Our privacy policy

This privacy policy applies to the online offering of Urban Greenery GmbH, accessible under the domain www.urban-greenery.de (including all subdomains) and informs you about the nature, scope and purpose of the collection, processing and use of personal data.

1. Who is responsible and how can I contact you?

Controller (§ 4 No. 7 GDPR):
Urban Greenery GmbH
Lerchenfeld 5–7
91459 Markt Erlbach, Germany
Phone: +49 9106 92990
E-Mail: hallo@urban-greenery.de
Commercial Register: Local Court Fürth, HRB 19755

Data Protection Officer:
Stefan Heidler
IFS Sicherheitstechnik GmbH
An der Leite 16
96193 Wachenroth, Germany
Phone: +49 9548 982027-0
E-Mail: datenschutz@ifs-infoweb.de

2. What is it about?

According to the GDPR, personal data means any information relating to an identified or identifiable natural person. This includes, for example, name, address, e-mail address, IP address and usage behavior. The processing of this data is always carried out on a legal basis and only for specified, explicit purposes. As soon as the respective purpose has been fulfilled and there are no statutory retention obligations, the data are deleted.

3. Who receives my data?

We only transmit your personal data

  • to fulfill our contractual and legal obligations (e.g. payment service providers, shipping service providers),

  • to service providers who support us within the scope of order processing (Art. 28 GDPR),

  • to authorities and courts if we are legally obliged to do so or to defend our rights.

For each processing operation, we explain the specific categories of recipients below.

4. Use of cookies

We use cookies and similar technologies (e.g. local storage). Some are technically necessary, others serve statistical and marketing purposes. You can adjust or withdraw your consent at any time via our consent manager (Consentmo).

Category Purpose Provider & Examples Storage Duration
Necessary Cookies Functionality (cart, login, security) Shopify (_ab, _checkout*, _secure_session_id, …) Session up to 2 years
Preferences Language and settings storage Consentmo (_cookieconsent_status, preferences) 1 day to 1 year
Statistics & Performance Visit counting, page analysis Google Analytics (_ga, _gat, _gid), Shopify (_s, _shopify_sa_t) 30 min to 2 years
Marketing/Retargeting Audience building, ad optimization Meta Pixel (_fbp), Pinterest Tag, AdRoll (__adroll*), LinkedIn ID Up to 1 year

5. Your rights

Under the GDPR you have the right to

  1. Access to your stored data (Art. 15),

  2. Rectification of incorrect data (Art. 16),

  3. Erasure (“right to be forgotten”, Art. 17),

  4. Restriction of processing (Art. 18),

  5. Data portability (Art. 20),

  6. Objection to processing based on legitimate interest (Art. 21),

  7. Withdrawal of consents given (Art. 7 para. 3),

  8. Complaint to a supervisory authority (Art. 77).

To exercise these rights, please contact our data protection officer (see section 1).

6. How are my data processed in detail?

Below we describe all essential processing operations, legal bases, recipients and storage durations.

6.1 Provision of the website

  • Type & scope: When accessed, log data (IP address, date/time, browser type, referrer, operating system) are collected automatically.

  • Purpose: Operational security, abuse prevention.

  • Legal basis: Legitimate interest (Art. 6 para. 1 lit. f GDPR).

  • Storage duration: 30 days.

  • Recipient: Hosting/shop platform Shopify, Inc. (Art. 28 GDPR).

6.2 Domain registrar

  • Type & scope: Registrant data (name, address, e-mail) are stored in WHOIS.

  • Provider: IONOS by 1&1.

  • Purpose: Domain registration.

  • Legal basis: Contract (Art. 6 para. 1 lit. b GDPR).

  • Storage duration: Until end of contract.

6.3 Cookies & tracking (Consentmo)

All cookie categories as well as opt-in/opt-out are managed by Consentmo. Consent is voluntary and revocable.

6.4 Contact form and form solutions

  • Type & scope: On our website we offer various contact and registration forms, mostly implemented via the Shopify platform. In individual specialized cases (e.g. additional landing pages) we additionally use Web3Forms. Data collected usually include first and last name, e-mail address, subject/message as well as optionally other fields necessary to handle your inquiry. Technically, IP address and timestamp are also recorded.

  • Purpose: Receiving and processing your inquiries, lead generation for B2B customers (SnapB2B) and other communication purposes.

  • Legal basis: Consent (Art. 6 para. 1 lit. a GDPR) and, for inquiries within existing contractual relationships, performance of a contract (Art. 6 para. 1 lit. b GDPR).

  • Storage duration: 3 months after conclusion of processing your inquiry, unless statutory retention obligations require longer periods.

  • Recipients:

    • Shopify, Inc. (data processing on behalf pursuant to Art. 28 GDPR) for all standard forms and shop-related contact inquiries.

    • Web3Forms (service provider) only for integrated specialized forms on selected landing pages.

    • SnapB2B for B2B registrations (if used).

6.5 User account & shop orders (Shopify, SnapB2B)

  • Type & scope: Customer account (name, address, e-mail), order data, SnapB2B lead data.

  • Purpose: Performance of contract, customer management.

  • Legal basis: Contract (Art. 6 para. 1 lit. b).

  • Storage duration: 10 years (statutory retention).

  • Recipients: Shopify, Inc., SnapB2B (service providers).

6.6 Payment service providers (Shopify Payments, PayPal, Shop Pay)

  • Type & scope: Payment status, transaction data.

  • Purpose: Processing of payments.

  • Legal basis: Contract (Art. 6 para. 1 lit. b).

  • Storage duration: Depending on the provider; at least 10 years for accounting.

  • Recipients: Shopify Payments, PayPal, Shop Pay (Shopify Inc., Canada).

6.7 Content Delivery Network (Shopify CDN)

  • Type & scope: IP, user agent when retrieving media files.

  • Purpose: Performance optimization.

  • Legal basis: Legitimate interest (Art. 6 para. 1 lit. f).

  • Storage duration: Dependent on the provider.

  • Recipients: Shopify CDN (Shopify Inc., Canada).

6.8 Web analytics & marketing tags

All services listed below are configured in Google Tag Manager:

Service Purpose Provider & Location Legal Basis
Google Analytics Visitor statistics (IP anonymization enabled) Google LLC, USA Consent (Art. 6 para. 1 lit. a)
Google Ads & Shopping Campaign tracking, conversion measurement Google LLC, USA Consent
Facebook/Meta Pixel Conversion tracking, retargeting Meta Platforms, Inc., USA Consent
Pinterest Tag Conversion & behavior tracking Pinterest, Inc., USA Consent
AdRoll Dynamic retargeting AdRoll Group, USA Consent
LinkedIn Insight Tag Page views, lead analytics LinkedIn Corp., USA Consent
YouTube Embed Video embedding Google LLC, USA Consent
DoubleClick (IDE) Advertising cookies, remarketing Google LLC, USA Consent

Data transfers to third countries are based on standard contractual clauses.

6.9 Google Sheets App Script

  • Type & scope: Automated report generation without publishing personal data.

  • Purpose: Processing and visualization of internal reports.

  • Legal basis: Legitimate interest (Art. 6 para. 1 lit. f).

  • Recipient: Google LLC, USA.

6.10 Dropbox integration (render.com)

  • Type & scope: Transfer of order data to protected Dropbox folders.

  • Purpose: Documentation and backup.

  • Legal basis: Contract (Art. 6 para. 1 lit. b) and Art. 28 (order processing contract).

  • Recipient: Dropbox, Inc. (based in the USA) via render.com.

7. Social media channels

We maintain official profiles on various social networks to offer you additional communication channels and information. The processing of personal data is carried out in accordance with the data protection provisions of the platforms and is based on our legitimate interest (Art. 6 para. 1 lit. f GDPR) or your consent (Art. 6 para. 1 lit. a GDPR) if you actively contact us.

7.1 Facebook & Instagram

  • Type & scope: When you visit our fan pages or interact with our posts, Facebook/Meta and Instagram automatically collect technical data (e.g. IP address, cookie IDs) and aggregated usage statistics via Insights. For direct messages, we record your username and the message content.

  • Purpose: Community management, communication, reach analysis.

  • Legal basis: Legitimate interest (Art. 6 para. 1 lit. f) and, if necessary, consent for interactive services (Art. 6 para. 1 lit. a).

  • Storage duration: See Meta Platforms, Inc. privacy notices.

  • Recipients: Meta Platforms Ireland Ltd. and Meta Platforms, Inc. (USA); we are jointly responsible for page content.

  • Note: To exercise your rights (access, erasure, etc.), please also contact Meta Platforms Ireland Ltd.

7.2 LinkedIn

  • Type & scope: When you visit our company profile or interact (comments, messages), LinkedIn collects information such as usernames, profile information, IP address and uses cookies.

  • Purpose: Corporate communication, recruiting, marketing analyses.

  • Legal basis: Legitimate interest (Art. 6 para. 1 lit. f) and, if necessary, consent (Art. 6 para. 1 lit. a).

  • Storage duration: See LinkedIn Inc. privacy policy.

  • Recipients: LinkedIn Corp. (USA).

8. Payment service: Shop Pay

  • Type & scope: Integration of Shop Pay (Shopify, Inc., Ottawa, Canada) as a payment method. When used, name, address, e-mail, phone number, IP address and, if applicable, company data are transmitted to Shopify.

  • Purpose: Processing of payment transactions.

  • Legal basis: Performance of contract (Art. 6 para. 1 lit. b GDPR).

  • Storage duration: Determined by Shopify. Details: https://www.shopify.com/legal/privacy

9. Content Delivery Network: Shopify CDN

  • Type & scope: Provision of static content (images, scripts) via regional CDN servers of Shopify, Inc. (Ottawa, Canada). IP address and browser data (user agent) are processed.

  • Purpose: Optimization of load times and availability of our website.

  • Legal basis: Legitimate interest (Art. 6 para. 1 lit. f GDPR).

  • Storage duration: Determined by Shopify. Details: https://www.shopify.com/legal/privacy

10. Checkout process: Shopify Checkout

  • Type & scope: Use of Shopify Checkout components from Shopify, Inc. (Ottawa, Canada). When paying via Shopify Checkout, name, address, e-mail, phone number, IP address and, if applicable, company data are transmitted to Shopify.

  • Purpose: Processing of order and payment process.

  • Legal basis: Performance of contract (Art. 6 para. 1 lit. b GDPR).

  • Storage duration: Determined by Shopify. Details: https://www.shopify.de/legal/datenschutz

11. Liability for content and links

Content:
The content of this website has been carefully reviewed. However, we assume no liability for the timeliness, accuracy or completeness (§ 7 para. 1 TMG).

Links:
External links lead to third-party content. Solely the respective providers are responsible for the accuracy and legality (§§ 8, 9 TMG). Upon becoming aware of legal violations, links will be removed immediately.

12. Copyright

All texts, images, graphics and other content of this website are protected by copyright. Any use outside the narrow limits of copyright law requires our express consent or that of the rights holder.

13. Recipients and third-country transfers

All service providers located outside the EU rely on EU standard contractual clauses. Details and copies of the agreements are available upon request.

14. Storage duration at a glance

  • Server logs: 30 days

  • Cookies: See section 4

  • Contact form: 3 months

  • Customer & order data: 10 years

  • Newsletter sign-ups: until withdrawal (+ 7 days buffer)

15. Changes to this policy

We adjust this privacy policy in case of legal changes or technical innovations. The date of the last update can be found at the end of this document.

As of: May 20, 2025
Urban Greenery GmbH

Sign up for our newsletter

Stay up to date.

Don't miss any news and be the first to receive information about offers and sales!