relevant payment providers also process the payment data required to complete a payment.
Customer account data: your email address, order history, and account settings. You can sign in to your Shopify customer account using a code sent by email or the Shop sign-in options offered.
Communication data: the contents of your inquiries and our replies.
Technical data: your IP address, browser and device information, access times, and log data required to provide the shop and keep it secure.
Usage and consent data: interactions with the shop, cookie preferences, and, depending on your consent and the features used, analytics, personalization, and marketing data.

Sources of personal data

We receive data directly from you, for example when you place an order, contact us, or subscribe to the newsletter. Technical data is processed through Shopify and integrated services when you use the shop. Payment and shipping providers may send us information about payment status, delivery, or returns. Shopify’s processing for its own purposes is explained in the section “Our relationship with Shopify.”

How do we use your personal data?

We use personal data only for the relevant purposes and on an applicable legal basis:

Orders and customer accounts: We process data to take steps toward and fulfill purchase contracts, process payments, deliver goods, handle withdrawals and complaints, and provide requested customer account features under Article 6(1)(b) of the General Data Protection Regulation (GDPR). Without the order, address, and payment details marked as required, we cannot process an order.
Contacting us: If your inquiry concerns a contract or steps toward entering into one, Article 6(1)(b) GDPR applies. We handle other inquiries on the basis of Article 6(1)(f) GDPR; our legitimate interest is to respond to your inquiry.
Technical operation and security: Processing necessary to operate a secure, functional shop and to detect and prevent misuse is based on Article 6(1)(f) GDPR. Our legitimate interests are to provide a reliable shop and protect our customers and systems.
Newsletters and analytics or advertising requiring consent: The legal basis is your consent under Article 6(1)(a) GDPR. Further details are provided in the following sections.
Legal obligations: Where we must process data, in particular to comply with tax-related retention requirements, the legal basis is Article 6(1)(c) GDPR.

How do we share personal data?

We share data where necessary for the relevant purpose and legally permitted. Recipients may include Shopify, payment providers, shipping providers, and our mail and returns reception service provider. Where applicable, they may also include IT service providers, tax or legal advisers, and authorities where we are legally required to disclose data. Where data is processed on our behalf, the requirements of Article 28 GDPR apply.

Payment processing

We use Shopify Payments and PayPal for payments. Depending on availability and your selection, Shopify Payments may offer card payments, Shop Pay, Apple Pay, Google Pay, and Klarna, among other methods. The contact, order, payment, and transaction data necessary for the selected payment method is transmitted to the payment providers involved. Our transmission of data to perform the contract is based on Article 6(1)(b) GDPR. Payment providers may also process data as independent controllers, for example to prevent fraud or comply with legal obligations.

For PayPal customers in the European Economic Area, the responsible entity is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Further information is available in the PayPal privacy statement. Information about Shopify and Shop Pay is available in the Shopify Consumer Privacy Policy. If you choose Klarna, please also refer to Klarna’s privacy information; depending on the payment method selected, the provider may carry out its own checks before making that method available.

Shipping and returns

For delivery, we share the necessary shipping details, in particular your name and delivery address, with DHL or Deutsche Post. For returns sent to our Postflex address, the mail and returns reception service we have engaged processes the information needed to receive, identify, and forward the return. The legal basis for processing your order and return is Article 6(1)(b) GDPR.

Our relationship with Shopify

The Services are hosted by Shopify. Shopify collects and processes personal data about your access to and use of the Services to provide and improve them. Data you submit to the Services is shared with Shopify and third parties who may be located in countries other than your country of residence, in order to provide and improve the Services for you. To protect, grow, and improve our business, we also use certain enhanced Shopify features that incorporate data and information from your interactions with our shop, other merchants, and Shopify. To provide these enhanced features, Shopify may use personal data collected through your interactions with our shop, other merchants, and Shopify. In these circumstances, Shopify is responsible for processing your personal data, including responding to requests to exercise your rights concerning the use of your personal data for these purposes. Further information about how Shopify uses your personal data and about your rights is available in the Shopify Consumer Privacy Policy. Depending on where you live, you can exercise certain rights concerning your personal data described here through the Shopify Privacy Portal.

Cookies and similar technologies

We use Shopify features to manage your cookie consent. Strictly necessary cookies and similar forms of access support functions such as the cart, sign-in, security, and storage of your privacy choices. Where storage or access is strictly necessary for a service you have explicitly requested, it is based on Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Subsequent processing of personal data is governed by the relevant legal bases described above.

Non-essential analytics, marketing, and personalization technologies require your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. In the cookie banner, you can accept, decline, or select individual categories. Declining does not prevent you from shopping. You may withdraw your consent for the future; this does not affect the lawfulness of processing carried out before withdrawal. Information about the cookies used by Shopify and how long they last is available in the Shopify Cookie Policy.

Facebook and Instagram: Meta Pixel, advanced matching, and Conversions API

We use the Meta Pixel, advanced matching, and the Conversions API through the Shopify integration “Facebook & Instagram by Meta.” The recipient of the data is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

With your consent, information about your use of our shop may be collected and transmitted to Meta. This may include, for example, pages and products viewed, searches, cart actions, and completed purchases, including order value and currency, as well as technical information such as your IP address, browser information, and cookie or event identifiers. Where available, your name, email address, telephone number, and location details may also be transmitted for matching purposes. For advanced matching, the contact details designated for this purpose are converted into hash values before transmission. This matching process does not constitute anonymization. The Conversions API is used in particular to transmit purchase events directly between Shopify and Meta; it is not limited to transmission through your browser.

We use these features to measure the effectiveness of our advertising on Facebook and Instagram and improve how our ads are delivered. Meta may associate the transmitted events with a user account and combine them with other information. Event data may also be processed for personalized advertising and to provide, improve, and secure Meta products. Details of Meta’s processing and the legal bases it relies on are explained in the Meta Privacy Policy.

Our collection and transmission of data for these advertising and measurement purposes is based on your consent under Article 6(1)(a) GDPR. Where information is stored on or accessed from your device, Section 25(1) TDDDG also applies. You can decline consent in the cookie banner and withdraw consent you have given at any time with effect for the future through “Cookie settings” in the footer of our website. This applies to both browser-side and server-side transmission for these purposes. You can continue to shop with us without giving this consent. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

For the collection and transmission of event data for jointly determined advertising purposes, we and Meta act as joint controllers under Article 26 GDPR. The allocation of responsibilities is set out in Meta’s Controller Addendum: we provide information about the processing and are responsible for correct integration and consent management in our shop. Meta is responsible in particular for handling data subject rights under Articles 15–20 GDPR in relation to data stored by Meta. You may also exercise your rights by contacting us at hallo@regung.com. Meta’s subsequent processing for its own purposes is not covered by this joint controllership. For certain matching, measurement, and analytics services, Meta acts as a processor under the Meta Business Tools Terms.

Under the Meta Business Tools Terms, Meta deletes the contact details transmitted for matching once the matching process is complete. Under these terms, Meta may retain event data for up to two years. This is not a general deletion period for all data held by Meta; further information is available in the Meta Privacy Policy.

Data may also be processed outside the European Economic Area, in particular by Meta Platforms, Inc. in the United States. According to Meta, transfers to Meta Platforms, Inc. covered by its certification rely on the EU-US Data Privacy Framework and the corresponding adequacy decision under Article 45 GDPR. For other transfers, Meta describes the use of safeguards including standard contractual clauses under Article 46 GDPR. Further details are provided in Meta’s information on international transfers and its Data Privacy Framework Disclosure.

When you subscribe to our newsletter, we process your email address, subscription status, and information documenting your subscription. Newsletters are sent through Shopify Messaging. We use a double opt-in process: after signing up, you receive an email asking you to confirm your subscription. The legal basis for sending newsletters is Article 6(1)(a) GDPR.

You may withdraw your consent at any time using the unsubscribe link in our marketing emails or by emailing hallo@regung.com. Necessary messages about an order are separate from newsletter subscriptions. Where necessary to document consent or an unsubscribe request, we may continue to retain the relevant records under Article 6(1)(f) GDPR; our interest is to demonstrate lawful communication and honor your decision to unsubscribe.

Shopify Messaging provides reports on newsletter delivery and usage. These include deliveries, unsubscribes, spam reports, opens recorded through tracking pixels, and clicks on links. Usage data may be associated with a subscription and helps us improve our content and sending practices. Analysis of opens and clicks that requires consent is based on Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. You may withdraw the relevant consent for the future. We process data used to manage unsubscribes and prevent further unwanted messages in order to respect your privacy choices.

Protection against spam and automated misuse

Our Shopify forms use hCaptcha, provided by Intuition Machines, Inc., USA, to distinguish human input from automated access. This may involve processing IP addresses, device and browser information, and interactions with forms. Processing serves to protect against spam and misuse and, insofar as necessary for these purposes, is based on Article 6(1)(f) GDPR. Section 25(2) TDDDG applies to storage on or access to your device that is strictly necessary. Further information about processing and data transfers is available in the hCaptcha privacy policy.

Third-party websites and links

Our website also contains links to external services, such as recommended content. If you follow one of these links, the relevant provider’s privacy information applies to data processing on the destination website.

Children’s data

The Services are not intended for use by children, and we do not knowingly collect personal data from children who have not reached the age of majority in your country. If you are the parent or guardian of a child who has provided personal data to us, you may contact us using the details below to request deletion of that data. As of the effective date of this privacy policy, we have no knowledge that we “share” or “sell” personal data of individuals under 16, as those terms are defined in applicable law.

Security and retention of your data

We implement technical and organizational measures to protect personal data. However, data processing and transmission cannot be completely protected against every risk.

We retain data for as long as it is needed for the relevant purpose. We retain order and payment data while performing the contract and afterward to the extent required by statutory retention obligations. Section 147 of the German Fiscal Code (AO) provides, in particular, for eight years for accounting records supporting entries, six years for commercial and business correspondence, and ten years for certain books and records. The period generally begins at the end of the relevant calendar year. Statutory extensions remain unaffected.

Inquiries are deleted once they have been fully dealt with, unless further retention is necessary to perform a contract, comply with legal obligations, or establish or defend claims. We use newsletter data to send newsletters until you unsubscribe. Evidence of consent may be retained for as long as necessary to meet our documentation obligations or defend against potential claims. For technical data, the security purpose, the need to investigate errors, and the documented retention and deletion periods of the services used are particularly relevant. Data is then deleted or anonymized.

Your rights and choices

Subject to the conditions set out in law, you have the following rights:

Access to your personal data under Article 15 GDPR.
Rectification of inaccurate data or completion of incomplete data under Article 16 GDPR.
Erasure under Article 17 GDPR.
Restriction of processing under Article 18 GDPR.
Data portability under Article 20 GDPR.
Withdrawal of consent for the future under Article 7(3) GDPR.

Right to object: Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving a reason; this also applies to related profiling under Article 21 GDPR.

To exercise your rights, simply contact us using the details above. Where necessary, we will ask for information to verify your identity. For processing for which Shopify acts as an independent controller, you may also exercise your rights through the Shopify Privacy Portal.

Complaints

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, particularly in the place of your habitual residence, your place of work, or the place of an alleged infringement. You do not need to contact us first. A list of authorities is available from the European Data Protection Board.

International transfers

Although REGUNG is based in Germany, the service providers we use may process data outside the European Economic Area, for example in Canada or the United States. Storage within the EU does not automatically rule out such transfers or access.

Where required, transfers rely on an adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR, in particular standard contractual clauses or binding corporate rules. Shopify explains its transfer mechanisms, including binding corporate rules for certain intra-group transfers, in its Data Processing Addendum. Further information is available in the linked privacy information of the relevant providers. You may also contact us to request information about the safeguards applicable to a transfer.

Changes to this privacy policy

We may update this privacy policy from time to time, for example to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will publish the revised privacy policy on this website, update the “Last updated” date accordingly, and provide any notice required by applicable law.

Contact

If you have questions about our privacy practices or this privacy policy, or wish to exercise any of your rights, please contact us by telephone on +49 6131 4896779, by email at hallo@regung.com, or by post at REGUNG, Dr. Inka Valeska Braun, c/o POSTFLEX PFX-727-170, Emsdettener Str. 10, 48268 Greven, Germany. The controller within the meaning of the General Data Protection Regulation is Dr. Inka Valeska Braun, trading as REGUNG, at the contact details above.

REGUNG