Privacy Policy of Musik Ebert GmbH

As of: 19.10.2026

This privacy policy explains how personal data is processed when you visit our online shop, place orders, receive our newsletter, request availability notifications or contact us.

1. Controller and data protection contact

Musik Ebert GmbH
Hussenstraße 45–49
78462 Konstanz, Deutschland
Email: info@musik-ebert.de
Telephone: +49 7531 13600

You can use these contact details for data protection enquiries and to exercise your rights.

2. Shopify and technical access data

Our online shop is operated using Shopify. The provider is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Irland.

When you visit the shop, the data processed includes, in particular, your IP address, the time of the request, the page accessed, the referring page, browser and operating system details, and technical transmission and status information. This serves to provide the shop, resolve errors and ensure security. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the reliable and secure operation of the shop.

Shopify generally processes customer data transmitted for the provision of the shop on our behalf. Technical access data is retained in accordance with the deletion rules applicable to the respective Shopify service. The relevant criteria are the provision and security of the service, the handling of technical faults and security incidents, statutory retention obligations, and the establishment or defence of legal claims. Information on this is provided in the Shopify Data Processing Addendum and the Shopify Consumer Privacy Policy.

Shopify Network Intelligence: This feature is enabled in our shop. Shopify processes data about your visits and purchases, in particular usage, device, identifier and transaction data, together with data from your interactions with other Shopify merchants and Shopify. This serves to provide and improve enhanced analytics, personalisation and advertising services for us and other merchants. Shopify acts as an independent controller for this processing.

Optional analytics, personalisation and advertising are based on your consent under Article 6(1)(a) GDPR; section 25(1) of the German TDDDG also applies to the corresponding storage of or access to information on your device. You can change your choices through our cookie settings. Information on Shopify's processing, retention and your rights can be found in the Shopify Consumer Privacy Policy. You can also exercise your data protection rights in relation to Shopify through the Shopify privacy portal.

Data is also transferred to other service providers and to other countries. The recipient countries and the legal bases for transfers are described in section 12.

3. Orders and customer administration

To process orders, we process, in particular, your name, billing and delivery addresses, contact details, the items ordered, order and transaction identifiers, amounts, and payment and delivery status. This information is stored in our customer records in Shopify. The legal basis for order processing and customer service relating to a contract is Article 6(1)(b) GDPR; the legal basis for statutory retention obligations is Article 6(1)(c) GDPR.

Information marked as required during the ordering process is needed to enter into or perform the contract. Without this information, we may be unable to process the order. Retention is governed by section 13.

4. Payment processing

Depending on the payment method selected, we transmit the necessary order, contact, transaction and payment data to the respective payment service provider. The legal basis is Article 6(1)(b) GDPR. Payment providers also process data as independent controllers to meet their own statutory obligations, conduct security checks and, where applicable, make creditworthiness decisions.

• Shopify Payments and Stripe: Payments are processed by Shopify and the payment processors involved, in particular Stripe Payments Europe, Limited, Ireland. Depending on the payment methods offered, you may use a credit card, Shop Pay, Apple Pay or Google Pay. For wallet payments, the selected wallet provider also processes data to authorise the payment. Further information: Shopify Payments and Stripe Privacy Policy.
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxemburg. Further information: PayPal Privacy Policy.
• Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Schweden. Klarna payment methods may involve identity, fraud and creditworthiness checks. The availability of a payment method may depend on the outcome. Information on data sources, storage and automated decisions: Klarna Privacy Policy.
• Payment in advance: To match a bank transfer to an order, we process the information provided by our bank, in particular the name, account information, amount and payment reference.
• TWINT: Payment and transaction data is processed by the payment processor integrated into the payment process, TWINT AG, Switzerland, and the issuing bank or payment company for your TWINT app. Further information: TWINT Privacy Policy.

The payment providers process the payment details entered with them. We receive the information required for processing, matching payments, refunds and accounting. The periods and criteria set out in the linked provider information apply to further retention by those providers as independent controllers.

5. Shipping and logistics

For delivery, we share your name and delivery address, together with the necessary delivery information, with shipping companies. A telephone number may be required to arrange delivery by a freight carrier. The legal basis is Article 6(1)(b) GDPR.

We use DHL, Swiss Post, and the freight carriers Noerpel and Lebert. Where applicable, we deliver larger instruments using our own logistics. We may send you shipment information by email. We obtain your consent, where required, before sharing your contact details with shipping companies for optional delivery notifications.

6. Cookies and your consent choices

We use cookies and similar technologies for essential shop functions and, with your consent, for optional functions, statistics and marketing. Section 25(1) TDDDG applies to optional storage of or access to information on your device. Operations that are strictly necessary for a digital service you have expressly requested are based on section 25(2) no. 2 TDDDG. The legal basis for each instance of personal data processing is stated under the individual services.

To manage consent, we use TinyCookie from Tobi AI Ltd, 93 Fernside Road, Poole, BH15 2JQ, Vereinigtes Königreich. This involves storing your consent choices and the necessary technical timing and status information. The legal bases are section 25(2) no. 2 TDDDG and Article 6(1)(c) in conjunction with Article 7 GDPR. Further information: TinyCookie Privacy Policy.

You can decline optional processing and change or withdraw your choices at any time using the link in the footer or here: cookie settings. Your consent is voluntary and is not a condition of making a purchase. The unsubscribe options in section 9 apply to newsletters and availability notifications.

An overview of cookies, their purposes and their lifetimes is provided in section 17.

7. Web analytics

7.1 Google Analytics and Analyzify

We use Google Analytics 4 (GA4) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland, to analyse the use of our shop and improve our offering. The data processed includes, in particular, page and product views, cart, checkout and purchase events, product and transaction identifiers, purchase values, browser and device information, and cookie, client and session identifiers.

The integration is provided through Analyzify from Solverhood OÜ, Pärnu mnt 12, Tallinn, Estland, with its US partner company StatsUp, LLC, 30 North Gould Street, STE R, Sheridan, WY 82801, USA. Analyzify processes data as part of its services on the basis of the Analyzify Data Processing Agreement. This may involve processing in the USA.

The legal bases are your consent under Article 6(1)(a) GDPR and, for the corresponding storage and access operations, section 25(1) TDDDG. Further information: Google Privacy Policy, Google Data Processing Terms and Analyzify Privacy Policy.

7.2 Additional comparative analytics

Once enabled, we also use an analytics route that we manage ourselves to compare the data quality, event coverage and reliability of our web analytics with the existing tracking. The data is analysed in a separate GA4 measurement destination. For this purpose, events from the Shopify shop are transmitted to GA4 through a server-side Google Tag Manager service on Google Cloud Run in Frankfurt am Main.

The data processed comprises pseudonymous client and session identifiers, event types and timestamps, consent information, page and product context, and product, cart, checkout and order events, including transaction identifiers, quantities, prices, currencies, discounts, and shipping and tax amounts. IP addresses are processed as part of the network connections.

The comparative analytics serves statistical purposes. The legal bases are your consent to statistics under Article 6(1)(a) GDPR and section 25(1) TDDDG. The cloud infrastructure provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Irland. The Google Cloud Data Processing Addendum applies.

7.3 IP addresses and retention

According to Google, IP addresses for GA4 traffic from the EU, Switzerland and the United Kingdom are used to derive approximate location information and are discarded before logging. The identifiers and event data used can allow recognition or attribution and constitute personal data.

In the existing GA4 properties and the additional measurement destination, the retention period is two months for event data and 14 months for user data, including key event data. Age, gender and interest data is retained for two months. New activity resets the retention period for the user identifier. Deletion takes place in GA4's monthly deletion cycle. These settings apply to the detailed data and reports they cover; aggregated standard reports and separate exports are not subject to these periods. Further information: Google Analytics data retention.

Technical operational and security logs for the additional service are used to resolve errors and secure its operation. The legal basis is Article 6(1)(f) GDPR. The retention period in the regular Cloud Logging storage is 30 days; administrative audit and system logs in the separate mandatory storage are retained for 400 days.

7.4 BigQuery analysis

Data from the existing GA4 tracking is exported to Google BigQuery in the EU storage region. We use it to analyse shop usage, purchase events and advertising performance, and to make comparisons over time. The data processed includes, in particular, events, transaction identifiers and pseudonymous user identifiers. The legal basis is your consent under Article 6(1)(a) GDPR, within the scope of the analytics or advertising purposes you have approved.

We retain personal data at a detailed level for this analysis for no more than two years from the date of the respective event. It is then deleted or effectively anonymised. Retention of these exports is independent of the GA4 settings.

8. Advertising and performance measurement

8.1 Google Ads, enhanced conversions and Google signals

We use Google Ads from Google Ireland Limited, whose address is given in section 7.1, to measure the success of our advertising and create audiences for personalised advertising. The data processed includes, in particular, website actions and purchases, purchase values, transaction identifiers, IP addresses, browser and device details, and click and cookie identifiers.

For enhanced conversions, data provided in connection with an order, in particular an email address and, where applicable, a telephone number, name and address, is converted into hash values and transmitted to Google. Google matches these identifiers against existing account information to attribute purchases to advertising interactions. The hash values are pseudonymous and are not anonymous.

In the existing GA4 properties, Google signals is enabled. Analytics data may be linked to information about signed-in Google users if their Google settings permit this. This enables additional and cross-device analysis, as well as use for advertising audiences. Our GA4 data is subject to the retention rules in section 7.3.

The legal bases for advertising-related processing are your corresponding consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw this consent through the cookie settings.

Retention of data transmitted to Google Ads depends on the processing for advertising attribution, measurement and security, and on the applicable Google deletion rules. Further information: Google advertising, Use of data for enhanced conversions and Google data retention.

8.2 Meta Pixel, advanced matching and Conversions API

Through the Shopify app “Facebook & Instagram”, we use the Meta Pixel, advanced matching and the Conversions API from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland. These services are used to measure our Facebook and Instagram advertising, attribute website actions to advertising interactions, create audiences and provide personalised advertising.

Through the pixel and server-side transmission from Shopify to Meta, the data processed includes, in particular, page and product views, cart and purchase events, product and order information, purchase values, IP addresses, browser and device information, and cookie and attribution identifiers. Available customer data such as name, email address, telephone number and location information is used for matching with Meta accounts. Suitable customer identifiers are transmitted in hashed form; Meta can associate them with an account.

The legal bases are your consent to advertising under Article 6(1)(a) GDPR and, for storage of or access to information on your device, section 25(1) TDDDG. You can withdraw your consent through the cookie settings.

We and Meta are joint controllers under Article 26 GDPR for the collection and transmission of event data for jointly determined advertising purposes. We provide the information and the means to give consent on our website. The further allocation of responsibilities is governed by the Controller Addendum. You can exercise your rights against both us and Meta. Meta is independently responsible for further processing for its own purposes.

The relevant criteria for storage by Meta include, in particular, the processing purpose, use of the services, statutory obligations, and the handling of security incidents or legal claims. Further information: Meta Privacy Policy and Meta Business Tools Terms. For transfers to the USA, see section 12.

9. Newsletters and availability notifications

9.1 Newsletters and email marketing

If you subscribe to our newsletter, we process the data you provide to send it through Shopify Email (Shopify Messaging) from Shopify International Limited. Your subscription is confirmed through a link in a confirmation email. The legal basis is your consent under Article 6(1)(a) GDPR.

Performance measurement using personal data: With your consent, we analyse whether you open our newsletters and which links you click. Shopify uses tracking pixels and tagged links for this purpose. The data processed comprises your email address or recipient identifier, the relevant campaign, opening and click events and their timestamps, and technical access data, in particular the IP address. The events can be associated with you as a recipient. The analysis is used to improve our newsletter content and delivery. The legal bases are Article 6(1)(a) GDPR and, where information is stored on or read from your device, section 25(1) TDDDG.

Where we send you email advertising for our own similar goods or services after a purchase, we do so subject to the conditions of section 7(3) of the German Act against Unfair Competition (UWG). The legal basis under data protection law is Article 6(1)(f) GDPR; our legitimate interest is advertising our own relevant offerings. You can object to this direct marketing at any time without incurring any costs other than transmission costs at basic rates.

You can unsubscribe from the newsletter using the unsubscribe link in each marketing email or by sending a message to info@musik-ebert.de. You can also withdraw your consent to performance measurement using personal data by contacting this email address.

Personal data relating to newsletters and analysis is stored for delivery and campaign analysis for the duration of your subscription or consent. If the purpose ceases to apply earlier, or following withdrawal of consent or an objection, the deletion rules in section 13 apply. Necessary records of consent are retained to meet the obligation to demonstrate consent under Article 7(1) GDPR and, where applicable, to defend against claims until the applicable limitation period expires. The relevant legal bases are Article 6(1)(c) or (f) GDPR. Necessary suppression records may remain stored for as long as we conduct email marketing in order to respect your objection.

9.2 One-off back-in-stock notification

You can request a one-off email notification for items that are out of stock. We use our own application for this purpose. A new notification request is activated through a confirmation link that is valid for 48 hours. The notification request does not subscribe you to the newsletter.

We process your email address, the requested product variant and product page, language, market and delivery country, the time of the request and confirmation, and the version of the consent text. If your email address is already associated with an internal customer record in our Shopify shop, the notification request may be linked to it. A pseudonymised IP identifier and sending timestamps are also processed to prevent misuse. Your email address is required for the notification; we cannot send it without this address.

The notification is based on Article 6(1)(a) GDPR. The legal basis for preventing misuse is Article 6(1)(f) GDPR; our interest is preventing unwanted emails and abusive sign-ups. Evidence of consent is based on Article 6(1)(c) in conjunction with Article 7(1) GDPR.

For technical processing and email delivery, we use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxemburg, with the configured processing region of Frankfurt am Main. The AWS Data Processing Addendum applies. The request data is also stored in Shopify.

Retention: Unconfirmed requests are deleted after 48 hours. Confirmed notification requests remain in place until the notification is sent, you withdraw your consent, or no more than twelve months have passed since confirmation. The email address, pseudonymised IP identifier and link to the customer record are then removed from the notification request. Any remaining personal status and timing information is stored for no more than a further 90 days for troubleshooting and necessary evidence of consent, and is then deleted or anonymised. Technical follow-up processing is based on Article 6(1)(f) GDPR; necessary evidence of consent is based on Article 6(1)(c) in conjunction with Article 7(1) GDPR.

You can cancel your notification request using the unsubscribe link in the associated emails or by sending a message to info@musik-ebert.de.

10. Contacting us

When you contact us by email, telephone or contact form, we process your contact details and the content of your enquiry to deal with your request. Article 6(1)(b) GDPR applies to enquiries relating to a contract; Article 6(1)(f) GDPR applies to other enquiries, and our interest is responding to your enquiry. The data is deleted once the enquiry and any necessary follow-up enquiries have been dealt with, unless there is a statutory retention obligation or it is retained to establish or defend legal claims.

11. YouTube

We embed YouTube videos in privacy-enhanced mode. The provider is Google Ireland Limited, whose address is given in section 7.1. When videos are loaded and played, the data transmitted to Google includes, in particular, IP addresses, device information and details of the content accessed. The embedding is based on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Further information: Google Privacy Policy.

12. Recipients and international data transfers

Recipients are the platform, payment, shipping, analytics, advertising and communications service providers named under the individual processing activities, and competent authorities where there is a statutory obligation to disclose data. Depending on the processing involved, the service providers act as processors, independent controllers or joint controllers with us.

We process data in Germany. For the services described, the following additional recipient countries are relevant in particular:

Choosing a European storage region does not rule out access from other countries. Details of additional service-specific recipients and their processing countries can be found, in particular, in the lists provided by Shopify, Google Cloud and AWS, and in the privacy information linked under the respective services.

Transfers to Switzerland and the United Kingdom are based on adequacy decisions of the European Commission under Article 45 GDPR. For Canada, this applies within the scope of the decision for the commercial organisations covered. For appropriately certified US recipients, the EU-U.S. Data Privacy Framework is the relevant basis.

For Shopify, the binding corporate rules specified in the Data Processing Addendum apply to intra-group transfers from the EEA that fall within their scope. Transfers by Google Analytics, Google Cloud, Analyzify and AWS are governed by the respective data processing terms, including the applicable standard contractual clauses under Article 46 GDPR. For Meta, the DPF disclosure and the EU Data Transfer Addendum apply. PayPal uses binding corporate rules for intra-group transfers that fall within their scope.

You can obtain information about the applicable safeguards and a copy of them through our data protection contact in section 1. Section 16 also applies in relation to Swiss data protection law.

13. Retention and deletion

Retention is governed by the periods and criteria stated under the individual processing activities. Order and customer data is stored for the performance of the contract, necessary customer service and statutory retention obligations. Once these purposes have been fulfilled, it is deleted unless it is needed to establish or defend claims until the applicable limitation period expires.

Under section 147 of the German Fiscal Code (AO) and section 257 of the German Commercial Code (HGB), the usual retention periods for records subject to retention obligations are eight years for accounting vouchers such as invoices, ten years for commercial books, inventories and annual financial statements, and six years for commercial and business correspondence. The periods generally begin at the end of the relevant calendar year. Statutory extensions, in particular as a result of tax proceedings, remain unaffected.

If a processing purpose ceases to apply or consent is withdrawn, we delete the personal data concerned unless another legal basis permits further storage. The separate periods for analytics, advertising and notification data are described in the respective sections.

14. Automated procedures and profiling

Shopify supports fraud detection through automated risk indicators for orders. We manually review orders flagged as suspicious; our decision on an order is not made solely by automated means. The legal basis is Article 6(1)(f) GDPR; our interest is preventing fraud.

The creation of advertising audiences described above may constitute profiling and is based on the required consent. For independent creditworthiness or payment decisions made by payment providers, their information linked in section 4 applies.

15. Your rights

Subject to the conditions laid down by law, you have the right of access under Article 15 GDPR, rectification under Article 16 GDPR, erasure under Article 17 GDPR, restriction of processing under Article 18 GDPR, and data portability under Article 20 GDPR.

Withdrawal of consent: You can withdraw your consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Objection: You can object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving a specific reason; this also applies to related profiling. Following an objection to marketing, your data will no longer be processed for these purposes.

Complaint: You can lodge a complaint with a data protection supervisory authority, in particular in the place of your habitual residence, place of work or the alleged infringement. The authority responsible for us is, in particular, the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg: Heilbronner Straße 35, 70191 Stuttgart; postal address: Postfach 10 29 32, 70025 Stuttgart; telephone: +49 711 615541-0; email: poststelle@lfdi.bwl.de; website.

To exercise your rights, you can use our data protection contact in section 1. You can manage your cookie choices through the cookie settings.

16. Additional information for individuals in Switzerland

Where the data processing described is subject to the Swiss Federal Act on Data Protection (DSG), the following additional information applies to the disclosures abroad referred to in section 12.

For disclosures to Germany, Ireland, Luxembourg, Estonia, Sweden and the United Kingdom, there is a level of data protection recognised as adequate by the Swiss Federal Council. For Canada, this recognition applies within the scope of the data protection laws covered. For US recipients, it applies insofar as the processing concerned is covered by Swiss-U.S. Data Privacy Framework certification. Transfers without such an adequate level of protection, in particular to Singapore or to US recipients not covered, are subject to the standard data protection clauses specified in section 12, with the necessary Swiss additions, or to the recognised binding corporate rules mentioned there under Article 16(2) DSG. You can obtain information and copies of the safeguards through our data protection contact.

17. Overview of cookies and similar storage

The following cookies are used depending on the functions you use and your consent. The providers' default lifetimes may be shortened by your browser; cookies may be updated when you use the service again. Their lifetimes in your browser are distinct from the retention of data already transmitted.

TinyCookie and additional comparative analytics

The cookies for the additional comparative analytics are used once this analytics route is enabled.

Other shop and tracking cookies

For payment or video functions, the respective providers may use additional storage technologies. Information on this is provided in the privacy information linked under those services. Information about cookies can also be found in the Shopify Cookie Policy, the Google Analytics cookie information, the Google overview of advertising cookies and the Meta Cookies Policy.

Open cookie settings