Privacy Policy
1. Controller and scope
The controller responsible for the processing described in this Privacy Policy is:
Fidu Brands GmbH
Otto-Hesse-Str. 19/T9
64293 Darmstadt
Germany
Represented by Managing Directors Christian Hinz and Erdem Keles. Commercial Register: Local Court of Darmstadt, HRB 95515.
Email: info@fidubrands.com
Telephone: +49 6151 384340
Central contact for cross-brand privacy matters: info@fidubrands.com
This Privacy Policy applies to the Fidu Brands offering at fidubrands.com and to the related customer and business processes described below. It explains in particular the nature, purposes, legal bases, recipients and duration of processing of personal data as well as your rights. Not every processing operation described takes place on every visit; the decisive factors are how you use our services, the specific business transaction and the consents you have given.
2. Categories and sources of data and legal bases
We process in particular identification and contact data, communications, contract, order and billing data as well as technical access and usage data. The information actually generated depends on how you use our services. Pure product or revenue totals that cannot be linked to an identifiable individual are not personal data. Customer identifiers, cookie IDs and hashed contact information, however, may still constitute personal data.
We receive data directly from you, through technically necessary processes when you visit our website and, as described below, from payment and shipping providers, sales systems or your company. If another person's data is provided to us, for example the details of a delivery recipient or a business contact, we process that data only for the associated purpose. Where data has not been collected from you directly, we provide the information required under Article 14 GDPR unless a statutory exception applies.
Consent is a legal basis under Article 6(1)(a) GDPR. Processing necessary to take steps at your request prior to entering into a contract or to perform a contract with you is based on Article 6(1)(b) GDPR. We fulfil legal obligations, in particular accounting and retention duties, on the basis of Article 6(1)(c) GDPR. Where we rely on Article 6(1)(f) GDPR, we identify the relevant legitimate interest in the respective section; this requires that your interests and fundamental rights do not override our interests.
The legal basis for storing information on or accessing information from your terminal device must be assessed separately. In Germany, Section 25 TDDDG applies in particular. A legal basis under the GDPR does not replace any consent required under the TDDDG.
3. Website operation and hosting
For the provision of our website we use Squarespace. The provider is Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland.
When the website is accessed, in particular the IP address, date and time, requested content, referrer information, browser and device information, operating system, language, transferred data volumes and technical status or error data are processed. These data are required to deliver pages and files, secure operations and investigate technical faults. Where forms are used, the data entered by you are added.
The legal basis for general provision and security is Article 6(1)(f) GDPR. Our legitimate interest is a secure and reliable website. Processing of a specific contractual or project enquiry is governed by the separate contact section. Non-essential analytics and marketing are not justified solely by the necessity of hosting.
Where Squarespace processes website visitor data on our behalf, it acts as a processor under Article 28 GDPR. Its infrastructure may involve international group companies and subprocessors, in particular in the United States. Provider documentation refers, where applicable, to Standard Contractual Clauses and, for appropriately certified US recipients, the EU-U.S. Data Privacy Framework.
Further information: https://www.squarespace.com/privacy and https://www.squarespace.com/dpa.
Technical logs are retained for their respective operational and troubleshooting purposes. Individual data may be retained for longer where required to investigate a specific security incident or for legal enforcement.
4. Cookies and consent management
Our website uses cookies and comparable technologies. These may include entries in local browser storage, pixels, scripts and other methods for storing or accessing information. Access to your terminal device must be distinguished from the subsequent processing of personal data.
Necessary functions
Without consent, we store or access information only where a statutory exemption applies, in particular where this is strictly necessary to provide a digital service expressly requested by you (Section 25(2) no. 2 TDDDG) or where it is used solely for transmitting a communication (Section 25(2) no. 1 TDDDG). This may include secure session management, a shopping cart used by you and storage of your privacy preferences. Not every useful or commercially beneficial function is therefore technically necessary.
Subsequent processing of personal data is based, depending on the function, on Article 6(1)(b) GDPR, Article 6(1)(f) GDPR for necessary technical security, or Article 6(1)(c) GDPR for statutory evidence obligations.
Optional analytics and marketing functions
For non-essential analytics, personalised advertising and other services requiring consent, your prior consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR is decisive. The purposes and providers are explained in the relevant service sections. You may refuse consent without losing the basic website or ordering functionality.
Choice, evidence and withdrawal
Your choices are managed through the cookie or privacy settings available on the website. For assignment and evidence purposes, we process the choices made, the time, the applicable information version and a technical consent identifier. Processing required to demonstrate consent is based on Article 6(1)(c) in conjunction with Article 7(1) GDPR; storing the preference on your device is based on Section 25(2) no. 2 TDDDG. Recipients are the technical service providers used for website operation and consent management.
You may change or withdraw your choices at any time with effect for the future via the cookie or privacy settings available on the website. You may also contact us using the details above. The lawfulness of processing carried out before withdrawal remains unaffected.
Session identifiers expire when the session ends or when their technical validity period expires. Persistent identifiers remain until they expire or until you delete them earlier. Specific lifetimes depend on the relevant technology; evidence of consent is retained for as long as the processing based on it and the necessary proof remain relevant. Evidence required by law or for specific legal defence may be retained in a restricted form for longer.
You can also delete or block cookies in your browser. Deleting cookies alone does not necessarily withdraw previously given consent and does not remove data that has already been transmitted. A new selection may be required after changing browser or device.
5. Contact and customer service
If you contact us by email, telephone, contact form or through an offered customer service channel, we process the information you provide. This includes your name, contact details, your request, where applicable your company and role, as well as related order, project or complaint information. Files or images provided voluntarily are processed only to handle the request. Please do not send sensitive data that is not necessary for your enquiry.
Where your enquiry concerns a contract with you or pre-contractual measures requested by you, Article 6(1)(b) GDPR applies. For general enquiries or communication with employees and representatives of a business partner, processing is based on Article 6(1)(f) GDPR. Our legitimate interests are the proper handling of enquiries, reliable business relationships and documentation of arrangements. Business correspondence that must be retained by law is processed under Article 6(1)(c) GDPR.
Recipients are the responsible persons within Fidu and the communications and IT service providers used for email, form transmission or customer support. Contacting us does not automatically subscribe you to a newsletter or constitute consent to personalised advertising.
Providing an appropriate contact method and the information necessary to clarify the matter is required for us to respond. Once the matter is concluded, information that is no longer required is deleted. Contract documents, business letters and content required for specific legal claims are subject to the separate retention rules described below.
6. Business enquiries, quotations and projects
For business enquiries, quotations and orders, we process in particular company and contact-person data, business contact details, billing and delivery addresses, project descriptions, product specifications, quantities, prices, approvals, delivery dates as well as payment and communication information. This serves consultation, quotation preparation, costing, product development, production, delivery and billing.
If you are personally the contracting party, processing is based on Article 6(1)(b) GDPR. If you act for a company, we process your business contact data on the basis of Article 6(1)(f) GDPR. Our legitimate interest lies in initiating and conducting the business relationship and in reliable project communication. Statutory accounting and retention duties are fulfilled on the basis of Article 6(1)(c) GDPR.
We obtain project information from you, your company and other parties involved in the order. Necessary information may be passed to production, design, procurement, quality-control and logistics partners. Personal data are disclosed only to the extent required for the respective task. For partners outside the EEA, the rules on international data transfers described below also apply.
Required project and billing information must be provided so that we can prepare an offer or perform the order. Voluntary information that is not necessary is treated separately. If separate data-protection arrangements apply to a specific order, for example where we process data of your own customers on your behalf, those arrangements apply in addition. This website Privacy Policy does not replace such an agreement.
7. Payment processing
For invoicing and payment allocation, we process names or company details, billing address, service and invoice information, amounts, payment dates and necessary bank and transaction data. Recipients are the banks and, where applicable, payment service providers involved as well as the departments responsible for accounting.
The legal bases are Article 6(1)(b) GDPR where there is a contract with you, Article 6(1)(f) GDPR for necessary processing of business contact details and Article 6(1)(c) GDPR for statutory accounting and retention duties. Our legitimate interest lies in correct and traceable billing. Operational payment information that is no longer required is separated from records that must be retained by law.
8. Merchandise management and order administration with Xentral
For merchandise management, customer and order administration, quotations, invoices, deliveries and returns, we use Xentral provided by Xentral ERP Software GmbH, Viktoriastraße 3b, 86150 Augsburg, Germany.
Data processed include, in particular, customer and contact-person data, contact information, billing and delivery addresses, customer and order identifiers, items and quantities, amounts, payment status, invoice and shipping information, and return or complaint data. Information from our sales systems may be synchronised automatically with Xentral.
Processing required to perform a contract with you is based on Article 6(1)(b) GDPR. For business contacts and necessary internal organisation, Article 6(1)(f) GDPR applies; our legitimate interest is reliable merchandise management, coordinated order processing and correct billing. Statutory documentation and retention obligations are fulfilled on the basis of Article 6(1)(c) GDPR.
Xentral is used as a processor under Article 28 GDPR for data processed on our behalf. Operations and support service providers receive data only within the scope of their task. A German provider address does not mean that all technical subprocessors operate exclusively in Germany. International subprocessors are additionally subject to the transfer rules described below.
If you use a returns portal provided via Xentral, the data required to identify the order and process the return, such as order number, contact information, affected items and reason for return, are processed for this purpose. Mandatory information serves the processing of the return; additional voluntary information is not a prerequisite for exercising statutory rights.
Retention is determined by the relevant order and the contract, accounting and retention rules described in this Policy. Further information: https://xentral.com/de/legal/datenschutz.
9. Shipping, delivery and returns
For delivery or return shipments, we provide the parcel or transport service provider appointed for the specific route with the data required for that purpose. These include name, delivery or collection address, shipment and tracking number, type of shipment and, where necessary, customs information. We receive delivery, return and, where applicable, damage information.
The recipient is the parcel service, freight forwarder or logistics partner appointed for the relevant order. The specific shipping route depends on the agreed scope of delivery and is shown in the order or shipping information.
Necessary delivery data are transmitted for contract performance under Article 6(1)(b) GDPR. Where a different recipient or business contact is named, Article 6(1)(f) GDPR may apply; our legitimate interest lies in proper performance of the commissioned delivery. Statutory customs and documentation duties are based on Article 6(1)(c) GDPR.
An email address or telephone number for an additional voluntary notification service of the carrier is transmitted on the basis of the relevant consent under Article 6(1)(a) GDPR. If contact details are necessary for a specifically commissioned delivery service, such as arranging a delivery appointment, they are processed for that purpose. Providing an email address in an order does not constitute blanket consent to additional carrier services.
For the transport itself, carriers generally act as independent controllers. Their retention rules and recipients are additionally governed by their own legal duties and privacy notices. For cross-border deliveries, necessary recipients in the destination country may be involved.
Withdrawal, returns and complaints
If you withdraw from a contract, return goods or make a complaint, we process the order assignment, your declaration, affected items and the communication, shipping, inspection and refund information required. This serves contract processing and fulfilment of statutory claims under Article 6(1)(b) or (c) GDPR. In disputed cases, necessary establishment, exercise or defence of legal claims may additionally be based on Article 6(1)(f) GDPR.
A statutory withdrawal does not require a reason. Voluntary information on return reasons is treated separately from data necessary to process the matter. Retention follows the business transaction and the rules in the retention section below.
10. Google Analytics
We use Google Analytics to statistically analyse use of our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The analysis helps us assess content, usability and the performance of our offerings.
Following the relevant consent, data may include page views, search and click events, sessions, visit times, referrers, technical device and browser information, approximate location information and technical user and session identifiers. In shop contexts, product views, cart actions and purchase events with item, value and transaction information may be added. Such identifiers can create a link to an individual even where we do not see names in our reports.
IP addresses are technically processed for communication and derivation of approximate location information. Google states that for accesses from the EU, Switzerland and the United Kingdom individual IP addresses are not logged or stored as part of this Analytics collection. This does not mean that all other Analytics data are anonymous.
Processing is based on your consent under Article 6(1)(a) GDPR; consent-requiring storage of or access to information on your device is based on Section 25(1) TDDDG. You may withdraw consent for the future via our cookie or privacy settings. A server-side transmission route or the absence of a particular cookie does not automatically remove the need for a legal basis.
Google processes analytics data collected for us under its data processing terms. Google companies and subprocessors may process data outside the EEA, in particular in the United States. Google's contractual documents provide, where applicable, for adequacy decisions or Standard Contractual Clauses.
User- and event-level retention depends on the settings of the respective Analytics property. Google distinguishes these data from aggregated standard reports and allows automatic deletion after the configured period. Where an identifier is configured to reset its expiry on new activity, the retention period may be extended. Purpose and deletion limits within our responsibility also apply to exports and internal analyses.
We use consent-based analytics information only for analyses covered by the consent. For further internal use of reports, please see the Fidu Portal section. Advertising purposes must be distinguished from pure audience measurement and are not authorised solely by a general statistics consent.
Further information: https://policies.google.com/privacy?hl=en, https://policies.google.com/technologies/partner-sites?hl=en, https://support.google.com/analytics/answer/7667196?hl=en.
11. External links and social media
Our website may contain links to our presences on social networks. Merely displaying a normal link does not by itself establish a connection to the target service. Only when you follow the link does the relevant provider process information in accordance with its own privacy notice.
Embedded posts, feeds, buttons or other external content that already establish a data connection from within our website must be distinguished from ordinary links. For integrations requiring consent, processing of personal data is based on Article 6(1)(a) GDPR and corresponding terminal-device access on Section 25(1) TDDDG. Data transmitted may include IP address, visited page, device information, technical identifiers and your interaction with the content. The provider may associate such data with its own user profile depending on login status.
For Facebook and Instagram content, the provider is Meta Platforms Ireland Limited, Ireland. For other social services activated or accessed by you, the provider information visible with the relevant content applies. Operators may also process data outside the EEA; applicable transfer safeguards must be considered in addition.
You are not required to activate external content in order to read other parts of our website or make an enquiry. Consent may be withdrawn through our privacy settings. This does not automatically change settings in your own account with the social network.
12. Internal business management: Fidu Portal
Fidu Brands GmbH operates an internal data platform, the Fidu Portal. Data from merchandise management, associated sales systems and the marketing and analytics systems used by us are made available and analysed there for business purposes.
Data sources include in particular Xentral as well as Google and Meta reports and, where relevant to the brand, Klaviyo. Not every source system is used on every website. Merely visiting this website does not automatically result in your data being processed in all systems mentioned.
Central processing serves the assignment and control of orders, deliveries, returns and payments, correction of data errors and preparation of revenue, cost, inventory and profitability analyses. Depending on the task, customer and order identifiers, master data, contact information, items, quantities, amounts, timestamps and status information may be involved. For marketing reports, aggregated campaign metrics must be distinguished from personal events and profiles.
Processing necessary for a specific contract is based on Article 6(1)(b) GDPR; for business contacts Article 6(1)(f) GDPR applies. Legally required documentation is based on Article 6(1)(c) GDPR. Necessary internal coordination and business analyses are based, after balancing the interests involved, on Article 6(1)(f) GDPR; our legitimate interests lie in correct billing, economic planning and traceable business processes.
Storage in the Portal does not create a new blanket permission for advertising or profiling. Data whose use is based on consent may be further processed only within the permitted purpose; a refused or withdrawn consent may not be circumvented through an internal copy. Cross-brand advertising profiling is not covered by a general business-management interest.
Access rights are assigned according to role and necessity. Where an analysis does not require individual personal data, data are reduced or aggregated as appropriate. Deletion and restriction also apply to related copies and exports; records that must be retained by law are treated separately.
13. Database and backend infrastructure with Supabase
For our central data platform and Fidu Portal we use database, backend and infrastructure services from Supabase. The provider of the published cloud services is Supabase Pte. Ltd., Singapore.
The project configured for our Portal uses the eu-central-1 region (Frankfurt am Main, Germany). Primary storage of project data is therefore configured in this region. This does not mean that every support, security, infrastructure or other ancillary processing operation takes place exclusively in Germany.
The data described in the Fidu Portal section are processed insofar as they are stored or processed in this infrastructure, together with technical log, access and authorisation information required for operation. Supabase is used as a processor under Article 28 GDPR. The substantive legal basis depends on the purpose of the underlying processing; choosing a database does not create an additional legal basis.
According to the provider documentation, Supabase and commissioned technical parties may also process data in Singapore, the United States or other countries. For transfers covered by the DPA to countries without an applicable adequacy decision, the Supabase DPA provides in particular for EU Standard Contractual Clauses. Actual protection conditions and any necessary supplementary measures must also be considered. Information and a copy of the essential safeguards can be requested from us.
Retention is determined by the processing purposes described and the applicable deletion or retention rules. Neither the duration of a Supabase subscription nor the mere existence of a data export justifies unlimited personal-data retention.
Further information: https://supabase.com/legal/customer-resources/data-processing-addendum, https://supabase.com/legal/customer-resources/subprocessor-list and https://supabase.com/privacy.
14. Other recipients and international data transfers
Within Fidu Brands GmbH, access is limited to persons responsible for the relevant process. In addition to the named providers, external recipients may include IT and communications providers, transport and payment companies, necessary project partners, tax advisers, legal advisers and competent authorities. Disclosure takes place only to the extent necessary and on the legal basis applicable to the specific purpose.
Processors are contractually bound in accordance with Article 28 GDPR. Independent controllers, such as certain payment companies or regulated professional advisers, do not become processors merely because of a business relationship. Joint controllership is assumed only where the actual processing and applicable arrangements provide for it.
For transfers outside the EU and EEA, we additionally assess the required level of protection. An adequacy decision under Article 45 GDPR applies only within its specific scope. The EU-U.S. Data Privacy Framework therefore does not apply indiscriminately to every US-based company. Where no applicable adequacy decision exists, Standard Contractual Clauses under Article 46 GDPR may be used together with an assessment of the actual protection conditions and, where necessary, supplementary measures.
Access from a third country to data stored in a European data centre may also be relevant. The specific basis is described for the respective service. Information and a copy of the essential agreed safeguards can be requested through our privacy contact, subject to legitimate confidentiality interests.
15. Retention, deletion and restriction
We distinguish between current business data, statutory archives, evidence of consent and optional analytics or marketing data. There is no general retention obligation for all customer data.
Enquiries are deleted once they have been conclusively handled and no further lawful purpose remains. If a contract is concluded, necessary content becomes part of the contract documentation. Commercial and business letters are generally retained for six years, accounting vouchers generally for eight years and certain accounting records, inventories or annual financial statements generally for ten years. Classification is governed by Section 257 HGB, Section 147 AO and any applicable special rules; commencement, extensions and exceptions are governed by law.
Where data remain necessary for the establishment, exercise or defence of legal claims, limited retention may continue until the matter is resolved or relevant limitation periods expire. The legal basis is Article 6(1)(f) GDPR. A merely abstract interest in possible future use does not justify unlimited retention.
For newsletters, analytics identifiers, advertising audiences, consent evidence and technical logs, the periods or criteria described for the relevant service apply. Withdrawal ends future processing covered by it. Invoices that must be retained independently by law and a limited advertising suppression record may be excluded from deletion where necessary.
Where data must be retained after their operational purpose has ended, further use is restricted to the lawful retention purpose. Deletion and restriction must also be reflected by processors and internal copies. Backups are handled in accordance with the defined backup and recovery concept.
16. Your data protection rights
Subject to the statutory requirements, you have the right to obtain information about your personal data and the related processing and to receive a copy of those data (Article 15 GDPR). You may have inaccurate data rectified and incomplete data completed (Article 16 GDPR).
You may request erasure, for example where the data are no longer needed or the processing is unlawful (Article 17 GDPR). This right is not absolute; statutory retention obligations or necessary legal defence may prevent erasure. Under the conditions of Article 18 GDPR, you may instead request restriction of processing.
Where you have provided data to us and automated processing is based on your consent or a contract, Article 20 GDPR gives you the right to receive those data in a structured, commonly used and machine-readable format and, where technically feasible, to have them transmitted to another controller.
You may withdraw consent at any time for the future. This does not affect the lawfulness of processing carried out before withdrawal. For practical exercise of your rights, use the settings described in the relevant section or our privacy contact.
Special notice concerning the right to object under Article 21 GDPR
For reasons arising from your particular situation, you may object at any time to processing based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
You may object to processing for direct marketing at any time without giving reasons. This includes related profiling. After such an objection, your data will no longer be used for those marketing purposes.
Complaint and handling of requests
Under Article 77 GDPR, you may lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, place of work or the place of an alleged infringement. For our company, the Hessian Commissioner for Data Protection and Freedom of Information is particularly relevant: https://datenschutz.hessen.de/. You do not have to contact us first.
We generally respond to requests within one month. Where legally permitted, this period may be extended by up to two further months; we will inform you of such an extension and the reasons within the first month. Where there are justified doubts concerning identity, we may request additional information necessary for verification. Exercising data-protection rights is generally free of charge, subject to statutory exceptions.
17. Profiling and automated decisions
Consent-based assignment of product interests or formation of marketing segments may constitute profiling. The data used, purposes and withdrawal options are described in the relevant marketing sections. Automated evaluation alone is not necessarily a decision within the meaning of Article 22 GDPR.
Under Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, subject to the statutory conditions. Where a statutory exception applies, the safeguards provided by law apply, which may include the right to obtain human intervention, express your point of view and contest the decision.
Consent to audience measurement, newsletters or personalised advertising is not blanket consent to legally significant automated decisions. Independent identity, fraud or credit assessments carried out by a selected payment provider are additionally subject to that provider's separate information on logic, significance, consequences and rights. Your rights regarding processing for which we are responsible remain unaffected.
18. Data security and changes
We implement risk-appropriate technical and organisational measures to protect personal data. These include appropriate access controls, secure transmission methods and procedures designed to maintain confidentiality, integrity and availability. Measures are adapted to the actual risks.
If our processing activities change, we update this information. Required information about new purposes will be provided before the relevant further processing. Updating this Privacy Policy does not replace any new consent that may be required.