PRIVACY POLICY

1. Controller and Contact

Protecting your personal data matters to us. This privacy policy explains what data we process when you visit our online shop, why we process it, and what rights you have under the EU General Data Protection Regulation (GDPR).

The controller responsible for data processing on this website is:

CENTER ROTATION CLO.
Bahnhofstraße 14
63820 Elsenfeld, Germany
Phone: +49 152 59398576
E-mail: info@centerrotation.com

2. Data Processed When Visiting Our Website

2.1 Server Log Files

If you browse our website without placing an order or entering any information, we only process the technical data your browser automatically transmits. This includes the page you accessed, date and time of access, the amount of data transferred, the referring website, your browser type and version, your operating system, and your IP address (where possible in shortened form).

We process this data because it is technically required to display the website and to keep it stable and secure. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of our shop). Log data is not merged with other data sources and is only reviewed if there is concrete suspicion of unlawful use.

2.2 Encryption

All data you transmit to us (for example when placing an order or contacting us) is protected by SSL/TLS encryption. You can recognise the encrypted connection by "https://" and the padlock icon in your browser's address bar.

3. Hosting and Content Delivery

3.1 Shopify

Our shop is hosted on the platform of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Data may also be processed by Shopify Inc., 150 Elgin Street, Ottawa, ON K2P 1L4, Canada.

All data collected via our shop (order data, customer account data, technical access data) is processed on Shopify's servers. We have entered into a data processing agreement with Shopify in accordance with Art. 28 GDPR. Transfers to Canada are covered by the European Commission's adequacy decision for Canada.

3.2 IONOS (Content Delivery Network)

To deliver media files such as images and scripts quickly, we use the content delivery network of IONOS Internet SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a fast and stable website). A data processing agreement in accordance with Art. 28 GDPR is in place.

4. Cookies

We use cookies – small text files stored on your device – to make our shop work and to provide certain functions. Session cookies are deleted automatically when you close your browser; persistent cookies remain on your device for a defined period (see your browser's cookie settings for details).

Where cookies process personal data, the legal basis is Art. 6(1)(b) GDPR (cookies required to perform the contract, e.g. shopping cart), Art. 6(1)(a) GDPR (cookies you have consented to), or Art. 6(1)(f) GDPR (legitimate interest in a functional, user-friendly shop).

You can configure your browser to notify you before cookies are set, to accept cookies only in certain cases, or to reject them entirely. Please note that some functions of our shop may not work without cookies.

5. Contact

5.1 Shopify Inbox (Live Chat)

We offer a live chat provided by Shopify International Limited (address above); data may also be transferred to Shopify Inc., Canada. Messages you send via the chat are processed to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation, otherwise Art. 6(1)(f) GDPR (legitimate interest in effective customer support). Chat data is deleted once your enquiry has been conclusively resolved, unless statutory retention obligations apply.

5.2 Contact Form and E-mail

If you contact us via contact form or e-mail, we process the data you provide solely to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. Your data is deleted once the matter has been fully dealt with, unless we are legally required to retain it.

6. Customer Account and Order Processing

When you create a customer account or place an order, we process the data required for this purpose (e.g. name, address, e-mail address, order details). The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures).

You can delete your customer account at any time by contacting us. After deletion, or after completion of your order, your data is restricted for further use and erased once the retention periods under commercial and tax law have expired, unless you have expressly consented to further use or we have reserved a legally permitted further use, about which we inform you below.

7. E-mail Marketing

7.1 Newsletter

If you sign up for our newsletter, we regularly send you information about our products and offers. The only mandatory information is your e-mail address; any further details are voluntary and used to address you personally.

We use the double opt-in procedure: after signing up, you receive an e-mail asking you to confirm your subscription. Your subscription only becomes active once you confirm. We log the sign-up and confirmation (time and IP address) to be able to demonstrate your consent.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every newsletter or by contacting us directly.

7.2 Product Recommendations to Existing Customers

If you have provided your e-mail address in the course of a purchase, we may send you e-mails with offers for products similar to those you have already purchased, in accordance with Section 7(3) of the German Act Against Unfair Competition (UWG). This serves our legitimate interest in direct marketing to existing customers (Art. 6(1)(f) GDPR). You can object to this use of your e-mail address at any time free of charge, for example via the unsubscribe link in each e-mail or by contacting us; only transmission costs at basic rates apply.

7.3 Klaviyo (Newsletter Dispatch)

Our newsletters are sent via Klaviyo Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA. For this purpose, the data you provide at sign-up is shared with Klaviyo. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in effective, professionally managed newsletter marketing). Klaviyo may use your data in pseudonymised form to improve its own services, but does not use it to contact you itself or pass it on to third parties. We have concluded a data processing agreement with Klaviyo. Transfers to the USA are safeguarded by appropriate guarantees pursuant to Art. 46 GDPR (EU standard contractual clauses) and, where applicable, Klaviyo's certification under the EU-U.S. Data Privacy Framework.

7.4 Back-in-Stock Notifications

For temporarily unavailable items, you can register your e-mail address to be notified when the item is back in stock. Your e-mail address is used solely for this one-off notification and processed on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time; your address will then be deleted from the notification list.

8. Data Processing for Order Handling

8.1 Scope

To fulfil your order, we work with service providers (logistics, payment providers) who receive the data necessary for their respective task. The legal basis is Art. 6(1)(b) GDPR.

8.2 Shipping

For delivery, we pass on your name and delivery address – and, where required for the delivery, your e-mail address or phone number – to the shipping company commissioned with the delivery:

• Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany
• DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

8.3 Payment Services

Depending on the payment method you choose at checkout, your payment data is passed on to the respective payment service provider. The legal bases are Art. 6(1)(b) GDPR (payment processing) and, where fraud prevention checks are performed, Art. 6(1)(f) GDPR (legitimate interest in protection against payment default and fraud). We offer the following payment services:

• Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland): if you pay with Apple Pay, payment is processed via the card stored in your Apple Wallet. Details on Apple's data processing: https://support.apple.com/en-gb/HT203027
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg): when paying via PayPal, your payment data is transmitted to PayPal. PayPal may perform its own credit checks for certain payment methods.
• Shopify Payments (Shopify International Limited, Ireland; payment processing via Stripe, see below): card payments processed directly in our checkout run via Shopify Payments.
• Klarna – Instant Bank Transfer (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden): if you choose instant bank transfer, your payment data is transmitted to Klarna for payment processing.
• Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland): Stripe processes card payments as the technical payment processor. Data may be transferred to Stripe Inc. in the USA; such transfers are safeguarded by EU standard contractual clauses.

9. Web Analytics

9.1 Google Analytics 4

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Data may also be transferred to Google LLC in the USA.

Google Analytics uses cookies and comparable technologies to analyse how visitors use our shop (e.g. pages viewed, session duration, approximate location based on shortened IP address, device and browser information). IP addresses are not logged or stored in full; only shortened IP data is used and it is not merged with other Analytics data. The information generated is used to compile reports on website activity for us.

Where enabled, Google Signals links usage data across devices for signed-in Google users with personalised advertising activated; details: https://support.google.com/ads/answer/2662922. Where we use the User ID function, analysis data can be assigned to a pseudonymous user ID across devices; details: https://support.google.com/analytics/answer/7532985.

This processing takes place only with your consent pursuant to Art. 6(1)(a) GDPR, which you can give and withdraw at any time via our cookie consent tool. Transfers to the USA are safeguarded by EU standard contractual clauses and Google's certification under the EU-U.S. Data Privacy Framework. Further information: https://policies.google.com/privacy, https://business.safety.google/privacy/ and https://policies.google.com/technologies/partner-sites.

9.2 Google Tag Manager

We use the Google Tag Manager (Google Ireland Limited, address above). The Tag Manager itself does not set cookies and does not collect personal data; it is a technical tool for deploying and controlling other services (such as analytics tags), which may themselves process data as described in their respective sections. The Tag Manager is used on the basis of Art. 6(1)(f) GDPR (legitimate interest in the efficient administration of website services).

9.3 Shopify Analytics

We use the analytics functions of Shopify International Limited (address above; data may also be transferred to Shopify Inc., Canada) to measure visits, sales and shop performance using cookies and similar technologies. The data is processed in pseudonymised form and helps us understand and improve how our shop is used. This processing takes place only with your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time via the cookie consent tool. Transfers to Canada are covered by the European Commission's adequacy decision.

10. Retargeting / Remarketing

Google Ads Remarketing

We use Google Ads Remarketing (Google Ireland Limited, address above; data may also be transferred to Google LLC, USA). This service allows us to show you interest-based ads on other websites within the Google advertising network based on your previous visit to our shop. For this purpose, Google sets a cookie on your device that enables pseudonymous recognition.

If you have a Google account and have allowed personalised advertising, this recognition may also work across devices. This processing takes place only with your consent pursuant to Art. 6(1)(a) GDPR, which you can withdraw at any time via the cookie consent tool. You can also permanently disable personalised ads at https://www.google.com/settings/ads. Further information: https://www.google.com/policies/technologies/ads/ and https://business.safety.google/privacy/.

11. Site Functionalities

Google Web Fonts

To display fonts consistently, we use web fonts provided by Google Ireland Limited (address above; data may also be transferred to Google LLC, USA). When you access our pages, your browser loads the required fonts from Google's servers, which gives Google knowledge of your IP address and the fact that our page was accessed via it. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a uniform and appealing presentation of our shop). Further information: https://business.safety.google/privacy/.

12. Cookie Consent Tool

Our shop uses a cookie consent tool to obtain and document your consent to cookies and cookie-based services that require consent. When you visit our shop, a consent banner is displayed in which you can grant or refuse consent for specific services, individually or in total. Your choice is stored so that the banner is not shown again on subsequent visits, and consents are logged for accountability purposes.

The tool itself processes the technical data required for consent management (e.g. consent status, timestamp, anonymised technical identifiers). This is done to comply with our legal obligations under Art. 7(1) GDPR (proof of consent) and thus on the basis of Art. 6(1)(c) GDPR. You can change or withdraw your cookie settings at any time via the corresponding link or icon on our website.

13. Your Rights

As a data subject, you have the following rights under the GDPR:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to be notified of rectification, erasure or restriction (Art. 19 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to Object (Art. 21 GDPR)

Where we process your personal data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your data is processed for direct marketing purposes, you may object at any time without stating reasons. If you object, your data will no longer be processed for direct marketing.

To exercise any of these rights, simply contact us using the details in Section 1.

14. Storage Duration

We store personal data only for as long as necessary for the respective purpose. The concrete duration depends on the applicable legal basis:

Data processed for the performance of a contract (Art. 6(1)(b) GDPR) is retained until the contract has been fully performed and then erased once the statutory retention periods under commercial and tax law (generally six to ten years, Sections 257 HGB and 147 AO) have expired, unless you have consented to further use.

Data processed on the basis of consent (Art. 6(1)(a) GDPR) is stored until you withdraw your consent.

Data processed on the basis of legitimate interests (Art. 6(1)(f) GDPR) is stored until you exercise your right to object, unless we can demonstrate compelling legitimate grounds for continued processing or the data is required for legal claims.

Data subject to statutory retention obligations is erased after those periods expire, provided it is no longer needed for the performance or initiation of a contract and no overriding interest in continued storage exists.

Last updated: 27 August 2026