Privacy policy

Updated: 1 October 2026

1. Controller and privacy contact

Dontix GmbH
Naurather Str. 8
54313 Zemmer, Germany
+49 (0) 6580 3090601
info@dontix.de

This notice explains how personal data is processed when you visit www.dontix.de, contact us or place an order. For privacy questions and to exercise your rights, contact Ammar Al-Naeb: datenschutz@dontix.de.

2. Website, Shopify and security

Our online shop runs on Shopify. Providing the website, cart, checkout and customer accounts involves processing IP addresses, browser and device information, pages visited, timestamps, session identifiers, and contact, account and order data. Security and log data support reliable operation and prevent misuse. The legal bases are Article 6(1)(b) GDPR for requested services and Article 6(1)(f) GDPR for our legitimate interest in a secure, functioning shop.

Shopify International Limited, Ireland, and affiliated companies participate in processing. Shopify acts as a service provider for shop operations and may act as a controller for certain additional services. Where those services are used, interactions with our shop and other merchants may be processed for improvement, personalisation and advertising; any required consent applies. Information and rights concerning Shopify: Shopify Consumer Privacy Policy. The website uses HTTPS to encrypt data in transit.

3. Contact, chat, accounts and orders

When you contact us by form, email, telephone or Shopify chat, we process the contact details, messages and any order information you provide to handle your enquiry. Please do not send patient data or other particularly sensitive information. For accounts and orders, we process names, business contact details, billing and delivery addresses, ordered items, and payment and transaction information. Required fields are necessary for the service concerned; without them, we may be unable to handle your enquiry or order. Other information is optional.

The legal bases are Article 6(1)(b) GDPR for contracts and pre-contractual enquiries, Article 6(1)(f) GDPR for other communication and customer support, and Article 6(1)(c) GDPR for legal obligations. Processing the personal data of our business customers' contact persons serves our legitimate interest in managing the business relationship.

We use Zoho Inventory to manage customer, order, invoice and shipping data. The provider involved is Zoho Corporation B.V., Netherlands, with affiliated companies. Necessary data is also received by the payment and shipping providers used for your order, IT providers and, where appropriate, tax advisers and legally authorised authorities. Depending on your payment method, payment information is also processed directly by the payment provider.

4. Cookies and your choices

Cookies and similar technologies support functions such as the cart, sign-in, security and remembering privacy choices. Strictly necessary storage or access is governed by section 25(2) of Germany's TDDDG; subsequent personal-data processing is based on Article 6(1)(b) or (f) GDPR, depending on its purpose. Non-essential technologies, particularly analytics and personalised advertising, require consent under section 25(1) TDDDG and Article 6(1)(a) GDPR.

Consent is voluntary and can be withdrawn for the future. Use the cookie banner's choices or available cookie settings, or contact our privacy contact. Browser settings also allow cookies to be deleted or blocked, which may limit shop functions. Withdrawal does not affect the lawfulness of earlier processing.

5. Analytics, advertising and external content

The following integrations are configured in the shop. Consent is the legal basis for personal-data processing for analytics and advertising and for non-essential external content (Article 6(1)(a) GDPR and, for device access, section 25(1) TDDDG). This data is not necessarily anonymous: identifiers and events may be associated with a browser, device or existing provider profile.

Google Analytics and Google Ads: Google Ireland Limited, Ireland, with Google LLC, USA. Visit, device and event data, including page views, product views, cart and purchase events, supports audience analysis, performance measurement and advertising. Depending on settings, the Google & YouTube integration may also process customer data to match advertising events.
Meta Pixel: Meta Platforms Ireland Limited, Ireland, with Meta Platforms, Inc., USA. Usage and purchase events and technical identifiers enable advertising measurement, audience creation and personalised ads on Facebook and Instagram. Meta may associate data with its own profiles. Joint-controller arrangements with Meta apply to the collection and transmission of pixel events; subsequent processing is carried out by Meta.
Lucky Orange: Lucky Orange LLC, USA. Usage analytics, heatmaps and session replays may capture pages visited, device information, clicks, mouse movements, scrolling and displayed page content. The content captured depends on the features and privacy settings used. This data is not automatically fully anonymous.
Google content: Google merchant features and embedded YouTube content may transmit technical usage data to Google. External links to social networks or WhatsApp lead to the respective providers, whose privacy notices apply there. Meta Pixel is a separate integration.

Shopify security features, including hCaptcha, may process technical browser, device and interaction data to prevent automated misuse. The purpose is abuse prevention, based on Article 6(1)(f) GDPR. The device-access exception applies only where access is strictly necessary for the requested function; otherwise consent is required.

6. Email marketing

Newsletters rely on your consent (Article 6(1)(a) GDPR). We process your email address, optional information and subscription evidence. Marketing to existing customers without separate consent is envisaged only under section 7(3) of Germany's UWG: the address was obtained during a sale, advertising concerns our own similar goods or services, you have not objected, and you are informed of your right to object when the address is collected and in every message. The data-protection basis is then Article 6(1)(f) GDPR. You can opt out at any time using the unsubscribe link or by contacting us; only ordinary transmission costs may apply.

7. International processing and retention

Shopify, Zoho, Google, Meta and Lucky Orange may arrange processing outside the European Economic Area, particularly in the USA, Canada or India. Depending on the recipient and transfer, an applicable adequacy decision or appropriate safeguards under Article 46 GDPR apply, notably EU Standard Contractual Clauses. Shopify uses Binding Corporate Rules for certain transfers within its group. You can request information about the safeguards applicable to a particular transfer and a copy from our privacy contact.

We retain data for as long as its purpose requires. Account and contract data is needed for the business relationship; enquiries are retained until resolved and, where necessary, to protect legal claims. Invoices and business records are subject to statutory commercial and tax retention periods. Analytics, advertising and cookie-data retention depends on the purpose and service settings. Data is deleted or anonymised when its purpose ends, unless a legal obligation or necessary protection of claims requires retention. Consent records and a minimal marketing suppression list may be needed longer to document consent or honour your objection.

8. Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw consent at any time for the future. You can object to processing based on legitimate interests for reasons relating to your particular situation, and to direct marketing, including related profiling, at any time without giving reasons. Contact: datenschutz@dontix.de.

You may complain to a data-protection supervisory authority, especially where you live or work or where an alleged infringement occurred. The authority responsible for Dontix is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate: www.datenschutz.rlp.de.