The controller responsible for the processing of your personal data on this website is:
Spandex Party Shop
BDE Consulting GmbH
Motzstraße 28
10777 Berlin
Germany
Managing Director: Simon Wicki
Email: shop@spandexpartyshop.com
We are not legally required to appoint a Data Protection Officer. If you have any questions about data protection, you may contact us at any time using the contact details provided above.
We process personal data only where there is a legal basis to do so. Depending on the situation, the legal basis is:
We delete personal data as soon as the purpose for which it was collected no longer applies, unless statutory retention periods require us to keep it.
This website is hosted on Amazon Web Services (AWS). The infrastructure is operated on our behalf as a processor under Art. 28 GDPR by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, provided this is the contracting entity shown in our AWS account and/or invoices.
We use AWS services in the Europe (Frankfurt) region, Germany (eu-central-1). To the extent technically configurable by us, the personal data processed for operating this website is stored and processed within the European Union.
AWS processes personal data on our behalf on the basis of the AWS Data Processing Addendum, which is incorporated into the AWS Service Terms and applies to the use of AWS services for the processing of customer data.
When you visit this website, the servers automatically collect and store information that your browser transmits, in so-called server log files:
This data is technically necessary to display the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR, based on our legitimate interest in the secure and stable operation of this website.
This data is not merged with other data sources. Server log files are generally deleted after 14 days, unless longer retention is necessary in individual cases to investigate or defend against a specific security incident.
This site uses SSL/TLS encryption for security and to protect the transmission of confidential content, such as orders and enquiries you send to us. You can recognise an encrypted connection by the “https://” prefix and the lock symbol in your browser's address bar.
This website only uses technically necessary cookies that are required for the basic functioning of the shop, such as keeping the items in your shopping cart during your visit and processing payments at checkout. These cookies do not track you and are not used for analysis or advertising. The legal basis for storing technically necessary information on your device is § 25(2) TDDDG; the associated processing of personal data is based on Art. 6(1)(f) GDPR. We do not use any analytics, tracking, or advertising cookies.
When you place an order, we collect and process the data you provide for the purpose of fulfilling the contract: your name, shipping and billing address, email address, the products ordered, and order/payment details. The legal basis is Art. 6(1)(b) GDPR. Orders can be placed as a guest; we do not require you to create an account.
We retain order-related data for the duration of the contract and thereafter for as long as we are required to under commercial and tax law (statutory retention periods under § 257 HGB and § 147 AO; depending on the document type these are generally 6, 8 or 10 years). The legal basis for this continued storage is Art. 6(1)(c) GDPR. After these periods expire, the data is deleted.
We offer payment via the following payment service providers. Depending on the payment method you choose, the data required for the payment (such as your name, address, email, order amount and, where applicable, your card details) is transmitted to the relevant provider so that the payment can be processed. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and, where applicable, Art. 6(1)(f) GDPR (efficient payment processing). The payment providers act as independent controllers for the payment data they process.
PayPal
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22-24 Boulevard Royal, L-2449 Luxembourg
For details, see PayPal's privacy policy.
Mollie (incl. credit card payments)
Mollie B.V.
Keizersgracht 126, 1015 CW Amsterdam, Netherlands
For details, see Mollie's privacy policy.
To deliver your order, we pass the data necessary for delivery (in particular your name and delivery address) to our shipping service provider:
DHL (operated by Deutsche Post AG / DHL Group)
We currently ship using the DHL services Warenpost, Warenpost International and Paket International. The legal basis is Art. 6(1)(b) GDPR. For international shipments, the data required for customs clearance may additionally be shared with the relevant authorities. DHL processes this data as an independent controller; please see DHL's privacy policy for details.
If you contact us by email, we process the personal data you provide (your email address and the content of your message) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). We delete this data once your enquiry has been fully dealt with and no statutory retention periods apply.
We only share your data with third parties where this is necessary, in particular with our hosting provider (as a processor), our payment providers, and our shipping service provider, as described above, as well as with tax advisors and authorities where we are legally required to do so. We do not sell your data, and we do not use it for advertising or profiling.
We process your data within the European Union/EEA wherever possible; our hosting and order data are stored in Germany. Where data is nonetheless transferred to a third country (for example in the course of payment processing by our payment providers), this only takes place on the basis of an adequacy decision, appropriate safeguards such as the EU Standard Contractual Clauses, or another legal basis under Chapter V GDPR.
You have the following rights regarding your personal data:
To exercise any of these rights, contact us at shop@spandexpartyshop.com.
Where we process your personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to that processing. If you object, we will no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Alt-Moabit 59-61, 10555 Berlin, Germany
You may also contact the supervisory authority in your country of residence or workplace.
For orders, the provision of certain data (name, address, email, payment data) is necessary to conclude and perform the contract. Without this data we cannot process your order.
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
We may update this privacy policy to reflect changes in our processing activities or in the legal requirements. The version published here at the time of your visit applies.
Last updated: 25.06.2026