Privacy policy

1. General Information

The protection of your personal data is very important to us. We process personal data exclusively in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other relevant data protection provisions.

With this privacy policy, we provide comprehensive information about the type, scope, purpose, and legal basis of the processing of personal data when visiting and using our online shop www.wasteddreams.com.

2. Controller

Blessed GmbH
Brand: Wasted Dreams
Bahnhofplatz 2
97070 Würzburg
Germany

Email: wasteddreamsstudio@gmail.com

3. Categories of Data Subjects

This privacy policy applies to:

  • visitors to our website

  • customers and prospective customers

  • users of a customer account

  • communication partners (e.g. email inquiries)

4. Legal Basis for Processing

We process personal data based on the following legal bases:

  • Art. 6 (1) (a) GDPR – consent

  • Art. 6 (1) (b) GDPR – contract / pre-contractual measures

  • Art. 6 (1) (c) GDPR – legal obligation

  • Art. 6 (1) (f) GDPR – legitimate interest

5. Hosting, Shop System & Customer Privacy

Our online shop is operated via the Shopify e-commerce platform. Shopify provides the shop system, hosting, server infrastructure, security mechanisms, payment and checkout functions, as well as analytics and administrative features.

During operation, the following data may be processed in particular:

  • IP address

  • device, browser and operating system information

  • log and security data

  • order, payment and customer data

  • derived location information

  • usage and interaction data

Shopify may also process personal data for the purposes of:

  • fraud and abuse prevention

  • system security

  • performance analysis

  • error diagnostics

Legal bases:

  • Art. 6 (1) (b) GDPR

  • Art. 6 (1) (f) GDPR

It cannot be ruled out that Shopify or affiliated companies process data in third countries (e.g. Canada or the USA). Appropriate safeguards such as adequacy decisions or standard contractual clauses are used.

6. Access Data & Server Log Files

When visiting our website, the following data is automatically processed:

  • IP address

  • date and time of access

  • pages accessed

  • referrer URL

  • browser type and version

  • operating system

Purposes:

  • technical provision of the website

  • stability and security

  • attack detection

Legal basis: Art. 6 (1) (f) GDPR

7. Orders, Customer Account & Contract Processing

7.1 Orders

The following data may be processed:

  • name

  • address

  • email address

  • order details

  • payment information

Purpose: contract fulfillment
Legal basis: Art. 6 (1) (b) GDPR

7.2 Customer Account

If you create a customer account, we store your data to manage and reuse it for future orders.

Legal basis: Art. 6 (1) (b) GDPR

8. Payment Service Providers

For payment processing we use external payment service providers who process data under their own responsibility.

Possible payment methods include:

  • PayPal

  • Klarna

  • credit card (e.g. Stripe / Shopify Payments)

  • Apple Pay

  • Google Pay

  • bank transfer

Legal basis: Art. 6 (1) (b) GDPR

9. Shipping & Logistics

For delivery purposes we pass on necessary data to shipping service providers (e.g. DHL, DPD, Hermes, UPS).

Purpose: delivery and shipment tracking
Legal basis: Art. 6 (1) (b) GDPR

10. Communication

If you contact us by email or contact form, we store the information provided to process your request.

Legal bases:

  • Art. 6 (1) (b) GDPR

  • Art. 6 (1) (f) GDPR

11. Cookies, Consent & Consent Management

We use cookies, pixels, tags, scripts, and similar technologies.

A distinction is made between:

  • technically necessary technologies

  • analytics, statistics, and marketing technologies

Analytics and marketing technologies are used only after consent via a consent management tool.

Legal bases:

  • necessary technologies: Art. 6 (1) (f) GDPR

  • optional technologies: Art. 6 (1) (a) GDPR

12. Web Analytics (Google Analytics 4)

If consent has been given, we use Google Analytics 4.

The following data may be processed:

  • truncated IP address

  • usage data

  • interactions

  • device information

Legal basis: Art. 6 (1) (a) GDPR

13. Online Advertising & Tracking

13.1 Google Ads & Enhanced Conversions

Tracking, conversion measurement, and remarketing.

13.2 Meta Pixel & Meta Conversion API

Pixel and server-side event transmission (e.g. purchases).

13.3 TikTok Pixel & Events API

Measurement and optimization of campaigns.

Legal basis: Art. 6 (1) (a) GDPR
Data transfers to third countries may occur.

14. Server-Side Tracking & APIs

To improve measurement accuracy, data may be processed server-side and transmitted to platforms (e.g. Google, Meta, TikTok).

Possible data processed:

  • event data

  • transaction data

  • technical metadata

Processing is carried out only after consent or based on legitimate interests (e.g. fraud prevention).

15. Google Merchant Center

Product and shop data may be transmitted for display in Google services.

Legal bases:

  • product data: Art. 6 (1) (f) GDPR

  • tracking: Art. 6 (1) (a) GDPR

16. Fraud Prevention & Security

Automated verification mechanisms may be used to prevent fraud and abuse.

Legal basis: Art. 6 (1) (f) GDPR

17. Recipients & Processors

Data may be transferred to the following categories of recipients:

  • hosting and IT service providers

  • payment service providers

  • shipping service providers

  • analytics and marketing providers

  • authorities (if legally required)

18. Data Retention

Personal data will be deleted as soon as the purpose of storage no longer applies, unless statutory retention obligations exist.

19. Data Security

We implement technical and organizational security measures, such as encryption and access restrictions, to protect your data.

20. Data Subject Rights

You have the right to:

  • access

  • rectification

  • erasure

  • restriction of processing

  • data portability

  • objection

  • withdrawal of consent

  • lodge a complaint with a supervisory authority

Contact: wasteddreamsstudio@gmail.com

21. Changes to this Privacy Policy

We reserve the right to amend this privacy policy. The current version published on the website shall apply.