Privacy policy
1. Controller
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
WILPSIZE – Thomas Klein
Golfstrasse 35
60528 Frankfurt am Main
Germany
Email: contact@wilpsize.com
Phone: +49 157 5244 9600
This Privacy Policy explains which personal data is processed when you visit our online shop, place an order, or otherwise use our services.
Where Swiss data protection law additionally applies to customers in Switzerland, its mandatory provisions shall apply in addition.
2. Personal data we process
Depending on how you use our online shop, the following data in particular may be processed:
- name and contact details, in particular email address, telephone number, billing address and delivery address
- order and contract data, in particular ordered products, variants, prices, shipping information and order history
- payment information or information about payment status
- communication data from enquiries and other correspondence
- technical data such as IP address, browser type, operating system, device information, and the date and time of access
- usage data relating to the use of our online shop
- consents and privacy settings, for example for cookies or email marketing
We only process data that is necessary for the respective purpose.
3. Provision and hosting of the online shop by Shopify
Our online shop is operated using the Shopify e-commerce platform.
For merchants in the European Economic Area, Shopify International Limited is the primary contracting party for Shopify services. In connection with providing the platform, Shopify processes, among other things, technical data as well as customer, order and transaction information.
Shopify International Limited
Ireland
The processing takes place in particular in order to provide the technical infrastructure for our online shop, enable orders, manage customer and order data, provide security functions, and ensure the stability and proper functioning of our shop.
Depending on the respective processing activity, the legal bases are in particular:
- Art. 6(1)(b) GDPR for taking steps prior to entering into a contract and for the performance of a contract
- Art. 6(1)(c) GDPR for compliance with legal obligations
- Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure, reliable and economically efficient operation of our online shop
Shopify may disclose data to affiliated companies and subprocessors and may also process data outside the European Economic Area. Shopify states that this includes, in particular, Canada and the United States. According to Shopify, such transfers are based on adequacy decisions and/or appropriate safeguards such as Standard Contractual Clauses.
3a. Shopify Network Intelligence and enhanced services
Shopify Network Intelligence is enabled in our online shop. Shopify may process information about the use of our shop together with information from interactions with Shopify and other Shopify merchants in order to provide enhanced services. These may include, in particular, features relating to security, fraud prevention, personalization and – where appropriate consent has been given – personalized advertising.
As part of these services, personal data may be transferred to Shopify and other service providers involved, which may also be located outside the European Economic Area.
For non-essential processing, in particular personalized advertising based on activities in our shop, with other merchants or with Shopify, appropriate consent is obtained from customers in the European Economic Area and Switzerland via the privacy settings or the cookie banner. Any consent given can be withdrawn there at any time.
Further information about Shopify’s processing of personal data can be found in the Shopify Consumer Privacy Policy and the Shopify Privacy Portal, where you can also exercise your data protection rights in relation to Shopify.
4. Orders and contract processing
When you place an order, we process the data you provide in order to:
- receive and process your order,
- perform the purchase contract,
- arrange for the production of the artwork,
- enable delivery,
- allocate payments,
- inform you about your order,
- handle complaints, returns and warranty claims.
This includes in particular your name, delivery and billing address, email address, telephone number, ordered products and specifications, order value, as well as payment and shipping status.
The legal basis is Art. 6(1)(b) GDPR.
Where we are required to retain certain data due to commercial, tax or other statutory requirements, the processing is additionally based on Art. 6(1)(c) GDPR.
4a. Electronic withdrawal function
To provide the electronic withdrawal function, we use the Shopify app “EU Widerrufs-Button & Formular” provided by 401layers UG (haftungsbeschränkt), Dorothea-Erx.-Str. 1a, 40721 Hilden, Germany.
When you use the withdrawal function, the personal data required to receive, assign and process your declaration of withdrawal is processed. This may include, in particular, your name, email address, information about your order and the items concerned, as well as the content, date and time of your declaration of withdrawal. In addition, technically necessary data such as your IP address, browser information and device information may be processed.
The processing takes place in order to receive your declaration of withdrawal, assign it to the relevant order, document it and send you a confirmation of receipt.
The legal basis is Art. 6(1)(c) GDPR insofar as the processing is necessary to comply with legal obligations, and Art. 6(1)(b) GDPR insofar as the processing serves to administer the contractual relationship.
401layers UG (haftungsbeschränkt) processes the personal data generated in connection with the withdrawal function as a technical service provider on our behalf.
5. Production and fulfillment by WhiteWall
The artworks ordered through WILPSIZE are produced, packaged and shipped directly to the delivery address provided by the customer by our production and fulfillment partner WhiteWall Media GmbH.
WhiteWall Media GmbH
Europaallee 59
50226 Frechen
Germany
The company details correspond to the current WhiteWall legal notice.
In order for WhiteWall to produce and deliver your order, we transmit the information required for this purpose. This may include in particular:
- name of the recipient
- delivery address
- telephone number, insofar as required for delivery
- information about the ordered product and its configuration
- other order data required for production, shipping or customs clearance
The data is transmitted only to the extent necessary for the production, processing and delivery of your order.
The legal basis is Art. 6(1)(b) GDPR.
WhiteWall may pass on the data required for delivery to the respective transport and shipping service providers used.
6. Payment processing
To process payments, we use Shopify Payments as well as the payment methods offered in the checkout.
Depending on the payment method selected by the customer, personal data may be transmitted to Shopify as well as to participating banks, card networks, wallet providers or other payment service providers.
This may include in particular:
- name and billing address
- order value and currency
- transaction number
- payment status
- technical information for fraud prevention and security checks
As a general rule, we do not receive full card details or comparable payment information to the extent that such data is processed directly by the respective payment service provider.
The processing is carried out for the performance of the purchase contract pursuant to Art. 6(1)(b) GDPR and, where necessary, for compliance with legal obligations pursuant to Art. 6(1)(c) GDPR.
Payment service providers may carry out their own automated security and risk assessments for fraud prevention purposes.
7. Contact
If you contact us by email, via a contact form or by telephone, we process the information you provide in order to respond to your enquiry.
This may include, in particular, your name, email address, telephone number, order number and the content of your enquiry.
If your enquiry relates to an order or a potential contract, the legal basis is Art. 6(1)(b) GDPR.
For other enquiries, the processing is based on our legitimate interest in processing and responding to customer enquiries pursuant to Art. 6(1)(f) GDPR.
8. Cookies and similar technologies
Our online shop uses cookies and similar technologies.
Some of these technologies are technically necessary to provide functions such as site navigation, the shopping cart, checkout, security or privacy settings.
Technically necessary cookies and similar technologies may be used without prior consent insofar as they are strictly necessary to provide a digital service expressly requested by the user.
Other technologies, in particular analytics, personalization or marketing technologies, are used only where valid consent has been given.
Under Section 25 TDDDG, consent is generally required for storing information on or accessing information from a user’s terminal device; an exception applies in particular to technologies that are strictly necessary.
You can make your choices via the cookie banner or the privacy settings provided in the shop and, where available, change or withdraw them at any time.
9. Usage analytics and improvement of the online shop
Shopify provides us with technical and statistical information about the use of our shop.
Where personal data is processed solely as part of technically necessary processes, the processing is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in ensuring security, error analysis and the proper functioning of our online shop.
Where analytics or comparable technologies require consent, the processing is carried out exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.
10. Security and fraud prevention
To protect our shop, prevent fraudulent orders and safeguard our customers, technical and transaction-related data may be processed.
This may include, in particular, your IP address, device information, order information and payment status.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to prevent misuse and fraud and to ensure the security of our online shop and our customers.
11. Recipients of personal data
We disclose personal data only where this is necessary for the performance of a contract, compliance with legal obligations, on the basis of consent, or on the basis of another statutory legal ground.
Recipients or categories of recipients may include in particular:
- Shopify as the operator of the shop platform
- WhiteWall Media GmbH as our production and fulfillment partner
- shipping and transport service providers engaged by WhiteWall or by us
- payment service providers, banks, card networks and wallet providers
- IT and technical service providers
- tax, accounting and legal advisers, where necessary
- authorities or other public bodies, where there is a legal obligation to disclose the data
Art. 13 GDPR requires, among other things, information to be provided about the recipients or categories of recipients of personal data.
12. Transfers to third countries
Some of our service providers, particularly in connection with the Shopify platform, may process personal data outside the European Economic Area.
Where the European Commission has adopted an adequacy decision for a recipient country, the transfer may be based on that decision.
Otherwise, the transfer takes place only subject to appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, or on the basis of another legally permitted transfer mechanism.
For transfers of personal data within the Shopify group of companies from the European Economic Area or Switzerland, Shopify’s Binding Corporate Rules (BCRs) approved by the competent European data protection authorities apply in particular.
13. Storage period
We store personal data only for as long as necessary for the respective processing purpose.
We retain order, invoice and contractual information beyond this period for as long as statutory commercial or tax retention obligations apply.
Data from customer enquiries is deleted once the enquiry has been fully processed and there are no statutory or contractual reasons requiring further storage.
Data processed on the basis of consent is generally processed until the consent is withdrawn or the respective processing purpose ceases to apply, unless statutory retention obligations require otherwise.
14. Your data protection rights
Where the statutory requirements are met, you have in particular the right to:
- access your personal data pursuant to Art. 15 GDPR
- rectification of inaccurate data pursuant to Art. 16 GDPR
- erasure pursuant to Art. 17 GDPR
- restriction of processing pursuant to Art. 18 GDPR
- data portability pursuant to Art. 20 GDPR
- object to certain processing activities pursuant to Art. 21 GDPR
- withdraw consent with effect for the future pursuant to Art. 7(3) GDPR
To exercise your rights, you can contact us at contact@wilpsize.com.
Where processing is based on Art. 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation.
15. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.
For our company, the competent authority is in particular:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
(Hessian Commissioner for Data Protection and Freedom of Information)
Wilhelmstraße 7
65185 Wiesbaden
Germany
Email: poststelle@datenschutz.hessen.de
The Hessian Commissioner for Data Protection is the supervisory authority for non-public bodies in Hesse and expressly provides a complaints procedure.
Your right to contact another supervisory authority competent under the GDPR instead remains unaffected.
16. Data protection for customers in Switzerland
Where the Swiss Federal Act on Data Protection (FADP) applies to processing, data subjects may additionally exercise the rights available to them under Swiss data protection law.
To exercise these rights, you may also contact us at contact@wilpsize.com.
17. Changes to this Privacy Policy
We may amend this Privacy Policy if our business processes, service providers used, technical functions or legal requirements change.
The current version will be published in our online shop.
Last updated: 28 September 2026