Privacy policy

This Privacy Policy describes how your personal information is collected, used, and shared when you visit or make a purchase from https://afato-surfwear.com (the “Website”).

1. PERSONAL INFORMATION WE COLLECT
a) Device Information
When you visit our website, we automatically collect certain information about your device, including:

  • Web browser, IP address, time zone
  • Cookies installed on your device
  • Pages or products viewed
  • Referrer URL or search terms
  • Interactions with the website

Technologies used for collection:
Cookies, log files, web beacons, tags, and pixels (e.g., Meta Pixel, Google Analytics)
We refer to this data as “Device Information”.

b) Order Information
When you make or attempt to make a purchase, we collect:

  • Name
  • Billing and shipping address
  • Payment details (e.g. credit card info)
  • Email address and phone number

We refer to this data as “Order Information”.
“Personal Information” in this policy refers to both Device and Order Information.

2. HOW WE USE YOUR PERSONAL INFORMATION
We use your data to:

  • Fulfill and ship your order
  • Communicate with you
  • Screen orders for potential fraud
  • Provide personalized content and advertising (if you consent)

Legal bases under GDPR:

  • Art. 6(1)(b) – performance of a contract
  • Art. 6(1)(f) – legitimate interests (e.g. website security, analytics)
  • Art. 6(1)(a) – your consent (e.g. for marketing cookies)

3. SHARING YOUR PERSONAL DATA WITH THIRD PARTIES
We share personal data only with the recipients listed below.

Shop platform and hosting:
Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes the data as a processor under a data processing agreement pursuant to Art. 28 GDPR; data is stored on servers within the EU. Where data is transferred to third countries in individual cases (including the USA and Canada), such transfers are safeguarded by the EU Standard Contractual Clauses.

Payment service providers (legal basis: Art. 6(1)(b) GDPR – performance of the contract):
– Shopify Payments (Shopify International Limited, address as above), including Shop Pay
– PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden
– Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland)
– Google Pay (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)

Which data is transferred to which provider depends on the payment method you select at checkout. If you choose a Klarna payment method (e.g. pay later or instalments), Klarna carries out an identity and credit assessment as an independent controller and obtains information from credit reference agencies for this purpose. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in mitigating the risk of payment default). Klarna informs you about its own processing at https://www.klarna.com/international/privacy-policy/.

Marketing and analytics – only with your consent given via the cookie banner (Art. 6(1)(a) GDPR):
– Google Analytics and Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
– Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland)
– Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA) – see section 4 for details

These services may transfer personal data to the USA. The providers are certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition.
Important: these services are only activated if you consent. Without your consent, no non-essential cookies are loaded and no data is transferred to the marketing and analytics services listed above.

4. E-MAIL MARKETING & NEWSLETTER (KLAVIYO)
To send our newsletter and for e-mail marketing we use Klaviyo, a service provided by Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. We process in particular your e-mail address as well as your open and click behaviour in order to send our newsletters and measure their reach.
The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every e-mail or by message to hello@afatosurfwear.com.
Klaviyo also processes data in the USA. An adequate level of data protection is ensured by Klaviyo’s certification under the EU-US Data Privacy Framework and, additionally, by EU Standard Contractual Clauses. A data processing agreement pursuant to Art. 28 GDPR is in place with Klaviyo.

5. INSTAGRAM GIVEAWAYS & PROMOTIONS
When participating in an Instagram giveaway, we may collect:

  • Instagram username
  • If selected as a winner: name, email, shipping address

Purpose: selecting winners, prize delivery
Legal basis: Art. 6(1)(b) GDPR
Retention: only as long as needed – deleted afterward
Not affiliated with Instagram. Minimum age: 18 years.

6. TARGETED ADVERTISING
With your consent, we may use your data to show personalized ads via:

You may opt out via the Digital Advertising Alliance.

7. DO NOT TRACK
Our website does not respond to “Do Not Track” browser signals.
You can control your preferences via our cookie banner instead.

8. YOUR RIGHTS (EU/GDPR)
If you reside in the EU or United Kingdom, you have the right to:

  • Access your personal data
  • Request correction, restriction or deletion
  • Request data portability
  • Withdraw any consent given

  • Objection to processing that we base on a legitimate interest (Art. 21 GDPR)

For requests, email: hello@afato-surfwear.com

The controller within the meaning of Art. 4 (7) GDPR is Diandra Stelljes & Fabian Tappert Textil GbR, Eutiner Straße 30, 27751 Delmenhorst, Germany, e-mail: hello@afato-surfwear.com.

Right to lodge a complaint: Irrespective of the rights above, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, e-mail: poststelle@lfd.niedersachsen.de, www.lfd.niedersachsen.de. You may also contact the supervisory authority of your habitual residence.

Note: Your data may be processed in third countries such as the USA or Indonesia (Bali). Shopify hosts data in the EU, but certain tools (e.g. Meta, Google, Klaviyo) may involve transfers to third countries under appropriate safeguards.

9. DATA RETENTION
We retain your personal information only:

  • As long as necessary to fulfill contracts or comply with legal obligations
  • Until you request deletion or object to processing

Specifically, we retain order and invoice data for up to ten years due to commercial and tax law obligations (Sec. 257 German Commercial Code, Sec. 147 German Fiscal Code). Newsletter data is deleted after you unsubscribe; proof of your consent is retained for the duration of the statutory limitation periods. Data from prize draws is deleted once the promotion has ended and the prize has been dispatched.

10. COOKIES AND CONSENT
We use the cookie banner integrated into our Shopify platform (Shopify Consent Management / Customer Privacy). A cookie banner appears when you visit the website, allowing you to make your selection.

Strictly necessary cookies required to operate the shop, the shopping cart and the checkout are set without consent on the basis of Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). All other cookies and comparable technologies – in particular analytics and marketing cookies – are only set with your express consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. Already on the first layer of the banner you can reject consent in full using an equally prominent button; rejecting does not require more clicks than accepting.

Your consent is voluntary and is not required in order to use our website.
Withdrawal: you can withdraw your consent at any time with effect for the future via the cookie settings in the footer of our website.
The lawfulness of processing carried out before withdrawal remains unaffected.

11. ELECTRONIC WITHDRAWAL FUNCTION
If you withdraw from your contract using our electronic withdrawal function (“Withdraw contract”), we process the data you enter there – your name, the details identifying the contract (e.g. order number) and the email address you provide – solely to process your withdrawal and to send the confirmation of receipt required by law. The withdrawal function is permanently available in the footer of our website during the withdrawal period. The legal basis is Art. 6(1)(c) GDPR (compliance with our legal obligation under Section 356a of the German Civil Code) and Art. 6(1)(b) GDPR (performance of the contract).

12. CONTACTING US AND CUSTOMER ACCOUNTS
If you contact us via our contact form, by email or by telephone, we process the data you provide – in particular your name, your email address and the content of your message – solely in order to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We delete this data as soon as your enquiry has been conclusively dealt with, provided no statutory retention periods apply.

You may voluntarily create a customer account in our shop. A customer account is not required in order to place an order. We process the data stored there to allow you to manage your orders and addresses; the legal basis is Art. 6(1)(b) GDPR. You may have your customer account deleted at any time – an informal message to hello@afato-surfwear.com is sufficient. Statutory commercial and tax retention obligations (see section 9) remain unaffected.

13. CHANGES TO THIS POLICY
We may update this Privacy Policy occasionally to reflect legal or technical changes.
The current version is always available on this page.

14. NECESSITY OF PROVIDING DATA AND AUTOMATED DECISION-MAKING
Providing your order, invoicing and delivery data is necessary for concluding and performing the purchase contract. Without this data we cannot process your order. All other information is voluntary; not providing it has no disadvantages for you.
No automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR), takes place.

15. CONTACT
AFATO Surfwear
Diandra Stelljes & Fabian Tappert Textil GbR
Eutiner Straße 30
27751 Delmenhorst – Germany
hello@afato-surfwear.com