Privacy Policy

Unless otherwise stated below, the provision of your personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide data has no consequences. This only applies insofar as no other indication is made in the following processing operations.
"Personal data" means any information relating to an identified or identifiable natural person.

Your data may be transferred to third countries outside the EU, especially to Canada and the USA, and processed there. There is an adequacy decision by the EU Commission for Canada. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission's standard contractual clauses.

Contact

Controller/Data Protection Officer
Contact us if you wish. The controller for data processing is: Hangar74 GmbH, Am Wildpark 14, 40629 Düsseldorf NRW, info@hangar74.com

You can also reach our data protection officer at: info@hangar74.com

Customer-initiated contact by email
If you initiate business contact with us by email, we collect your personal data (name, email address, message text) only to the extent you provide it. The data processing serves to process and respond to your contact inquiry.
If the contact serves the purpose of carrying out pre-contractual measures (e.g., consultation regarding purchase interest, offer preparation) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time to the processing of personal data concerning you based on Art. 6 para. 1 lit. f GDPR for reasons arising from your particular situation.
We only use your email address to process your inquiry. Your data will then be deleted in compliance with legal retention periods, unless you have consented to further processing and use.

Collection and processing when using the contact form
When using the contact form, we collect your personal data (name, email address, message text) only to the extent you provide it. The data processing serves the purpose of making contact.
If the contact serves the purpose of carrying out pre-contractual measures (e.g., consultation regarding purchase interest, offer preparation) or concerns a contract already concluded between you and us, this data processing is based on Art. 6 para. 1 lit. b GDPR.
If contact is made for other reasons, this data processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in processing and responding to your inquiry. In this case, you have the right to object at any time to the processing of personal data concerning you based on Art. 6 para. 1 lit. f GDPR for reasons arising from your particular situation.
We only use your email address to process your inquiry. Your data will then be deleted in compliance with legal retention periods, unless you have consented to further processing and use.

Use of WeTransfer
We use the WeTransfer service of WeTransfer B.V. (Willem Fenengastraat 19, 1096 BL Amsterdam, Netherlands; “WeTransfer”) to send files up to 2 GB in size at your request.
The use serves the purpose of transmitting large files in high quality. For this purpose, we pass on your email address as well as the file to be transmitted to WeTransfer. WeTransfer generates a download link, which is sent to you and us by email. The data is encrypted during transmission and storage by WeTransfer and can only be accessed via the download link.
Your personal data may be transmitted to WeTransfer servers in the USA and temporarily stored there (partly unencrypted). For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). WeTransfer is not certified under the TADPF. The data transfer is based, among other things, on standard contractual clauses as appropriate safeguards for the protection of personal data, which can be viewed at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_de.
The processing is based on Art. 6 para. 1 lit. a GDPR with your consent, provided you have explicitly agreed to the use of WeTransfer.
You can revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out based on the consent until the revocation.
Further information on data protection when using WeTransfer can be found at: https://wetransfer.com/legal/privacy.

Customer Account      Orders      

Customer account
When opening a customer account, we collect your personal data to the extent specified there. The data processing serves the purpose of improving your shopping experience and simplifying order processing. The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us, without affecting the lawfulness of the processing carried out based on the consent until the revocation. Your customer account will then be deleted.

Your data may be transferred to third countries outside the EU, especially to Canada and the USA, and processed there. There is an adequacy decision by the EU Commission for Canada. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Shopify is not certified under the TADPF. This data transfer is based on contractual obligations comparable to those of the EU Commission's standard contractual clauses.




Shipping service provider      

Passing on the email address to the shipping company to inform about the shipping status
We pass on your email address to the shipping company as part of contract processing, provided you have explicitly consented to this during the ordering process. The transfer serves the purpose of informing you by email about the shipping status. The processing is based on Art. 6 para. 1 lit. a GDPR with your consent. You can revoke your consent at any time by notifying us or the shipping company without affecting the lawfulness of the processing carried out based on the consent until the revocation.

Payment service provider      

Use of PayPal
We use the payment service PayPal from PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of offering you payment via the payment service. By selecting and using payment via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfill the contract with you using the chosen payment method. This processing is based on Art. 6 para. 1 lit. b GDPR.

All PayPal transactions are subject to the PayPal Privacy Policy. You can find it at https://www.paypal.com/de/webapps/mpp/ua/privacy-full

Use of PayPal Express
We use the PayPal Express payment service of PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of offering you payment via the PayPal Express payment service. To integrate this payment service, it is necessary for PayPal to collect, store, and analyze data (e.g., IP address, device type, operating system, browser type, location of your device) when the website is accessed. Cookies may also be used for this purpose. The cookies enable the recognition of your browser.
The processing of your personal data is based on Art. 6 para. 1 lit. f GDPR from our overriding legitimate interest in a customer-oriented offer of various payment methods. You have the right to object at any time to the processing of personal data concerning you for reasons arising from your particular situation.
By selecting and using PayPal Express, the data required for payment processing is transmitted to PayPal in order to fulfill the contract with you using the chosen payment method. This processing is based on Art. 6 para. 1 lit. b GDPR. Further information on data processing when using the PayPal Express payment service can be found in the associated privacy policy at www.paypal.com/de/webapps/mpp/ua/privacy-full?locale.x=de_DE#Updated_PS.

Use of PayPal Check-Out
We use the payment service PayPal Check-Out from PayPal (Europe) S.à.r.l. et Cie, S.C.A. (22-24 Boulevard Royal L-2449, Luxembourg; "PayPal") on our website. The data processing serves the purpose of offering you payment via the payment service. By selecting and using payment via PayPal, credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, the data required for payment processing is transmitted to PayPal in order to fulfill the contract with you using the chosen payment method. This processing is based on Art. 6 para. 1 lit. b GDPR.

Cookies may be stored in this process, enabling the recognition of your browser. The data processing that takes place is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in a customer-oriented offering of various payment methods. You have the right to object at any time to the processing of personal data concerning you for reasons arising from your particular situation.

Credit card via PayPal, direct debit via PayPal & "Pay Later" via PayPal 
For certain payment methods such as credit card via PayPal, direct debit via PayPal, or "Pay Later" via PayPal, PayPal reserves the right to obtain a credit report based on mathematical-statistical methods using credit agencies if necessary. For this purpose, PayPal transmits the personal data required for a credit check to a credit agency and uses the information received about the statistical probability of a payment default for a balanced decision regarding the establishment, execution, or termination of the contractual relationship. The credit report may include probability values (score values) calculated based on scientifically recognized mathematical-statistical methods, which also take address data into account in their calculation. Your legitimate interests are considered in accordance with legal provisions. The data processing serves the purpose of credit checking for contract initiation. The processing is based on Art. 6 para. 1 lit. f GDPR due to our overriding legitimate interest in protection against payment default when PayPal advances payment. 
You have the right to object at any time, for reasons arising from your particular situation, to the processing of personal data concerning you based on Art. 6 para. 1 lit. f GDPR by notifying PayPal. Providing the data is necessary for concluding the contract with the payment method you have chosen. Failure to provide the data will result in the contract not being concluded with the payment method you have selected.

Third parties
When paying via a third-party payment method, the data required for payment processing is transmitted to PayPal. This processing is based on Art. 6 para. 1 lit. b GDPR. For the execution of this payment method, the data may then be passed on by PayPal to the respective provider. This processing is based on Art. 6 para. 1 lit. b GDPR. Local third parties can include, for example:

• Apple Pay (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland)
• Google Pay (Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland)

Invoice purchase via PayPal 
When paying via the payment method invoice purchase, the data required for payment processing is initially transmitted to PayPal. For the execution of this payment method, the data is then transmitted by PayPal to Ratepay GmbH (Franklinstraße 28-29, 10587 Berlin; "Ratepay") in order to fulfill the contract with you using the chosen payment method. This processing is based on Art. 6 para. 1 lit. b GDPR. Ratepay may carry out a credit check based on mathematical-statistical procedures (probability or score values) using credit agencies as described above. The data processing serves the purpose of creditworthiness assessment for contract initiation. The processing is based on Art. 6 para. 1 lit. f GDPR from our overriding legitimate interest in protection against payment default when Ratepay advances payment. Further information on data protection and which credit agencies Ratepay uses can be found at https://www.ratepay.com/legal-payment-dataprivacy/ and https://www.ratepay.com/legal-payment-creditagencies/. 

Further information on data processing when using PayPal can be found in the associated privacy policy at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Analysis      Advertising tracking      

Use of Google Analytics 4
We use the web analytics service Google Analytics from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website.
The data processing serves the purpose of analyzing this website and its visitors as well as for marketing and advertising purposes. For this purpose, Google will use the information obtained on behalf of the operator of this website to evaluate your use of the website, to compile reports about website activities, and to provide other services related to website and internet usage to the website operator. 
The following information may be collected, among others: IP address, date and time of the page visit, click path, information about the browser you use and the device you use, visited pages, referrer URL (website from which you accessed our website), location data, purchase activities. Your data may be linked by Google with other data, such as your search history, your personal accounts, your usage data from other devices, and any other data Google has about you.

Your IP address is first shortened by us on our own servers. Google thus only receives pseudonymized data.

Google uses technologies such as cookies, web storage in the browser, and tracking pixels that enable an analysis of your use of the website. The use of cookies or comparable technologies is carried out with your consent based on § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. 

The processing of your personal data is carried out with your consent based on Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time without affecting the lawfulness of the processing carried out based on the consent until the revocation.

We use the advanced implementation of the consent mode (Advanced Consent Mode). In this case, user data is transmitted to Google in the form of “pings” even if consent is not given. These pings may include, among other things, the following information: IP address to derive the IP country (the IP address is not logged), date and time of the page visit, URL of the visited pages, user agent, referrer URL (website from which our website was accessed), or information about triggering website events such as a conversion. Based on this information, Google models user data to enable comprehensive usage analysis despite the refusal of consent.

The information generated about your use of this website is usually transmitted to and stored on a Google server in the USA. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Google has certified itself under the TADPF and thereby committed to comply with European data protection principles. Both Google and US government authorities have access to your data.

More information about terms of use and privacy can be found at https://policies.google.com/technologies/partner-sites and at https://policies.google.com/privacy?hl=de&gl=de.

Use of Google AdSense
We use the AdSense feature of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google") on our website. The data processing serves the purpose of renting advertising space on the website and targeting visitors of the website with interest-based advertising. Using this feature, personalized, interest-based ads from the Google Display Network are shown to visitors of the provider's website. Google uses cookies that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is usually transmitted to a Google server in the USA and stored there. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Google has been certified according to the TADPF and thus committed to comply with European data protection principles. Google will transfer this information to third parties if required by law or if third parties process this data on behalf of Google. Google will never associate your IP address with other data from Google.
The use of cookies or comparable technologies takes place with your consent based on § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. The processing of your personal data takes place with your consent based on Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent until the revocation.
Further information as well as Google's privacy policy can be found at: https://www.google.com/policies/technologies/ads/ and https://www.google.de/policies/privacy/

Plug-ins and Others

Use of Social Plug-ins
We use social network plug-ins on our website. The integration of social plug-ins and the data processing involved serve the purpose of optimizing advertising for our products.
When integrating social plug-ins, a connection is established between your computer and the servers of the social network providers, and the plug-in is displayed on the page by notifying your browser, provided you have explicitly consented to this. In this process, both your IP address and the information about which of our pages you have visited are transmitted to the provider's servers. This applies regardless of whether you are registered or logged in to the social network. Transmission also occurs for users who are not registered or not logged in. If you are simultaneously connected to one or more of your social network accounts, the collected information can also be assigned to your corresponding profiles. When using the plug-in functions (e.g., by pressing the button), this information is also assigned to your user account. You can prevent this assignment by logging out of your social media accounts before visiting our website and before activating the buttons.
The use of cookies or comparable technologies takes place with your consent based on § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. The processing of your personal data takes place with your consent based on Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent until the revocation.
The social networks named below are integrated on our website via social plug-ins. Further information on the scope and purpose of the collection and use of data, as well as your related rights and options to protect your privacy, can be found in the linked privacy notices of the providers.

Facebook of Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland)
Meta Platforms Ireland and we are jointly responsible for the collection of your data and the transmission of this data to Facebook when the service is integrated. This is based on an agreement between us and Meta Platforms Ireland regarding the joint processing of personal data, which defines the respective responsibilities. The agreement can be accessed at https://www.facebook.com/legal/controller_addendum . According to this, we are particularly responsible for fulfilling the information obligations pursuant to Articles 13, 14 GDPR, for complying with the security requirements of Article 32 GDPR regarding the correct technical implementation and configuration of the service, as well as for complying with the obligations under Articles 33, 34 GDPR, insofar as a breach of the protection of personal data concerns our obligations under the joint processing agreement. Meta Platforms Ireland is responsible for enabling the data subject rights according to Articles 15 - 20 GDPR, complying with the security requirements of Article 32 GDPR regarding the security of the service, and fulfilling the obligations under Articles 33, 34 GDPR, insofar as a breach of the protection of personal data concerns the obligations of Meta Platforms Ireland under the joint processing agreement.
Your data may be transferred to the USA. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). Meta has been certified according to the TADPF and thus committed to comply with European data protection principles.
More information about the collection and use of data by Facebook, about your related rights and options to protect your privacy can be found in the Facebook privacy policy at https://www.facebook.com/about/privacy/.

Use of YouTube
We use the function to embed YouTube videos from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "YouTube") on our website. YouTube is a company affiliated with Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”).
The function displays videos stored on YouTube in an iFrame on the website. The "Enhanced Privacy Mode" option is activated. This means that YouTube does not store any information about the visitors of the website. Only when you watch a video, information about this is transmitted to YouTube and stored there. Your data may be transferred to the USA. For the USA, there is an adequacy decision by the EU Commission, the Trans-Atlantic Data Privacy Framework (TADPF). YouTube has been certified according to the TADPF and thus committed to comply with European data protection principles.
The use of cookies or comparable technologies takes place with your consent based on § 25 para. 1 sentence 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR. The processing of your personal data takes place with your consent based on Art. 6 para. 1 lit. a GDPR. You can revoke your consent at any time without affecting the legality of the processing carried out on the basis of the consent until the revocation.
More information about the collection and use of data by YouTube and Google, about your related rights and options to protect your privacy can be found in the YouTube privacy policy at https://www.youtube.com/t/privacy.

Data subject rights and storage duration

Duration of storage
After complete contract processing, the data will initially be stored for the duration of the warranty period, then stored taking into account statutory retention periods, especially tax and commercial law retention periods, and then deleted after the expiration of the period, unless you have consented to further processing and use.

Rights of the data subject
If the legal requirements are met, you have the following rights according to Art. 15 to 20 GDPR: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability.
In addition, according to Art. 21 para. 1 GDPR, you have the right to object to processing based on Art. 6 para. 1 f GDPR, as well as to processing for the purpose of direct advertising.

Right to complain to the supervisory authority
According to Art. 77 GDPR, you have the right to complain to the supervisory authority if you believe that the processing of your personal data is not lawful.

You can file a complaint, among other places, with the supervisory authority responsible for us, which you can reach at the following contact details:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
P.O. Box 20 04 44
40102 Düsseldorf
Tel.: +49 211 384240
Fax: +49 211 38424999
E-Mail: poststelle@ldi.nrw.de

Right to object
If the personal data processing listed here is based on our legitimate interest according to Art. 6 para. 1 lit. f GDPR, you have the right to object to these processings at any time for reasons arising from your particular situation, with effect for the future.
After an objection has been made, the processing of the affected data will be stopped, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or if the processing serves the assertion, exercise, or defense of legal claims.

last update: 02.10.2025