Privacy policy

Last updated: 20 October 2026

This is an English translation for your convenience. In case of doubt, the German version applies.

1. Controller

YourNextBag, owner Jake Hargrave
Östliche Hauptstraße 17, 76684 Östringen, Germany
Email: your.next.bag@outlook.de

We process personal data only to the extent necessary to operate this shop, process your orders and communicate with you, or where you have given your consent.

2. Hosting and shop system

Our online shop runs on Shopify. The contracting party for merchants in Europe is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes our shop's data on our behalf (Art. 28 GDPR). Data may also be transferred to Shopify Inc. in Canada and to sub-processors in the USA. For Canada, an adequacy decision of the EU Commission exists; transfers to the USA are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (our legitimate interest in a secure and reliable shop).

3. Server log data

When you visit our shop, data transmitted by your browser is processed for technical reasons: IP address, date and time, page visited, referrer URL, browser type and operating system. This data is used to deliver the website, ensure stability and defend against attacks (Art. 6(1)(f) GDPR).

4. Cookies and consent

We use cookies and similar technologies that are strictly necessary to operate the shop – for example for the shopping cart, checkout, security and storing your cookie choice (Section 25(2) No. 2 TDDDG, Art. 6(1)(b) and (f) GDPR). We also store a note in your browser's session storage that the loading screen has already been shown; this entry contains no personal data and is deleted when you close the browser window.

We only use cookies for statistics, personalisation or marketing with your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). This includes in particular Shopify's visitor statistics. You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link in the shop.

5. Fonts

The fonts of this shop are delivered from Shopify's servers. No connection is made to servers of Google or other font providers.

6. Orders

For your order we process your name, billing and delivery address, email address, telephone number if provided, order and payment information. This information is required to conclude the contract; without it we cannot fulfil your order (Art. 6(1)(b) GDPR). After the contract has been completed, we store the data for as long as statutory retention periods apply (commercial and tax law, usually 6 to 10 years; Art. 6(1)(c) GDPR).

If you create a customer account, we store your details and order history until you have the account deleted (Art. 6(1)(b) GDPR).

7. Payment service providers

To process payments, we pass the necessary data (e.g. name, amount, order number, payment details) to the payment service provider you choose (Art. 6(1)(b) GDPR). Payment service providers also process data for fraud prevention under their own responsibility.

Shopify Payments (card, Apple Pay, Google Pay): Shopify International Limited (address see above) with its payment partner Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you use Apple Pay or Google Pay, Apple or Google additionally process data under their own privacy policies.
PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
Prepayment by bank transfer: your payment is received by our bank; we use the information only to match your payment.

8. Shipping

For delivery, we pass your name and delivery address to the shipping company we use: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, or Hermes Germany GmbH, Essener Straße 89, 22419 Hamburg (Art. 6(1)(b) GDPR). We only pass on your email address or telephone number if you have agreed to this beforehand (Art. 6(1)(a) GDPR), for example so that the carrier can inform you about the delivery.

9. Contact

If you write to us by email or via the contact form, we process your details to answer your enquiry (Art. 6(1)(b) GDPR for contract-related enquiries, otherwise Art. 6(1)(f) GDPR). Our email inbox is provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We delete enquiries once they have been dealt with and no retention obligations apply.

10. Newsletter

If you sign up for our newsletter, we will inform you by email about newly arrived items, offers and promotions in our shop. We only need your email address to sign you up. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) No. 2 UWG).

Confirmation (double opt-in): After signing up, you will receive an email with a confirmation link. We only send you the newsletter once you have clicked it. This ensures that nobody signs up with someone else's email address. We store the time of sign-up and confirmation so that we can prove your consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

Welcome discount: After confirming, you will receive a one-time discount code by email. The terms can be found under Newsletter discount. If you redeem the code, we process this as part of your order (Art. 6(1)(b) GDPR).

Sending and performance measurement: We send the newsletter with Shopify Messaging, a service of Shopify International Limited (address see section 2), acting on our behalf (Art. 28 GDPR). The newsletter contains an invisible tracking pixel and special links that show us whether an email was opened and which links were clicked. We use this analysis to improve the newsletter; it is covered by your consent. If you do not want this, please unsubscribe from the newsletter.

Unsubscribing and storage period: You can unsubscribe at any time – via the link at the end of every newsletter email or by sending a message to your.next.bag@outlook.de. This does not affect the lawfulness of processing carried out until then. After you unsubscribe, we will no longer send you the newsletter. We keep your email address and proof of your earlier consent for up to three years to prevent the newsletter from being sent again and to be able to defend ourselves against any claims (Art. 6(1)(f) GDPR). If you have placed an order with us, the retention periods in section 6 also apply.

11. Online withdrawal

For the “Withdraw from contract” function we use the app “EU Widerrufs-Button” by 401layers UG (haftungsbeschränkt), Dorothea-Erx.-Str. 1a, 40721 Hilden, Germany. It processes the details you enter in the withdrawal form (in particular name, order number and email address) in order to receive your withdrawal and confirm its receipt. We are legally obliged to do so (Section 356a BGB; Art. 6(1)(c) GDPR).

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal message to your.next.bag@outlook.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.