Privacy Policy

This privacy policy applies to the online shop at https://smarfie.com/en (Smarfie brand).
It informs you about the nature, scope and purpose of the processing of personal data in accordance with the GDPR and the BDSG (German Federal Data Protection Act).

1. Controller

Handelskontor Fieberg GmbH

Dornenbusch 21

32805 Horn-Bad Meinberg

Germany

Managing Director: Marcus Fieberg

Commercial register: HRB 10647, Amtsgericht Lemgo

Phone: +49 (0)179 4709011

Email: info[@]handelskontor-fieberg.de

Further information: Imprint.
You may submit privacy-related enquiries via the contact form or the email address stated above.

2. Purpose of this shop

smarfie.com is the online shop of the Smarfie brand.
We process data in order to maintain customer accounts, process orders, issue invoices and perform the contract.
An order is also possible without a customer account.

3. Hosting

The website is operated in a data centre in Germany.
The hosting provider processes master and connection data on our behalf (Art. 28 GDPR).
A data processing agreement is in place.

4. Server log files

When pages are accessed, the web server automatically stores:

• IP address
• Date and time of the request
• URL accessed, referrer
• Browser type and operating system
• HTTP status code

Legal basis: Art. 6(1)(f) GDPR (operation, security, prevention of misuse).
Logs are generally deleted after a few days, unless longer retention is required to investigate attacks.

5. Cookies and session

We use only technically necessary cookies.
There is no tracking, no Google Analytics and no advertising cookies.

• Session cookie: maintains login, language, shopping cart and CSRF protection. Deleted when the browser is closed or after logout.
• Stay signed in: only if you actively choose this on the login page. The session then persists across browser restarts until you sign out or the period expires.

Legal basis: Art. 6(1)(b) and (f) GDPR as well as Section 25(2) TDDDG (strictly necessary cookies).

6. Registration and customer account

Upon registration we collect:

• First and last name
• Email address, phone (optional)
• Password (stored only as a hash)

The email address is used to confirm the account.
Access becomes active after confirmation of the email address.
Legal basis: Art. 6(1)(b) GDPR (preparation and performance of the contract).

In the account you can view and change profile details (company optional), shipping and billing addresses, orders, invoices and access credentials.
Failed login attempts may temporarily lock the account (security, Art. 6(1)(f) GDPR).

7. Orders and payment

At checkout we store order items, billing and shipping address, selected shipping method and payment method.
Payment is processed via PayPal.

We retain invoices and business correspondence in accordance with commercial and tax law (generally 6 or 10 years, Art. 6(1)(c) GDPR, Section 147 AO, Section 257 HGB).

For payment via PayPal, PayPal’s privacy notices apply (PayPal (Europe) S.à r.l.
et Cie, S.C.A., Luxembourg).
The legal basis is Art. 6(1)(b) GDPR.

8. Shipping

For delivery we transmit name, address and necessary contact details to the shipping provider commissioned in each case.
Only to the extent required for delivery.
Legal basis: Art. 6(1)(b) GDPR.

9. Contact form

Via the form (company, name, email, subject, message) you can reach us without a public email address on the page.
The details are used solely to process your enquiry.
Legal basis: Art. 6(1)(b) or (f) GDPR.
We delete enquiries once they have been dealt with and no retention obligation applies.

10. Email

We send emails for account confirmation, password reset and orders.
This is required for the contract or the security of the account (Art. 6(1)(b) and (f) GDPR).
We do not send newsletters without separate consent.

11. Recipients

Personal data are received only by those who need them to fulfil the purposes stated above:

• Hosting and system operation in Germany
• Shipping providers
• Payment service providers, where you choose that payment method
• Tax advisers, authorities, where required by law

We do not transfer data to a third country outside the EU/EEA, except where you yourself choose a service based outside (e.g. PayPal).
In that case the safeguards of the respective provider apply (for example EU standard contractual clauses).

12. Retention period

Account data remain for as long as the customer account exists and statutory periods run.
After deletion of the account we remove the data insofar as no commercial or tax law obligations prevent this.
Server logs: see section 4. Form enquiries: see section 9.

13. Your rights

You have the following rights vis-à-vis us:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an informal message via the contact form or to info[@]handelskontor-fieberg.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the authority responsible for us:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

Kavalleriestraße 2–4

40213 Düsseldorf

https://www.ldi.nrw.de/

14. Obligation to provide data

Without the details marked as mandatory upon registration and ordering, we cannot maintain a customer account or perform a contract.
The phone number is optional.

15. No automated decision-making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

16. SSL/TLS

Transmission takes place via HTTPS (TLS).
Without this encryption, data on the network would be readable in plain text.

17. Changes

We update this policy when the shop, the legal situation or the services used change.
The version published on this page applies in each case.

Last updated: 24 September 2026