Last updated: 25 October 2026
1. Who is responsible?
The controller responsible for data processing on this website is:
BuyBack GmbH
c/o DUSBASE
Grafenberger Allee 277–287
40237 Düsseldorf
Germany
Email: info@buyback.store
Managing Director: Julian Witeczek
2. Overview
We process personal data only as far as necessary to run our shop, process your orders and – with your consent – to analyse and improve our website and advertising. The legal bases are Art. 6 (1) (a) GDPR (consent), (b) (contract), (c) (legal obligation) and (f) (legitimate interests).
3. Hosting and shop system (Shopify)
Our shop runs on Shopify. The provider for the EU is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. When you visit our shop, Shopify processes technical data such as your IP address, browser type, date and time of access and the pages visited, in order to deliver the website securely and stably (Art. 6 (1) (f) GDPR). Shopify also stores the data you enter when ordering. Data may be transferred to Shopify Inc. in Canada (adequacy decision of the EU Commission) and to the USA; such transfers are based on the EU Commission’s standard contractual clauses and, where applicable, the EU-U.S. Data Privacy Framework. We have concluded a data processing agreement with Shopify.
4. Orders and customer account
When you place an order, we process your name, address, email address, phone number (if provided), order and payment details in order to perform the contract (Art. 6 (1) (b) GDPR). If you create a customer account, we store your data so that you can view your orders. You can delete your account at any time by contacting us.
We keep order and invoice data for as long as required by commercial and tax law (generally 6 to 10 years, Art. 6 (1) (c) GDPR); other data is deleted when it is no longer needed.
5. Payment
Depending on the payment method you choose, your payment data is passed to the respective payment provider, which processes it under its own responsibility, for example:
- Shopify Payments (card payments, Apple Pay, Google Pay) – processed via Stripe Payments Europe Ltd., Dublin, Ireland
- PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg
- Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden – Klarna may carry out an identity and credit check; details are in Klarna’s privacy notice
Legal basis: Art. 6 (1) (b) GDPR, and for fraud prevention Art. 6 (1) (f) GDPR.
6. Shipping
To deliver your order, we pass your name, delivery address and, if you have agreed, your email address or phone number to DHL (Deutsche Post AG / DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany) so that DHL can announce or coordinate the delivery (Art. 6 (1) (b) GDPR; for notifications Art. 6 (1) (a) GDPR). You can withdraw consent at any time.
7. Contact by email or contact form
If you contact us, we process your details to handle your request (Art. 6 (1) (b) or (f) GDPR). Our email is hosted by Microsoft (Microsoft Ireland Operations Limited, Dublin, Ireland) as part of Microsoft 365; we have a data processing agreement in place.
8. Newsletter
If you subscribe to our newsletter, we use your email address to send you information about offers and news (Art. 6 (1) (a) GDPR). We use the double opt-in procedure. You can unsubscribe at any time via the link in every newsletter. If we send newsletters with Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), Brevo processes the data on our behalf.
9. Cookies and consent
We use cookies and similar technologies. Technically necessary cookies (e.g. shopping basket, checkout, security) are used on the basis of § 25 (2) TDDDG and Art. 6 (1) (f) GDPR. All other cookies – for statistics and marketing – are only used if you give your consent in our cookie banner (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can change or withdraw your consent at any time via the cookie settings in the footer of our website.
10. Analytics and advertising (only with your consent)
Shopify Analytics: Shopify provides us with statistics on the use of our shop (e.g. pages visited, conversions).
Google Analytics, Google Ads and conversion tracking: With your consent, we use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure the reach of our website and the success of our ads and to show you relevant ads. Google may transfer data to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. We use Google Consent Mode, so that Google tags only set cookies after you have consented.
Google Merchant Center / Shopping: We provide our product data to Google to display our products in Google Shopping. No personal data of our customers is transferred for this.
11. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7 (3)). To exercise your rights, email info@buyback.store.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
12. Data security
Our website uses SSL/TLS encryption. We take appropriate technical and organisational measures to protect your data.
13. Changes
We will update this privacy policy if our services or the legal requirements change. The current version is always available on this page.