Privacy policy
Last updated on: 27 August 2026
Data Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Ybrato Owner: Markus Maier Peissenbergstraße 10 81547 Munich Germany
Email: info@ybrato.com Phone: +49 163 2515832
We have not appointed a data protection officer, as there is no legal obligation to do so.
General
YBRATO operates this store and website in order to provide you, the customer, with a curated shopping experience (the "Services"). YBRATO is powered by Shopify. This Privacy Policy describes how we collect, use, and disclose personal information when you visit, use, or make a purchase, or otherwise communicate with us.
What Personal Information We Process
Depending on how you interact with the Services, we may collect or process the following categories of personal information:
Contact details including your name, postal address, billing address, shipping address, phone number, and email address.
Financial information including credit card, debit card, and financial account numbers, payment card information, transaction details, form of payment, payment confirmation, and other payment details.
Account information including your username, password, security questions, configurations, and settings.
Transaction information including the items you view, put in your cart, add to your wishlist, or purchase, return, exchange, or cancel, as well as your past transactions.
Communications with us including the information you provide when communicating with us.
Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.
Usage information including information about your interaction with the Services.
Provision of the Website and Server Log Files
When you access our website, your browser automatically transmits information to the server, which is temporarily stored in log files: IP address, date and time of access, the page accessed, the volume of data transferred, browser type, and operating system. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in ensuring the trouble-free operation and security of the website.
How We Use Your Personal Information
Depending on how you interact with us, we may use personal information for the following purposes: to provide, tailor, and improve the Services (including performing our contract with you, processing your payments, fulfilling your orders, managing your account, arranging shipping, and enabling returns, exchanges, and reviews); for marketing and advertising; for security and fraud prevention; to communicate with you; and for legal reasons, to comply with applicable law.
Legal Bases for Processing
We process your personal information on the following legal bases:
Performance of a contract (Art. 6(1)(b) GDPR): to process your order, payment, and delivery, and to manage your customer account.
Consent (Art. 6(1)(a) GDPR): for sending marketing emails and for the use of non-essential cookies and analytics/marketing services.
Legal obligation (Art. 6(1)(c) GDPR): to comply with statutory retention obligations, for example under tax and commercial law.
Legitimate interests (Art. 6(1)(f) GDPR): to ensure the security of our website, to prevent fraud, and to tailor our offering to your needs. Our legitimate interest lies in the secure and economical operation of the online shop.
Obligation to Provide Data
The provision of certain personal information is necessary for the conclusion and performance of the purchase contract. In particular, we require your contact, billing, and delivery details as well as your payment data in order to process your order and perform the contract with you. Without this information, we cannot conclude the contract or fulfil your order. The provision of any further data is voluntary and not required for the conclusion of the contract.
Services and Recipients We Use
Under certain circumstances, we disclose personal information to third parties who provide services on our behalf or act as independent controllers:
Shopify (Shopify International Ltd., Ireland) – operation and hosting of the online shop, as well as related functions and applications provided by Shopify itself. Legal basis: Art. 6(1)(b) and (f) GDPR. Further information: privacy.shopify.com.
Payment service providers – Depending on the payment method you select, your payment data is transmitted to the relevant provider: PayPal (Europe) S.à r.l. et Cie, S.C.A (Luxembourg); Klarna Bank AB (Sweden); Apple Inc.; Google Ireland Ltd.; Shopify International Ltd. (Shop Pay); EPI Company SE / Wero (Belgium); and the providers of Bancontact and eps. Legal basis: Art. 6(1)(b) GDPR.
Klarna (Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden) – If you select a Klarna payment method during checkout (e.g. invoice or instalment purchase), we and/or Klarna transmit the data required to process it. In doing so, Klarna carries out processing for payment handling and for identity and credit checks, and may obtain information from credit reference agencies for this purpose. The legal basis is Art. 6(1)(b) GDPR as well as Klarna's legitimate interest under Art. 6(1)(f) GDPR. Further information can be found in Klarna's privacy notice.
MobilePay (MobilePay ApS, Ryesgade 3F, 2200 Copenhagen, Denmark) – If you select MobilePay as payment method during checkout, we and/or MobilePay transmit the data required to process the payment (e.g. contact and payment details). Legal basis: Art. 6(1)(b) GDPR.
DHL / Deutsche Post (DHL Group, Germany) – shipping and parcel tracking; for this purpose we transmit your delivery address and, where applicable, contact details. Legal basis: Art. 6(1)(b) GDPR.
Google & YouTube channel (Google Ireland Ltd.) – Through this channel we transmit product data to Google in order to display our products in Google services (e.g. free product listings, Shopping ads). Legal basis: Art. 6(1)(f) GDPR; where consent-requiring cookies are set in this context, Art. 6(1)(a) GDPR.
GOAFFPRO (GoAffPro, 16, Sector 20, Haryana, India) – We use GOAFFPRO to manage our partner/affiliate program. This involves setting referral cookies and processing data of visitors who reach our website via a referral link. The legal basis for the cookies used is Art. 6(1)(a) GDPR (consent). As the provider is based in India, a transfer to a third country takes place (see the section "International Transfers").
Revoq – EU Withdrawal Button – We use this application to provide the legally required withdrawal button. Where personal information (e.g. details in a withdrawal form) is processed in this context, this is done to comply with our legal obligations under Art. 6(1)(c) GDPR.
Shopify "Translate & Adapt" – We use this application to provide our website in multiple languages. Processing takes place within the scope of Shopify hosting.
In addition, we disclose personal information where you request or consent to it, to our affiliates, and in connection with legal obligations or a business transaction (e.g. merger or bankruptcy).
Cookies and Similar Technologies
Our website uses cookies. We use technically necessary cookies (e.g. for the shopping cart and session management) on the basis of Art. 6(1)(f) GDPR. For all non-essential cookies – in particular analytics, marketing, and affiliate cookies – we obtain your consent in accordance with Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR via our cookie banner. You can withdraw your consent at any time with effect for the future via the cookie settings.
Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services is transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside. In these circumstances, Shopify is jointly responsible for the processing of your personal information. Further information can be found in the Shopify Consumer Privacy Policy at privacy.shopify.com.
Third-Party Websites and Links
The Services may provide links to websites or other platforms operated by third parties. If you follow such links, you should review their privacy policies. We are not responsible for the privacy or security of such websites.
Children's Data
The Services are not intended to be used by children, and we do not knowingly collect any personal information about children who are below the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details below to request its deletion.
Security and Retention of Your Information
Please be aware that no security measures are perfect or impenetrable, and we therefore cannot guarantee "perfect security." We recommend that you do not use unsecure channels to communicate sensitive information to us.
We retain personal information from order processing for the duration of the statutory retention periods (in particular commercial and tax law periods of up to ten years pursuant to Section 147 AO and Section 257 HGB). We retain your customer account data for as long as the account exists; after its deletion, we remove the data unless statutory retention periods require otherwise. We retain server log data only for as long as necessary for the security and operation of the website, and delete or anonymize it thereafter. The retention period of individual cookies depends on their respective purpose and ranges from the duration of your session to several months. Data based on consent is stored until the consent is withdrawn. Otherwise, we store personal information only for as long as necessary for the stated purposes.
Automated Decision-Making
We do not carry out any decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you. If you select a Klarna payment method, Klarna may, as an independent controller, carry out an automated assessment for identity and credit-check purposes; further information can be found in Klarna's privacy notice.
Your Rights
You have the following rights in relation to your personal information:
Right of access. You have the right to request access to the personal information we hold about you.
Right to erasure. You have the right to request the deletion of the personal information we hold about you.
Right to rectification. You have the right to request the correction of inaccurate personal information.
Right to data portability. You have the right to receive a copy of the personal information we hold about you and to request its transfer to a third party.
Right to object and to restriction of processing. You have the right to object to the processing of your personal information for certain purposes or to request its restriction.
Withdrawal of consent. Where we rely on consent, you have the right to withdraw it at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.
Managing communication preferences. You can object to receiving marketing emails at any time by using the unsubscribe option in our emails.
You will not suffer any disadvantage from exercising these rights. We may need to verify your identity in order to process your request.
Complaints
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.
International Transfers
We may transfer, store, and process your personal information outside the country in which you reside. Where we transfer your personal information outside the European Economic Area (for example to GOAFFPRO in India), we rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, unless the transfer is to a country for which an adequacy decision exists.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised version on this website and update the "Last updated" date.
Contact
Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of your rights, please contact us by phone at +49 163 2515832, by email at info@ybrato.com, or by post at Peissenbergstraße 10, 81547 Munich, Germany.
