Privacy policy
Who We Are (Data Controller)
QUADRO DER GROSSBAUKASTEN GmbH
Am Schilfpark 13, 21029 Hamburg, Germany
EORI No.: GB 479821148000
E-mail: info@quadroshop.co.uk
Goods are stocked in the United Kingdom and dispatched domestically.
What Personal Data We Collect
| Category | Typical examples |
|---|---|
| Identity Data | First and last name, title, account username |
| Contact Data | Billing and delivery address, e-mail address |
| Account Data | Encrypted password, saved addresses, preferences |
| Order & Transaction Data | Products purchased, order numbers, payment amounts, return/refund history |
| Payment Data | Card type, masked card number, PayPal ID – processed by accredited PSPs; no full card details stored |
| Technical Data | IP address, device/browser type, OS, language, time-zone, error logs |
| Usage Data | Page views, clicks, time on site, referring URLs |
| Marketing Preferences | Newsletter opt-in status, product interests |
We do not intentionally collect special-category data or data relating to children under 13.
Mandatory vs optional data: Identity, Contact, Payment and Order data are contractually required to conclude and perform your purchase. Without them we may be unable to process your order or meet legal obligations (e.g. tax records).
Purposes & Legal Bases for Processing
| Purpose | Legal basis | Typical data used |
|---|---|---|
| Operate website & prevent fraud | Legitimate interests – Art 6 (1)(f) | Technical, Usage |
| Process & deliver your order | Contract – Art 6 (1)(b) | Identity, Contact, Order, Payment |
| Manage customer account | Contract – Art 6 (1)(b) | Identity, Contact, Account |
| Customer service | Contract or Legitimate interests | Identity, Contact |
| Direct marketing (newsletter) | Consent – Art 6 (1)(a) | Contact, Preferences |
| Marketing to existing customers (soft opt-in) | Legitimate interests | Identity, Contact |
| Analytics & site improvement | Legitimate interests / Consent (non-essential cookies) | Technical, Usage |
| Legal obligations (tax, customs) | Legal obligation – Art 6 (1)(c) | Order, Payment |
| Defend/establish legal claims | Legitimate interests | Any relevant data |
You may withdraw consent at any time (see Section 8).
Cookies & Tracking
- Necessary cookies – core functions (basket, checkout, login)
- Analytics cookies – traffic & behaviour (only with consent)
- Marketing cookies – personalised ads (only with consent)
On first visit you will see a cookie banner that lets you accept or reject non-essential cookies. Details are in our separate Cookie Policy.
How We Share Your Data
- Payment processors (Visa, Mastercard, PayPal)
- Fulfilment & logistics – OnPoint Fulfilment (Walkerpack Ltd., UK)
- Shop platform & hosting – Shopify International Ltd. (Ireland/Canada/USA)
- Email & marketing services (newsletter provider)
- Analytics / advertising partners (Google Analytics, Google Ads – consent based)
- Professional advisers (lawyers, auditors)
- Authorities where legally required
- Successors in the event of a business sale/transfer
All processors act under contract (Art 28 UK GDPR) and may use data only as instructed by us. We never sell your personal data.
International Transfers
- Germany / EEA → UK – covered by the UK adequacy decision.
- Canada / USA – protected by the UK International Data Transfer Agreement or the EU SCCs with UK Addendum, plus encryption and access controls.
Copies of relevant safeguards are available on request.
Retention Periods
| Data category | Typical retention period |
|---|---|
| Order & transaction records | 6–10 years (accounting & warranty) |
| Customer account data | While account active; deleted on request unless legal retention applies |
| Marketing data | Until you unsubscribe, then kept on suppression list to honour opt-out |
| Support tickets | Up to 2 years after resolution |
| Server logs | A few weeks to a few months |
| Analytics data | 14 months (Google Analytics default) |
Data needed for legal claims may be kept longer until the matter is resolved.
Your Rights
- Access – receive a copy of your data
- Rectification – correct inaccurate data
- Erasure – request deletion in certain cases
- Restriction – temporarily halt processing
- Portability – obtain data in machine-readable form
- Withdraw consent – at any time for processing based on consent
- Object – especially to legitimate-interest processing and direct marketing (we stop immediately)
-
Complain –
- UK residents: to the Information Commissioner’s Office (ICO)
- EU/EEA residents: to your local authority (list here)
To exercise any right, email info@quadroshop.co.uk. We respond within one month.
Security Measures
- SSL/TLS encryption on every page
- Firewalls, intrusion detection, least-privilege access controls
- Data stored on secure servers hosted by Shopify and UK-based fulfilment IT
- Regular security reviews and staff confidentiality obligations
No system is perfect, but we strive to protect your data. We will notify you of any notifiable breach without undue delay.
Links to Third-Party Sites
Our site may contain links to external sites; we are not responsible for their privacy practices. Please review their policies.
Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be posted here and, where appropriate, notified by email. Continued use of our services after changes means you accept the updated policy.
Contact Us
Questions or requests?
Email: info@quadroshop.co.uk
Postal: QUADRO DER GROSSBAUKASTEN GmbH, Am Schilfpark 13, 21029 Hamburg, Germany
We are happy to help.