1Controller

The controller responsible for data processing within the meaning of the EU General Data Protection Regulation (GDPR) is:

TRENDYADAPT
Hauptstraße 26/3
71272 Renningen
Germany

Email: contact@rogerpouches.com

ROGER is a brand of TRENDYADAPT. In this policy, "we", "us" and "our" refer to TRENDYADAPT.

2General Information on Data Processing

We collect and use personal data of our users only to the extent necessary to provide a functioning website and to deliver our content and services. Personal data is collected and used only with the user's consent or on one of the legal bases set out in Art. 6 GDPR.

3Data Collected Automatically When You Visit Our Website

When you visit our website, the following information is automatically recorded by our hosting provider (Shopify):

• IP address (anonymised)
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL
• Amount of data transferred

This data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest in the technical provision of the website) and deleted after a maximum of 30 days.

4Cookies

Our website uses cookies. Cookies are small text files stored on your device that allow your browser to connect with our website.

We distinguish between the following categories:

• Strictly necessary cookies (shopping cart, login status, checkout, currency and language settings). Legal basis: Art. 6(1)(f) GDPR.
• Analytics and marketing cookies (Meta Pixel and similar tools). These are set only with your express consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

You can withdraw your consent at any time through our cookie banner or by adjusting the cookie settings in your browser.

5Hosting (Shopify)

Our website is hosted by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.

Shopify processes personal data on our behalf as a processor under Art. 28 GDPR. Shopify is GDPR-compliant and relies on the European Commission's Standard Contractual Clauses (SCCs) for transfers to third countries.

Further information: shopify.com/legal/privacy

6Meta Pixel (Facebook and Instagram)

We use the Meta Pixel (formerly Facebook Pixel) provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. For users outside the European Economic Area and the United Kingdom, the provider is Meta Platforms, Inc., Menlo Park, California, USA.

The Meta Pixel allows us to track visitor interactions on our website and to use them for advertising on Facebook and Instagram. The following data is processed:

• Pages visited and products viewed
• Add-to-cart and purchase events
• IP address
• Browser and device information
• Pseudonymised user identifiers

Advanced Matching. We use the Advanced Matching feature. Additional customer data (for example email address or phone number) is hashed before being transmitted to Meta in order to improve advertising performance. This data is only ever transmitted in encrypted form.

Conversions API. We also use the Meta Conversions API. It enables server-side transmission of event data (for example purchases or add-to-cart events) directly to Meta, including when browser-based tracking has been disabled by the user. This transmission is also carried out in pseudonymised form.

Legal basis: your express consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Data may be transferred to the United States. Meta relies on the European Commission's Standard Contractual Clauses (SCCs) for such transfers.

You can withdraw your consent at any time through our cookie banner or in your Meta account settings at facebook.com/settings?tab=ads.

Meta's privacy policy: facebook.com/about/privacy

7Newsletter (Email Marketing)

You can sign up for our newsletter on our website. When you do so, we collect the following data:

• Email address (required)
• First name (optional)
• Time of sign-up
• IP address at the time of sign-up

Double opt-in. After signing up, you will receive a confirmation email containing an activation link. You are only added to our newsletter list once you have clicked this link.

Legal basis: Art. 6(1)(a) GDPR (consent).

You can unsubscribe from the newsletter at any time using the unsubscribe link included in every email. After you unsubscribe, your data is removed from our active marketing lists.

8Order Processing

When you place an order, we collect the following data in order to perform the contract:

• First and last name
• Shipping address and billing address
• Email address
• Phone number (optional)
• Order contents and order value
• Payment data (processed by the payment provider)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations, for example statutory retention periods).

Retention period: 10 years, in accordance with German commercial and tax law.

9Payment Providers

We use external service providers to process payments. The related data processing takes place directly between you and the payment provider:

• Shopify Payments (Shopify International Limited, Ireland). Privacy policy
• Klarna (Klarna Bank AB, Sweden). Privacy policy
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). Privacy policy

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

10Shipping and Logistics

In order to deliver your order, we transmit your shipping data (name, address and, where applicable, phone number and email address) to our logistics partners:

• DHL and Yunexpress for international shipping, together with the postal carrier responsible for final delivery in your country

Legal basis: Art. 6(1)(b) GDPR.

11Contacting Us

When you contact us by email, the data you provide (name, email address, phone number where applicable, and the content of your enquiry) is stored in order to handle your request.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) or Art. 6(1)(b) GDPR in the case of pre-contractual enquiries.

This data is deleted once your request has been fully dealt with, unless statutory retention obligations apply.

12Your Rights

You have the following rights in relation to us:

• Right of access (Art. 15 GDPR): you can request information about the data we hold about you
• Right to rectification (Art. 16 GDPR): you can request the correction of inaccurate data
• Right to erasure (Art. 17 GDPR): the "right to be forgotten"
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

Depending on where you live, you have additional rights under local law. We honour them in the same way.

United Kingdom. The rights listed above also apply under the UK GDPR.

United States. Depending on your state (for example California, Virginia, Colorado, Connecticut or Texas), you may have the right to know what personal information we collect, to delete it, to correct it, and to opt out of "sale" or "sharing" for targeted advertising. We do not sell personal information for money. You can opt out of targeted-advertising cookies through our cookie banner. We will not discriminate against you for exercising your rights.

Canada. Under PIPEDA you may access and correct your personal information and withdraw consent, subject to legal or contractual restrictions.

Australia and New Zealand. Under the Australian Privacy Act 1988 and the New Zealand Privacy Act 2020 you may request access to and correction of the personal information we hold about you.

To exercise any of your rights, please email us at: contact@rogerpouches.com. We may ask you to verify your identity before responding. We respond within one month, or within the shorter period required by your local law.

13Right to Lodge a Complaint With a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

Our competent supervisory authority is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
Germany
www.baden-wuerttemberg.datenschutz.de

You may also contact the data protection authority in your own country.

14International Transfers

We are based in Germany and you may be located in the United States, the United Kingdom, Canada, Australia or New Zealand. Your data therefore travels between your country and the European Union. Where we transfer data out of the EU or UK, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant). Some providers, such as Meta and Shopify, may process data in the United States under these safeguards.

15Age Restriction

Our website and products are intended for adults aged 18 and over. We may ask you to confirm that you are 18 or older before you can purchase. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

16Data Security

We use technical and organisational security measures to protect your data against unauthorised access, loss or manipulation. Data transmitted through our website is encrypted using SSL/TLS.

17Changes to This Privacy Policy

We reserve the right to amend this privacy policy so that it always meets current legal requirements or reflects changes to our services. The new privacy policy will then apply to your next visit.