Privacy policy
Last updated: 10.08.2026
This policy explains what happens to your personal data when you visit www.2ndrec.com, place an order, or contact us. We have tried to keep it readable. If anything is unclear, just write to us.
Who is responsible
Schardt Stoll GbR
Seilerstraße 41–43
20359 Hamburg
Germany
Partners: Johannes Schardt, Christophe Stoll
VAT ID: DE813396117
Email: johannes@2ndrec.com
Phone: +49 1577 3853834
We are the controller for the processing described here, unless a section says otherwise. Section "Shopify Network Intelligence" describes one processing operation for which Shopify is the controller, not us.
We are not required to appoint a data protection officer. Please direct any privacy question to the address above.
Change of operator
Until 10.08.2026 this shop was operated by precious – Gesellschaft für Design mbH, Karolinenstraße 6, 20357 Hamburg. Since then it has been operated by Schardt Stoll GbR. Customer and order data collected before that date was transferred to us in the course of the business transfer, so that we can continue to service existing orders, returns and warranty claims.
Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest and that of the previous operator in the orderly continuation of the business relationship; and Art. 6 (1) (c) GDPR for records subject to statutory retention.
You may object to this processing at any time under Art. 21 GDPR.
Where your data is stored
Our shop runs on Shopify. Our data hosting location is set to the European Union, so customer and order data is stored in the EU.
Shopify acts as our processor under a data processing agreement that forms part of the Shopify Terms of Service. Our contracting party is Shopify International Limited, 2nd Floor Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland. Shopify's corporate group includes entities in Canada and the United States, and some of Shopify's sub-processors are located outside the EU. Where data is transferred outside the EU, this is based on an adequacy decision of the European Commission (Canada) or on the EU Standard Contractual Clauses, in some cases combined with the EU–US Data Privacy Framework. You can request a copy of the safeguards from us at any time.
Visiting the website
When you open a page, your browser sends technical information that is needed to deliver it: your IP address, the date and time, the page requested, the referring page, your browser type and version, and your operating system.
Purpose: delivering the site, security, and troubleshooting.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is operating a functioning and secure shop.
Retention: log data is deleted or anonymised after a short period on Shopify's infrastructure.
Cookies and similar technologies
We use cookies and comparable technologies. Some are strictly necessary — they keep your shopping cart, your chosen country and currency, and your session working. These do not require consent (§ 25 (2) TDDDG).
Everything else — anything used for analytics, personalisation or advertising — is only set after you have given consent via our cookie banner. Until you consent, it does not run. You can withdraw your consent at any time, with effect for the future, using the "Cookie settings" link in the footer.
Legal basis: § 25 (1) TDDDG together with Art. 6 (1) (a) GDPR for consent-based cookies; § 25 (2) TDDDG and Art. 6 (1) (f) GDPR for strictly necessary ones.
Placing an order
To process your order we collect your name, billing and shipping address, email address, phone number if you provide one, the items ordered, and your payment details.
Purpose: performing the purchase contract, including delivery, invoicing, returns and warranty handling.
Legal basis: Art. 6 (1) (b) GDPR. For the retention of invoices and order records, Art. 6 (1) (c) GDPR in conjunction with § 147 AO and § 257 HGB.
Retention: order and invoice data is kept for ten years as required by German tax and commercial law. After that it is deleted.
Providing this data is necessary to conclude the contract. Without it we cannot accept or ship an order.
Payment
Payment is handled by our payment providers: Paypal, Visa, Mastercard, American Express, Union Pay, Maestro, Apple Pay, Google Pay and Klarna. When you pay, the data required for the transaction is passed to the provider you selected. We ourselves do not see or store full card details.
If you use Shop Pay, Shopify's accelerated checkout, Shopify processes your data for that service under its own privacy policy. Shop Pay also loads components on our product pages so that it can recognise returning Shop Pay users.
Legal basis: Art. 6 (1) (b) GDPR for processing your payment; Art. 6 (1) (f) GDPR for fraud prevention.
Some payment providers carry out their own fraud and, where applicable, credit checks. Details are in their respective privacy policies.
Shipping
To deliver your order we pass your name, delivery address and, where needed for the delivery, your email address or phone number to the carrier: DHL, UPS, DPD, GLS, BRT, Spring and Pakajo depending on the option you chose. For orders outside the EU, customs authorities receive the data required for customs clearance.
Legal basis: Art. 6 (1) (b) GDPR.
Shopify Network Intelligence
We have Shopify Network Intelligence enabled. This means Shopify may use personal data arising from your interactions and transactions with our store, with other Shopify merchants, and with Shopify itself, in order to provide, develop and improve analytics, product customisation, advertising and other services — both for us and for other merchants. This can include showing you advertising based on your activity across those stores.
For this processing Shopify acts as a controller in its own right, not as our processor. This is set out in Appendix E of the Shopify Data Processing Addendum and in section 9.2 of the Shopify Terms of Service.
This means your data is shared with Shopify and, through Shopify, with other recipients — including in countries outside the European Union.
Legal basis: Art. 6 (1) (a) GDPR — your consent, given through our cookie banner. You can withdraw it at any time with effect for the future via "Cookie settings" in the footer.
You can find more information and exercise your rights directly with Shopify here:
- Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers
- Shopify privacy portal: https://privacy.shopify.com
Reminders through the Shop app
If you use Shopify's Shop app, Shopify may send you reminders based on your activity in our store — for example when you leave items in your cart, when an item you looked at is back in stock, when a price drops, or when you have viewed products repeatedly without ordering. These messages are sent by Shopify to Shop app users.
Legal basis: Art. 6 (1) (a) GDPR, based on the consent you gave. You can object at any time, either through the settings in your Shop account or by writing to us.
Newsletter
If you subscribe to our mailing list, we use your email address to send you news about releases, offers and occasional label updates.
We use a double opt-in procedure: after you sign up you receive an email asking you to confirm. Only after you confirm do we send anything else. We log your sign-up and your confirmation so that we can demonstrate consent if asked.
Legal basis: Art. 6 (1) (a) GDPR and § 7 (2) no. 2 UWG.
Retention: until you unsubscribe. Consent records are kept for as long as needed to demonstrate compliance.
You can unsubscribe at any time using the link in every email, or by writing to johannes@2ndrec.com.
Withdrawing from a contract
Our online withdrawal function is provided by Revoq ("EU Withdrawal Button"), which acts as our processor. When you use it we process the name, order details and contact address you enter, and we send you a confirmation of receipt.
Legal basis: Art. 6 (1) (c) GDPR — complying with our obligations under § 356a BGB — and Art. 6 (1) (b) GDPR for handling the withdrawal itself.
Customer accounts
If you create an account, we store the data you enter there together with your order history, so that you do not have to re-enter it and can see your past orders.
Legal basis: Art. 6 (1) (b) GDPR.
You can delete your account at any time by writing to us. Order records that we are legally required to keep will be retained until the statutory period expires.
Contacting us
If you email us, we process your message and contact details in order to answer.
Legal basis: Art. 6 (1) (b) GDPR where your enquiry concerns a contract, otherwise Art. 6 (1) (f) GDPR — our legitimate interest in responding to enquiries.
Retention: until your enquiry is resolved, subject to any statutory retention periods.
Fraud prevention
Shopify analyses orders for indications of fraud and gives us a risk assessment. We decide ourselves whether to accept or cancel an order — there is no automated decision-making producing legal effects for you within the meaning of Art. 22 GDPR.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is preventing fraudulent orders and payment defaults.
Your rights
You have the right to:
- access the personal data we hold about you (Art. 15 GDPR)
- have inaccurate data corrected (Art. 16 GDPR)
- have your data erased (Art. 17 GDPR)
- have processing restricted (Art. 18 GDPR)
- receive your data in a portable format (Art. 20 GDPR)
- withdraw consent at any time, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it (Art. 7 (3) GDPR)
To exercise any of these, write to johannes@2ndrec.com.
Your right to object
Where we process your data on the basis of a legitimate interest under Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims.
Where your data is processed for direct marketing purposes, you have the right to object at any time without giving reasons. After such an objection we will no longer process your data for that purpose.
An objection is informal. An email to johannes@2ndrec.com is enough.
Complaints
If you believe we are handling your data unlawfully, you can complain to a supervisory authority — in particular in the EU member state where you live or work, or where the alleged infringement took place.
The authority responsible for us is:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI)
Hamburg, Germany
https://datenschutz-hamburg.de
Children
Our shop is not directed at children, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We update this policy when our processing or the legal requirements change. The current version is always available on this page, with the date of the last update at the top.