Privacy policy
Last updated: November 2026
1. Controller
NIQUA Vertriebs GmbH
Schulstraße 19
56290 Beltheim
Germany
Phone: +49 (0)6762 4093-0
Email: info@niquagroup.com
For questions about data protection, please contact us at info@niquagroup.com
2. Legal bases
We process personal data on the basis of your consent (Art. 6(1)(a) GDPR), for the performance of a contract or pre-contractual measures (Art. 6(1)(b)), to comply with legal obligations (Art. 6(1)(c)) or to protect legitimate interests (Art. 6(1)(f)). Our legitimate interests lie in particular in the secure and economic operation of the online shop, fraud prevention and responding to enquiries. Storing information on your device or accessing it is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
3. Provision of the online shop and server log files
When you visit the shop, technically necessary data is processed: IP address, date and time, pages accessed, referrer URL, browser, operating system and device information. The purpose is to provide the shop and ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR.
4. Shopify
Our shop runs on the Shopify platform. Our contractual partner is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides hosting, the shop system, checkout and security functions and processes, in particular, usage, contact, order, delivery and payment data. Shopify acts as our processor. Data may also be transferred to affiliated companies in Canada and the USA (see section 13).
5. Cookies, consent and consent tool
We use technically necessary cookies and similar technologies (e.g. shopping cart, checkout, customer account, language and country selection, security, storing your cookie choices) without consent (Section 25(2) TDDDG, Art. 6(1)(b) or (f) GDPR).
We use all other technologies for analytics and marketing (sections 10 and 11) only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We manage your consent with the consent tool Pandectes. You can change or withdraw your choice at any time via the cookie icon. Clicking the icon reopens the consent settings. There you can select or deselect individual categories and confirm with "Save settings" or deselect all optional categories with "Reject all".
6. Customer account and business customers
If you create a customer account, we process your name, email address, billing and delivery address, telephone number (if provided) and your order history in order to provide the account and process orders (Art. 6(1)(b) GDPR). For business customers, we additionally process the company name, VAT ID and, where applicable, proof of business activity in order to provide trade terms.
7. Orders and contract performance
For orders, we process your name, billing and delivery address, email address, telephone number (if provided), the products ordered, payment method, and order and shipping data. The purpose is to process the order, payment, delivery, invoicing, returns and complaints (Art. 6(1)(b) GDPR) and to comply with retention obligations under commercial and tax law (Art. 6(1)(c)).
8. Payment service providers
To process payments, we pass the necessary data to the payment service provider you have chosen (Art. 6(1)(b) GDPR). Some of them process the data under their own responsibility, e.g. for fraud and credit checks:
– Shopify Payments, provided by Shopify International Limited, Dublin, Ireland: credit cards (e.g. Visa, Mastercard, American Express), Shop Pay and other payment methods shown at checkout such as Apple Pay and Google Pay;
– PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg;– Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden;
– Revolut Pay: Revolut Bank UAB, Konstitucijos ave. 21B, 08130 Vilnius, Lithuania.
9. Shipping
For delivery, we pass your name, delivery address and, where necessary for delivery notifications, your email address or telephone number to the shipping service provider commissioned in each case, in particular DPD Deutschland GmbH, DHL Paket GmbH and Deutsche Post AG (Art. 6(1)(b) GDPR). For freight shipments of bulky goods, we pass the data to the commissioned freight forwarder.
10. Analytics and optimisation (only with consent)
– Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland: analysis of how the shop is used, e.g. pages viewed, time spent, origin, device and purchases. IP addresses are shortened by Google within the EU. We use Google Consent Mode: no analytics cookies are set without your consent.
– Microsoft Clarity by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland: heatmaps and pseudonymised session recordings to improve the usability of the shop. Input in form fields is masked.
11. Marketing and advertising (only with consent)
– Google Ads with conversion tracking and remarketing by Google Ireland Limited (address see above): measuring whether our ads lead to orders, and showing ads to visitors of our shop.
– Pinterest Tag by Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland: measuring and optimising advertising on Pinterest.
– TikTok Pixel by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland: measuring and optimising advertising on TikTok.
12. Newsletter
If you subscribe to our newsletter, we process your email address and any information you provide voluntarily in order to send you information about products, new arrivals, offers and expert knowledge (Art. 6(1)(a) GDPR). Subscription uses the double opt-in procedure: after signing up, you receive an email in which you confirm your subscription. Only then will you receive the newsletter. We send it using Shopify Messaging by Shopify International Limited (see section 4). We evaluate whether newsletters are opened and which links are clicked in order to improve our content. You can unsubscribe at any time via the unsubscribe link in every email.
13. Transfers to third countries
Some service providers or their affiliates are based in Canada or the USA (including Shopify, Google, Microsoft and Pinterest). For Canada, there is an adequacy decision of the European Commission. For the USA, data is transferred to companies certified under the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023) or on the basis of EU Standard Contractual Clauses (Art. 46 GDPR). TikTok may also transfer data to other third countries. This is done on the basis of EU Standard Contractual Clauses.
14. Contacting us
If you contact us by email, telephone or form, we process your details to handle your enquiry (Art. 6(1)(b) GDPR where it relates to a contract, otherwise Art. 6(1)(f)).
15. Social media links
Our shop links to our profiles on Facebook, Instagram, Pinterest, TikTok and YouTube. These are simple links: data is only transferred when you click a link. The privacy policies of the respective platforms apply there.
16. Retention period
We store data only for as long as is necessary for the respective purpose. We retain commercial and tax records for up to ten years in accordance with Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), and accounting vouchers for eight years. We store customer accounts until you delete them and newsletter data until you unsubscribe. The storage period of cookies can be found in the consent tool.
17. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw your consent at any time with effect for the future. To exercise these rights, please use the contact details in section 1.
Right to object: Where we process data on the basis of legitimate interests, you may object on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons.
You may also lodge a complaint with a supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz, Germany, poststelle@datenschutz.rlp.de.
18. Automated decision-making
We do not make decisions based solely on automated processing that have legal effects. Payment service providers such as PayPal or Revolut may carry out automated fraud or credit checks under their own responsibility. Further details can be found in their privacy notices.
19. Data security and changes
We transmit data in encrypted form (TLS) and protect it with appropriate technical and organisational measures. We update this privacy policy when the shop, the services used or the legal situation change.