Privacy policy

State: October 2026

1. Controller

The controller for the processing of personal data on this website (hundekau.de) is:

Heinrich Pemöller Handels-Partner GmbH
Seeweg 14
24329 Dannau
Germany
Phone: +49 4383 28 29 824
Email: service@hpgmbh.de
Represented by the managing director Stefan Mohr

If you have questions about data protection, you can reach us using the contact details above.

2. General information

We process your personal data only within the framework of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Personal data is any information that can be used to identify you personally, for example your name, address, email address or IP address.

Depending on the purpose, we base the processing on the following legal grounds:

  • Art. 6(1)(a) GDPR (consent)
  • Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures)
  • Art. 6(1)(c) GDPR (legal obligation, e.g. tax retention obligations)
  • Art. 6(1)(f) GDPR (legitimate interests)
  • § 25(1) TDDDG (consent to the storage and reading of information on your device) and § 25(2) TDDDG (storage that is strictly necessary)

For security reasons, this website uses SSL or TLS encryption.

3. Hosting and shop system (Shopify)

Our online shop is operated on the Shopify platform. The provider for merchants in the EU is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores all shop data on our behalf, including order, customer and access data, and provides the technical infrastructure.

When you visit our website, information transmitted by your browser is collected automatically (server log files): IP address, date and time of access, page accessed, referrer URL, browser type and operating system. This data is required for the secure and stable operation of the website (Art. 6(1)(f) GDPR).

We have a data processing agreement with Shopify (Art. 28 GDPR). Shopify may also transfer data to group companies in Canada and the USA. For Canada, an adequacy decision of the EU Commission exists; for the USA, the transfer is based on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses. Further information: shopify.com/legal/privacy.

Shopify also uses technically necessary cookies, for example for the shopping cart, checkout and login to your customer account (§ 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR). In addition, Shopify creates statistical evaluations of the use of the shop for us (Shopify Analytics). Insofar as cookies or identifiers that are not strictly necessary are used for this purpose, this is done only with your consent.

4. Cookies and consent management (iubenda)

When you first visit our website, a cookie banner appears through which you decide which non-essential services (e.g. statistics and marketing) you consent to. You can change or withdraw your choice at any time via the cookie settings on our website. Withdrawal does not affect the lawfulness of the processing carried out until then.

For consent management we use the service iubenda of iubenda s.r.l., Via San Raffaele 1, 20121 Milan, Italy. In doing so, your consent decision, a timestamp and your shortened IP address are processed in order to be able to prove consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). Your choice is stored in a cookie on your device.

5. Orders and customer account

When you order from us, we process the data you provide in the ordering process: name, billing and delivery address, email address, if applicable phone number, the items ordered and the chosen payment method. We need this data to conclude and process the purchase contract (Art. 6(1)(b) GDPR). Without this information we cannot carry out your order.

You can create a customer account in which your orders and addresses are stored. The customer account is voluntary; you can also order as a guest. You can have your customer account deleted at any time.

To manage stock, orders and invoices, we use the merchandise management system JTL-Wawi of JTL-Software-GmbH. For this purpose, order and customer data is transferred from the shop to our merchandise management system (Art. 6(1)(b) and (c) GDPR).

6. Payment service providers

For payment processing, we pass on the data required for this (e.g. name, address, order amount, payment data) to the payment service provider you have chosen (Art. 6(1)(b) GDPR). The payment service providers are partly responsible themselves for the processing of your payment data. Their privacy notices apply in addition.

  • Shopify Payments (card payment, Apple Pay, Google Pay): Payments are processed via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. For Apple Pay and Google Pay, the privacy notices of Apple and Google also apply.
  • Shop Pay: If you use Shop Pay, your payment and address data is stored by Shopify so that you can pay faster in future. This only happens if you actively select Shop Pay.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Privacy notice: paypal.com/en/legalhub/privacy-full.
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. To verify your identity and creditworthiness, Klarna may transmit data to credit agencies and make an automated decision. Privacy notice: klarna.com/international/privacy-policy.

7. Shipping

For delivery, we pass your name and delivery address on to our shipping service provider DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany (Art. 6(1)(b) GDPR). We pass your email address and, where applicable, phone number on to DHL only if you have consented in the ordering process so that DHL can inform you about the delivery (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.

8. Contact and chat

If you contact us by email, phone, contact form or via the chat on our website (Shopify Inbox), we process your details in order to handle your enquiry (Art. 6(1)(b) GDPR for enquiries about orders, otherwise Art. 6(1)(f) GDPR). To protect against spam, forms may be secured by Shopify with Google reCAPTCHA. We delete your enquiry once it has been fully dealt with and no statutory retention obligations exist.

9. Newsletter

If you subscribe to our newsletter, we use your email address to inform you about products, offers and news (Art. 6(1)(a) GDPR). Registration takes place using the double opt-in procedure: you receive an email in which you confirm your subscription. We store the time of registration and confirmation as well as your IP address in order to be able to prove the registration.

The newsletter is sent via Shopify Messaging (Shopify Email). In the process, it is evaluated whether a newsletter was opened and which links were clicked so that we can improve our content. This evaluation is part of your consent.

If you have ordered from us, we may also send you information about our own similar products by email without separate consent (§ 7(3) UWG, Art. 6(1)(f) GDPR). You can object to this at any time without incurring costs other than the transmission costs according to the basic rates.

You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending us a message.

10. Customer reviews (Judge.me)

We use the service Judge.me for product and shop reviews. After an order, we send you an email inviting you to review your purchase. For this purpose, we transmit your name, your email address and the products purchased to Judge.me (Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG; our legitimate interest lies in collecting genuine customer opinions). You can object to the review request at any time, including via the unsubscribe link in the email.

If you submit a review, it is published on our website with your name in the form you choose, if applicable with uploaded photos or videos. How we ensure the authenticity of reviews can be found under Information on the authenticity of customer reviews. Privacy notice of Judge.me: judge.me/privacy.

11. Third-party shop functions

To present our offer, we use the following extensions. They process technical usage data (e.g. IP address, pages accessed, shopping cart contents) within the scope of our legitimate interest in a functioning and appealing shop (Art. 6(1)(f) GDPR) or, insofar as information that is not strictly necessary is stored on your device, only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR):

  • Kaching Bundles: display of quantity discounts and product sets.
  • Sales Pop Up (Care Cart): notices about recently purchased products (e.g. product and time of purchase).
  • EU Widerrufsbutton (Visionz GmbH): enables you to declare a withdrawal electronically. We process the data provided in the process in order to handle your withdrawal (Art. 6(1)(c) GDPR).

12. Web analytics and marketing

We use the following services only if you have consented in the cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the cookie settings.

Google Analytics 4 and Google Ads conversion tracking
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics evaluates how visitors use our website (e.g. pages accessed, time spent, origin, device, purchases). With Google Ads conversion tracking, we measure whether a visit via a Google ad led to a purchase. Cookies or similar identifiers are set and your IP address is processed. A transfer to the USA is possible; Google is certified under the EU-U.S. Data Privacy Framework. Privacy notice: policies.google.com/privacy.

Meta Pixel (Facebook and Instagram)
The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. With the Meta Pixel, we measure the effect of our ads on Facebook and Instagram and can show visitors to our website suitable ads there (retargeting, custom audiences). In addition, we transmit purchase events to Meta via a server interface (Conversions API); encrypted (hashed) contact data such as email address or phone number may be transmitted in the process. We and Meta are jointly responsible for the collection and transmission (Art. 26 GDPR); you can find the agreement at facebook.com/legal/controller_addendum. A transfer to the USA is possible; Meta is certified under the EU-U.S. Data Privacy Framework. Privacy notice: facebook.com/privacy/policy.

TikTok Pixel
The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. With the TikTok Pixel, we measure the effect of ads on TikTok and can show visitors to our website suitable ads there. A transfer to third countries, including the USA, is possible; it is based on the EU Standard Contractual Clauses. Privacy notice: tiktok.com/legal/privacy-policy-eea.

13. Our presence on social networks

We operate pages and profiles on Facebook and Instagram. When you visit them or interact with us, the respective operator processes your data in accordance with its own privacy notices. For the statistics on our Facebook and Instagram page, we are jointly responsible with Meta (Art. 26 GDPR). We only receive aggregated, anonymous statistics. The legal basis is our legitimate interest in communicating with customers and prospective customers (Art. 6(1)(f) GDPR).

14. Storage period

We store personal data only for as long as is necessary for the respective purpose. We retain order and invoice data for up to ten years due to commercial and tax law obligations (§ 257 HGB, § 147 AO). We delete data based on consent after you withdraw it, unless there is a statutory retention obligation. Depending on their type, cookies are deleted when you close the browser or after their lifetime has expired.

15. Your rights

You have the right at any time to:

  • information about your data stored with us (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
  • lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

Right to object under Art. 21 GDPR
Insofar as we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds. You can object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, an informal message to the contact details above is sufficient.

16. Obligation to provide data and automated decisions

The provision of your data is required for the conclusion of a purchase contract. Beyond that, you are not obliged to provide us with data. We ourselves do not make automated decisions within the meaning of Art. 22 GDPR. When paying via Klarna, Klarna may carry out an automated credit check (see section 6).