Privacy policy

Updated: 16 September 2026.

Controller

The controller responsible for personal data processed through this shop is Pinclair, operated by Talha Rasitoglu, Schulstraße 20, 78098 Triberg, Germany. Email: info@pinclair.de. Order support: support@pinclair.de. No data protection officer has been appointed.

Scope and legal bases

This privacy policy covers the Pinclair online shop at pinclair.de, orders, digital delivery, support enquiries, and the associated shop, payment, security and accounting processes. We process personal data where needed to operate the shop, handle orders, supply digital products, provide support, process payments, comply with legal obligations or pursue legitimate interests.

The principal legal bases are Article 6(1)(b) GDPR for a contract and steps requested before a contract, Article 6(1)(c) GDPR for legal obligations, Article 6(1)(f) GDPR for legitimate interests, and Article 6(1)(a) GDPR for consent.

Visiting the shop

Technical data may include your IP address, access date and time, browser and device information, pages visited, referring URL, language preferences, cart and checkout events, session information, error records and security logs. These data help us provide pages, products, cart and checkout functions, identify errors, maintain security, prevent abuse and keep the shop stable. The legal basis is Article 6(1)(f) GDPR and, where necessary for an order, cart or checkout, Article 6(1)(b) GDPR.

Shopify operates the shop infrastructure. Its services may include technical shop functions, Shopify Analytics, web pixels or similar shop events, security and bot protection, checkout, hosting and content delivery.

Cookies and consent

We use necessary cookies and similar technologies for the shop, cart, checkout, language preferences, security, fraud prevention, payments and functions you expressly request. The legal bases are Article 6(1)(b) or (f) GDPR and section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Where consent is required, non-essential cookies, analytics, marketing, personalisation and comparable technologies are used only with your consent, under Article 6(1)(a) GDPR and section 25(1) TDDDG. You can change or withdraw your choice in the cookie banner or privacy settings. Shopify's customer privacy functions can communicate consent choices to Shopify-managed features including pixels, audiences and checkout.

We use Google Ads through the Shopify Google & YouTube app to advertise our shop and measure which adverts lead to visits, cart actions and purchases. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Measurement is configured for page and product views, searches, additions to the cart, checkout starts, the payment-information step and completed purchases. Data may include the visited and referring page, time, IP address, browser and device information, advert-click and cookie identifiers, product identifiers, quantities, order value, currency and a transaction identifier used to avoid counting a transaction twice. The payment-information event identifies a checkout step; it does not mean that full card numbers or other payment secrets are transmitted as conversion data.

Your consent: Non-essential advertising cookies and the associated personal conversion measurement depend on your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You choose marketing and analytics preferences through the Shopify cookie banner. You can order without agreeing to these purposes.

The integration uses Google Consent Mode to adjust tag behaviour according to the consent choice communicated through Shopify. Depending on the technical implementation, declining consent may still permit limited signals without advertising cookies, such as consent status, time, browser and referring page, to be sent to Google for statistical modelling. Declining advertising cookies therefore does not guarantee that no connection to Google takes place. See Google's Consent Mode explanation.

Enhanced conversions, which match hashed customer data, and Customer Match advertising lists are disabled in our Google & YouTube integration.

Retention: Google states a 90-day lifetime for conversion cookies with the prefix _gcl_. You can delete cookies earlier in your browser. Cookie lifetime is separate from Google's further retention, which depends on the data and purpose. See Google's cookie information and retention information.

Recipients and transfers: Google LLC and other Google companies may process data alongside Google Ireland Limited, including in the United States. Google describes safeguards including its EU–US Data Privacy Framework certification and, where required, standard contractual clauses. See Google's data-transfer frameworks, privacy policy and information about partner websites.

You can change or withdraw consent for the future through cookie settings in the footer. This does not affect the lawfulness of earlier processing. If a browser or script blocker prevents the settings dialog from opening, contact info@pinclair.de. Additional Google preferences are available in My Ad Center.

Previous use of DataFast

We stopped using DataFast (JustShipIt Pte. Ltd., Singapore) on 16 September 2026. Browser tracking is disabled and the Shopify app has been uninstalled. The Shopify connection has therefore been disconnected.

Visitor, customer and order data previously transferred may remain with the provider until deletion is complete. Complete deletion by the provider has not yet been confirmed. Information about the previous processing and international transfers is available in the DataFast data processing agreement and DataFast privacy policy. For questions about previous processing or to exercise your data protection rights, please contact info@pinclair.de.

Customer accounts, contact forms and bot protection

When you use a customer account, sign in or use a shop form, we process the necessary information, such as your name, email address, account status, form content, time and technical session data. Article 6(1)(b) GDPR applies to contract-related enquiries and account functions. General enquiries are handled under our legitimate interest in communicating with you, Article 6(1)(f) GDPR.

Shopify forms integrate hCaptcha, provided by Intuition Machines, Inc., USA, to prevent spam and automated abuse. It may process IP addresses, browser and device information, interaction data and security indicators. The legal basis is our legitimate interest in protecting the forms, Article 6(1)(f) GDPR; necessary access to your device is covered by section 25(2)(2) TDDDG. See the hCaptcha privacy policy for processing, retention and transfer information.

Orders and contracts

For an order we process the information needed to receive, review and fulfil it. This includes your name, email address, billing and checkout details, telephone number if provided, country and billing country, order number, product and variant, quantity and price, payment method and status, delivery status, order correspondence and evidence relating to delivery, redemption, payment or support problems.

We use these data to accept or decline orders, check payment and delivery, provide digital products, answer questions, comply with legal obligations, and establish or defend claims. The legal bases are Article 6(1)(b), (c) and (f) GDPR. Country, billing and checkout data may also be used to check the available sales territory, product eligibility, abuse and payment risks. The countries available in checkout determine where we accept orders.

Digital delivery and product data

Depending on the product, we process data needed for digital delivery, access, invitations, code provision, evidence of delivery and support. For gift codes, these include order number, email address, variant, delivery time and status, code or delivery reference and support evidence. Invitations, family plan slots, memberships and subscriptions may require an email address, username or another account identifier that you provide so an invitation or allocation can be sent to your own account.

Account-access products may involve handover information, recipient email address, account identifiers, access information, duration status and support evidence. Do not send unsolicited passwords, seed phrases, private keys, full payment credentials or complete identity documents. Where a product explicitly requires temporary account access, follow the setup instructions and use a temporary password; change the temporary password immediately after setup. A temporary password does not prevent access to account contents during setup.

Where necessary for the particular delivery, recipient email addresses, usernames, account identifiers, product variants or delivery status may be shared with platform, supplier, fulfilment or delivery services. These may be invitation, membership, learning, streaming, community, gaming or gift-card services. For a gift code delivered only to you, we do not share your data with the platform unless necessary for delivery.

Pinclair is an independent retailer and is not an official partner, operator, distributor or representative of Duolingo, Blinkist, Canva, Picsart, Craft, Grammarly, Riot Games/Valorant or other named platforms. Names identify the products. The legal bases for delivery processing are Article 6(1)(b) GDPR, Article 6(1)(c) GDPR for legal obligations and Article 6(1)(f) GDPR for evidence, abuse prevention and defending claims.

Secure account entry for Blinkist, Canva, Picsart and Grammarly

If you choose setup on your existing Blinkist, Canva, Picsart or Grammarly account, we process the account email address and temporary password you provide solely to set up the access you purchased. The legal basis is Article 6(1)(b) GDPR. You enter the details in a separate form. We store them encrypted in our application and make them available only to the responsible person at Pinclair within the relevant Shopify order. For this submission, only a reference number is stored in Shopify’s order data.

The technical service provider is Supabase Pte. Ltd. Our project database is located in Frankfurt. Supabase and its subprocessors may also process data outside the EEA. Processing is subject to Supabase’s data processing terms, which provide for EU standard contractual clauses for applicable international transfers. Further information is available in Supabase’s privacy notice.

After setup is complete, the order is cancelled or it is fully fulfilled, we delete the login details from our application’s active data. Entries without a linked order can no longer be retrieved after 24 hours; details linked to an order can no longer be retrieved more than seven days after entry. A regular deletion process removes expired data. For our internal record, we retain the order link, product identifiers, processing status, timestamps and internal operator identifier for no more than 90 days after deletion, without the account email address or password. The provider’s technical backup and retention periods may differ.

Support

We process information you send with an enquiry, including email address, order number, product, problem description, screenshots, times and payment or delivery information, to handle your request. Do not send sensitive information that is unnecessary. We never ask for seed phrases, private keys or full wallet login credentials. The legal basis is Article 6(1)(b) GDPR for order enquiries and Article 6(1)(f) GDPR for general support, security and evidence.

Payments with PayPal

We offer PayPal as a payment service at checkout. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

When you use PayPal, the order and transaction data needed for payment are processed. These include the order or reference number, amount, currency, name, email address, billing and contact details, product information and payment status. PayPal also collects technical device and connection data and processes information to review payments, prevent fraud and meet its own legal obligations. We receive payment status and transaction information needed to handle your order, refunds and payment disputes.

PayPal also processes data as an independent controller. Details, including international processing and retention, are available in the PayPal privacy statement.

Our legal bases are Article 6(1)(b) GDPR for payments and contract performance, Article 6(1)(c) for statutory retention and documentation, and Article 6(1)(f) for our legitimate interests in fraud prevention and resolving payment disputes.

Order review and fraud prevention

We may review orders before delivery to prevent abuse, fraud, payment problems, mistaken orders, chargebacks, unmet product requirements or legally or technically impossible delivery. Review may consider order data, payment and delivery status, product type, cart, product tags, billing country, correspondence, technical indicators and support information. This is not a solely automated decision under Article 22 GDPR. A decision to stop, decline or cancel an order is made by a person or can receive human review through support. The legal basis is Article 6(1)(f) GDPR.

Service providers and recipients

  • Shopify International Limited / Shopify Inc.: shop operation, hosting, customer accounts, orders, digital provision, customer communication and technical security. Analytics and advertising follow the consent choices and data flows described above. Shopify privacy information.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A.: payments, refunds and payment disputes, as described above.
  • Google Ireland Limited and Google companies: Google Ads and conversion measurement, as described above.
  • Zoho Mail: email communication with you through pinclair.de, including sender and recipient addresses, message content, attachments and technical delivery data. Zoho privacy information.
  • odacer finanzsoftware GmbH (Papierkram): invoicing, bookkeeping and tax documentation using the necessary customer, invoice and payment data. Papierkram privacy information.
  • Intuition Machines, Inc. (hCaptcha): protection of Shopify forms, as described above.
  • Platform and provisioning services needed for your product: only the data required for invitations, setup, delivery or resolving a problem, as described in the digital delivery section.

We disclose data to authorities or courts where required by law or necessary to establish, exercise or defend legal claims, under Article 6(1)(c) or (f) GDPR. Processors may process data only within the agreed scope and under our instructions; independent controllers such as PayPal also fulfil their own purposes and obligations.

International processing

Shopify, Google, Zoho, PayPal and hCaptcha, together with their subprocessors, may process data outside the EEA, particularly in the United States. The provider notices linked in the relevant sections explain recipients, processing countries and transfer arrangements.

Transfers are subject to Articles 44 onwards GDPR. Relevant grounds include an applicable adequacy decision under Article 45 or appropriate safeguards under Article 46, such as EU standard contractual clauses with supplementary protections where necessary. An ordinary data processing agreement alone does not replace these requirements. You can request information or copies of the safeguards applicable to your data at info@pinclair.de.

Retention

We retain personal data only as long as needed for its purpose or a legal retention duty.

  • Technical security, error and abuse evidence is retained as needed for security, diagnosis and fraud prevention. Our own security and fraud notes are normally retained for up to 12 months, unless an order, payment, legal or security case requires longer.
  • Order, contract, payment, delivery and order-related support data are normally retained for performance, statutory rights, evidence and defending claims until the ordinary limitation period expires: generally three years from the end of the calendar year in which a claim arises, unless a longer legal duty applies.
  • Under section 147 of the German Fiscal Code, accounting vouchers, including invoices, are generally retained for eight years, books and annual accounts for ten years, and other records subject to retention for six years. The period generally begins at the end of the calendar year of creation, receipt or the last entry, as applicable. Statutory extensions, such as for an unresolved tax proceeding, may apply.
  • Business correspondence is normally retained for six years where legally required.
  • Consent and withdrawal records are retained as needed to demonstrate the choice, normally for up to three years from the end of the calendar year.

Data are deleted or anonymised when no longer needed unless legal obligations prevent this.

Providing data

You are generally not obliged to provide personal data. Certain information is contractually necessary for an order, payment, digital delivery or support. Without it we may be unable to handle the request, or may be able to do so only to a limited extent.

Your rights

Subject to the GDPR's conditions, you have rights of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests, withdrawal of consent for the future, and complaint to a data protection authority. Contact info@pinclair.de or support@pinclair.de to exercise your rights.

You may complain to a competent supervisory authority, including the authority where you live or where we are established. The version published on this page is the current privacy policy.

Withdrawal declarations

If you send a withdrawal declaration by email or post, we process your contact details, the order reference and the content of your declaration to handle it and document receipt. We use Zoho Mail for email. The legal bases are Article 6(1)(b) and (c) GDPR. The retention periods for contract correspondence and evidence described above apply.

Customer reviews with Judge.me

We use Judge.me, provided by Judge.me Ltd, c/o Buckworths, 2nd Floor, 1–3 Worship Street, London EC2A 2AB, United Kingdom, to collect product reviews, match them to purchases and display them in our shop. Judge.me processes customer and order data on our behalf, in particular names, email addresses, customer and order identifiers, purchased products and fulfilment status, as well as review content, star ratings and technical data such as IP addresses and browser information. Existing order data may also be processed through the Shopify connection.

Published reviews display the review content, star rating, display name and, where applicable, a verified-purchase badge. Email addresses and order numbers are not displayed publicly. Our legal basis is our legitimate interest in traceable product reviews and preventing abuse (Article 6(1)(f) GDPR). You may object under Article 21 GDPR and contact info@pinclair.de for access, correction or deletion. We do not send automatic review requests or reminders.

Processing is governed by the Judge.me Data Processing Addendum. According to the provider, data are stored mainly in the United States. The agreement provides for safeguards for international transfers, including EU standard contractual clauses. Reviews are retained as long as needed for display and traceability, subject to statutory retention duties and necessary evidence. See the Judge.me privacy policy for further information about recipients, retention and rights.

Secure digital delivery and retrieval status

When we provide your digital delivery in your customer account, we process the order and customer identifiers, purchased products and variants, payment, review and delivery status, and the codes, links, login details or setup information prepared for that delivery. Delivery contents are stored in encrypted form in our application. They are disclosed only after release by Pinclair and sign-in to the Shopify customer account associated with the order. Authorised people at Pinclair prepare the delivery within the respective order.

When you explicitly open delivery details, we record the time of the first retrieval for each delivered unit. This status helps us deliver your order and answer support requests. It records the disclosure of the details, not whether a message was read or a product was redeemed with its provider. Opening an email or the status overview alone does not count as retrieval. We do not use invisible email-opening pixels for this purpose.

This feature also uses Supabase with the Frankfurt database and the transfer arrangements described above. Processing serves performance of the contract and handling of support requests. We retain delivery contents and retrieval data for as long as needed for delivery, repeat retrieval, support or the clarification of claims. Contents that are no longer needed are deleted; legally required order and accounting records are kept separately. The earlier deletion of the temporary account details you entered for setup, described above, remains unchanged.