Skip to content
ROCK your BABY ROCK your BABY
DE EN

Privacy policy

1. Controller

Cullatec GmbH
Managing Directors: Max Arendt, Alexander Stephan Rieth
Saarland University, Building A 1.1
66123 Saarbrücken, Germany
Phone: +49 160 95822847
Email: info@cullatec.com

2. Hosting and server logs

When you access our website or shop, the server processes data including your IP address, time of access, requested address, amount of data transferred, referrer, browser and operating system. This data is required to deliver content, detect attacks and secure technical operations. Our legitimate interest is a secure and reliable service. The legal basis is Article 6(1)(f) GDPR.

Our hosting provider is ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Server logs are generally deleted or anonymised after no more than seven days. If a specific security incident occurs, affected logs may be retained for longer until the incident and any legal claims have been resolved.

3. Strictly necessary cookies and browser storage

Shop sessions, baskets, checkout, language selection and storage of your privacy choice require cookies or local or session browser storage. Without these functions, the shop service you explicitly request cannot be provided in full. Storage or access is permitted without consent under section 25(2)(2) TDDDG; subsequent processing is based on Article 6(1)(b) or (f) GDPR depending on the function. Our legitimate interest is a secure, usable website and verifiable observance of your choice.

Your privacy choice is stored in your browser for up to 180 days. Shop session data generally ends when the session expires or is deleted. You may delete browser data at any time in your browser.

4. Analytics, marketing and campaign attribution

Analytics and marketing are activated only after your corresponding voluntary choice. The legal bases are your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You may change your choice at any time for the future through “Cookie settings” in the footer.

After analytics or marketing consent, we store campaign parameters and click identifiers supplied with the page request together with the landing page, referrer, time and a randomly generated session identifier for up to 90 days in your browser. This enables visits and purchases to be attributed to campaigns. Names, email addresses, telephone numbers, postal addresses, free text, engraving text and payment data are not included in tracking events.

5. Contact, newsletter and sound download

We process contact-form and email enquiries to handle your request under Article 6(1)(b) GDPR for pre-contractual or contractual matters and otherwise under Article 6(1)(f) GDPR. Our legitimate interest is responding to legitimate enquiries. Enquiries are generally stored until handling is complete and then no longer than the end of the regular statutory limitation period, unless a longer obligation or legal dispute applies.

Newsletter registration uses double opt-in and is based on your consent. For a requested sound download, we use your email address to send the link. Voluntary information, such as the expected month of birth, is used only to select suitable content and offers. You may withdraw consent at any time. After unsubscribing, we delete distribution-list data; evidence of consent may be retained for up to three years to defend legal claims.

6. Customer account, order and withdrawal

For customer accounts, checkout, orders and withdrawals we process in particular master, contact, delivery, order, status and communication data. Mandatory fields are required to conclude and perform the contract; without them we cannot process the order. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(c) GDPR for commercial and tax obligations.

Customer-account data is stored until the account is deleted, unless a retention obligation applies. Contract and order data is stored for performance and statutory claims. Accounting records are generally retained for eight years and commercial correspondence for six years. Data submitted through the electronic withdrawal function is processed to handle and evidence the withdrawal and to confirm its receipt without delay.

7. Payments

For classic advance bank transfer, we process payment reference, account holder and receipt of payment. For credit or debit card, Apple Pay, Google Pay, Revolut Pay and Pay by Bank we use Revolut Bank UAB, Konstitucijos ave. 21B, 08130 Vilnius, Lithuania. Data required for the selected payment method is transmitted, in particular order reference, amount, currency and technical transaction data. Depending on the payment method, participating banks, card networks and Apple or Google are also involved. We do not store full card details in the shop.

The legal basis is Article 6(1)(b) GDPR. Security and fraud checks are based on Article 6(1)(f) GDPR; our legitimate interest is preventing abusive payments. Further information: Revolut Pay Checkout, Apple Privacy and Google Privacy.

8. Shipping and transactional emails

We provide the carrier appointed for the particular order with the name, delivery address and contact details needed for delivery. Order, payment, dispatch, invoice and withdrawal messages are sent through our email services hosted by ALL-INKL.COM. The legal bases are Article 6(1)(b) and (c) GDPR.

9. Google Analytics 4 and Google Ads

After analytics consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse reach, origin, page sequences and funnel activity. Data processed includes shortened IP and device information, page views, campaign parameters, product views, basket and checkout steps, order number and purchase value. Google Signals is disabled. Personal shop fields and payment data are not transmitted as events.

Google Ads does not receive a second parallel purchase measurement; it uses the GA4 purchase conversion linked to the Google Ads account. User and event data in the standard GA4 property is retained for no more than 14 months in accordance with the configured retention period; aggregated reports may continue to exist. The legal basis is your consent. Google Privacy.

10. Meta Pixel

After marketing consent, we use the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, to measure and optimise advertising. Page and shop events, technical browser and device information, campaign identifiers and, for purchases, order number and purchase value are transmitted. Names, contact details, postal addresses, engraving text and payment data are not transmitted as events. The legal basis is your consent. Meta Privacy.

11. TikTok Pixel and Events API

After marketing consent, we use the TikTok Pixel and, for purchase events, the TikTok Events API from TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Browser and server reports use the same event identifier so that a purchase is not counted twice. Page and purchase events, campaign and cookie identifiers, IP address, browser identifier, order number, purchase value and, where available, the TikTok click identifier are processed. Names, email addresses, telephone numbers, postal addresses, payment data and engraving text are not transmitted as tracking events. The legal basis is your consent. TikTok Privacy.

12. Recipients and international transfers

Recipients are limited to service providers required for hosting, communication, payment, delivery, statutory duties and consented analytics or advertising. Google, Meta and TikTok may transfer data to affiliated companies and service providers outside the European Economic Area. Where no adequacy decision applies to the recipient country, transfers are based in particular on standard contractual clauses approved by the European Commission and additional safeguards; the EU-US Data Privacy Framework may apply to certified US recipients. You may request a copy or more information about the applicable safeguards from info@cullatec.com.

13. Affiliate and influencer programme

Only if you apply for or participate in the affiliate or influencer programme do we process master, contact, participation, attribution, commission and payout data to operate and settle the programme under Article 6(1)(b) and (c) GDPR. Abuse and settlement checks are based on Article 6(1)(f) GDPR. Unsuccessful applications are generally deleted after six months unless consent to longer contact or another legal basis applies.

14. Your rights and supervisory authority

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection. Consent may be withdrawn at any time for the future. No solely automated decision with legal or similarly significant effect is made.

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken, www.datenschutz.saarland.de. Please send questions and requests concerning your rights to info@cullatec.com.