Privacy policy

Privacy Policy

This policy explains what personal data we collect when you visit or order from canyonoutlet, why we process it, and what rights you have under the GDPR.

Controller

canyonoutlet
Promenade 555, 46047 Oberhausen, Germany
Email: [email protected]
Phone: +49 208 828 2051

What data we collect

  • Order data: name, delivery and billing address, email address, phone number and the contents of your order.
  • Payment data: processed by our payment provider. We never receive or store full card numbers.
  • Technical data: IP address, browser and device type, and pages viewed — to operate the store, prevent fraud and improve the site.
  • Communications: messages you send us and our replies.

Why we process it

To perform our contract with you and fulfil your order (Art. 6(1)(b) GDPR); to comply with tax, accounting and consumer-law obligations (Art. 6(1)(c)); and for our legitimate interest in securing the store and preventing fraud (Art. 6(1)(f)). Marketing emails are sent only where you have given consent (Art. 6(1)(a)), which you may withdraw at any time.

Who receives your data

Our shop platform (Shopify), our payment provider and our shipping carriers, each only to the extent needed to process and deliver your order. We do not sell personal data. Where a recipient is outside the EEA, transfers are covered by an adequacy decision or standard contractual clauses.

How long we keep it

Order and invoice records are kept for the statutory retention period under German commercial and tax law (up to 10 years). Other personal data is deleted once the purpose for which it was collected no longer applies.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to data portability. You may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority — in Germany, the data protection authority of the federal state in which we are established. To exercise any of these rights, write to [email protected].

Cookies

We use cookies that are strictly necessary for the store to function (cart, checkout, security). Analytics and marketing cookies are set only where you have consented; you can withdraw consent at any time through your browser settings or our cookie preferences.

Changes

We may update this policy to reflect changes in our services or the law. The current version is always available on this page.

Provision of data and automated decision-making

Providing the personal data needed to process an order is required to conclude and perform the contract with us. Without it we cannot accept or deliver your order; there is no statutory obligation on you to provide it, but the contract cannot be performed otherwise. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Supervisory authority

You have the right to lodge a complaint with a supervisory authority. The authority competent for us is: Der Sächsische Datenschutzbeauftragte, Devrientstraße 5, 01067 Dresden, Germany.

Retention of technical data

Server and access logs are deleted after 30 days unless required longer to investigate a specific security incident.