Privacy policy

Controller: Fischer & Hasenohr GbR ("Flavio's"), Brandhorst 3, 24214 Noer, Germany.
Phone: +49 151 296 671 10 · Email: hello@flavios.store

1. Who is responsible
Flavio's operates an online marketplace and acts as a commercial agent (Handelsvertreter) in the name of the brands that sell through it (the "Brands"). We are the controller for your use of the site, your account, payment handling, customer service and marketing. When you buy a product, the relevant Brand is the seller and becomes an independent controller of the order data it needs to fulfil the sale and meet its own legal obligations (e.g. issuing and retaining your invoice). Each Brand's own privacy information governs its processing as seller.

2. What we process and why
- Browsing the site: IP, browser/device, pages visited, timestamp — to run the site, prevent abuse, basic analytics (Art. 6(1)(f) GDPR).
- Placing an order: name, billing & shipping address, email, optional phone, order details, payment data — to conclude and process your contract with the Brand and arrange shipping (Art. 6(1)(b) GDPR).
- Account: email, hashed password, order history — faster checkout, tracking (Art. 6(1)(b) GDPR).
- Newsletter: email, opt-in record — editorial updates (Art. 6(1)(a) GDPR, consent, double opt-in).
- Customer service: name, email, message, related order data — to help you and liaise with the Brand (Art. 6(1)(b)/(f) GDPR).
- Analytics & marketing cookies: only with your consent via the cookie banner (Art. 6(1)(a) GDPR).

3. Cookies
On your first visit a banner lets you accept, reject non-essential, or customise. Strictly necessary cookies run without consent (§ 25(2) TTDSG); functional, analytics and marketing cookies only with consent. You can change your choice anytime via the cookie settings link in the footer. Details in our Cookie Policy.

4. Who receives your data
- The relevant Brand — seller / independent controller — to conclude and fulfil your sale, ship, invoice, statutory retention (EU/UK, sometimes beyond).
- Shopify Inc. — processor — hosting, checkout, order management (Canada/EU/USA).
- Shipturtle — processor — routing order data to the correct Brand, payout coordination (EU/India).
- Stripe Payments Europe Ltd. — payment processing and payout splitting to Brands (Ireland/EU).
- PayPal (Europe) S.à r.l. (Luxembourg), Klarna Bank AB (Sweden) — payment processing.
- Carriers (DHL, DPD, UPS, etc.) — delivery.
- Klaviyo Inc. — email delivery and analytics (USA).
- Tax authorities / compliance providers — statutory obligations.
We never sell your data. Transfers outside the EU/EEA rely on the EU Standard Contractual Clauses or an adequacy decision (e.g. EU–US Data Privacy Framework).

5. Retention
Order/invoice data: 10 years (§ 147 AO) — the Brand keeps its own copy as seller. Accounts: until deletion (inactive accounts may be removed after 3 years). Newsletter: until you unsubscribe, consent record kept 3 years. Service emails: 3 years. Server logs: 14 days.

6. Your rights (GDPR)
Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and withdrawal of consent (7(3)). Write to hello@flavios.store; we respond within the legal one-month maximum. Where a right concerns data the Brand holds as seller, we forward your request to the Brand and support you.

7. Complaints
You can lodge a complaint with a supervisory authority. Competent for Schleswig-Holstein: Unabhängiges Landeszentrum für Datenschutz (ULD), Holstenstraße 98, 24103 Kiel — datenschutzzentrum.de.

8. Children
The site is not directed at children under 16; we do not knowingly collect their data.

9. Changes
The version posted on this page applies; we announce substantial changes in advance where possible.

Note: have this reviewed by a data-protection lawyer before launch, including the controller arrangement between Flavio's and each Brand.