Privacy Policy
We appreciate your interest in our shop. The protection of your personal data is important to us. Here you can find out what data we collect, what we use it for and what rights you have.
1. Controller
The controller in the sense of the General Data Protection Regulation (GDPR) is:
YW Commerce Ecomfly Limited
Office 3906, 39/F, The Center
99 Queen's Road Central
Central, Hong Kong
Business Registration Number (Hongkong): 79351125
E-Mail: support@alpenwarm.de
2. Hosting and Shop System
This shop runs on the Shopify platform. The provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes all data generated when visiting the shop and placing an order on our behalf.
We have concluded a data processing agreement with Shopify in accordance with Art. 28 GDPR. The legal basis is our legitimate interest in a secure and efficient shop operation (Art. 6 para. 1 lit. f GDPR) as well as the fulfilment of the contract (Art. 6 para. 1 lit. b GDPR).
3. Server Log Files
When you access our pages, data transmitted by your browser is automatically collected: IP address, date and time of the request, page accessed, referrer URL, browser type and operating system. This data is used for technical provision, security and error analysis. No merging with other data sources takes place.
Legal basis: Art. 6 para. 1 lit. f GDPR.
4. Order and Contract Fulfilment
If you place an order, we process the data we need for processing: name, delivery and billing address, email address, if applicable phone number, order and payment data.
We pass this data on to:
- the payment company you selected for payment processing,
- the contracted shipping service provider for the delivery of your order,
- our tax advisor and the tax authorities, as far as legally required.
Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfilment) as well as Art. 6 para. 1 lit. c GDPR (legal obligation, in particular commercial and tax law retention periods of six to ten years).
5. Payment Service Providers
Depending on which payment method you choose, we pass the data necessary for payment processing to the respective provider, for example to PayPal, Apple, Google or the card processing service provider. These providers are independently responsible for the processing; their privacy policies also apply.
Legal basis: Art. 6 para. 1 lit. b GDPR.
6. Customer Account
You can order from us without creating an account. If you create one, we store the data stored there until you delete the account. Legal basis: Art. 6 para. 1 lit. b GDPR.
7. Contacting Us
If you write to us by email or via a form, we store your information to process your request. Legal basis: Art. 6 para. 1 lit. b GDPR for contract-related enquiries, otherwise Art. 6 para. 1 lit. f GDPR.
8. Newsletter and Email Dispatch via Klaviyo
If you subscribe to our newsletter, we process your email address to send you information about products and promotions. The registration takes place via a double opt-in procedure: you receive a confirmation email after registration and are only registered after clicking on the confirmation link.
Legal basis: your consent, Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time – via the unsubscribe link in every email or by sending a message to support@alpenwarm.de. The legality of the processing carried out until then remains unaffected.
We use Klaviyo for dispatch. The provider is Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Klaviyo processes your email address and other information you provide to us, as well as data on how you use our emails – whether and when you opened an email and which links you clicked – and data on your behaviour in our shop, such as viewed products and abandoned shopping carts, on our behalf. This helps us to tailor the newsletter to your interests and to measure the effectiveness of our emails.
We have concluded a data processing agreement with Klaviyo in accordance with Art. 28 GDPR. Klaviyo also processes data in the USA. We base the transfer on the EU-US Data Privacy Framework and additionally on the standard contractual clauses of the European Commission pursuant to Art. 46 para. 2 lit. c GDPR.
Your data remains stored with Klaviyo until you unsubscribe from the newsletter. After that, we delete it or add it to a blocking list so that you do not receive any further emails from us. More information can be found in Klaviyo's privacy policy: klaviyo.com/legal/privacy-notice.
9. Cookies and Consent Management
We use technically necessary cookies for the shop to function – for example, for the shopping cart and language settings. Legal basis: § 25 para. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR.
Cookies and technologies that are not technically necessary – in particular for analysis and marketing – are only used with your consent. Legal basis: § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. You can change your selection at any time.
10. Analysis and Marketing
The following services are only used if you have given your consent in the cookie banner. The legal basis in each case is § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time with effect for the future by changing your cookie selection; the legality of the processing carried out until then remains unaffected.
Meta Pixel (Facebook and Instagram)
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
The Meta Pixel records which pages you visit in our shop and which actions you take – for example, viewing a product, adding it to the shopping cart or completing an order. Your IP address, device and browser information, online identifiers including cookie IDs, and this event data are processed. We use this to measure the effectiveness of our advertising and to display suitable ads to you on Facebook and Instagram.
Meta also processes the data for its own purposes. For the collection and transfer, we and Meta are joint controllers according to Art. 26 GDPR; for the subsequent processing, Meta is solely responsible. A transfer to the USA is possible and is based on the EU-US Data Privacy Framework and on standard contractual clauses. Storage period: generally up to 24 months. Further information: facebook.com/privacy/policy.
Google Analytics and Google Ads
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics evaluates how you use our shop: pages viewed, duration of stay, origin of the visit, approximate location based on the truncated IP address, device and browser data, and online identifiers. The IP address is truncated before evaluation. Via Google Ads and conversion tracking, we also measure whether an ad led to an order and can display ads to you on Google services and partner sites.
We have concluded a data processing agreement with Google. A transfer to the USA is possible and is based on the EU-US Data Privacy Framework and on standard contractual clauses. Storage period: up to 14 months for user and event data. Further information: policies.google.com/privacy.
TikTok Pixel
Provider for users in the European Economic Area: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland.
The TikTok Pixel records which pages you visit and which actions you take – for example, product view, shopping cart and purchase completion. IP address, device and browser data, online identifiers and this event data are processed. We use this to measure the effectiveness of our TikTok advertising and to target ads.
A transfer to TikTok group companies outside the European Union, including the USA, Singapore and China, cannot be ruled out. There is no adequacy decision by the European Commission for China; TikTok bases the transfer on standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR. A level of data protection equivalent to the European level cannot be guaranteed. Storage period: generally up to 13 months. Further information: tiktok.com/legal/privacy-policy-eea.
11. Data Transfer to Third Countries
Some of the services used also process data outside the European Union. In these cases, we base the transfer on an adequacy decision of the European Commission or on standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR.
12. Storage Period
We only store personal data for as long as it is necessary for the respective purpose or as required by legal retention periods. After that, we delete it or restrict processing.
13. Your Rights
You have the right to:
- Information about the data stored about you (Art. 15 GDPR),
- Rectification of incorrect data (Art. 16 GDPR),
- Erasure (Art. 17 GDPR),
- Restriction of processing (Art. 18 GDPR),
- Data portability (Art. 20 GDPR),
- Object to processing, insofar as it is based on a legitimate interest (Art. 21 GDPR),
- Withdraw consent given with effect for the future (Art. 7 para. 3 GDPR).
Simply write to us at support@alpenwarm.de.
14. Right to Complain
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR. The supervisory authority of your usual place of residence, your workplace or the place of the alleged infringement is competent.
15. Changes to this Declaration
We will adjust this privacy policy if our processing changes or if the legal situation requires it. The current version can always be found on this page.
Status: September 2026
Privacy Policy — International (UK, US, Canada, Australia, New Zealand)
The section above is our GDPR-based privacy notice, written for customers in Germany, Austria, Luxembourg, Switzerland and Liechtenstein. This section is written for customers in the United Kingdom, the United States, Canada, Australia and New Zealand and describes the same practices in plain English, plus the rights that apply specifically in your country.
1. Who's responsible for your data
YW Commerce Ecomfly Limited
Office 3906, 39/F, The Center
99 Queen's Road Central
Central, Hong Kong
Hong Kong Business Registration Number: 79351125
Email: support@alpenwarm.de
2. Hosting and shop platform
This shop runs on Shopify. The platform provider is Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes, on our behalf, all data generated when you browse the shop or place an order.
3. Server logs
Visiting our site automatically records data your browser sends: IP address, date and time of the request, page requested, referrer URL, browser type and operating system. We use this for technical delivery, security and troubleshooting. We don't combine it with other data sources.
4. Order and account data
When you order, we process what's needed to fulfil it: name, billing and shipping address, email, phone number if given, and order and payment details. We share this with the payment provider you choose, the carrier delivering your order, and our accountant or tax authorities where the law requires it. If you create an account, we keep the data in it until you delete the account.
5. Payment providers
Depending on the payment method you choose, we pass the data needed to process payment to the relevant provider — for example PayPal, Apple, Google, or the card processor. These providers are independently responsible for their own processing, and their own privacy notices apply in addition to this one.
6. Getting in touch
If you email us or use a contact form, we keep what you send us to handle your query.
7. Newsletter (Klaviyo)
If you sign up for our newsletter, we process your email address to send you product and promotion updates. Sign-up uses double opt-in: you get a confirmation email and are only subscribed once you click the confirmation link. You can unsubscribe at any time using the link in every email or by writing to support@alpenwarm.de.
We use Klaviyo to send these emails. The provider is Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. On our behalf, Klaviyo processes your email address and any other details you give us, plus data on how you interact with our emails (opens, link clicks) and your shop activity (products viewed, abandoned carts), so we can tailor the newsletter and measure results. Your data stays with Klaviyo until you unsubscribe, after which we delete it or suppress it so you receive no further emails. See Klaviyo's own privacy notice: klaviyo.com/legal/privacy-notice.
8. Cookies and consent
We use strictly necessary cookies so the shop works — for example the cart and language setting. Where the law where you live requires your opt-in consent for cookies that aren't strictly necessary — including analytics and advertising — we only set them once you've agreed in our cookie banner, and you can change your choice at any time.
9. Analytics and advertising
The following services are used only where you've consented in the cookie banner (or, in jurisdictions that use an opt-out model rather than opt-in, until you opt out as described below).
Meta Pixel (Facebook and Instagram)
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (for users outside the EEA/UK, Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA, may also be involved). The Meta Pixel records which pages you visit and actions you take in our shop — viewing a product, adding to cart, completing an order — along with your IP address, device and browser information, and cookie-based identifiers. We use this to measure and improve our advertising on Facebook and Instagram.
Google Analytics and Google Ads
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and, for US users, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics measures how you use our shop — pages visited, time spent, approximate location from a truncated IP address, device and browser data. Google Ads and conversion tracking let us see whether an ad led to an order.
TikTok Pixel
Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, and, for US users, TikTok Inc., 5800 Bristol Parkway, Culver City, CA 90230, USA. The TikTok Pixel records page views and actions (product view, cart, purchase) so we can measure and target our TikTok advertising.
10. Data transfers outside your country
Several of the services above process data in countries other than your own, including Ireland and the United States. Where required, we and our providers use recognised transfer safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses, for these transfers.
11. How long we keep data
We keep personal data only as long as it's needed for the purpose it was collected for, or as long as the law requires us to keep it (for example, accounting records), then delete it or restrict its processing.
12. Your rights, generally
Wherever you live, you can normally ask us to: tell you what data we hold about you; correct inaccurate data; delete your data; and object to or restrict certain processing. Write to support@alpenwarm.de to use any of these. We may need to verify your identity first.
13. Rights and regulators specific to your country
United Kingdom
UK GDPR and the Data Protection Act 2018 apply to your data. In addition to the rights above, you have the right to data portability and the right to withdraw consent at any time where processing is based on consent. You can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
United States — California
If you're a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you the right to know what personal information we've collected about you, to request its deletion or correction, to opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising, and to limit use of sensitive personal information — and the right not to be discriminated against for exercising any of these. We don't sell personal information for money, but sharing data with advertising partners such as Meta, Google and TikTok as described above can count as a "sale" or "sharing" under California law. You can opt out on our privacy choices page, or by sending a Global Privacy Control signal from your browser.
Canada
The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to your data. You can ask to access or correct your information, and withdraw consent to processing that relies on it, by writing to support@alpenwarm.de. If we can't resolve your concern, you can complain to the Office of the Privacy Commissioner of Canada. If you're in Québec, Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) also applies, and you can complain to the Commission d'accès à l'information du Québec.
Australia
We handle your data in line with the Australian Privacy Principles under the Privacy Act 1988. You can ask to access or correct your information by writing to support@alpenwarm.de. If we can't resolve your complaint, you can raise it with the Office of the Australian Information Commissioner (OAIC).
New Zealand
We handle your data in line with the Information Privacy Principles under the Privacy Act 2020. You can ask to access or correct your information by writing to support@alpenwarm.de. If we can't resolve your complaint, you can raise it with the Office of the Privacy Commissioner.
European Economic Area and Switzerland
If you're in the EEA or Switzerland, the GDPR or the Swiss Federal Act on Data Protection applies to your data in the same way described in the German-language section above, regardless of which language you're reading this in.
14. Changes to this policy
We update this policy when our data practices change or the law requires it. The current version is always on this page.
Last updated: September 2026