IRONVOW

This store sells restraint equipment intended for adults. By entering you confirm that you are at least 18 years old and of legal age in your country.

Leave
IRONVOW

Legal

Privacy Policy

Privacy Policy

IRONVOW sells hardware, not data. We collect the minimum required to take an order, ship it, and meet our legal obligations — and nothing beyond that. There are no advertising pixels, no analytics profiling, and no tracking cookies on this site.

This policy explains what we hold, why, for how long, and what you can require of us under the General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for processing personal data on this website is:

[PLACEHOLDER: legal company name] [PLACEHOLDER: street address] [PLACEHOLDER: postal code, city, country] Email: [PLACEHOLDER: privacy contact email] Commercial register: [PLACEHOLDER: register court and number]

Data protection officer: [PLACEHOLDER: DPO name and contact, or the statement that no DPO is required under Art. 37 GDPR / § 38 BDSG]

2. What we process, and why

Order and delivery data. Name, delivery address, billing address, email address, and — where you choose to provide one for carrier notifications — a telephone number, together with the contents and value of your order. Legal basis: Art. 6(1)(b) GDPR, performance of the purchase contract.

Payment data. Card details are entered on, and processed by, our payment service provider. We never see or store a full card number. We receive only a transaction reference, the payment status, and the billing name and country. For SEPA bank transfers we see the transfer reference and the sending account details that appear on our bank statement. Legal basis: Art. 6(1)(b) GDPR.

Correspondence. Emails you send us about an order, a return, a sizing question, or a fault, along with our replies. Legal basis: Art. 6(1)(b) GDPR where the message concerns a contract, otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries.

Server logs. Our web server records the requesting IP address, date and time, the page requested, the referring URL, the HTTP status, the transferred data volume, and the browser and operating system string. These logs exist to keep the site available and to identify attacks. They are not combined with other data and are not used to build a profile of you. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in operating a secure service. Retention: [PLACEHOLDER: log retention period, e.g. 7 days].

Accounting records. Invoices and the transaction data on them. Legal basis: Art. 6(1)(c) GDPR, together with the statutory retention duties described in section 5.

Newsletter, if you subscribe. Your email address and the confirmation record of your subscription. We use a double opt-in procedure: you receive a confirmation email and are only added once you click the link. Legal basis: Art. 6(1)(a) GDPR, your consent. You may withdraw consent at any time using the unsubscribe link in any message or by writing to us; withdrawal does not affect the lawfulness of processing carried out before it.

Age declaration. This site is for adults. When you confirm you are 18 or older, that confirmation is stored in a strictly necessary cookie on your own device. It contains no personal data and is not transmitted to us as an identifier.

3. Cookies

We set only cookies that are technically necessary to operate the site: a session identifier, your shopping cart, and your age confirmation. These do not require consent under § 25(2) TTDSG.

We do not use Google Analytics, Meta Pixel, TikTok Pixel, or any comparable measurement, remarketing, or attribution service. We do not embed third-party fonts, maps, or social media widgets that would disclose your IP address to another company.

4. Who receives your data

We disclose personal data only where it is necessary to deliver your order or to comply with the law. Recipients are:

  • our fulfilment partner, who picks and packs orders at our EU warehouse: [PLACEHOLDER: 3PL name and country]
  • the carrier delivering your parcel: [PLACEHOLDER: carriers]
  • our payment service provider: [PLACEHOLDER: payment provider name and country]
  • our email and hosting providers: [PLACEHOLDER: hosting and email providers]
  • our tax adviser and, where legally required, the tax authorities: [PLACEHOLDER: tax adviser]

Each processor is bound by a data processing agreement under Art. 28 GDPR. None of them is permitted to use your data for their own purposes. We do not sell, rent, or trade personal data, and we do not share it with advertising networks or data brokers.

Transfers outside the EU/EEA. [PLACEHOLDER: state whether any processor is located outside the EU/EEA and, if so, name the safeguard relied on — adequacy decision under Art. 45 GDPR or Standard Contractual Clauses under Art. 46 GDPR.] Our EU warehouse and our order data are held within the European Union.

5. How long we keep it

Order and invoice data are retained for the statutory commercial and tax retention periods, which in Germany run to ten years under § 147 AO and § 257 HGB, and six years for commercial correspondence. Support correspondence unrelated to an order is deleted after [PLACEHOLDER: retention period, e.g. 24 months]. Newsletter data is deleted immediately on unsubscribe, apart from a suppression record proving that you opted out. Server logs are deleted as stated in section 2.

6. Your rights

Under the GDPR you may require from us:

  • Access (Art. 15) — confirmation of whether we process your data, and a copy of it.
  • Rectification (Art. 16) — correction of inaccurate data and completion of incomplete data.
  • Erasure (Art. 17) — deletion, unless we are required to retain the data under the periods in section 5.
  • Restriction of processing (Art. 18) — while a dispute over accuracy or lawfulness is resolved.
  • Data portability (Art. 20) — the data you provided, in a structured, machine-readable format.
  • Objection (Art. 21) — you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. Where you object to direct marketing, we stop immediately and without qualification.
  • Withdrawal of consent (Art. 7(3)) — at any time, with effect for the future.

To exercise any of these, write to [PLACEHOLDER: privacy contact email]. We answer within one month. We will ask you to identify yourself only to the extent necessary to be sure we are not disclosing your data to someone else.

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.

7. Complaints

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work, or the place of the alleged infringement.

The authority competent for us is:

[PLACEHOLDER: competent supervisory authority — for a controller established in Germany, the Landesdatenschutzbehörde of the relevant federal state, with address and website]

8. Discretion

We understand that a purchase from this shop is private. Order confirmations name the shop only in the terms agreed in our Shipping & Returns page; parcels carry no product description on the outside; and no employee, processor, or carrier receives more information about the contents than is required to move the box. If you would prefer that we retain nothing beyond the legal minimum after your warranty period ends, write to us and we will do exactly that.

9. Changes

We will update this policy when our processing changes — for example if we add a payment method or change fulfilment partner. The version in force is always the one published here.

Last updated: [PLACEHOLDER: date]