Privacy policy

Last updated: 21 September 2026

1. Who is responsible for your data?

The controller responsible for the processing described in this Privacy Policy is:

Gereon Martin Goldbach
trading as “More Than Just Hearing”
Ilse-Krall-Straße 47
69124 Heidelberg
Germany

Email: mupo.shop49@gmail.com
Contact form: https://mu-po.de/pages/contact

In this Privacy Policy, “MUPO”, “we”, “us” and “our” refer to the controller named above. You can contact us using the details above for any privacy request.

2. Scope of this Privacy Policy

This Privacy Policy explains how we collect, use, disclose and retain personal data when you visit mu-po.de, buy a product, create or use a customer account, subscribe to marketing, contact us, or otherwise interact with our store.

Our store is hosted by Shopify. Some Shopify consumer services, including Shop and Shop Pay, are provided by Shopify directly under Shopify’s own terms and privacy notice. In those cases, Shopify may act as an independent controller for its own processing.

3. Personal data we process

Depending on how you use the store, we may process:

• identification and contact data, such as your name, email address, telephone number, billing address and shipping address;
• order and contract data, such as products ordered, order number, order status, returns, cancellations and correspondence;
• payment and transaction data, such as the selected payment method, payment status, transaction identifiers and fraud-risk information. Full card details are processed by the payment providers and are not made available to us in full;
• account data, such as login and account settings;
• communication data that you provide by email, contact form or other support channels;
• marketing data, such as newsletter subscriptions, consent records, withdrawals, email interactions and relevant shopping activity used for consented reminders;
• technical and usage data, such as IP address, browser and device information, cookie identifiers, consent settings, pages and products viewed, cart activity, timestamps, log data and referrer information; and
• information required to establish, exercise or defend legal claims and to comply with legal obligations.

We generally collect this data directly from you and your device. We may also receive it from Shopify, payment providers, fulfilment and delivery providers, or other service providers involved in your transaction.

4. Purposes and legal bases

a. Store operation and security

We process technical and usage data to provide the website, maintain stability and security, prevent misuse and fraud, and troubleshoot errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of the store and the protection of our business and customers.

b. Orders, payment, production, delivery, returns and customer accounts

We process identification, contact, order, payment and account data to take steps at your request, conclude and perform the purchase contract, collect payment, arrange production and delivery, provide order updates, handle complaints, returns and cancellations, and provide customer-account functions. The legal basis is Article 6(1)(b) GDPR.

c. Legal obligations

We process and retain data where necessary to comply with tax, accounting, commercial, product-safety, consumer-protection and other legal obligations. The legal basis is Article 6(1)(c) GDPR.

d. Customer service and other enquiries

We process the information in your enquiry to respond to you. If your enquiry concerns a contract or steps before entering into a contract, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to communicate with customers and other interested persons and to manage our business relationships.

e. Newsletter and marketing emails

If you subscribe to our newsletter or other marketing emails, we process your email address, subscription and consent records, and relevant email interactions to send the requested messages and document your consent. The legal basis is Article 6(1)(a) GDPR. We use a double-opt-in procedure for new email subscribers. You can withdraw your consent at any time using the unsubscribe link in a marketing email or by contacting us. Withdrawal does not affect processing carried out before withdrawal.

f. Shopping reminders and personalised marketing

Where you have given the required consent, Shopify may use cookie, device and shopping-activity data to support marketing features, such as reminders about browsed products, abandoned carts, price reductions or products that are back in stock. The legal basis for our consent-based processing is Article 6(1)(a) GDPR. You can withdraw your choice at any time through the cookie settings available in the store.

Eligible Shop users may also receive email or push reminders from Shopify based on their activity on our storefront. Shop is a Shopify consumer service. Shopify provides these reminders under its own responsibility and privacy notice; your Shop settings and Shopify’s privacy portal provide additional controls.

g. Cookies and similar technologies

Technically necessary cookies and similar technologies are used to provide functions expressly requested by you, such as navigation, cart, checkout, account, security and consent storage. Access to or storage of information on your device is based on section 25(2) of the German Telecommunications Digital Services Data Protection Act (“TDDDG”) where the technology is strictly necessary. Related personal-data processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the function.

Non-essential technologies for analytics, personalisation or marketing are used only where required consent has been obtained. Access to or storage of information on your device is then based on section 25(1) TDDDG, and related personal-data processing is based on Article 6(1)(a) GDPR. You can reject non-essential purposes or withdraw consent at any time through the cookie banner or the cookie-preferences link in the store. Necessary technologies cannot be disabled through the consent tool because the store would not function correctly without them.

The exact cookies and similar technologies may change as Shopify and the enabled store functions evolve. The cookie banner and its details provide the current categories and choices.

5. Shopify and Shopify Network Intelligence

Our store is hosted and operated using services from Shopify International Limited, Ireland, and its affiliated companies and subprocessors.

Shopify processes customer data for us to provide the store platform, checkout, customer accounts, payments, security, communications, analytics, consent management and related services. Shopify may also process personal data under its own responsibility when you use Shopify consumer services such as Shop or Shop Pay.

Shopify Network Intelligence is enabled for this store. This means Shopify may securely use data from interactions with our store together with data from interactions with other merchants and with Shopify to provide enhanced services. These services can include fraud prevention, analytics, personalisation and advertising-related functions. To provide them, information may be shared with Shopify and other recipients in countries other than your own.

For visitors in the EEA, United Kingdom and Switzerland, non-essential use for these enhanced services is subject to the consent choices collected through the store’s privacy banner. You can withdraw consent through the store’s cookie settings. You can also learn about Shopify’s processing and exercise choices or rights through:

Shopify Consumer Privacy Policy
Shopify Privacy Portal

6. Payment processing

The store currently uses Shopify Payments. Depending on the payment method you select, Shopify and the payment partners involved process payment and transaction data to authorise and settle the payment, prevent fraud, process refunds and chargebacks, and comply with financial, sanctions and anti-money-laundering obligations. Some payment processors act as independent controllers for these purposes.

Available methods are displayed during checkout and may include Shop Pay and card payments. If you use Shop Pay, Shopify processes saved account, payment, shipping and order information under Shopify’s consumer terms and privacy notice. We do not receive your full payment-card number.

If an additional payment provider is activated in the future, this Privacy Policy will be updated before that method is offered.

7. Production, fulfilment and delivery

We use Gelato ASA, Dronning Eufemias gate 8, 0191 Oslo, Norway, to produce and fulfil our made-to-order posters. We provide Gelato with the information required to fulfil an order, in particular the recipient’s name, delivery address, contact and order details. Gelato may use local production partners and delivery carriers and may route an order internationally where necessary for production and delivery.

The processing is necessary to perform your purchase contract under Article 6(1)(b) GDPR. Gelato and its contracted production and logistics providers process the information required to produce, dispatch, track and deliver the order. The specific carrier can depend on the production location and delivery destination.

Gelato privacy information: https://www.gelato.com/legal/privacy

8. Communications and email provider

Shopify’s communication functions, including Shopify Messaging, are used for transactional messages, subscriptions and enabled marketing functions. Shopify processes the contact, order, consent and message data required to provide those services.

Messages sent to our contact email address are processed using Google services. For users in the EEA and Switzerland, the relevant Google service provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may use affiliated companies and infrastructure outside the EEA. Google privacy information is available at https://policies.google.com/privacy.

9. Translation functions

We use Shopify Translate & Adapt to manage store language content. This is a Shopify service and does not add a separate non-Shopify marketing provider. Technical data may be processed by Shopify when translated store pages are delivered.

10. Recipients of personal data

We disclose personal data only where necessary for the purposes described above. Recipients may include:

• Shopify and its affiliated companies and subprocessors;
• Shopify Payments and the payment partners involved in your chosen payment method;
• Gelato, its relevant production partners and delivery carriers;
• Google as our email service provider;
• professional advisers, insurers, IT support or other service providers where required for a specific task; and
• courts, authorities or other public bodies where disclosure is legally required.

We do not currently use separate Meta or Google advertising pixels or a separate Google Analytics integration in the Shopify customer-events settings. If that changes, we will update this Privacy Policy and the consent configuration before using them.

11. International data transfers

Some recipients or their subprocessors are located outside the European Economic Area (“EEA”), including in Canada, the United States and countries where products may be printed or delivered.

Where required, international transfers are based on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified US recipients, or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, supplemented where necessary by additional safeguards. Information about Shopify’s transfer mechanisms and subprocessors is available at:

Shopify international data transfers
Shopify subprocessors

You can contact us if you would like more information about the safeguards relevant to a particular transfer.

12. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected and to meet legal obligations or establish, exercise or defend legal claims.

• Order, invoice, payment and accounting records are retained for the applicable statutory periods. Under German law these are commonly six, eight or ten years depending on the type of document; invoice copies and many accounting records are generally retained for eight years. The period usually begins at the end of the relevant calendar year.
• Customer-account data is kept while the account is active and is deleted or restricted after an account-deletion request unless continued retention is legally required.
• Enquiry and customer-service correspondence is kept until the matter is resolved and afterwards only for as long as necessary for documentation, legal obligations or possible claims.
• Marketing data is kept until you withdraw consent or object, unless a limited record is required to demonstrate the consent and honour your opt-out.
• Cookie consent choices are retained for the period configured in the consent tool and may be renewed when legally or technically necessary.
• Technical and security logs are retained according to operational and security needs and the retention settings of the relevant provider.

When a retention period ends, data is deleted or anonymised unless further storage is legally required.

13. Your rights

Subject to the legal requirements and exceptions, you may have the right to:

• obtain access to your personal data and a copy of it (Article 15 GDPR);
• have inaccurate data corrected and incomplete data completed (Article 16 GDPR);
• request deletion of your data (Article 17 GDPR);
• request restriction of processing (Article 18 GDPR);
• receive data you provided in a structured, commonly used and machine-readable format and transmit it to another controller (Article 20 GDPR);
• object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR);
• object at any time to processing for direct marketing purposes (Article 21 GDPR);
• withdraw consent at any time with effect for the future (Article 7(3) GDPR); and
• lodge a complaint with a supervisory authority (Article 77 GDPR).

You are not subject to a decision based solely on automated processing by us that produces legal effects concerning you or similarly significantly affects you. Payment and fraud-prevention providers may use automated checks under their own responsibility and must provide the information required for their processing.

To exercise a right against us, email mupo.shop49@gmail.com or use the contact details in section 1. We may need information necessary to verify your identity and locate the relevant data.

Our competent supervisory authority is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Germany

Complaint information: https://www.baden-wuerttemberg.datenschutz.de/beschwerde/

You may also contact the supervisory authority at your habitual residence, place of work or the place of the alleged infringement.

14. United States privacy choices

Depending on your US state of residence and the applicable law, you may have rights to request access, correction or deletion, receive a copy of certain data, and opt out of certain uses described as sale, sharing or targeted advertising. Where applicable, you can use our data-sharing opt-out page at https://mu-po.de/pages/data-sharing-opt-out. We also process recognised Global Privacy Control signals where required and supported by Shopify.

15. Children

Our store is not directed to children, and we do not knowingly collect personal data from children for marketing. If you believe that a child has provided personal data to us inappropriately, please contact us so that we can review and, where required, delete it.

16. Security

We and our providers use organisational and technical measures intended to protect personal data against accidental or unlawful loss, alteration, disclosure or access. No internet transmission or storage system can be guaranteed to be completely secure.

17. Changes to this Privacy Policy

We may update this Privacy Policy when our services, providers, settings or legal requirements change. The current version is published in the store and shows its latest update date. Where required by law, we will provide additional notice of material changes.

18. Contact

For privacy questions or requests, contact:

Gereon Martin Goldbach, trading as “More Than Just Hearing”
Ilse-Krall-Straße 47, 69124 Heidelberg, Germany
Email: mupo.shop49@gmail.com
Contact form: https://mu-po.de/pages/contact