Privacy policy

Last updated: 30 October 2026

Thank you for visiting our online shop. This privacy policy explains which personal data we process when you visit our website, shop with us or subscribe to our newsletter, what we use it for and what rights you have. Personal data means any information that relates to you as a person, for example your name, your email address or your IP address.

1. Who we are (controller) and how to contact us

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Infantium Victoria GmbH
represented by its managing director Yuliya (Julia) Gaydina
Hirschanger 2
30559 Hannover
Germany

Phone: +49 511 80600959
Email: info@infantiumvictoria.pro
Commercial register: HRB 211565, Amtsgericht (Local Court) Hannover
VAT ID: DE296563185

We have not appointed a data protection officer, because as a small company we are not legally required to. For any questions about data protection and to exercise your rights, please write to info@infantiumvictoria.pro.

This privacy policy applies to our online shop at https://www.infantiumvictoria.pro in all language versions (English, German, Dutch, Spanish) and to our newsletter.

2. Overview: data, purposes and legal bases

Depending on how you use our services, we mainly process the following data:

• Access and device data (e.g. IP address, browser, time of access), so that the website works and stays secure;
• Order and contract data (e.g. name, billing and delivery address, email address, phone number, items ordered, payment method), to process your order;
• Customer account data, if you choose to create a customer account;
• Newsletter data (email address and, optionally, your child's or children's birth month), if you join the Little Activists club;
• Usage data from cookies and similar technologies for analytics, advertising and partner programmes, and only if you have given your consent;
• Communication data, if you contact us or write a review.

We rely on the following legal bases:

• Art. 6(1)(a) GDPR: your consent (e.g. newsletter, analytics and marketing cookies). Storing information on your device and accessing it is additionally governed by Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act).
• Art. 6(1)(b) GDPR: performance of a contract or steps taken before entering into a contract (e.g. order, payment, shipping, customer account).
• Art. 6(1)(c) GDPR: compliance with legal obligations (e.g. retention under tax and commercial law, proof of consent, handling withdrawals).
• Art. 6(1)(f) GDPR: our legitimate interests (e.g. secure and stable operation of the website, answering general enquiries, keeping a suppression list after you unsubscribe from the newsletter). We name the specific interest in the sections below.
• Section 25(2) no. 2 TDDDG: for cookies and similar technologies that are strictly necessary to run our shop. These do not require consent.

Providing your data is generally voluntary. To place an order, however, we need the information marked as required in the checkout. Without it, we cannot conclude or perform the contract.

3. Visiting our website

3.1 Hosting and shop system (Shopify)

Our online shop runs on the e-commerce platform Shopify. For merchants in the EU, the contracting party is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify provides the technical infrastructure and processes all data generated when you visit and use the shop, including server log files, shopping cart, checkout, orders and customer accounts.

Shopify processes this data as our processor, on our instructions and on the basis of a data processing agreement (Art. 28 GDPR). The data may also be processed by Shopify Inc. in Canada and in the USA. For Canada, there is an adequacy decision of the European Commission (Art. 45 GDPR). Transfers to the USA are based on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Where Shopify processes data for its own purposes, Shopify is itself responsible for that processing, and Shopify's privacy notices apply.

The legal basis is Art. 6(1)(b) GDPR where processing your order is concerned, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and efficient operation of our online shop by a specialised provider.

3.2 Server log files

Each time you access our website, your browser automatically sends information that is stored in so-called server log files. This includes in particular:

• the IP address of the requesting device,
• the date and time of access,
• the page or file accessed and the amount of data transferred,
• the website from which you came to us (referrer URL),
• the browser and operating system used.

This data is technically necessary to display the website to you, to ensure its stability and security, and to detect misuse (e.g. attacks). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest follows from these purposes. The log files are collected by Shopify and stored only for as long as these purposes require.

4. Cookies and consent

4.1 What are cookies?

Cookies are small text files that your browser stores on your device. Similar technologies include, for example, the browser's local storage, pixels and scripts that read information from your device. Below, we use the term "cookies" for all of these technologies. Some cookies are deleted as soon as you close your browser (session cookies). Others remain stored for a set period so that your browser is recognised on your next visit.

4.2 Strictly necessary cookies

Some cookies are strictly necessary to run our shop: they keep your shopping cart, make the checkout work, maintain your session, store your cookie choices and show you the language and currency of your country. These cookies do not require your consent (Section 25(2) no. 2 TDDDG).

The related processing of personal data is based on Art. 6(1)(b) GDPR where it is necessary to provide the shop and process your order, and otherwise on Art. 6(1)(f) GDPR; our legitimate interest lies in a functioning shop. Storing your cookie choices also serves as proof of your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

4.3 Cookies that require your consent

We only use all other cookies and tools if you have consented beforehand (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Our cookie banner groups them into categories:

• Analytics: helps us understand how our shop is used (e.g. Google Analytics, see section 8).
• Marketing: lets us measure the effect of our advertising, show ads in a more targeted way, pay partners for referred orders and send you relevant emails (e.g. Google Ads, Meta, Pinterest, Klaviyo onsite tracking, affiliate partners; see sections 6.5, 8 and 9).
• Preferences: stores settings and choices that go beyond what is technically necessary.

4.4 Changing your choices and withdrawing consent

On your first visit, our cookie banner, a tool provided by Shopify, gives you three options: accept all cookies ("Accept"), decline all non-essential cookies ("Decline") or choose individual categories ("Manage preferences"). Until you consent, only strictly necessary cookies are set.

You can withdraw your consent or change your choices at any time with effect for the future via the "Cookie settings" link in the footer of our website. This does not affect the lawfulness of processing carried out before the withdrawal. You can also delete or block cookies in your browser at any time; in that case, some features of our shop may not be available to you.

5. Shopping with us

5.1 Orders

When you place an order, we process the data we need to conclude and perform the purchase contract: name, billing and delivery address, email address, phone number if provided, items ordered, prices, payment method and order history. We use this data to confirm, fulfil, deliver and invoice your order, to keep you informed about its status and to handle questions, complaints and returns.

The legal basis is Art. 6(1)(b) GDPR. Where we must retain order and invoice data under tax and commercial law, the legal basis is Art. 6(1)(c) GDPR (see section 13).

5.2 Customer account (optional)

You can also order from us without a customer account. If you choose to create a customer account (Shopify customer accounts), we store your email address, your name, your saved addresses and your order history so that you can view your orders and shop faster in future. The legal basis is Art. 6(1)(b) GDPR.

You can have your customer account deleted at any time; a short email to us is enough. Data that we must keep for legal reasons is restricted until the relevant retention period ends and then deleted.

5.3 Payment

To process your payment, we pass the necessary data (e.g. name, address, email address, invoice amount, order number and payment details) to the relevant payment service provider. The legal basis is Art. 6(1)(b) GDPR.

• Shopify Payments: we process card payments (Visa, Mastercard, American Express, Maestro, UnionPay), Apple Pay, Google Pay, Shop Pay, Klarna, Bancontact, iDEAL | Wero, EPS, BLIK, MB WAY, MobilePay, Satispay and Bizum via Shopify Payments. Shopify Payments is operated by Shopify; the payment processor is Stripe Payments Europe Ltd., Dublin, Ireland.
• Klarna: the provider is Klarna Bank AB, Stockholm, Sweden. If you choose a Klarna pay-later method, Klarna may carry out its own identity and credit check under its own responsibility. This may involve an automated individual decision. You can find details, including your rights in this context, in Klarna's privacy notice.
• PayPal: the provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.

For wallet payments (e.g. Apple Pay, Google Pay, Shop Pay) and for payment methods that redirect you to your bank or payment provider, that provider also processes your data. Where payment service providers process data under their own responsibility (e.g. for fraud prevention or to meet legal obligations), their privacy notices also apply.

5.4 Shipping

We ship with DHL (Deutsche Post AG or DHL Paket GmbH, Bonn; express shipments with DHL Express Germany GmbH, Heinrich-Brüning-Str. 5, 53113 Bonn). For delivery, we pass your name and delivery address to DHL. The legal basis is Art. 6(1)(b) GDPR.

We only pass your email address and, if provided, your phone number to DHL so that DHL can notify you about the delivery (e.g. announcing the delivery date, shipment tracking). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in smooth delivery. You can object to this at any time.

5.5 Order and invoice management (Billbee)

To manage orders and create invoices, we use Billbee, a service of Billbee GmbH, Germany. Billbee receives the order and invoice data from our shop for this purpose and processes it as our processor on our behalf. The legal basis is Art. 6(1)(b) and (c) GDPR.

5.6 Withdrawal

So that you can easily withdraw from a purchase online, we use the app "Revoq – EU Withdrawal Button" by BuschBytes, Germany. If you use the withdrawal function, we process your name, email address, order number and the details of your withdrawal in order to handle the withdrawal and confirm its receipt. The legal basis is Art. 6(1)(c) GDPR (compliance with our legal obligations relating to the right of withdrawal).

5.7 Purchases via partner shops and marketplaces

Our products are also offered through partner shops and platforms. For this, we use the wholesale marketplace Faire and the service Syncee, which synchronises stock and orders between our shop and partner shops.

If you buy through a partner shop or marketplace, that partner is the controller for your order and its privacy notice applies. We receive the order and delivery data we need to fulfil the order. The legal basis is Art. 6(1)(b) GDPR or, where we are not ourselves your contracting party, Art. 6(1)(f) GDPR; our legitimate interest lies in fulfilling the order placed through the partner.

The COSH! digital wardrobe receives product information from our shop through an interface (API), but no customer data.

5.8 Tree planting (Ecologi)

Through the Ecologi app (Ecologi, London, United Kingdom), we have a tree planted for every order. For this, the app has technical access to the order data in our shop, including names and contact details. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in carrying out our tree-planting programme. For the United Kingdom, there is an adequacy decision of the European Commission (Art. 45 GDPR).

5.9 Take-back programme

You can send outgrown Infantium Victoria clothes back to us. For this we process your name, address and email address and the details of the items you return, so that we can handle the return and send you your 20% voucher. We repair returned items and resell them in the Preloved section of our shop; no personal data about you is passed on with them. The legal basis is Art. 6(1)(b) GDPR (carrying out the programme you take part in).

6. Newsletter "Little Activists club"

6.1 Signing up with double opt-in

In our newsletter, the Little Activists club, we share club news, introduce new pieces, send you our free pocket books (short guides as PDFs) and make you personal offers, including a welcome code and a gift code in your child's birth month.

You can sign up via a pop-up or via sign-up forms on our website. You can also tick the newsletter box when you order or in your customer account. Only your email address is required. We use the double opt-in procedure: after signing up, you receive an email with a confirmation link. You are only subscribed once you click that link. This ensures that nobody can sign up someone else's email address.

The legal basis for sending the newsletter is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future (see section 6.6).

6.2 What data we store

• your email address (required);
• optionally, the birth month of your child or children, and only the month: no names and no full date of birth. This lets us send you a birthday gift code in the right month;
• the language or language version of the website, the sign-up form used and the time of sign-up;
• your IP address and the time of your confirmation.

We process the birth month on the basis of your consent (Art. 6(1)(a) GDPR). You can change it or have it deleted at any time without having to unsubscribe from the newsletter.

We store the language, form, timestamps and IP address so that we can prove your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR) and defend ourselves against any claims (Art. 6(1)(f) GDPR). We also use the language to send you the newsletter in your language.

6.3 Sending via Klaviyo

We use Klaviyo for the newsletter, a service of Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. Klaviyo stores your newsletter data and sends the emails on our behalf (processing under Art. 28 GDPR). The data is transferred to the USA. Klaviyo is certified under the EU-U.S. Data Privacy Framework; in addition, we have agreed the European Commission's standard contractual clauses.

6.4 Open and click tracking

Our newsletters contain a small tracking pixel and links that let Klaviyo see whether and when you opened an email and which links you clicked. We use this information to send you content that interests you and to stop sending to recipients who have not opened our emails for a long time. This does not involve any automated decision with legal or similarly significant effects (Art. 22 GDPR).

This tracking is part of your consent to receive the newsletter (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can object to it or withdraw your consent at any time by unsubscribing from the newsletter (see section 6.6).

6.5 Onsite tracking by Klaviyo

If you have consented to the "Marketing" cookie category, Klaviyo records on our website which products you view and add to your cart. If you are subscribed to the newsletter, Klaviyo links this information to your newsletter profile. This allows us, for example, to send you a reminder about products you viewed or about a cart you did not complete. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via the "Cookie settings" link in the footer.

6.6 Unsubscribing and suppression list

You can unsubscribe from the newsletter at any time, either via the unsubscribe link in every email or by sending a short message to info@infantiumvictoria.pro.

After you unsubscribe, we keep your email address on a suppression list so that you receive no further newsletters from us. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in respecting your wish permanently. We use the suppression list for this purpose only.

7. Reviews

7.1 Review invitations by email

After a purchase, we may ask you by email to review your purchase. These invitations are sent for us by Loox or Trustpilot. For this, they receive the necessary details, for example your name, email address, order number and the items purchased.

In Germany, review invitations count as advertising. We send them to you as an existing customer under Section 7(3) UWG (Art. 6(1)(f) GDPR). Our legitimate interest lies in receiving feedback on our products and showing other customers genuine experiences. You can object at any time without incurring any costs other than the transmission costs at basic rates; every invitation contains an unsubscribe link.

7.2 Loox

For product reviews on our website, we use Loox, a service of Loox Ltd., Israel. If you submit a review, we publish it on the relevant product page: with your name in the form you provided, your star rating, your text and, if applicable, your photos. The legal basis for publication is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time; we will then remove your review. For Israel, there is an adequacy decision of the European Commission (Art. 45 GDPR).

7.3 Trustpilot

We also use the review platform of Trustpilot A/S, Copenhagen, Denmark. Trustpilot sends review invitations after a purchase (see section 7.1). We also embed Trustpilot widgets on our website that display reviews of our shop. When the widgets load, your browser connects to Trustpilot's servers, and your IP address is transmitted to Trustpilot.

If the widgets are only loaded after your consent, the legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Otherwise, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting customer reviews transparently. For reviews you write directly on the Trustpilot platform, Trustpilot's terms of use and privacy notice also apply.

8. Analytics and advertising

8.1 General

We only use the following services if you have consented to the relevant category via our cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). They help us understand how our shop is used and measure the effect of our advertising. You can withdraw your consent at any time via the "Cookie settings" link in the footer. Some providers also process data in the USA; we point this out for each service. You will find details in section 12.

8.2 Google Analytics 4

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies to record how you use our website, for example which pages you visit, how long you stay, which page brought you to us, which device and browser you use, your approximate location and purchases in the shop. On this basis, Google prepares reports for us on how our shop is used.

We use Google Consent Mode: your choice in the cookie banner is passed to Google so that Google services only set cookies and process data in line with your decision. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Usage data in Google Analytics is deleted automatically after 14 months at the latest. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

8.3 Google Ads and Google Merchant Center

We advertise with Google Ads and use Google's conversion tracking. If you reach us via a Google ad, Google sets a cookie that records whether you then buy from us or complete another defined action. This tells us how well our ads are working.

Through Google Merchant Center, we provide Google with our product data (e.g. items, prices, availability) so that our products can be shown in Google services. Where data about your visit is collected via the Google tag on our website in this context, this only happens with your consent.

The provider in each case is Google Ireland Limited (address see section 8.2). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). For transfers to the USA, see section 8.2.

8.4 Meta Pixel (Facebook and Instagram)

We use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland ("Meta"). The pixel lets us measure how visitors who reach us via an ad on Facebook or Instagram use our shop (e.g. products viewed, purchases), and show our ads in a more targeted way to people who are interested in our products. For this, information about your visit (e.g. IP address, browser and device information, pages viewed and actions in the shop) is transmitted to Meta. If you have a Facebook or Instagram account, Meta may link this information to your account.

We and Meta are joint controllers (Art. 26 GDPR) for collecting the data on our website and transmitting it to Meta. The subsequent processing is the sole responsibility of Meta. You can exercise your rights against both us and Meta. We will provide you with the essence of the joint controller arrangement on request.

Meta may transfer data to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

8.5 Pinterest Tag

We use the Pinterest Tag of Pinterest Europe Limited, Dublin, Ireland ("Pinterest"). The tag records information about your visit and your actions in our shop so that we can measure the effect of our ads on Pinterest and show them in a more targeted way. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Data may be transferred to Pinterest, Inc. in the USA; Pinterest, Inc. is certified under the EU-U.S. Data Privacy Framework.

9. Affiliate and partner programmes

9.1 Purpose and legal basis

We work with partners, such as websites, who link to our shop and receive a commission for referred purchases. So that we can see which partner referred a purchase and pay the commission correctly, a cookie or identifier is stored when you click a partner link. If you then buy from us, data such as the partner's identifier, the time of the click, the order number and the order value is recorded.

We only use these services with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via the "Cookie settings" link in the footer.

9.2 Awin

The provider is Awin AG, Eichhornstraße 3, 10785 Berlin, Germany. Awin may also use technology from its own partners for this purpose; these, too, are only loaded with your consent.

9.3 Everflow

The provider is Everflow Technologies Inc., 530 Showers Drive, Suite 7-302, Mountain View, CA 94040, USA. Data is transferred to the USA in this context. Everflow is certified under the EU-U.S. Data Privacy Framework; in addition, Everflow's data processing agreement provides for the European Commission's standard contractual clauses.

10. Other website features

10.1 Instagram feed

On our website, we use the Instafeed app to show images from our Instagram account. The images are loaded from servers of Instagram or Meta (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). In the process, your IP address is transmitted to Meta, and Meta can learn that you visited our page. For transfers to the USA, see section 8.4.

If the feed is only loaded after your consent, the legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Otherwise, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our products attractively.

10.2 Fonts (Google Fonts)

Klaviyo's newsletter sign-up forms load fonts from Google Fonts, a service of Google Ireland Limited (address see section 8.2). In the process, your browser connects to Google's servers, and your IP address is transmitted to Google. If the fonts are only loaded after your consent, the legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG; otherwise, it is Art. 6(1)(f) GDPR, our legitimate interest being a consistent presentation of the forms.

10.3 Promotion bar (Hextom)

To announce current promotions, we use a promotion bar from the Hextom app. No personal data is processed beyond the technically necessary access data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in informing you about promotions.

10.4 Search, filters and bundles

For search and filters in our shop, we use Shopify Search & Discovery, and for product bundles Shopify Bundles. Both are Shopify features; what you enter (e.g. search terms) is processed by Shopify as part of the hosting (see section 3.1). The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR; our legitimate interest lies in a user-friendly shop.

11. Contacting us

If you contact us by email or phone, we process your details (e.g. name, email address, phone number and your request) in order to answer your enquiry.

If your enquiry relates to a contract or an order, the legal basis is Art. 6(1)(b) GDPR. For other enquiries, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering your request. We delete your enquiry once it has been dealt with, unless statutory retention obligations prevent this (see section 13).

12. Recipients and transfers outside the EU

12.1 Recipients

We only share your data where this is necessary for the purposes described in this policy, where you have consented or where we are legally required to. Recipients are in particular:

• our shop and hosting provider Shopify (section 3.1);
• payment service providers (section 5.3);
• the shipping provider DHL (section 5.4);
• Billbee for order and invoice management (section 5.5) and the Revoq app for withdrawals (section 5.6);
• partner shops and marketplaces, if you buy there (section 5.7);
• Klaviyo for the newsletter (section 6);
• the review services Loox and Trustpilot (section 7);
• providers of analytics and advertising services and affiliate networks, only with your consent (sections 8 and 9);
• our tax adviser or bookkeeper, where necessary to comply with tax and commercial law obligations;
• authorities and courts, where we are legally required to.

We have carefully selected the service providers that process data on our behalf and bound them to our instructions through data processing agreements (Art. 28 GDPR).

12.2 Transfers to third countries

Some recipients are based outside the European Union or the European Economic Area (EEA), or process data there. We only transfer data to such a third country if an adequate level of data protection is ensured there:

• Adequacy decision (Art. 45 GDPR): the European Commission has found that Canada (Shopify), Israel (Loox) and the United Kingdom (Ecologi) ensure an adequate level of data protection.
• USA, EU-U.S. Data Privacy Framework: there is also an adequacy decision for companies in the USA that are certified under the EU-U.S. Data Privacy Framework. To our knowledge, this applies to Klaviyo, Google, Meta, Pinterest and Everflow.
• Standard contractual clauses (Art. 46(2)(c) GDPR): where no adequacy decision applies, we base transfers on the European Commission's standard contractual clauses.

13. How long we keep your data

We only store personal data for as long as is necessary for the relevant purpose or required by statutory retention periods. After that, we delete it. Where we must keep data for legal reasons, we restrict its processing until the retention period ends. In detail:

• Order and invoice data: we keep invoices and accounting records for 8 years (Section 147 of the German Fiscal Code, AO, and Section 257 of the German Commercial Code, HGB, as amended from 2025 by the Fourth Bureaucracy Relief Act), commercial and business letters for 6 years, and books, inventories and annual financial statements for 10 years. These periods start at the end of the calendar year in which the document was created.
• Customer account: until you have the account deleted; the order data it contains is then kept within the statutory periods.
• Newsletter: until you unsubscribe or withdraw your consent. We keep the proof of your consent (section 6.2) for up to 3 years after your consent ends (regular limitation period, Section 195 of the German Civil Code, BGB). We keep your email address on the suppression list for as long as necessary to respect your wish to unsubscribe.
• Enquiries: until your request has been dealt with; where they are commercial or business letters, 6 years.
• Server log files: only briefly, in line with Shopify's settings (see section 3.2).
• Cookies: depending on the category and cookie, until the end of your browser session or until the end of the set lifetime. An overview of the cookies Shopify sets, with their lifetimes, is available at https://www.shopify.com/legal/cookies. You can delete cookies in your browser at any time.
• Usage data in Google Analytics: see section 8.2.

14. Your rights

14.1 Your rights at a glance

You have the following rights with regard to us:

• Access (Art. 15 GDPR): you can find out whether we process data about you and which data.
• Rectification (Art. 16 GDPR): you can have incorrect data corrected and incomplete data completed.
• Erasure (Art. 17 GDPR): you can request that your data be deleted, unless statutory retention obligations prevent this.
• Restriction of processing (Art. 18 GDPR): you can ask us to restrict the processing of your data, e.g. while we check its accuracy.
• Data portability (Art. 20 GDPR): you can receive data you have provided to us on the basis of consent or a contract in a common, machine-readable format, or have it transmitted to another controller.
• Objection (Art. 21 GDPR): see the separate notice in section 14.3.
• Withdrawal of consent (Art. 7(3) GDPR): you can withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
• Complaint to a supervisory authority (Art. 77 GDPR): see section 14.2.

To exercise your rights, simply send an email to info@infantiumvictoria.pro. You can also withdraw cookie consent directly via the "Cookie settings" link in the footer, and unsubscribe from the newsletter via the link in every email.

14.2 Right to lodge a complaint

If you believe that the processing of your data infringes data protection law, you can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz Niedersachsen (State Commissioner for Data Protection of Lower Saxony)
Prinzenstraße 5
30159 Hannover
Germany

You can also contact the supervisory authority in the EU member state where you live or work, or where the alleged infringement took place.

14.3 Right to object under Art. 21 GDPR

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where we process your data for direct marketing, you can object to processing for this purpose at any time, without giving reasons; this also applies to profiling to the extent that it is related to such direct marketing. After you object, we will no longer use your data for direct marketing purposes.

An informal message to info@infantiumvictoria.pro is enough to object.

14.4 No automated decision-making

We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). If you choose a Klarna pay-later method, Klarna may carry out an automated check under its own responsibility (see section 5.3).

15. Children

Our shop is aimed at adults who are shopping for children. We do not knowingly collect personal data from children. The only child-related information we process is the birth month of your child or children, which you as a parent may choose to give for the Little Activists club, without names and without a full date of birth (see section 6.2). If you become aware that a child has sent us personal data, please write to us and we will delete it.

16. Data security

Our website and checkout use TLS encryption (HTTPS). You can recognise an encrypted connection by the address in your browser starting with "https://". We also take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access (Art. 32 GDPR). However, nobody can guarantee completely secure data transmission over the internet.

17. Changes to this privacy policy

We update this privacy policy when our services, the services we use or the legal situation change. The current version on this page always applies; you will find the date of the last change at the top. If a change requires your consent, we will ask for it again.