Privacy policy

This Privacy Policy explains how personal information is processed when visiting this website, purchasing digital sewing patterns, contacting the business, or subscribing to the newsletter. It describes the purposes and legal bases for processing, the service providers involved, and the applicable privacy rights.

Shopify is used to operate the online store. The following sections explain processing by Shopify and the additional services used. Any required consent is obtained separately; visiting the website does not constitute consent to optional cookies or analytics.

Controller and contact information

Barbara Roth, trading as BARBARA et Co., is the controller responsible for the business's processing described in this policy.

BARBARA et Co.
Barbara Roth
c/o IP-Management #12433
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany

Email: support@barbaraetco.com
Telephone: +49 177 6810951

Personal information

Personal information is information relating to an identified or identifiable natural person. Examples include a name, email address, order information, and technical identifiers such as an IP address. Identification may be direct or indirect.

Depending on how the store and its features are used, processing includes the following categories:

• Contact information: name, email address, address and billing address, and a telephone number if provided.
• Payment and transaction information: payment method, payment confirmation, amounts and transaction details, and the card or account information required for the selected payment method during payment processing by the services involved.
• Account information: email address, account identifier, information required to sign in, and settings when a customer account is used.
• Order and delivery information: products viewed or placed in the cart, digital content purchased, order history, consent and declaration texts, payment, delivery, withdrawal and refund status, and the associated identifiers and times.
• Communication information: the contents and associated details of contact and support requests.
• Device and usage information: IP address, browser, device and network information, technical identifiers, and information about page views and interactions with the store.
• Newsletter information: email address, language preference, signup, confirmation and unsubscribe status, and the necessary records and times.

Sources of information

Information comes from details provided when placing an order, using a customer account, contacting the business, or signing up for the newsletter. Technical information is also generated when the website and its features are used. The services involved provide additional operation-related information, such as payment confirmations or delivery and unsubscribe events. The conditions described in the analytics and cookie settings section apply to optional cookies and similar technologies.

Purposes of processing

• Orders and digital delivery: entering into contracts, processing payments, supplying sewing-pattern files, managing orders and customer accounts, and handling withdrawals, refunds and delivery problems. The file delivery section explains the applicable legal bases and delivery records.
• Contact and support: handling requests and communications relating to the store and existing business relationships.
• Newsletters and other email marketing: operating the selected newsletter subscription and separate enabled Shopify marketing messages. The newsletter section explains consent, unsubscribing and the distinction between different messages.
• Analytics and store improvement: evaluating store use and improving content and navigation under the conditions described in the analytics and cookie settings section.
• Security and fraud prevention: authentication, protecting accounts and orders, and detecting, investigating and preventing abusive or unlawful activity.
• Legal obligations and claims: complying with statutory recordkeeping and disclosure duties, responding to lawful requests from authorities, and establishing, exercising or defending legal claims.

Legal bases for contact, security, and legal claims

Requests relating to steps before entering into a contract or to its performance are handled under Article 6(1)(b) GDPR. Other general inquiries are handled under Article 6(1)(f) GDPR; the legitimate interests are responding appropriately to inquiries and conducting business communications.

Necessary processing to secure the store and detect and prevent abuse and fraud relies on Article 6(1)(f) GDPR. The legitimate interests are protecting IT systems, accounts, and orders and operating a secure store. Necessary processing to establish, exercise, or defend legal claims also relies on Article 6(1)(f) GDPR; the legitimate interests are protecting and enforcing the business's rights. These bases apply only where processing is necessary and is not overridden by the interests or fundamental rights and freedoms of the person concerned. Statutory retention or disclosure duties, where applicable, are fulfilled under Article 6(1)(c) GDPR.

File delivery and order records

Sewing-pattern files are supplied through Shopify Digital Products. Shopify Flow processes the order, recipient, payment, status, and declaration information needed to check and control delivery. Necessary processing for contract performance relies on Article 6(1)(b) GDPR; legally required records rely on Article 6(1)(c). Consent to digital delivery is not newsletter consent.

Order confirmation and technical delivery record

Order and contract confirmations are generated through Shopify and include the applicable contract documents as PDF attachments. A technical delivery record is stored with the order to control and document digital delivery. It includes order and operation identifiers, information about the document versions used, the time and reference of the order-confirmation dispatch event, and technical verification values. This information helps trace the delivery process, prevent duplicate deliveries and resolve delivery problems. The order, recipient, status, and declaration information needed for these checks is processed within Shopify services.

The technical delivery record is stored with the order and is separate from the time-limited execution log in Shopify Flow. Its retention follows the purpose-specific criteria in the retention section and any statutory duties applicable to the relevant record. Deletion of a Flow execution log after 14 days does not mean that this record stored with the order is also deleted.

Newsletter with EmailOctopus

The newsletter covers sewing patterns, news from the studio and Journal, and offers. Signup takes place through the Shopify newsletter form using double opt-in. The subscription becomes active only after the new signup email is confirmed. An email address is required; processing also includes language preference, signup, confirmation and unsubscribe status, and the related times and records. The one-time 5% welcome email is part of the configured newsletter offer. Placing an order does not replace newsletter signup.

Newsletters are sent through EmailOctopus, a service provided by Three Hearts Digital Ltd, 86–90 Paul Street, Shoreditch, London EC2A 4NE, United Kingdom. Shopify provides the form and confirmation process; EmailOctopus manages the mailing list used for delivery and sends the separate German and English newsletters. EmailOctopus acts as our processor for the contact lists processed on our instructions. Information appears in the Data Processing Schedule in its Terms of Use and EmailOctopus privacy notice.

Synchronization between Shopify and EmailOctopus uses Shopify Flow and the Workflow Transactional Email and Workflow Webhooks apps from Code Creation Labs GmbH. Processing includes email address, language, contact, list and event identifiers, status information, and the times needed for the relevant operation. The unsubscribe return channel may also receive contact fields included in an event; internal routing limits further processing to the fields needed to match and check the status. The apps support transmission and records of the operation rather than independent use of recipient addresses for their own newsletters. Code Creation Labs acts as a processor for the payloads transmitted on our instructions. Under the existing processing agreements, its own app infrastructure is hosted in Belgium; this does not make the entire service chain exclusively EU-based. Further details about the HTTP service appear in the Workflow Transactional Email privacy notice; the EmailOctopus subprocessor list describes its further service providers.

Newsletter delivery relies on Article 6(1)(a) GDPR; Section 7 UWG also applies to email advertising. Technical processing supports the selected newsletter subscription. Necessary consent records and honoring an unsubscribe request must be distinguished according to their purposes. Consent can be withdrawn at any time through the unsubscribe link or by contacting support@barbaraetco.com. Unsubscribe status is synchronized between EmailOctopus and Shopify. Necessary contract emails and file delivery are separate.

Measurement settings and individual links

Open statistics, ordinary click analytics, and additional Google Analytics link tracking are disabled for the configured EmailOctopus welcome automation. Individual confirmation and unsubscribe links remain necessary to match the relevant signup or unsubscribe request. Delivery and unsubscribe events are processed to operate the service.

The newsletters contain a provider credit linking to EmailOctopus. This link contains identifiers associated with the particular message and recipient contact. Clicking the link transmits these identifiers to EmailOctopus. Disabling ordinary open and click analytics therefore does not mean that all newsletter links are free of individual identifiers. The provider credit is part of the free sending plan. The provider credit leads to the EmailOctopus website. EmailOctopus is independently responsible for processing visitor data on its own website. This may include the IP address and, depending on the selected cookie preferences, cookie information. Further information appears in the EmailOctopus privacy notice.

Retention and international processing

Contact information is processed for the active newsletter subscription. Necessary consent records and unsubscribe status are retained for their specific purposes: documenting consent and preventing unwanted delivery after an unsubscribe request. Information must be deleted or anonymized when its purpose ends and no other lawful retention basis remains. Unsubscribing therefore does not mean that every record is immediately erased.

The existing processing agreements with Code Creation Labs specify a maximum of 30 days for technical operation histories and operational logs processed through its services. For encrypted database backups of Workflow Transactional Email, the provider also specifies a rotation period of no more than 14 days. This backup period is not a general deadline for Workflow Webhooks or other services. Neither period applies indiscriminately to the Shopify customer profile, the EmailOctopus mailing list, consent records, contract documents, or mailboxes. The purpose-based deletion criteria and the provider's Data Processing Schedule apply to the mailing list and content held by EmailOctopus.

The newsletter service EmailOctopus is provided by Three Hearts Digital Ltd in the United Kingdom. Its subprocessor list and Data Processing Schedule identify storage and delivery services in the EEA as well as other processing and access involving the United States. Primary storage in Ireland therefore does not mean exclusively European processing. The specific transfer arrangements and sources of safeguards are explained in the International transfers section.

Other messages

These details concern newsletters sent through EmailOctopus. Separate Shopify marketing messages, including an abandoned-checkout reminder, are outside this welcome automation. Their measurement settings are not changed by disabling EmailOctopus measurement. Order, contract, and download emails are also separate.

Shopify Analytics and cookie settings

Shopify Analytics is used to evaluate store use and improve content and navigation. The provider for the German business is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland. Depending on the feature and privacy choices, processing may include page views and interactions, visit times and duration, traffic sources, browser and device information, IP addresses, and cookie or session identifiers. Reports can group visits by country, region and city. These are approximate location assignments and do not reveal a precise address.

Optional analytics cookies and similar access to a device require prior consent under Section 25(1) of Germany's TDDDG. Where BARBARA et Co. initiates consent-based analytics processing, the legal basis is Article 6(1)(a) GDPR. Shopify's privacy settings manage this choice. Optional purposes can be declined and choices can be changed at any time through “Cookie Settings” in the footer. Withdrawal applies to future processing and does not affect the lawfulness of processing before withdrawal. Declining optional analytics does not prevent a purchase.

Necessary store functions and order processing are separate from optional visitor analytics. Shopify also provides reports based on transaction information needed to fulfill contracts and legal obligations; these do not depend on consent to optional analytics cookies. The applicable legal bases are Article 6(1)(b) and (c) GDPR. Shopify Network Intelligence and Shopify's own processing are explained in the Shopify section.

Cookie duration depends on the function. Shopify currently lists a rolling 30-minute duration for the session cookie _shopify_s and up to one year for _shopify_y and _shopify_analytics. These are cookie lifetimes, not a blanket retention period for all analytics records. Details and current durations appear in Shopify's Cookie Policy. Shopify's processing and international-transfer safeguards are described in its Data Processing Addendum and Consumer Privacy Policy.

Instagram and Instafeed

The embedded Instagram feed and its external content load only after explicit consent to the Marketing category in Cookie Settings. Without that permission, the external embed remains blocked; the static preview images are served by the store. Processing initiated by BARBARA et Co. when loading the feed relies on Article 6(1)(a) GDPR. Consent can be withdrawn at any time by disabling Marketing through Cookie Settings in the footer. The feed is then removed and the page reloads. Withdrawal applies going forward and does not affect the lawfulness of processing before withdrawal.

The Instagram feed uses Instafeed by Mintt Studio. Loading the feed and its images involves transmitting technical connection information, including the IP address, to the service's infrastructure; image requests may also reach Instagram. Mintt Studio states that Instafeed does not place cookies. The separate Instafeed analytics upgrade is not enabled in this store. Further information appears in the privacy notices of Mintt Studio and Instagram. A newsletter subscription is separate from cookie consent and can be withdrawn through the unsubscribe link in each newsletter.

Recipients and service providers

Personal information is transmitted to the services involved in the relevant operation. These include Shopify and its service providers for store operations, payment processing, data storage, orders and digital delivery. The newsletter uses EmailOctopus and the Code Creation Labs apps identified in the newsletter section. The Instagram feed uses Instafeed by Mintt Studio.

The following sections distinguish processing on behalf of BARBARA et Co. from processing for which the provider is independently responsible. Information about international transfers and retention applies to the specified service and category of records.

Disclosure may also be necessary at the express request or with the consent of the person concerned, to comply with legal obligations, to respond to lawful requests from authorities, or to establish and defend legal claims.

Shopify

Shopify provides the store's technical platform and hosting. Shopify processes personal information about access to and use of the store and the order and account information submitted. Additional Shopify service providers may be involved in providing and improving the services; processing outside the country where the person concerned resides is possible.

The store also uses enhanced Shopify features, including Shopify Network Intelligence. These can incorporate information from interactions with this store, other merchants and Shopify to protect, improve and develop the business and services. In this context, Shopify may combine information from different interactions and use it for related personalized features. Shopify is independently responsible for this processing and handles privacy requests concerning it.

Further information appears in the Shopify Consumer Privacy Policy. The Shopify Privacy Portal provides a way to exercise applicable rights with Shopify. The separate rights section explains privacy rights relating to BARBARA et Co.

Third-party websites and links

The website may contain links to external websites and online platforms. Each provider's privacy information applies to its own processing. Including a link does not mean adopting the external content or processing practices. Information published on public or semipublic platforms may also be visible to and used by other people. The EmailOctopus section provides additional information about the provider link in the newsletter.

International transfers

Primary storage in the EU does not exclude processing outside the European Economic Area (EEA). The services used rely on the following transfer arrangements:

• Shopify: Transfers from the EEA to Shopify group companies outside the EEA and Switzerland are covered by Shopify's Binding Corporate Rules. For transfers to other service providers in countries without an adequate level of protection, Shopify specifies the EU Standard Contractual Clauses. The safeguards are available in Appendix C, section 8 of the Data Processing Addendum, the Binding Corporate Rules, and Shopify's overall privacy policy. The overall privacy policy also explains transfers when Shopify acts as an independent controller.
• EmailOctopus: Transfers to Three Hearts Digital Ltd in the United Kingdom rely on the current European Commission adequacy decision for the United Kingdom. For onward transfers, the subprocessor list specifies UK adequacy rules for EEA processing by AWS and Bird, the IDTA or UK Addendum for certain further AWS/Bird processing, UK-approved Standard Contractual Clauses for Gravatar, and the UK-US Data Bridge supported by the UK Addendum for Cloudflare and Twilio SendGrid. The list identifies each service's processing, location, and mechanism; not every service processes data for every operation. Details appear in Schedule 2, section 7 of the Terms of Use.
• Code Creation Labs: Under the agreed processing contracts, its own infrastructure for Workflow Transactional Email and Workflow Webhooks operates in Belgium, within the EEA. Onward transmission to Shopify or EmailOctopus is separate and is subject to the transfer arrangements described above.
• Mintt Studio / Instafeed: The subprocessor list identifies EU hosting and global services, including Cloudflare and Meta/Instagram. For transfers to countries without an adequacy decision, section 11 of the Data Processing Addendum provides for the current EU or UK Standard Contractual Clauses as the default, unless another lawful transfer arrangement has been agreed.

The linked documents explain the relevant safeguards. Information and a copy of the safeguards applicable to the processing concerned can also be requested at support@barbaraetco.com.

Retention and deletion

Retention depends on the purpose of processing. Relevant factors include the need to manage accounts, perform contracts and provide support, comply with legal retention obligations, resolve disputes and enforce claims. Information must be deleted or anonymized when its purpose ends and no other lawful retention basis remains. The service-specific details in the newsletter and delivery sections supplement these criteria.

Information security

Technical and organizational safeguards are used to protect personal information. Absolute security cannot be guaranteed, and transmission may involve risks. Sign-in information must be kept confidential. Appropriate secure communication methods should be used for sensitive or confidential information.

Privacy rights

Subject to the applicable legal conditions, rights include access, correction, deletion, restriction of processing and data portability.

Where processing is based on consent, that consent may be withdrawn at any time for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Where processing relies on legitimate interests, there is a right to object on grounds relating to the person's particular situation, subject to the applicable legal conditions.

There is a right to object at any time to the processing of personal information for direct marketing.

Requests to exercise these rights may be sent to support@barbaraetco.com. There is also a right to complain to a data protection supervisory authority. The European Data Protection Board's website lists the European supervisory authorities.

Exercising privacy rights does not result in discrimination. Identity verification may be required where permitted or required by law. Requests through an authorized agent are possible under applicable law; authorization and, where necessary, identity must be verified. Requests are handled within the applicable statutory deadlines.

Unsubscribing from promotional emails does not affect necessary, nonpromotional messages about a customer account or order. The newsletter section explains withdrawal of newsletter consent.

Additional rights under local law and Shopify requests

Additional mandatory privacy rights under applicable local law remain unaffected. These may include specific rights concerning targeted advertising or certain disclosures of information and a review of a decision refusing a request. Related requests may also be sent to the contact address above. The GDPR rights described above are not generally restricted to people living in the EEA or the United Kingdom. The Shopify Privacy Portal is also available for processing for which Shopify is independently responsible.

Children's information

The services are not directed to children. Personal information is not knowingly collected from children below the age of majority applicable where they live. Parents or legal guardians may use the contact details above to request deletion if a child has nevertheless provided personal information. As of the stated policy date, there is no actual knowledge of a “sale” or “sharing” of personal information of people under 16 within the meaning of those terms under applicable law.

Changes to this Privacy Policy

Changes to processing practices, services or legal requirements may require updates to this Privacy Policy. The revised policy is made available on the website with an updated policy date. A separate notice is provided where required by law.