Privacy policy

This English version is a non-binding translation provided for your convenience. The legally binding version is the German one.

Last updated: 29 June 2026

1. Controller

KARTHA GO
Owner: Ahmed Masmoudi
Am Köhnen 76, 40599 Düsseldorf, Germany
Phone: +49 179 5284730 · Email: info@karthago-holzdeko.de

A data protection officer is not legally required, as the threshold of § 38 BDSG is not met.

2. General information on data processing

We process personal data only insofar as this is necessary to provide a functioning website together with our content and services. The legal bases are in particular Art. 6(1)(a), (b), (c) and (f) GDPR. Personal data is deleted as soon as the purpose of processing ceases to apply and no statutory retention obligations prevent this (see section 13).

3. Hosting (Shopify)

This website is hosted on the platform of Shopify International Ltd. (Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes order, contact and usage data on our behalf; a data processing agreement is in place. The legal basis is Art. 6(1)(f) GDPR (secure and efficient operation of the online shop). Shopify privacy notice: https://www.shopify.com/legal/privacy

4. Transfer of data to third countries

Some of the services used (including Shopify, PayPal, Klarna, Google, Meta, Pinterest, TikTok) also process data outside the EU/EEA, in particular in the USA and Canada. Insofar as data is transferred to the USA, this is based on the EU Commission's adequacy decision (EU-US Data Privacy Framework) for certified companies or on EU standard contractual clauses (Art. 46 GDPR). An adequacy decision exists for Canada. For individual services (in particular TikTok), a transfer to further third countries is possible, based on standard contractual clauses.

5. Server log files

When the website is accessed, information (including browser type, operating system, referrer URL, IP address, time) is automatically stored in server log files. The legal basis is Art. 6(1)(f) GDPR. For security reasons the log files are stored for a maximum of 30 days and then deleted.

6. Cookies and consent management

We use cookies that are technically necessary for operating the shop (e.g. the shopping cart) and – only with your consent – cookies for statistics and marketing purposes. You give your consent via our cookie banner and can withdraw it at any time with future effect via the cookie settings. The legal basis for consent-based cookies is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG; for technically necessary cookies, Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG.

7. Order processing

To process your order we process your master data (name, address, email) and contract data. We pass this on to shipping and payment service providers insofar as this is necessary for delivery and payment. The legal basis is Art. 6(1)(b) GDPR. Orders are possible as a guest without creating a customer account.

8. Payment service providers

For payment processing we use external service providers (e.g. Shopify Payments, PayPal, Klarna). The data collected during payment is processed by the respective provider as an independent controller in accordance with its own privacy policy; in the case of purchase on account/instalments, a credit check may be carried out. The legal basis is Art. 6(1)(b) GDPR. Privacy notices: PayPal https://www.paypal.com/de/legalhub/privacy-full · Klarna https://www.klarna.com/de/datenschutz/ · Shopify Payments https://www.shopify.com/legal/privacy

9. Shipping

To deliver your order we transmit your address data to the shipping company we commission (usually DHL – DHL Paket GmbH). The legal basis is Art. 6(1)(b) GDPR.

10. Contact form and email

If you contact us, we process your details in order to handle the enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR.

11. Newsletter

For sending the newsletter we use the double opt-in procedure; dispatch takes place via Shopify (Shopify International Ltd.). After signing up you receive an email with a confirmation link; only after confirmation do we add you to the distribution list. You can unsubscribe from the newsletter at any time. The legal basis is Art. 6(1)(a) GDPR.

12. Web analytics, tracking and marketing

Insofar as you consent via our cookie banner, we use the following analytics, tracking and marketing services. These process usage and device data (including IP address, device and browser data, interactions on the website) for reach, statistics, optimisation and advertising purposes, and use cookies or similar technologies for this. A transfer to third countries (in particular the USA) is possible (see section 4). The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. You can withdraw your consent at any time with future effect via the cookie settings.

  • Google (Google Ireland Ltd.): Google Analytics 4 and Google Ads (conversion tracking, remarketing). Privacy: https://policies.google.com/privacy
  • Meta (Meta Platforms Ireland Ltd.) for Facebook and Instagram: Meta Pixel and Conversions API (conversion tracking, remarketing, custom/lookalike audiences). Privacy: https://www.facebook.com/privacy/policy
  • Pinterest (Pinterest Europe Ltd.): Pinterest Tag (conversion tracking, advertising). Privacy: https://policy.pinterest.com/de/privacy-policy
  • TikTok (TikTok Technology Ltd.): TikTok Pixel (conversion tracking, advertising). Privacy: https://www.tiktok.com/legal/page/eea/privacy-policy/de

13. Storage period

We store personal data only for as long as is necessary for the respective purposes. Order and invoice data are subject to the statutory retention periods (in particular § 147 AO – 10 years, § 257 HGB – 6 years).

14. Data security

The website uses SSL/TLS encryption to protect the data transmitted.

15. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent given at any time with future effect. You also have the right to lodge a complaint with a supervisory authority, for us in particular: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, poststelle@ldi.nrw.de

16. Updates and changes

This privacy policy is currently valid. Changes in legal or regulatory requirements may make it necessary to amend it.