Privacy policy

Last updated: September 2026

This policy explains which personal data we process when you visit our shop, place an order or write to us – for what purpose, on what legal basis, to whom it is passed on and how long we keep it.

1. Controller

Roxxlyn Design GmbH
Lenßenstraße 35
41239 Mönchengladbach, Germany
Managing Director: Andreas Plaßmann
Phone: +49 30 2016 9208
Email: info@roxxlyn.com

For any questions about data protection and to exercise your rights, you can reach us at info@roxxlyn.com.

2. The key points at a glance

  • Our shop runs on Shopify. Order, payment and customer data are stored there.
  • For Custom Tailoring (configurator, veneer reservation, file upload) we operate our own server in Frankfurt am Main.
  • Your address is passed on to the shipping carrier and, for shipments outside the EU, also to customs.
  • We only set cookies that are not technically necessary with your consent.
  • We do not sell data and currently do not use any third-party advertising or tracking pixels.

3. When you visit our shop

Hosting. Our shop is operated by Shopify (Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland). When you access the shop, Shopify processes technically necessary data such as your IP address, date and time, the page accessed, browser and operating system in order to deliver the page, protect it against misuse (including through bot detection) and fix errors. The legal basis is our legitimate interest in a secure, functioning shop (Art. 6(1)(f) GDPR). Shopify may transfer data to Shopify Inc. in Canada and to subprocessors in the USA (see section 12).

Fonts (Adobe Fonts). To ensure a consistent typeface, we load fonts from Adobe Fonts (Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Park, Dublin 24, Ireland). In doing so, your IP address is transmitted to Adobe; according to Adobe, no cookies are set. A transfer to Adobe Inc. in the USA is possible. Legal basis: Art. 6(1)(f) GDPR (consistent presentation of our shop).

Videos (Vimeo). On some pages we show films from Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA). The video is only loaded when you click “Play”. Only then is data such as your IP address transmitted to Vimeo and cookies may be set. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG – German Telecommunications Digital Services Data Protection Act).

4. Cookies and similar technologies

We set technically necessary cookies and storage entries (e.g. for the shopping cart, checkout, language settings and security) on the basis of § 25(2) TDDDG and Art. 6(1)(b) and (f) GDPR. We only set all other cookies – for example for statistics or marketing – if you agree to them in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page.

Configurator. When you use Custom Tailoring, your browser stores a random identifier and the veneers you have selected in local storage (localStorage). This allows us to keep a selected veneer reserved for you for a short time so that nobody else buys it at the same time. The identifier contains neither your name nor any contact details. This is technically necessary for the function you have requested (§ 25(2) no. 2 TDDDG).

5. When you place an order

For your order, we process the data you provide at checkout: name, delivery and billing address, email address, phone number (if provided), items ordered and configuration, payment method and payment status. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) and our statutory retention obligations (Art. 6(1)(c) GDPR). Without this information, we cannot process your order.

Payment. Payment is handled by the payment service provider you choose, e.g. Shopify Payments (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland) or PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). You enter your payment details directly with the respective provider; we only receive the confirmation and the information required for billing. The providers carry out their own fraud and identity checks in the process.

Order processing. For processing, invoicing and shipping, we transfer order data to our order management system Billbee (Billbee GmbH, Germany).

Shipping and customs. For delivery, we pass on your name, delivery address, email address and phone number to the commissioned shipping carrier, currently in particular FedEx (Federal Express Europe, Inc., Zweigniederlassung Deutschland) and Spring GDS (Spring Global Delivery Solutions B.V., Netherlands), as well as their delivery partners in the destination country. The carrier needs your email address and phone number so that it can keep you informed about the delivery. For shipments outside the EU (e.g. to the United Kingdom, the USA or Switzerland), the carrier and the customs authorities of the destination country also receive the information required for the customs declaration (contents, value of goods, tariff number). The legal basis is Art. 6(1)(b) and (c) GDPR; the transfer to third countries is necessary for the performance of the contract (Art. 49(1)(b) GDPR).

Order emails. We send order confirmations, shipping and service emails via Shopify and via the email service Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France).

6. Custom Tailoring and uploading your files

If you order an extra for which we need a file from you (e.g. UV printing or your own logo), we will send you a personal link after your purchase. You can use this upload page to send us files and a note. We store the file, file name, note, time and the link to your order on our own server at Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus; server location Frankfurt am Main, Germany). In addition, we receive a notification by email to our mailbox (section 9). So that we can work with your file directly in the workshop, we keep a copy of the file and your note in our Google Drive (Google Workspace, Google Ireland Limited, see sections 9 and 12). As long as the file is missing, we will remind you of it by email up to twice. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

Please only upload designs for which you hold the necessary rights, and no photos in which other people can be recognised without their consent. We automatically delete uploaded files 180 days after they are uploaded – on our server and in Google Drive.

The configurator and the veneer reservation (section 4) as well as the processing of withdrawals (section 10) also run on the same server.

7. Customer account

If you create a customer account, we store your details and your orders in it so that you can view them later (Art. 6(1)(b) GDPR). Sign-in is handled by Shopify, where applicable with a code sent by email or via Shop Pay. You can have your account deleted at any time; a short message to us is sufficient.

8. Newsletter

If you subscribe to our newsletter, we use your email address to send you news about our products. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the unsubscribe link in every email or by sending us a message. After that, we will no longer use your address for the newsletter.

9. When you contact us

If you write to us by email or via the contact form, or call us, we process your details in order to deal with your enquiry (Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f) GDPR). Our email mailboxes are operated by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). A transfer to Google LLC in the USA is possible (see section 12).

10. Withdrawal via our online withdrawal button

If you declare a withdrawal using the form in our shop, we process the information from the form in order to process the withdrawal and confirm its receipt to you (Art. 6(1)(c) GDPR). Processing takes place on our server in Frankfurt am Main; we send the confirmation via Brevo.

11. Overview of service providers

Our service providers process data only on our behalf and in accordance with our instructions; we have data processing agreements in place with them (Art. 28 GDPR). The exceptions are the shipping carriers, the payment service providers and the customs authorities: they act under their own responsibility.

  • Shopify (Ireland) – shop system, hosting, checkout, customer account
  • Hostinger (Cyprus, server in Frankfurt am Main) – configurator, veneer reservation, file upload, processing of withdrawals
  • Billbee (Germany) – order processing, invoices, shipping preparation
  • Brevo (France) – sending service emails
  • Google Workspace (Ireland/USA) – email mailboxes and storage of uploaded customer files (Google Drive)
  • Adobe Fonts (Ireland/USA) – fonts
  • Vimeo (USA) – videos, only after a click
  • Shopify Payments / Stripe, PayPal – payment
  • FedEx, Spring GDS and their delivery partners – shipping and customs clearance

12. Transfers to countries outside the EU

Some of the providers named above also process data outside the EU or the EEA. For Canada, the United Kingdom and Switzerland, there are adequacy decisions of the European Commission. For the USA, we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Transfers that are necessary for the delivery and customs clearance of your order are based on Art. 49(1)(b) GDPR.

13. How long we store data

  • Order and invoice data: for as long as required by the retention periods under commercial and tax law (6, 8 or 10 years depending on the document, § 257 HGB – German Commercial Code, § 147 AO – German Fiscal Code).
  • Uploaded files: 180 days after uploading, after which they are deleted automatically, including the copy in Google Drive.
  • Veneer reservations: These expire automatically after a short time.
  • Customer account: until you delete it or have it deleted. Order data that we are required to keep remains stored, with restricted access, until the end of the statutory period.
  • Newsletter: until you unsubscribe.
  • Enquiries: until your enquiry has been dealt with, and thereafter within the statutory periods if the message is relevant for business purposes.

14. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). A short message to info@roxxlyn.com is sufficient.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to the use of your data for direct marketing at any time without giving reasons.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

15. Shopify and visitors outside the EU

Shopify itself is responsible for certain advanced features (e.g. Shop Pay, fraud protection across multiple shops). You can find out more in Shopify's privacy policy, where you can also exercise your rights with respect to Shopify.

Depending on where you live (e.g. in certain US states), you have further rights, such as the right to object to the “sharing” of your data for personalised advertising. We treat a “Global Privacy Control” signal from your browser as such an objection. We do not act on other “Do Not Track” signals.

16. Changes

If our shop, our service providers or the legal situation change, we will update this privacy policy. The version published here applies in each case.