Privacy policy

Last updated: 23 October 2025

Wavy24 operates this shop and website, including all related information, content, features, tools, products and services, in order to provide you with an individual shopping experience (the “Services”). Wavy24 is powered by Shopify. This privacy policy explains how we collect, use and disclose personal data when you visit or use the website, make a purchase or another transaction using the Services, or otherwise communicate with us. If there is a conflict between our Terms and this privacy policy regarding the collection, processing or disclosure of personal data, this privacy policy takes precedence.

Please read this privacy policy carefully. By using or accessing any of the Services, you acknowledge that you have read this privacy policy and understand the collection, use and disclosure of your data as described below.

Personal data that we collect or process

“Personal data” means information that identifies you or another person, or that can reasonably be linked to you. It does not include anonymous information or information anonymised so that it can no longer be attributed to you. Depending on how you interact with the Services, where you live and what applicable law permits or requires, we may collect or process the following categories of data and inferences drawn from them:

• Contact details: name, postal address, billing address, delivery address, telephone number and email address.
• Financial data: credit-card, debit-card and financial-account numbers, payment-card and account information, transaction details, payment method, payment confirmation and other payment details.
• Account information: username, password, security questions, configurations and settings.
• Transaction information: items that you view, place in your shopping cart or wishlist, purchase, return, exchange or cancel, as well as previous transactions.
• Communications with us: information provided when you contact us, for example when you submit a support request.
• Device information: information about your device, browser or network connection, IP address and other unique identifiers.
• Usage information: information about how and when you interact with or browse the Services.

Sources of personal data

We may collect personal data directly from you, automatically through the Services and through cookies or similar technologies, from service providers acting on our behalf, and from partners or other third parties.

How we use personal data

Depending on how you interact with us and which Services you use, we may process personal data for the following purposes:

• Providing, adapting and improving the Services: fulfilling our contract with you, processing payments, fulfilling orders, saving your preferences and items of interest, sending account-related notifications, managing accounts, organising shipping, facilitating returns and exchanges, enabling reviews and creating a more individual shopping experience, including product recommendations.
• Marketing and advertising: sending marketing communications by email, SMS or post and displaying advertising online, including through Google Ads, Meta Ads and Microsoft Advertising (Bing Ads), where permitted and, where required, on the basis of your consent.
• Abandoned-cart reminders: if you begin the ordering process, provide your email address and do not complete the purchase, we may send a reminder on the basis of our legitimate interest under Article 6(1)(f) GDPR. You may object at any time.
• Security and fraud prevention: authenticating accounts, securing payments and purchases, detecting, investigating and taking action against fraudulent, illegal, unsafe or malicious activities and protecting public safety and our Services.
• Communicating with you: providing customer support, responding to enquiries and maintaining our business relationship.
• Legal reasons: complying with applicable law, responding to lawful requests, handling actual or potential disputes and enforcing our terms and policies.

How we disclose personal data

For legitimate purposes described in this policy, we may disclose personal data to Shopify, service providers and other third parties acting on our behalf, including providers of IT management, payment processing, data analysis, customer support, cloud storage, fulfilment and shipping. We may also disclose data to business and marketing partners that provide marketing services and display advertising, to affiliates within our corporate group, at your request or with your consent, and in connection with business transactions, legal obligations, enforcement of terms or the protection of rights and safety.

With your consent under Article 6(1)(a) GDPR, we may use in particular:

• Google Ads: services of Google Ireland Limited, including cookies and similar technologies for conversion tracking, measuring advertising success and remarketing. Data may be transferred to servers in the United States.
• Meta Ads: services of Meta Platforms Ireland Limited, including the Meta Pixel, for conversion tracking and interest-based advertising on platforms such as Facebook and Instagram. Data may be transmitted to Meta and processed in the United States.
• Microsoft Advertising (Bing Ads): services of Microsoft Ireland Operations Limited, including Universal Event Tracking, for analysing campaigns and displaying personalised advertising in the Microsoft advertising network. Data may also be transferred to the United States.

Further information and available choices can be found in the privacy policies of the respective providers.

Relationship with Shopify

The Services are hosted by Shopify. Shopify collects and processes personal data relating to your access to and use of the Services in order to provide and improve them. Data submitted through the Services is shared with Shopify and may also be processed by third parties in countries other than your country of residence. We also use certain advanced Shopify features that take account of your interactions with our shop, other merchants and Shopify. For these purposes, Shopify may be responsible for processing your personal data and for responding to requests regarding your rights. Further information is available in Shopify’s consumer privacy policy and at https://privacy.shopify.com/en.

Third-party websites and links

The Services may contain links to websites or online platforms operated by third parties. Please review their privacy, security and other terms. We are not responsible for the privacy, security, accuracy or reliability of third-party websites. Information shared in public or semi-public areas, including social networks, may also be viewed by other users.

Children’s data

The Services are not intended for children, and we do not knowingly collect personal data from children who have not reached the age of majority in their country. Parents or guardians may contact us to request deletion of data provided by a child. As of the effective date of this policy, we are not aware that we “share” or “sell” personal data of persons under 16 years of age as those terms may be defined under applicable law.

Security and retention

No security measures are perfect or impenetrable. We cannot guarantee perfect security, and information transmitted to us may be exposed to risks during transmission. Please do not use insecure channels to send sensitive or confidential information. We retain personal data for as long as necessary, taking account of account management, the provision of Services, legal obligations, dispute resolution and enforcement of contracts and policies.

Your rights and choices

Depending on where you live and subject to applicable limitations, you may have rights of access, deletion, correction and data portability. You may opt out of marketing emails at any time using the unsubscribe option in our emails. If you live in the United Kingdom or the European Economic Area, you may also have the right to object to or restrict processing and to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

You may exercise your rights where indicated within the Services or by contacting us. We may need to verify your identity and, where legally permitted, an authorised agent may submit a request on your behalf. Exercising your rights will not result in any disadvantage.

Complaints

If you have a complaint about how we process personal data, please contact us. Depending on where you live, you may also have the right to lodge a complaint with the competent data-protection authority.

International transfers

We may transfer, store and process personal data outside your country of residence. Where data is transferred outside the European Economic Area or the United Kingdom, we rely on recognised transfer mechanisms, such as the European Commission’s Standard Contractual Clauses or equivalent agreements issued by the competent UK authority, unless the receiving country provides an adequate level of protection.

Changes to this privacy policy

We may update this privacy policy to reflect changes to our practices or for operational, legal or regulatory reasons. We will publish the revised policy on this website, update the date and provide any notice required by applicable law.

Contact

If you have questions about our privacy practices or this policy, or wish to exercise your rights, contact us by email at kontakt@wavy24.de or by post at Way2Buy GmbH, Kirchweg 128F, 24558 Henstedt-Ulzburg, Germany. For the purposes of applicable data-protection law, we are the controller of your personal data.