1. Introduction
Tidywiperbox respects your privacy and handles personal data in accordance with the General Data Protection Regulation (GDPR), applicable German data protection legislation and other relevant European Union requirements.
This Privacy Policy explains how personal data is collected, used, stored and disclosed when you visit www.tidywiperbox.com, place an order, contact customer service or otherwise interact with our online shop.
Personal data is processed only for specified purposes and on an appropriate legal basis. We limit the information collected to what is relevant to the purposes described in this policy.
2. Data Controller and Contact Details
For the purposes of the GDPR, the data controller is:
Data Controller: Tidywiperbox
Address: Höhscheider Weg 29, 42699 Solingen, Germany
Email: secops@tidywiperbox.com
Telephone: +49 2126582800
Website: www.tidywiperbox.com
You may use the contact details above to submit questions about this Privacy Policy, request access to your personal data or exercise your applicable data protection rights.
3. Personal Data We Collect
Depending on how you use our website, we may collect the following categories of personal data:
3.1. Identity and Contact Details
Your name, email address, telephone number, billing address, delivery address and other contact details you provide when placing an order or contacting us.
3.2. Order and Purchase Information
Order numbers, items purchased, quantities, order dates, order values, delivery details, transaction status, refund records and relevant correspondence concerning your purchase.
3.3. Payment Information
Payments are processed by Stripe. Depending on the payment method and transaction, payment-related information may include transaction references, payment status, billing details and limited payment method information.
Payment card details may be collected and processed directly by Stripe through its payment services. We receive the transaction information needed to administer your order and maintain our purchase records.
3.4. Customer Service Communications
Information contained in emails, telephone enquiries and other communications you send to us, including information needed to respond to your request or resolve an order-related matter.
3.5. Website Usage Information
When you visit our website, certain information may be recorded, such as your IP address, browser type, device information, access times, requested pages and relevant website activity. The information collected depends on the website functions you use and the applicable browser and consent settings.
3.6. Cookie and Similar Information
Our website may use cookies and similar technologies to support essential website functions, remember relevant preferences and, where enabled and lawfully permitted, measure website usage. Further details are provided in Section 10.
4. Purposes and Legal Bases for Processing
We process personal data only where a lawful basis applies under Article 6 of the GDPR.
| Purpose | Legal basis |
|---|---|
| Processing purchases, managing orders and arranging delivery | Performance of a contract, Article 6(1)(b) GDPR |
| Processing payments and administering refunds | Performance of a contract, Article 6(1)(b) GDPR; legal obligations where applicable |
| Responding to customer enquiries | Steps taken at your request before a contract, performance of a contract, or legitimate interests, depending on the enquiry |
| Maintaining invoices, accounting records and transaction documentation | Compliance with legal obligations, Article 6(1)(c) GDPR |
| Handling complaints and establishing, exercising or defending legal claims | Legitimate interests, Article 6(1)(f) GDPR, or compliance with legal obligations where applicable |
| Maintaining website functionality and investigating operational issues | Legitimate interests, Article 6(1)(f) GDPR, where appropriate |
| Using non-essential cookies or similar technologies that require permission | Your consent, Article 6(1)(a) GDPR and applicable German law |
| Sending promotional communications, where offered | Consent or another lawful basis where expressly permitted by applicable law |
Where processing relies on legitimate interests, those interests may include administering our business, maintaining purchase records, responding to enquiries and protecting our legal position. We consider the impact on individuals and their applicable rights when relying on this basis.
Where consent is required, you may refuse it or withdraw it at any time. Withdrawal does not affect processing carried out lawfully before withdrawal.
5. Payment Processing Through Stripe
We use Stripe to process payments for purchases made through our website.
When you proceed to payment, relevant information may be transmitted to Stripe, including your name, email address, billing details, transaction amount, order reference and information required for the selected payment method.
Stripe processes personal data to facilitate payments and, depending on its role in the particular activity, may also process information for its own purposes, including compliance with legal requirements and the assessment or prevention of fraudulent transactions.
Depending on the transaction and the applicable arrangements, Stripe may act as our processor or as an independent data controller. Stripe determines its own purposes and obligations for processing activities carried out in its capacity as a controller.
Stripe may share relevant information with banks, payment method providers, service providers and other recipients where necessary for the applicable payment services or legal obligations.
For further information about Stripe’s handling of personal data, please consult its Privacy Centre and applicable privacy notices.
We use payment-related information to administer purchases, confirm transaction status, process refunds where appropriate, maintain accounting records and respond to payment-related enquiries.
6. Disclosure of Personal Data
Personal data may be disclosed to the following categories of recipients where necessary and lawful:
- Stripe and relevant payment service participants: to process transactions and related payment matters.
- Delivery and fulfilment providers: to prepare, dispatch and deliver purchased goods.
- Website hosting and service providers: to operate the website, maintain its functions and provide services on our behalf.
- Accounting, tax and professional advisers: to assist with applicable legal and accounting obligations.
- Public authorities and courts: where disclosure is required by law or necessary in connection with legal proceedings.
Where a service provider processes personal data on our behalf, appropriate contractual arrangements are used where required by law. Recipients may process information only within the scope permitted by the applicable arrangements and legal requirements.
We do not disclose personal data to unrelated parties for their own promotional purposes without an appropriate legal basis.
7. International Data Transfers
Some service providers, including payment service providers, may process personal data outside the European Economic Area (EEA).
Where personal data is transferred to a country outside the EEA, the transfer will be carried out in accordance with the GDPR. Depending on the circumstances, this may involve an applicable European Commission adequacy decision, approved standard contractual clauses or another lawful transfer mechanism.
Information about relevant transfer arrangements may be requested using the contact details in Section 2, subject to applicable legal restrictions.
8. Data Retention Periods
We retain personal data only for as long as necessary for the purposes for which it was collected, taking account of applicable statutory retention periods, contractual requirements and the need to establish, exercise or defend legal claims.
The following periods describe our intended retention schedule, subject to any longer period required by law or necessary for a specific legal matter.
| Data category | Retention period |
|---|---|
| Order, invoice and accounting records subject to statutory retention | Generally 8 years for accounting documents subject to the applicable German statutory period, and up to 10 years for records subject to a 10-year retention requirement |
| Commercial correspondence and business communications subject to statutory retention | Generally 6 years where the applicable German statutory period applies |
| Customer account information, where accounts are offered | For the duration of the account and thereafter for as long as necessary to resolve outstanding matters or meet legal obligations |
| Customer service enquiries | Generally up to 3 years after the enquiry is closed, unless further retention is necessary for a legal claim or statutory obligation |
| Payment transaction records | For the period required for accounting, tax, payment administration and applicable legal claims |
| Website access logs | For the period necessary for operational review, fault investigation and relevant legal purposes, with routine logs generally reviewed for deletion within 30 days |
| Consent records relating to cookies and similar technologies | For as long as needed to demonstrate the applicable consent or refusal and manage consent preferences, with periodic review |
| Marketing consent records, where applicable | Until consent is withdrawn or the relevant purpose ends, while retaining limited evidence where necessary to record the withdrawal or demonstrate compliance |
German statutory retention periods depend on the type of record and the applicable legal provisions. Where a statutory period applies, the relevant records will be retained for that period. Where a record is no longer required, it will be deleted or anonymised in accordance with applicable requirements.
A deletion request does not require us to remove records that must be retained by law or that are still necessary for the establishment, exercise or defence of legal claims.
9. Your Data Protection Rights
Subject to the conditions and limitations set out in applicable law, you may have the following rights under the GDPR:
- Right of access: to obtain confirmation of whether your personal data is being processed and access the relevant information.
- Right to rectification: to request correction of inaccurate or incomplete personal data.
- Right to erasure: to request deletion where the legal requirements are met.
- Right to restriction: to request that processing be restricted in circumstances specified by law.
- Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format, where applicable.
- Right to object: to object to processing based on legitimate interests on grounds relating to your particular situation.
- Right to withdraw consent: to withdraw consent at any time where processing is based on consent.
- Right to lodge a complaint: to complain to the competent data protection supervisory authority.
To exercise your rights, email secops@tidywiperbox.com. We may request information reasonably necessary to verify your identity before acting on a request.
We will respond within the time limits established by applicable data protection law. Where the law permits an extension, we will inform you accordingly.
You may lodge a complaint with the competent supervisory authority, including the relevant authority in Germany where appropriate. For information about German supervisory authorities, visit the Federal Commissioner for Data Protection and Freedom of Information.
10. Cookies and Similar Technologies
Our website may use cookies and similar technologies to support website functions and remember preferences.
Strictly necessary cookies may be used where required to provide a function you have expressly requested or where another applicable legal exception applies. For other cookies or access to information stored on your device, we will seek consent where required under applicable German law, including Section 25 of the TDDDG.
Where consent is required, you may accept or refuse non-essential cookies through the website’s consent controls. You may also change your preferences through those controls where available.
Disabling certain cookies may affect some website functions. Further information about individual cookies, their purposes and their durations should be provided through the website’s cookie information or consent interface.
11. Data Protection Measures
We apply appropriate organisational and technical measures to protect personal data against unauthorised access, unlawful processing, accidental loss and unintended disclosure.
Access to personal data is limited to what is necessary for relevant business functions. Service providers receiving personal data are selected and engaged in accordance with applicable legal requirements.
No method of transmitting or storing information can be described as entirely free from risk. We review our handling practices in light of the nature of the information processed and relevant legal obligations.
12. Children’s Data
Our online shop is intended for individuals who are legally able to enter into purchases under the applicable law. We do not knowingly seek to collect personal data from children where the collection would be unlawful.
Where we become aware that personal data has been collected unlawfully from a child, we will assess the circumstances and take appropriate action in accordance with applicable law.
13. Automated Processing
Payment service providers may use automated systems to assess transactions, identify unusual activity or meet their legal obligations. Such processing may be carried out by Stripe or other relevant payment participants under their respective responsibilities.
Where a decision producing legal effects or similarly significant effects concerning you is based solely on automated processing, the rights and safeguards provided by Article 22 GDPR will apply where its conditions are met.
We do not use this Privacy Policy to claim that every payment-related decision is made solely by automated means.
14. Third-Party Websites
Our website may contain links to websites operated by third parties, including payment service providers. When you visit an external website, that provider’s privacy notice and applicable terms govern its handling of information within its responsibility.
We encourage you to review the relevant privacy information before submitting personal data to an external service.
15. Changes to This Privacy Policy
We may update this Privacy Policy when our data handling practices, website functions or applicable legal requirements change.
The latest version will be published on this page with its updated date. Where required by law, we will provide additional information or seek consent before implementing a change that requires it.
16. Contact
For questions about this Privacy Policy or the handling of your personal data, please contact:
Tidywiperbox
Höhscheider Weg 29
42699 Solingen
Germany
Email: secops@tidywiperbox.com
Telephone: +49 2126582800
Website: www.tidywiperbox.com