Privacy policy

Date: 10 October 2026

1. Data controller and contact details

Leslis GmbH, Kufsteiner Strasse 23a, 83075 Bad Feilnbach, Germany, represented by the managing director Dirk Busshart, is the data controller responsible for the processing of personal data described here. For data protection enquiries, you can contact us at support@leslis.de or via the postal address provided.

Personal data means information relating to an identified or identifiable individual. Mandatory fields in our forms are clearly marked. Without the information required to place an order, we cannot process a contract. Voluntary information, newsletter subscriptions or consent to advertising tracking are not a prerequisite for making a purchase.

2. Shop operation, hosting and security

Our shop is operated via Shopify. For retailers in the European Economic Area, the platform provider is Shopify International Limited, Ireland. Shopify processes, in particular, connection and device data, as well as the data required for the shopping basket, checkout, customer account and order processing. When you visit the shop, data collected includes, amongst other things, your IP address, the time of access, the URL accessed, browser and device information, and technical log data.

This processing is necessary to operate the shop, deliver its content, analyse errors and guard against misuse and fraud. The legal basis is Article 6(1)(f) of the GDPR; our legitimate interest is in the secure and reliable operation of the shop. Where processing is necessary for the performance of a contract or pre-contractual measures, Article 6(1)(b) of the GDPR applies. Storage and access to your device that are technically essential are governed by Section 25(2)(2) of the TDDDG.

Shopify uses affiliated companies and technical service providers, and in doing so data may also be processed in Canada, the USA and other countries. For intra-group transfers, Shopify uses, among other things, Binding Corporate Rules (BCRs); further information can be found in the Shopify Data Processing Addendum. In the case of Shopify services offered independently, such as Shop or Shop Pay, Shopify also processes certain data under its own responsibility. In this regard, the Shopify Privacy Notice for Customers applies.

3. Contact, Customer Account and Orders

If you contact us by email, via the contact form or via chat, we process your contact details and the content of your message in order to deal with your enquiry. For contract-related enquiries, Article 6(1)(b) of the GDPR applies; for other enquiries, Article 6(1)(f) of the GDPR applies on the basis of our legitimate interest in providing an appropriate response.

For customer accounts and orders, we process your name, email address, billing and delivery addresses, the products and variants you have ordered, any personalisation details, payment and dispatch status, and your communications with us. The legal basis for this is Article 6(1)(b) of the GDPR. We fulfil our obligations under tax and commercial law on the basis of Article 6(1)(c) of the GDPR.

To process your order, the relevant payment providers, delivery companies, production and fulfilment partners, as well as providers of returns services, accounting, data backup and technical operational support, receive the data required in each case. For items from our Collective range, the delivery partner named in the offer and their shipping service provider may carry out the delivery directly. Personalisation texts or uploaded files are processed for the design you have ordered and passed on to the production partner carrying out the work, insofar as this is necessary.

Our internal stock, order and service applications support these processes. The electronic cancellation function is provided via the Händlerbund Cancellation Manager. The contact and contract details entered there, as well as the time and content of the declaration, are used to process and document the cancellation and the acknowledgement of receipt; the legal basis for this is Article 6(1)(b) and (c) of the GDPR.

4. Payment

Depending on the payment method you choose, the payment service provider shown at checkout and the banks involved will receive the payment, identification and transaction data needed to process the payment. These include, in particular, Shopify Payments, PayPal and Klarna, provided you select the respective payment method. The legal basis for our transfer of data is Article 6(1)(b) of the GDPR. Payment service providers process data in some cases as independent data controllers, in particular for the purposes of fraud prevention, compliance with legal obligations and, where applicable, credit checks. Their privacy notices also explain any automated decision-making and the corresponding rights.

Further information: Shopify, PayPal and Klarna.

5. Cookies and consent management

We use cookies, local browser storage and similar technologies. For functions that are technically essential, such as the shopping basket, login, security and the storage of your privacy preferences, Section 25(2)(2) of the TDDDG applies. For non-essential storage or access, your consent is required under Section 25(1) of the TDDDG; the associated processing of personal data is governed by Article 6(1)(a) of the GDPR.

To manage and document your choices, we use Cookiebot from Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. This involves processing your choices, the time of selection, an identification code and technical browser and connection information. The legal basis is Article 6(1)(c) of the GDPR for the fulfilment and demonstration of our obligations regarding consent, as well as Article 6(1)(f) of the GDPR for the reliable provision of the management function.

You can change your preferences via ‘Cookie Settings’ in the footer or the cookie policy and withdraw your consent with effect for the future. There you will also find information on detected cookies, their purposes and expiry times. Further details from the provider: Cookiebot Privacy Policy. The lawfulness of the processing prior to withdrawal remains unaffected.

6. Newsletters and Klaviyo

We use Klaviyo, Inc., USA, for newsletters and the management of our marketing contacts. In particular, the following data is processed: email address, name (where applicable), registration and consent data, and unsubscriptions. With your consent, newsletter opens, links clicked and activity in the shop may also be analysed and linked to your customer profile in order to tailor content to your interests. Tracking pixels, cookies and similar technologies are used for this purpose. The legal bases for consent-based advertising and the associated measurement of its effectiveness are Article 6(1)(a) of the GDPR and, in the case of device access, Section 25(1) of the TDDDG.

You can unsubscribe from the newsletter using the unsubscribe link in every promotional email or by sending us a message. You may object to direct marketing at any time. Provided that the legal requirements of Section 7(3) of the German Unfair Competition Act (UWG) are met, we may also use the email address obtained in connection with a purchase to advertise our own similar products. The legal basis for this is then Article 6(1)(f) of the GDPR; our legitimate interest lies in marketing to existing customers. We will inform you of your right to object at the time of data collection and on each occasion the data is used. At most, you will incur transmission costs in accordance with standard rates.

Klaviyo also processes data in the USA. Under its data-processing agreement, Klaviyo bases covered data transfers on its certification under the EU–US Data Privacy Framework and additionally provides for standard contractual clauses. Further information: Klaviyo Privacy Policy.

7. Google Analytics and Advertising

Google Analytics and Google Ads are planned for audience analysis and advertising measurement via our Google integration. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Among other things, this may involve the processing of pages visited, clicks, referral sources, device information, identifiers and purchase events. The analysis helps us to understand how our website is used and to evaluate our advertising campaigns. For advertising functions, this information may also be used to attribute ad impressions and for interest-based advertising.

The legal basis for the analysis of personal data and advertising measurement is your consent pursuant to Article 6(1)(a) of the GDPR; Section 25(1) of the TDDDG applies to the corresponding access to devices. You can change your preferences via the cookie settings. Google may process data in the USA and other countries. Information on the respective legal bases for data transfers and safeguards can be found under ‘Google Data Transfers’; in addition, the Google Privacy Policy applies.

8. Meta / Facebook and Instagram

Our Facebook/Instagram integration enables the measurement of advertising performance and interest-based advertising. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The following data may be processed: page and product views, shopping basket and purchase events, device and connection data, and identifiers. Where appropriate mapping has been set up, matched contact details may also be used to identify an ad contact. Meta may link this information to an existing user account.

Your consent under Article 6(1)(a) of the GDPR is required for this processing of personal data for advertising purposes; Section 25(1) of the TDDDG applies to device access. You can change or withdraw your consent in the cookie settings. We share responsibility with Meta for the collection and transfer of certain event data in accordance with the Controller Addendum. Further processing is the responsibility of Meta. Information on data transfers, particularly to the USA, and on your rights: Meta Privacy Policy and Meta Transfer Terms.

9. Reviews with Judge.me

We use Judge.me Ltd, United Kingdom, to manage and display product reviews. When you submit a review, the details you enter – such as your display name, review text, star ratings and any images you choose to add – are processed. Order and contact details may be used to attribute the review to a purchase and to verify it. Your email address will not be displayed as part of the public review.

The publication of a review you have submitted is based on Article 6(1)(a) of the GDPR. We base the checking for misuse and the verifiable attribution of reviews on Article 6(1)(f) of the GDPR; our legitimate interest lies in ensuring reliable reviews. For promotional review requests sent by email, the relevant consent is required. When the review page is loaded, the technical provider receives the necessary connection data; this is based on our legitimate interest in providing the displayed review content in accordance with Article 6(1)(f) of the GDPR. Details regarding recipients and international data transfers: Judge.me Privacy Policy and Data Processing Addendum.

10. External content and fonts

Content is also provided via technical delivery services for the display of the shop and integrated functions. In doing so, the servers involved receive, in particular, the IP address and technical details of the request. This also applies to fonts retrieved externally from Google Fonts. These requests serve to display the respective content and fonts. Google’s information on processing can be found in the Google Privacy Policy.

Where technical delivery is necessary for the requested service, Article 6(1)(b) or (f) of the GDPR applies. Our legitimate interest is the functional provision of the shop. This legal basis does not replace consent where an integration or device access requires such consent.

11. Transfers outside the EEA

In the case of the services mentioned, data may be processed outside the European Economic Area. The relevant adequacy decisions of the European Commission or appropriate safeguards under Article 46 of the GDPR, such as standard contractual clauses or binding corporate rules, apply. The EU–US Data Privacy Framework applies only to transfers covered by it to appropriately certified US companies. You can request information or a copy of the relevant safeguards via the linked provider notices or by contacting us.

12. Retention period

Retention periods depend on the respective purpose, statutory retention obligations and any necessary evidence. Contract and enquiry data are retained for processing purposes and, where necessary, for asserting or defending claims. For commercial and tax documents, the retention period is generally six, eight or ten years, depending on the type of document; ongoing proceedings may require a longer retention period. Data that is no longer required is deleted or anonymised, provided there is no legal obligation to retain it further.

Newsletter data is processed for the respective mailing purpose until you unsubscribe or the legal basis ceases to apply. Records of consent and blocking information, limited to the extent necessary, may be retained for documentation purposes and to ensure compliance with your objection. For technical logs, the retention period depends on the necessary error and security analysis; for reviews, it depends on their publication and any reasons for review or deletion. Retention periods for device-related storage can be found in the Cookie Policy.

13. Your data protection rights

Where the legal requirements are met, you have the rights of access, rectification, erasure, restriction of processing and data portability in accordance with Articles 15 to 20 of the GDPR. You may withdraw any consent you have given at any time with effect for the future.

Objection: Where processing is carried out on the basis of Article 6(1)(f) of the GDPR, you may object on grounds relating to your particular situation. We will then cease processing the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or we require the data to establish, exercise or defend legal claims. You may object to direct marketing, including any associated profiling, at any time without giving reasons.

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de. To exercise your rights, you may also contact us directly at support@leslis.de.