Privacy Policy

Last updated: 17 September 2026

Who we are

Hidden Jams is operated by Woern Design + Solutions GmbH, Mozartstraße 15, 91088 Bubenreuth, Germany. We are the controller responsible for the processing described below in connection with our shop, orders and returns.

Contact: info@hiddenjams.online · +49 176 201 69 285

What we process and why

We receive information from you, automatically when you use our services, and from Shopify, payment providers and delivery providers.

• Orders, payments and returns: We process your name, contact and address details, order and transaction information, and correspondence to fulfil purchases, provide customer support and handle withdrawals, returns and refunds. The legal basis is performance of a contract or steps you request before a contract, under Article 6(1)(b) GDPR.

• Shop operation and security: We process technical connection information, including IP address, browser and device information and access times, to operate the shop, diagnose faults and prevent misuse. This serves our legitimate interests in a functioning, secure service under Article 6(1)(f) GDPR.

• Other enquiries and legal matters: We process correspondence to answer enquiries and information needed to establish or defend legal claims under Article 6(1)(f) GDPR. Our interests are responding to requests and protecting our legal rights. We retain and disclose records where required by tax, commercial or other applicable law under Article 6(1)(c) GDPR.

The information needed to process a purchase is required to fulfil the contract; without it, we cannot complete your order. Consent to optional tracking is not required to make a purchase.

Shopify and Shop

Our shop is hosted by Shopify International Limited, Ireland. Shopify processes contact, order, transaction, device and usage information to provide the shop and related services. We also sell through Shopify's Shop channel.

We use Shopify Network Intelligence. Subject to your privacy choices, Shopify combines information about your interactions with our shop, other merchants and Shopify to improve services, analytics, personalisation and advertising for us and other merchants. Our use of optional analytics, personalisation and advertising is based on consent under Article 6(1)(a) GDPR. Shopify acts as a controller for its processing for these enhanced services and for its own consumer services, such as Shop.

Information is shared with Shopify and its service providers, including providers in other countries. See Shopify's Consumer Privacy Policy. You can exercise rights and limit Shopify's use or sharing of your information for advertising through Shopify's privacy portal.

Payments

We offer Shopify Payments and PayPal. Depending on your selection, payment and relevant order information are processed by Shopify Payments (Shopify International Limited, Ireland, and its payment processors) or PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. We receive transaction information and payment status.

Payment providers also process data for their own fraud-prevention and legal obligations. Depending on the payment method, automated fraud or credit assessments may affect payment availability. Their notices explain this processing and applicable review rights: Shopify and its payment processors and PayPal's Privacy Statement.

Production, delivery and returns

We share the name, delivery address, relevant contact details and order information needed for production and fulfilment with print-on-demand production and fulfilment providers based in Germany, and with the carriers handling delivery.

We use an external returns portal and returns-management providers to handle withdrawals and returns. This involves order-identification details, contact details, withdrawal statements and return information needed to process the request.

IT and communications providers support these services. Professional advisers and public authorities receive information where necessary for the legal purposes described above. Service providers processing data on our behalf are subject to data-processing agreements.

Cookies and privacy choices

Essential cookies support functions such as the shopping basket, checkout, authentication and privacy preferences. Access to your device for these functions is based on Section 25(2) TDDDG; associated personal-data processing relies on Article 6(1)(b) or (f) GDPR for the purposes described above.

Optional analytics, personalisation and advertising tracking require your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can refuse these purposes or change and withdraw your consent through Cookie preferences. Details of Shopify cookies and their lifetimes appear in the “Merchant storefronts” section of Shopify's Cookie Policy.

You can also opt out of Shopify's use or sharing of your data for targeted advertising through Shopify's privacy portal, or contact us about processing for which we are responsible.

International transfers

Our providers may process data outside the European Economic Area, including in Canada, the United States and Singapore. EU hosting does not exclude such processing. Transfers are protected, as applicable, by adequacy decisions, EU Standard Contractual Clauses or approved Binding Corporate Rules. Details are available in the linked provider notices and Shopify's Data Processing Addendum. Contact us for information about the safeguards relevant to your data or a copy of them.

How long we keep data

We retain account information while an account is maintained, and order and support information until the transaction or enquiry is completed, subject to applicable warranty and legal-claim periods.

German statutory retention periods generally require eight years for invoices and accounting vouchers, six years for business correspondence and ten years for accounting books, counted from the end of the relevant calendar year. Longer retention may be required for tax proceedings or ongoing legal claims. Data no longer needed are deleted or anonymised.

Retention of technical data depends on session duration, troubleshooting and security needs, including preservation of evidence relating to a specific incident. Cookie lifetimes are linked above. Shopify and payment providers explain retention for their own processing in their privacy notices.

Your rights

Under the GDPR, you can request access, correction, erasure, restriction of processing and data portability, subject to the applicable conditions. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Contact us using the details above.

You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing, including related profiling, at any time.

You may complain to a data-protection supervisory authority, including the Bavarian State Office for Data Protection Supervision (BayLDA), or the authority where you habitually reside, work or believe an infringement occurred.