Privacy Policy

Last updated: August 2026

§ 1 General Information

Your personal data (e.g. title, name, address, email address, phone number, bank details, credit card number) is processed by us only in accordance with the provisions of German data protection law and the data protection law of the European Union (EU). The following provisions inform you about the purposes of processing, recipients, legal bases, storage periods, as well as your rights and the controller responsible for your data processing. This privacy policy applies only to our websites. If you are redirected to other websites via links on our pages, please refer to the respective websites for information on how your data is handled there.

§ 2 Data Processing for Contract Fulfillment

(1) Purpose of Processing

The personal data you provide to us during the order process is required for the conclusion of a contract with us. You are not obliged to provide your personal data. However, without providing your address, we cannot send you the goods. For certain payment methods, we require the necessary payment details in order to forward them to a payment service provider commissioned by us. The processing of the data you enter during the order process therefore takes place for the purpose of contract fulfillment.

If you contact us by email, via a contact form, etc. before concluding a contract, we process the data obtained in this way to carry out pre-contractual measures and to respond to your inquiries about our products.

In the event of opening a customer account, your data (in particular name, address, payment method, email, and password) will be processed for registration and the creation of a customer login. With the stored data, you can shop faster and view your past orders at any time. You may delete your account at any time by notifying us or using a delete function.

(2) Legal Basis

The legal basis for this processing is Art. 6(1)(b) GDPR.

(3) Categories of Recipients

Payment service providers, shipping service providers, hosting providers, possibly merchandise management systems, possibly suppliers (dropshipping).

(4) Storage Period

We store the data required for contract processing until the expiry of statutory warranty periods and, where applicable, contractual guarantee periods. Data required under commercial and tax law will be retained for the legally prescribed periods, generally ten years (§ 257 HGB, § 147 AO). Data processed for pre-contractual measures will be deleted once the measures have been carried out and it is clear that no contract will be concluded.

§ 3 Shop Infrastructure & Payment Processing

3.1 Shopify – Shop Platform and Hosting

Our online shop is operated on the Shopify platform. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes, as a processor on our behalf, all data arising in connection with the order process, customer account management, and shop operation (e.g. name, address, email, order data, payment information).

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment) as well as Art. 28 GDPR (Data Processing Agreement with Shopify). The transfer of data to the USA is based on the EU-US Data Privacy Framework (DPF), as Shopify is DPF-certified.

Personal data stored in connection with shop operation is deleted after the expiry of statutory retention periods. Transaction and tax-relevant data is retained for up to ten years in accordance with legal requirements (§ 257 HGB, § 147 AO).

Further information: https://www.shopify.com/legal/privacy
You can find the Data Processing Agreement (DPA) with Shopify at: https://www.shopify.com/legal/dpa

3.2 Payment Service Providers

Please note the following privacy policies of the payment service providers we use:

• PayPal: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
• Google Pay: Privacy Notice
• Klarna: https://www.klarna.com/de/datenschutz/
• Apple Pay: https://support.apple.com/de-de/HT203027

§ 4 Analytics & Tracking

4.1 Information About Cookies

This website uses technically necessary cookies as well as — following your explicit consent via our cookie banner — marketing and tracking cookies. Technically necessary cookies enable, for example, the placement of multiple products in a shopping cart and are essential for the operation of the shop.

Legal basis:

• Technically necessary cookies: Art. 6(1)(f) GDPR in conjunction with § 25(2) TTDSG (legitimate interest; no consent required).
• Marketing and tracking cookies: Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG (explicit consent via cookie banner required).

Storage period: Technically necessary session cookies are deleted when the browser is closed. Persistent cookies have a lifespan ranging from a few minutes to several years, depending on the provider.

RIGHT TO OBJECT: You can withdraw your consent for marketing cookies at any time via our cookie banner. You can deactivate technically necessary cookies via your browser settings, although this may result in functional limitations.

4.2 Web Analytics with Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies that enable an analysis of your use of the website. The information generated by the cookie about your use of this website is generally transferred to and stored on a Google server in the USA.

Legal basis: Art. 6(1)(a) GDPR (consent via our cookie banner). Google Analytics is only activated after your active consent.

Recipient / Third Country: Google Ireland Limited and Google LLC (USA). The transfer of data to Google LLC is based on the EU-US Data Privacy Framework (DPF).

Storage period: User data stored in Google Analytics is automatically deleted after 14 months. Aggregated report data without personal reference may be stored permanently.

RIGHT TO OBJECT: You can withdraw your consent at any time via our cookie banner. You can also prevent data collection via the browser plug-in: https://tools.google.com/dlpage/gaoptout

§ 5 Product Reviews (Judge.me LLC)

To collect and display product reviews, we use the service Judge.me, LLC, 169 Madison Avenue, STE 2484, New York, NY 10016, USA.

Self-submitted reviews: If you submit a review, your name, email address, order number, review text, and star rating are transmitted to and processed by Judge.me. Your email address is used exclusively for verifying the review and is not publicly displayed upon publication; it is not visible to other website visitors. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the transparent presentation of product quality and customer satisfaction).

Review requests by email: After a purchase, we transmit your name, email address, and order number to Judge.me so that Judge.me can send you a review request on our behalf. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in obtaining customer feedback for quality assurance purposes). You may object to receiving review requests at any time.

The data is transferred to Judge.me, LLC (USA). The transfer is based on Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR. Further information: https://judge.me/privacy

§ 6 Marketing & Communication

6.1 Newsletter

When you sign up for the newsletter, your email address is used for advertising purposes. As part of the newsletter, we inform you in particular about products from our range and current offers. The newsletter is sent, and the associated email marketing is carried out, via Klaviyo (see § 6.2).

Legal basis: Art. 6(1)(a) GDPR (explicit consent via double opt-in procedure).

Storage period: Your email address is stored for the newsletter distribution only for the duration of the desired subscription.

Right of withdrawal: You may withdraw your consent at any time with effect for the future (e.g. via the unsubscribe link in every email).

6.2 Klaviyo – Email Marketing and Behavioral Tracking

We use the service Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA, to send email newsletters, automated cart-abandonment emails, and to analyze user behavior on our website for the purpose of personalized marketing automation. The following data is processed: email address, name, website visits, cart activity, and purchase history.

Legal bases:

• Sending of newsletters and cart-abandonment emails: Art. 6(1)(a) GDPR (explicit consent via double opt-in).
• Behavioral tracking on the website (including for non-subscribed visitors): Art. 6(1)(a) GDPR (consent via our cookie banner prior to activation of tracking).

The data is transferred to Klaviyo, Inc. (USA). Klaviyo is certified under the EU-US Data Privacy Framework (DPF). Further information: https://www.klaviyo.com/legal/privacy-notice

6.3 Facebook / Meta Social Plugins

Our website uses Facebook social plugins, operated by Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. The plugins (e.g. the "Like" button) are only loaded after your explicit consent via our cookie banner. Only after your consent is a connection established to Meta's servers and the relevant information transmitted.

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG (explicit consent via cookie banner).

The data is transmitted to Meta Platforms, Inc. (USA). Meta is certified under the EU-US Data Privacy Framework (DPF), which is recognized as a secure legal framework by the adequacy decision of the European Commission. Further information: https://www.facebook.com/policy.php

6.4 Affiliate Marketing (UpPromote)

We participate in an affiliate partner program and use the service UpPromote by Secomapp Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422, for this purpose. This service enables the tracking of referral sales via partner links. The following data is processed: order number, order value, referral URL, and a device identifier (cookie/pixel).

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG (explicit consent via cookie banner, category: marketing/tracking).

The transfer of data to UpPromote (Singapore) is based on Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR.

Storage period: (currently being finalized).

§ 7 Third-Party Services & AI Services

7.1 Zipchat.ai – AI-Powered Live Chat

On our website, we use the AI-based chat service Zipchat Inc. (Zipchat.ai), USA, to answer customer inquiries in real time and to improve customer service. The following is processed: chat content, IP address, and voluntarily provided contact details.

Legal basis: Art. 6(1)(b) GDPR (processing for the performance of pre-contractual measures). A Data Processing Agreement pursuant to Art. 28 GDPR has been concluded with Zipchat.

Please do not submit any sensitive personal data via the chat.

Data is processed on servers in the USA. The transfer is based on the EU-US Data Privacy Framework (DPF) — Zipchat is DPF-certified — as well as, additionally, on Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR. Further information: https://zipchat.ai/legal/privacy-policy

§ 8 International Transfer

8.1 Data Transfer to an Affiliated Company (South Korea)

Data may be transferred to NUC Co., Ltd., an affiliated company of NUC Electronics Europe GmbH based in the Republic of Korea (280 Nowonro, Buk-gu, Daegu), for the purpose of global quality assurance (warranty and repair service) as well as customer service, insofar as this takes place within the framework of a Data Processing Agreement pursuant to Art. 28 GDPR. The legal basis for this processing is Art. 6(1)(b) GDPR (contract fulfillment and pre-contractual measures). A copy of the Data Processing Agreement may be requested from us.

The transfer to the Republic of Korea is based on the adequacy decision of the European Commission of 17 December 2022, which established an adequate level of data protection for Korea, corresponding to the European standard.

§ 9 Your Rights as a Data Subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against us as the controller:

1. Right of access – Art. 15 GDPR
2. Right to rectification – Art. 16 GDPR
3. Right to erasure – Art. 17 GDPR
4. Right to restriction of processing – Art. 18 GDPR
5. Right to data portability – Art. 20 GDPR
6. Right to withdraw consent under data protection law – Art. 7(3) GDPR
7. Right to object – Art. 21 GDPR: If processing is based on Art. 6(1)(f) GDPR, you have the right to object at any time for reasons arising from your particular situation.
8. Right to lodge a complaint with a supervisory authority – Art. 77 GDPR

To exercise your rights, please contact:
NUC Electronics Europe GmbH
info@kuvings.de
Phone: +49 (0) 6196 950 2397