Privacy policy

Privacy Policy
Last updated: 30 September 2026

1. Who We Are
This Privacy Policy explains how we collect, use and protect your personal information when you visit our store, subscribe to Symbols & Thoughts, make a purchase or contact us.

The controller responsible for processing your personal information within the meaning of the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP) is:

Darja Zelmer
Symbols & Thoughts
c/o Autorenglück #20994
Albert-Einstein-Straße 47
02977 Hoyerswerda, Germany
Email: hello@symbolsandthoughts.com

We are not required to appoint a data protection officer.

2. Personal Information We Collect
Depending on how you interact with us, we may process the following personal information:

  • Contact details: name, billing and shipping address, email address and, if provided, phone number.
  • Order and subscription details: products purchased, subscription status, billing dates, cancellations, returns and order history.
  • Payment information: payment method and transaction details. Full card details are processed directly by our payment providers and are not stored by us.
  • Account information: login details and preferences, if you create a customer account.
  • Communications: the content of emails or messages you send us.
  • Device and usage information: IP address, browser type, device information and how you interact with our store, collected via cookies and similar technologies (see section 5).

We collect this information directly from you, automatically when you use our store, and from our service providers who process it on our behalf.

3. Purposes and Legal Bases for Processing
We process your personal information only where a legal basis applies:

  • To fulfil our contract with you (Art. 6(1)(b) GDPR): processing orders and subscriptions, taking recurring payments, shipping your letters, handling cancellations, withdrawals and returns, managing your customer account and responding to support requests.
  • To comply with legal obligations (Art. 6(1)(c) GDPR): retaining invoices and transaction records as required by German tax and commercial law, completing customs declarations, and responding to lawful requests from authorities.
  • Based on our legitimate interests (Art. 6(1)(f) GDPR): ensuring the security and technical operation of our store, preventing fraud and misuse, and asserting or defending legal claims. Our legitimate interest lies in running a secure and functional online store.
  • Based on your consent (Art. 6(1)(a) GDPR): sending our newsletter and marketing emails, and using non-essential cookies for analytics or marketing. You can withdraw your consent at any time with effect for the future.

Providing your personal information is necessary to conclude a contract with us. Without it, we cannot process your order or subscription.

4. Newsletter and Marketing Emails
If you sign up for our newsletter or waitlist, we use your email address (and, if provided, your country) to send you updates about Symbols & Thoughts. We send these only with your consent. You can unsubscribe at any time via the link in every email or by writing to us. Transactional emails about your orders and subscription (e.g. order confirmations, shipping notices, billing reminders) will still be sent, as they are necessary to fulfil our contract.

5. Cookies
Our store uses cookies and similar technologies. Cookies that are strictly necessary for the store to function (e.g. shopping cart, checkout, security) are used on the basis of § 25(2) TDDDG and Art. 6(1)(b) and (f) GDPR. Analytics and marketing cookies are only used if you consent via our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your cookie consent at any time via the cookie settings on our website.

6. Who We Share Your Information With
We share your personal information only where necessary for the purposes described above:

  • Shopify (Shopify International Ltd., Ireland): hosting our store, checkout and payment processing (Shopify Payments).
  • Appstle (Appstle Inc.): managing subscriptions and recurring billing.
  • Deutsche Post AG (Germany): delivering your letters within Germany and to Switzerland. We share your name and shipping address for this purpose.
  • Customs authorities (for shipments to Switzerland): we transmit your name, address and the contents and value of your shipment, as required for the customs declaration.
  • [PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg]: payment processing, if you choose PayPal.
  • [Shopify Email]: sending newsletters and marketing emails.

These service providers process your information on our behalf and under data processing agreements, or as independent controllers where required for their services (e.g. payment providers). We may also disclose information where required by law or to protect our legal rights.

Relationship with Shopify: Shopify may process certain information about your interactions with our store as an independent controller, for example to provide fraud prevention or features across multiple stores. You can learn more in the Shopify Consumer Privacy Policy and exercise your rights regarding this processing via the Shopify Privacy Portal (https://privacy.shopify.com/en).

We do not sell your personal information.

7. International Transfers
Some of our service providers are located or process data outside the European Economic Area, the UK or Switzerland, in particular in the United States and Canada. Where this is the case, transfers are based on an adequacy decision (e.g. the EU–US Data Privacy Framework, where the recipient is certified) or on the European Commission's Standard Contractual Clauses, or equivalent safeguards under UK and Swiss law.

8. How Long We Keep Your Information
We retain your personal information only as long as necessary for the purposes described:

  • Order, invoice and payment records: up to 10 years, as required by German tax and commercial law (§ 147 AO, § 257 HGB).
  • Subscription and customer account data: for the duration of your subscription or account, and afterwards only as long as needed to handle any remaining claims.
  • Newsletter data: until you unsubscribe.
  • Support communications: generally up to 3 years, in line with statutory limitation periods.

Once the retention period ends, your information is deleted or anonymised.

9. Your Rights
You have the following rights regarding your personal information:

  • Access (Art. 15 GDPR): to know what information we hold about you.
  • Rectification (Art. 16 GDPR): to have inaccurate information corrected.
  • Erasure (Art. 17 GDPR): to have your information deleted, unless we are legally required to keep it.
  • Restriction (Art. 18 GDPR): to have processing restricted in certain cases.
  • Data portability (Art. 20 GDPR): to receive your information in a common, machine-readable format.
  • Withdrawal of consent (Art. 7(3) GDPR): to withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal.

Right to object (Art. 21 GDPR): Where we process your information based on legitimate interests, you have the right to object at any time on grounds relating to your particular situation. You may object to the use of your information for direct marketing at any time, without giving reasons.

To exercise any of these rights, email us at hello@symbolsandthoughts.com. We may need to verify your identity before responding.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany). You may also contact the authority in your country of residence. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC), and in the UK, the Information Commissioner's Office (ICO).

10. Automated Decision-Making
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

11. Children
Our store is not directed at children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Security
We take appropriate technical and organisational measures to protect your personal information, including encrypted (SSL/TLS) connections on our store. However, no method of transmission over the internet is completely secure. Please avoid sending sensitive information to us by unencrypted email.

13. Third-Party Links
Our store may link to external websites and platforms, such as our Instagram account. We are not responsible for the privacy practices of these third parties. Please review their privacy policies when you visit them.

14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. The current version is always available on this page, and the "Last updated" date shows when it was last revised.