Privacy policy

Last updated: 18 September 2026

This privacy policy explains which personal data we process when you visit our online shop 157grad.de, place an order or contact us, for what purposes and on what legal basis we do so, and what rights you have. The German version of this policy is the legally binding one; this English version is provided for your convenience.

Summary

  • We mainly process your data to handle your order and answer your questions.
  • Statistics and analytics services as well as embedded videos only run if you agree in the cookie banner. You can change your choice at any time.
  • We do not sell your data and we do not run personalised advertising through our shop.
  • You have the right to access, rectification, erasure, restriction, data portability and objection at any time (section 17).

1. Controller

The controller responsible for data processing is:

Udo Meyer
157Grad – Vaporizer & gutes Zubehör
Göttinger Chaussee 115
30459 Hannover
Germany

Phone: +49 (0) 511 26232729
Email: info@157grad.de

Please use these contact details for any questions about data protection and to exercise your rights.

2. Visiting our website and shop platform

Our online shop runs on the Shopify platform. Our contractual partner and processor is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify provides the technical infrastructure (hosting, page delivery, cart, checkout, customer account, forms and emails sent from the shop).

Each time you access our pages, access data is processed automatically: IP address, date and time of access, page accessed, previously visited page (referrer), browser, operating system, device type and approximate location (country, region) derived from the IP address. This data is required to display the website to you, to ensure its stability and security and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free operation of the shop. For fast delivery, Shopify uses a content delivery network (including Cloudflare, Inc., USA).

Shopify may also process data in Canada and the USA. For Canada, an adequacy decision of the EU Commission exists. For transfers to the USA, see section 15. More information: Shopify privacy policy.

Our website is transmitted exclusively in encrypted form (TLS/HTTPS).

3. Cookies and consent management

We and the services we use store information on your device or read it from your device (e.g. cookies, local storage). This happens

  • without consent where it is strictly necessary for the functions you request, e.g. cart, checkout, customer account, language setting, security and storing your cookie choice (Section 25(2) No. 2 TDDDG; for the subsequent processing Art. 6(1)(b) and (f) GDPR);
  • only with your consent for all other purposes, in particular statistics/web analytics and embedded third-party content (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

To manage your consent we use the service iubenda (iubenda S.r.l., Via San Raffaele 1, 20121 Milan, Italy). iubenda stores your choice in a cookie on your device and records your consent (time and content of your choice) so that we can prove it (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). To display the appropriate banner, your country is determined from your IP address; for this purpose a service of Cloudflare, Inc. (USA) is queried.

Changing your choice or withdrawing consent: You can change your choice at any time with effect for the future using the consent settings button at the edge of the screen. You can also delete or block cookies in your browser; some shop functions (e.g. the cart) may then no longer work.

4. Orders, customer account and contract processing

When you place an order, we process the data you provide: name, billing and delivery address, email address, phone number where applicable, ordered items, chosen payment and shipping method and the communication relating to your order. Mandatory fields are marked; without this information we cannot conclude or perform the contract. The legal basis is Art. 6(1)(b) GDPR.

If you create a customer account, we store your details there so that you can view your orders and complete future orders more quickly (Art. 6(1)(b) GDPR). You can have your customer account deleted at any time, e.g. by sending us a short message.

Before purchasing, you confirm our terms and conditions, privacy policy and cancellation policy. We store the time and place of this confirmation with your order so that we can prove it (Art. 6(1)(f) GDPR).

To process orders, invoices, stock levels and shipping labels, we use the inventory management system Billbee (Billbee GmbH, Germany) as a processor. We also store order and correspondence data in our own management system on our own hardware in Germany. For our email mailbox and data backups we use IT service providers acting on our behalf.

After the contract has been fully performed, we retain the data for as long as required by commercial and tax law (currently six to ten years, Art. 6(1)(c) GDPR in conjunction with the German Commercial Code and Fiscal Code) and delete it afterwards. Invoice and accounting data is also passed on to our tax advisor.

5. Payment processing

Depending on the payment method you choose, we pass the data required for payment (e.g. name, address, email address, invoice amount, order number) to the respective payment service provider (Art. 6(1)(b) GDPR). Payment service providers partly collect payment data themselves and are independent controllers in this respect; their privacy notices also apply. To prevent payment defaults and fraud, the providers may carry out further checks (Art. 6(1)(f) GDPR).

  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. We embed the PayPal payment buttons on product and cart pages; for this purpose a connection to PayPal is established when the page loads and your IP address is transmitted (Art. 6(1)(b) and (f) GDPR, Section 25(2) No. 2 TDDDG). PayPal privacy notice
  • Klarna invoice and EPS: Processing is handled by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. For purchases on invoice, Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden is also involved. Klarna may carry out an identity and credit check and decides under its own responsibility whether purchase on invoice is offered. Mollie privacy notice, Klarna privacy notice
  • Credit card (Visa, Mastercard): Viva Payment Services S.A. (Viva Wallet), Greece.
  • Prepayment / bank transfer: You transfer the amount to our bank; we match the incoming payment with your order.
  • Cash on delivery: The amount is collected by DHL on delivery (see section 6).

6. Shipping

For delivery we pass your name, delivery address and – for cash on delivery – the amount to be collected to the shipping service provider (Art. 6(1)(b) GDPR):

  • DHL companies of Deutsche Post AG, including DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany;
  • Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany (letters and small parcels).

We only pass your email address or phone number to the shipping service provider if you have agreed to this during checkout (Art. 6(1)(a) GDPR), so that it can announce or arrange the delivery with you, or if this information is required for the chosen shipping method (e.g. express shipments or delivery to a parcel locker; Art. 6(1)(b) GDPR). You can withdraw your consent at any time by contacting us or the shipping service provider.

Direct shipping in exceptional cases: In exceptional cases a wholesaler, manufacturer or logistics service provider ships the goods directly to you on our behalf. It then receives your name, delivery address and the ordered items (Art. 6(1)(b) GDPR).

7. Contact by email, phone or contact form

When you contact us, we process your details (e.g. name, email address, phone number, order number, content of your message) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). We delete the data when it is no longer needed, unless statutory retention obligations apply (usually six years for business correspondence).

The contact form is provided by Shopify. To protect against spam and abuse, Shopify may use a spam protection service (e.g. Google reCAPTCHA) (Art. 6(1)(f) GDPR).

AI-assisted processing: To handle requests faster and more thoroughly, we have the email thread relating to a case, including the associated order and shipment data, summarised internally by an AI language model. For this purpose we transmit this content to Anthropic (Anthropic Ireland, Limited, Ireland, or Anthropic PBC, USA) or OpenAI (OpenAI Ireland Ltd., Ireland, or OpenAI OpCo, LLC, USA), acting as processors. Under their contractual terms, the providers do not use this data to train their models. The summary is only used for our internal work; every decision on your request is made by a human. The legal basis is Art. 6(1)(f) GDPR (our interest in fast and careful processing). You can object to this at any time (section 17). For transfers to the USA, see section 15.

8. Newsletter

If you subscribe to our newsletter, we use your email address to send you regular information about offers, new products and promotions. The legal basis is your consent (Art. 6(1)(a) GDPR). We log the time of your subscription so that we can prove your consent.

The newsletter is sent via Shopify Email (Shopify, see section 2). We evaluate whether a newsletter was opened and which links were clicked so that we can improve our content. You can unsubscribe at any time via the unsubscribe link in every email or by sending us a message. After you unsubscribe, we remove your address from the mailing list; where applicable we keep it on a suppression list so that we can permanently respect your objection (Art. 6(1)(f) GDPR).

9. Back-in-stock notification

If an item is sold out, you can use "Notify me" to be informed as soon as it is available again. For this we store your email address (or the contact details you provide) and the requested item. The function is provided on our behalf by a service provider. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. We use the data exclusively for this notification and delete it as soon as it is no longer needed for this purpose.

10. Shop functions provided by service providers

Some functions of our shop are provided by specialised service providers integrated via Shopify, e.g. suggestions for accessories and add-ons, zoom for product images, cart and notification functions and calculation of the cash-on-delivery fee. Technical data (IP address, device and browser information, page accessed, cart contents) is transmitted to the respective provider to the extent necessary for the function. The providers act as our processors. The legal basis is Art. 6(1)(b) and (f) GDPR and Section 25(2) No. 2 TDDDG. On request, we will tell you which service providers we use.

To display our customer reviews on Google, images (e.g. reviewers' profile pictures) may be loaded from servers of Google Ireland Limited; this transmits your IP address to Google.

11. Web analytics and shop improvement (only with consent)

We only use the following services if you have given your consent in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). They help us understand how our shop is used so that we can improve it. You can withdraw your consent at any time (section 3).

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Using cookies or similar technologies, Google Analytics collects pseudonymous usage data, e.g. pages viewed, time spent, clicks, cart and purchase events, device, browser and approximate location. IP addresses are not stored by Google Analytics 4. It is integrated via Google's "Google & YouTube" app, which uses the Google tag. Google processes the data as a processor; a transfer to Google LLC in the USA is possible (section 15). Event data is deleted after 14 months at the latest. Google privacy policy

Microsoft Clarity

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Clarity shows us how visitors use our pages: click and scroll analyses ("heatmaps") and reconstructions of individual visits from mouse movements, clicks and scrolling. Input in form fields is masked. Pseudonymous usage and device data is processed; a transfer to Microsoft Corporation in the USA is possible (section 15). Microsoft deletes the data in accordance with the retention periods defined for Clarity. Microsoft privacy statement

Shopify statistics

Shopify compiles statistics for us on the use of the shop (e.g. visits, page views, cart and purchase activity), which we view in aggregated form. Where information is stored on or read from your device for this purpose, this only happens with your consent.

12. Embedded YouTube videos

On some pages we embed videos from YouTube. The provider is Google Ireland Limited (address see section 11). The videos are only loaded once you have consented to the embedding (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Google then receives your IP address, device information and information about which video you watch; if you are logged in to Google, Google may associate this with your account. A transfer to the USA is possible (section 15).

13. Our pages on Facebook and Instagram

We maintain company pages on Facebook and Instagram, services of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). On our website these are only included as simple links; no data is transmitted to Meta when you visit our shop. Only when you click a link are you taken to Meta's site.

When you visit our pages on Facebook or Instagram, Meta processes your data under its own responsibility. We are joint controllers with Meta for the page statistics ("Insights") (Art. 26 GDPR); the corresponding agreement can be found here. We use these pages to inform you about our offering and to get in touch with you (Art. 6(1)(f) GDPR). Information on data processing by Meta: Meta privacy policy.

The share buttons in our blog posts are also simple links; data is only transmitted when you click one of them.

14. Other recipients

Beyond the recipients named above, we only pass on data if we are legally obliged to do so (e.g. to tax or law enforcement authorities, Art. 6(1)(c) GDPR) or if this is necessary to enforce or defend legal claims (e.g. to lawyers or courts, Art. 6(1)(f) GDPR).

15. Transfers to countries outside the EU

Some of the providers named also process data outside the European Union, in particular in the USA. For the USA, the EU Commission adopted an adequacy decision on 10 July 2023 (EU-US Data Privacy Framework); it applies to companies certified under it. Where a recipient is not certified, we base the transfer on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR). For Canada, an adequacy decision exists.

16. Retention period

We only store personal data for as long as is necessary for the respective purpose or as statutory retention periods require. Unless otherwise stated in this policy, we delete the data as soon as the purpose no longer applies, or restrict its processing while only a retention obligation remains. Data we process on the basis of your consent is deleted after you withdraw consent, unless another legal basis applies.

17. Your rights

You have the following rights with regard to your personal data:

  • access (Art. 15 GDPR),
  • rectification (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR),
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR).

Simply use the contact details in section 1.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the LfD Niedersachsen (State Commissioner for Data Protection of Lower Saxony), Prinzenstraße 5, 30159 Hannover, Germany, phone +49 (0) 511 120-4500, email poststelle@lfd.niedersachsen.de, www.lfd.niedersachsen.de.

18. Obligation to provide data, no automated decision-making

You are not legally or contractually obliged to provide your data. However, without the information marked as mandatory we cannot conclude or perform a contract. We do not engage in solely automated decision-making, including profiling (Art. 22 GDPR). For purchases on invoice, Klarna decides under its own responsibility whether to offer this payment method (section 5).

19. Changes to this privacy policy

We update this privacy policy when our data processing or the legal situation changes. The version published on this page applies.