Privacy Policy
1. Controller
Sechsecken GmbH
Rheinpromenade 13
40789 Monheim am Rhein
Germany
Telephone: 02173/2650321
Email: info@aloba.us
Represented by Managing Director Arvid Loboda.
2. General Information on Data Processing
We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the applicable provisions of the Digital Services Act (DDG) and the Telecommunications Digital Services Data Protection Act (TDDDG).
Personal data is processed only where necessary to provide our online shop, perform contracts, comply with legal obligations, or on the basis of consent or a legitimate interest.
3. Hosting and Shopify Shop Platform
Our online shop is operated using Shopify.
For merchants based in the European Economic Area, the relevant Shopify entity is generally:
Shopify International Limited
The Sidings, 4th Floor
Grand Canal Quay
Dublin D02 E7K8
Ireland
As part of providing Shopify services, personal data may be processed by Shopify-affiliated companies and contracted service providers. This may also involve processing outside the European Economic Area.
Where required, Shopify uses appropriate data protection safeguards for international data transfers.
Further information can be found in Shopify's privacy information.
4. Data We Process
We may process personal data in particular when you:
- visit our online shop, for example IP address, browser, device and technical usage data,
- place an order, for example name, billing and delivery address, email address and order information,
- use a customer account,
- subscribe to our newsletter,
- contact us,
- submit a review or other voluntary content.
Depending on the processing activity, the legal basis may include:
- Art. 6(1)(b) GDPR for the performance of a contract or pre-contractual measures,
- Art. 6(1)(c) GDPR for compliance with legal obligations,
- Art. 6(1)(a) GDPR based on your consent,
- Art. 6(1)(f) GDPR based on our legitimate interests, provided your interests or fundamental rights do not override them.
5. Payment Processing
We use payment service providers to process payments.
Payments can currently be processed in particular through Shopify Payments and PayPal. Depending on the country, device and availability, Shopify Payments may offer different payment methods, such as credit and debit cards and other payment options supported by Shopify.
The payment methods actually available for your order are displayed at checkout.
The data required for the relevant transaction is transferred to the selected payment service provider for payment processing.
The legal basis is generally Art. 6(1)(b) GDPR for the performance of the purchase contract and, where required, Art. 6(1)(c) GDPR for compliance with legal obligations.
6. Shipping and Fulfilment
To process, fulfil and deliver orders, we transfer the necessary personal data to the relevant shipping, logistics and fulfilment service providers.
Depending on the product and destination, this may include shipping providers, fulfilment partners and applications connected with Shopify.
The data processed may include in particular your name, delivery address, email address, telephone number where applicable, as well as order and shipping information.
The providers involved in each individual case may vary depending on the product ordered, the destination country and the selected shipping method.
The legal basis is generally Art. 6(1)(b) GDPR.
7. Technical Service Providers and Shopify Apps
We use technical service providers and Shopify apps to operate and develop our online shop.
These may be used in particular for:
- shop functionality and hosting,
- order and invoice processing,
- shipping and fulfilment,
- customer communication,
- translations,
- product reviews,
- search engine optimisation,
- security and performance,
- marketing and newsletters,
- analytics and statistics.
The services we currently use include, among others, applications for fulfilment, shipping processing, email marketing, product reviews, invoicing and translations.
Depending on their function, these providers may process personal data on our behalf or under their own data protection responsibility.
Where processing is carried out on our behalf, the legally required agreements are put in place.
Where personal data is transferred to third countries, appropriate safeguards under Art. 44 et seq. GDPR are used where required.
8. Newsletter and Marketing Communications
We may use Shopify functions as well as external email marketing services to send newsletters and marketing communications.
Klaviyo is currently integrated into our online shop, among other services.
If you subscribe to our newsletter, we process your email address and any additional information you voluntarily provide.
Processing is based on your consent pursuant to Art. 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future, for example by using the unsubscribe link in a marketing email.
9. Product Reviews
We currently use Judge.me Reviews, among other services, for product reviews.
Personal data may be processed as part of the review functionality where necessary to provide, assign and manage reviews.
Where review requests are sent in connection with an order, the necessary order and contact information may be processed for this purpose.
Processing is carried out on the applicable legal basis under data protection law.
10. Analytics and Marketing
Analytics and marketing services may be used to analyse and market our online shop.
Applications for online advertising and marketing are currently integrated into the shop. Where cookies or similar technologies that are not technically necessary are used, they will only be activated after you have provided the appropriate consent.
Where consent is required, processing is based on Art. 6(1)(a) GDPR.
Consent that has been provided can be changed or withdrawn with effect for the future through the available cookie or privacy settings.
11. Cookies and Similar Technologies
Our online shop uses technically necessary cookies and similar technologies required for functions such as the shopping basket, checkout, security and, where applicable, customer accounts.
The requirements of Section 25 TDDDG apply to storing information on your device or accessing information already stored on it.
Consent is required in particular for technologies that are not necessary. A statutory exemption from the consent requirement may apply to processes that are strictly technically necessary.
You can change or withdraw consent you have provided with effect for the future through the available privacy or cookie settings.
12. Storage Period
We store personal data only for as long as necessary for the respective processing purpose or for as long as statutory retention obligations apply.
Once the relevant purpose no longer applies, the data will be deleted unless statutory retention periods or other legal grounds prevent deletion.
Depending on the type of records, statutory commercial and tax retention periods may in particular be 6, 8 or 10 years.
13. Rights of Data Subjects
Subject to the applicable legal requirements, you have in particular the following rights:
- right of access under Art. 15 GDPR,
- right to rectification under Art. 16 GDPR,
- right to erasure under Art. 17 GDPR,
- right to restriction of processing under Art. 18 GDPR,
- right to data portability under Art. 20 GDPR,
- right to object under Art. 21 GDPR,
- right to withdraw consent with effect for the future.
To exercise your rights, please contact us at:
14. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority.
For North Rhine-Westphalia:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
15. Updates and Changes
This Privacy Policy is current as of October 2026.
We reserve the right to update this Privacy Policy if legal requirements, our data processing activities or the services we use change.