body{font-family:Arial,Helvetica,sans-serif;color:#252525;line-height:1.65;max-width:920px;margin:40px auto;padding:0 22px}h1{font-size:2rem}h2{font-size:1.28rem;margin-top:1.8em}p{margin:0.8em 0}.date{margin-top:2.8em;color:#555}

Privacy Policy

Data controller

The controller responsible for the processing of personal data on this website is:

mediarath – Martin Damrath
Schöneberger Str. 75d, 22149 Hamburg, Germany
Email: info@mediarath.de
Phone: +49 40 84890296

This Privacy Policy applies to our online store at mediarath.de, associated customer accounts and communications with us.

Personal data we process

Depending on how you use our store, we process names, contact details, billing and delivery addresses, order and payment information, return information, customer account and support details, and review or chat content that you provide voluntarily. When you visit the website, technical information may also be processed, including your IP address, browser and device information, access times and, subject to your consent, usage and interaction data.

We collect this information directly from you, through your use of the website and from service providers, payment providers and delivery partners where necessary to provide our services or otherwise permitted by law.

Purposes and legal bases

We process personal data to operate and protect our store, handle orders, payments, deliveries, returns and enquiries, and meet legal obligations. The principal legal bases are Article 6(1)(b) GDPR (performance of a contract and pre-contractual steps), Article 6(1)(c) GDPR (legal obligations) and Article 6(1)(f) GDPR (legitimate interests in securely operating the store and responding to general enquiries).

Where consent is required for analytics, advertising, affiliate technologies or particular marketing communications, we rely on Article 6(1)(a) GDPR. Storage of or access to information on your device is also subject to Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Hosting, Shopify and enhanced Shopify services

Our online store is operated using Shopify. Shopify processes personal data as part of hosting, customer accounts, shopping carts, checkout, order administration and security functions in order to provide the store. Information may be transferred to Shopify and service providers in countries other than your country of residence.

Shopify Network Intelligence is enabled for our store. Shopify may therefore use information about interactions with our store, Shopify and, where relevant, other merchants to provide enhanced services, including product improvement, personalisation and more relevant advertising. For certain enhanced services, Shopify acts as an independent controller for its processing. Your consent and opt-out preferences are taken into account in accordance with applicable privacy rules and Shopify settings.

Further information and options for exercising your rights with Shopify are available in Shopify's Consumer Privacy Policy and the Shopify Privacy Portal.

Cookies and consent

We use cookies and similar technologies that are necessary for the operation of the store, including the cart, checkout, language and region preferences, and security.

Where required by law, we obtain your consent through the Shopify cookie banner before using non-essential analytics, advertising and affiliate technologies. You can accept, reject or manage your preferences. You can change or withdraw consent for the future at any time through the cookie or privacy settings on our store. The relevant legal bases are Section 25 TDDDG and, where personal data is processed, Article 6(1)(a) GDPR.

Orders, payment, shipping and returns

To process your order, we use the required contact details, addresses, payment and order information and share necessary information with the payment services you select and our shipping, warehouse and logistics providers, including DHL where applicable. Payment details may be processed directly by the relevant payment provider. We rely on Article 6(1)(b) GDPR for contract performance and Article 6(1)(c) GDPR for statutory accounting and record-keeping obligations.

Tracking links may take you to delivery providers' websites, where their own privacy notices apply.

Customer accounts, contact and support

When you use a customer account or contact us by email, contact form or support channel, we process the information you submit to address your request, perform our contract with you and, where relevant, prevent misuse. The legal basis is Article 6(1)(b) GDPR for contract-related matters or Article 6(1)(f) GDPR for general enquiries and reliable customer support.

Shopify Inbox and AI-assisted chat

We use Shopify Inbox with AI-assisted features enabled. When you use the chat, we process your messages and the information they contain. Depending on your enquiry, product, contact or order information may also be used to answer your questions. Replies may be generated automatically or handled by our customer support team.

Shopify processes this information to provide the chat and AI features and, under its applicable terms, may also use data to improve those features. Our legal basis is Article 6(1)(b) GDPR for contract-related matters and otherwise Article 6(1)(f) GDPR (efficient customer support). Please do not submit unnecessary sensitive information in the chat. For details about Shopify's processing, see its privacy information.

Product reviews with Judge.me

We use Judge.me to collect, manage and display product reviews. A voluntary review may involve processing its content, your name or display name, relevant contact details and the product reviewed. Published reviews and display names may be visible to other visitors.

Technical resources are loaded to display review widgets. Where consent is legally required, additional analytics or interaction events relating to these widgets are processed only with that consent. Depending on the function, processing of voluntary reviews is based on Article 6(1)(a) or Article 6(1)(f) GDPR. If review invitation emails are sent, they are subject to the relevant consent or other applicable legal basis.

Affiliate programme with GOAFFPRO

We operate an affiliate programme using GOAFFPRO. If you visit our store through an affiliate link, we may, with your consent, store a partner identifier in a cookie or in your browser's local storage so that a later purchase can be attributed to the affiliate and a commission calculated. You can withdraw consent through our cookie settings. Without consent, such attribution may not be possible.

For affiliates, we also process the registration, contract, contact and accounting information needed to administer the programme and pay commissions. Legal bases are Article 6(1)(b) and (c) GDPR; consent-based visitor tracking is governed by Article 6(1)(a) GDPR together with Section 25 TDDDG.

Analytics and advertising: Google and Meta

Our store has integrations for Google & YouTube and Facebook & Instagram (Meta). Depending on the features enabled and your consent, these may process device and browser information, page views, interactions and purchase events for measurement, conversions, product catalogues and advertising. Providers include Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

Where non-essential cookies, similar identifiers or consent-based tracking are used, the legal basis is your consent under Section 25 TDDDG and Article 6(1)(a) GDPR. You can change your preferences in our cookie settings. Further information is available in Google's Privacy Policy and Meta's Privacy Policy.

YouTube videos

Certain product pages offer videos hosted on YouTube, a Google service. Initially, we display only a preview image hosted through our store. The YouTube player is loaded, and a connection to Google established, only when you expressly choose to play the video. Google may then process your IP address, device details and information about your video usage; international data transfers may occur.

The legal basis for activation is your consent under Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. Without activation, the embedded YouTube player is not loaded. Further information: Google's Privacy Policy.

Store design and other applications

We use applications including PageFly, T-Lab Language Switcher and Smart Pricing to design and operate the store. Depending on the function, technical usage and device information may be processed to display pages or provide the service. Font files used for the design are delivered through Shopify's CDN. Any non-essential analytics or advertising technologies used by these applications are subject to the consent rules described above.

Newsletter and marketing messages

If you subscribe to our newsletter or other marketing messages, we process your contact information to send the communications you select and, where relevant, document consent. The legal basis is generally Article 6(1)(a) GDPR; applicable rules for marketing to existing customers remain unaffected. You can unsubscribe at any time using the link in the message or by contacting us. Transactional messages, such as order updates, are sent independently of marketing consent.

Recipients and international transfers

Where necessary, we share personal data with Shopify, the apps used in our store, hosting and IT providers, payment services, shipping and logistics companies, communications providers and competent authorities. Depending on their role, recipients process data on our behalf or as independent controllers.

For transfers outside the European Economic Area, we rely where required on European Commission adequacy decisions, appropriate safeguards such as the EU Standard Contractual Clauses, or other legally permitted transfer mechanisms. We cannot guarantee that every integrated service processes data exclusively within the EU.

Retention periods

We retain personal data only for as long as needed for its purpose. Business and tax records are retained for the applicable statutory periods. Support requests, customer account information, reviews and technical usage data are retained according to their purposes, legal requirements, necessary evidence and legitimate interests and then deleted or anonymised unless another legal basis applies. Consent may be withdrawn at any time for the future.

Your data protection rights

Subject to the requirements of the GDPR, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and objection to processing based on legitimate interests (Article 21). You can withdraw consent for the future at any time (Article 7(3) GDPR). You also have the right to lodge a complaint with a competent data protection supervisory authority (Article 77 GDPR).

To exercise your rights, email info@mediarath.de. Where Shopify is an independent controller for certain enhanced services, you can also use the Shopify Privacy Portal.

Security, external links and changes

We implement appropriate technical and organisational measures to protect personal data. However, absolute security of information transmitted over the internet cannot be guaranteed.

Our store may contain links to third-party websites. When you visit them, the privacy notices of the relevant operators apply.

We update this Privacy Policy when our processing practices or legal requirements change. The current version is available on our website.

Last updated: October 9, 2026