Skip to content
Leinenhof

Privacy policy

Datenschutzerklärung — what we collect, why we collect it, the legal basis for each purpose, how long we keep it and what you can require of us.

Harold's Lederwaren GmbH · Last updated 12 August 2026

1. Controller

Harold's Lederwaren GmbH
Lämmerspieler Strasse 40-42, 63179 Obertshausen, Germany
Email: support@haroldssswaren.shop
Telephone: +49 1709855495

We have not appointed a data protection officer, as the statutory thresholds under § 38 BDSG are not met. Data protection enquiries go to the address above and are handled by the management.

2. What we process, why, and on what basis

2.1 Visiting the site

Our hosting provider records server log data — IP address, date and time, the page requested, HTTP status, referrer and user agent — for the operation and security of the site. Legal basis: Art. 6 (1)(f) GDPR, our legitimate interest in a functioning, secure site. Retention: 14 days, then deleted.

2.2 Placing an order

We process your name, email address, telephone number, delivery address, order contents, any engraving text, and the payment status. Legal basis: Art. 6 (1)(b) GDPR — performance of the contract. Tax and commercial law require us to retain invoicing data for ten years (§ 147 AO, § 257 HGB), so order records are kept for that period. Legal basis for that retention: Art. 6 (1)(c) GDPR.

Engraving text is treated as personal data. It is used to produce your item and nothing else. Where it is not part of the invoice record, it is deleted once the order is complete and the return window has passed. Our form refuses street addresses.

2.3 Payment

Card details are entered on the payment provider’s own page and never reach our servers. We receive a payment reference and a status. The provider acts as an independent controller for the payment transaction under Art. 6 (1)(b) and (c) GDPR.

2.4 Contact form, made-to-measure enquiries

Name, email, telephone if given, and the content of your message. Legal basis: Art. 6 (1)(b) GDPR where the enquiry concerns a contract or its initiation, otherwise Art. 6 (1)(a) GDPR — consent, which you give by ticking the box. Retention: until the enquiry is resolved, then up to six months in case you come back to it, unless commercial retention obligations apply.

2.5 The photo wall

If you submit a photograph, we process the image itself, the dog’s name, the first name or nickname you choose to display, your email address, the description you write, and which products you selected. Legal basis: Art. 6 (1)(a) GDPR — consent.

  • EXIF metadata is stripped on our server before the image is stored. That includes any GPS coordinates your camera or phone wrote into the file.
  • We do not ask for, store or display a location. There is no location field in the submission form or in our records.
  • Only a first name or a nickname is published. Your email address is used to tell you when the photo is published and to action a withdrawal; it is never shown.
  • Nothing is published without review. A person checks every submission first.
  • Consent is revocable at any time with effect for the future. Write to support@haroldssswaren.shop; the photograph is removed and cached copies are purged. Withdrawing consent does not affect the lawfulness of processing before it was withdrawn.

Full licence terms are at image rights.

2.6 Cookies and local storage

Strictly necessary storage — your cart contents and your recorded cookie choice — is set on the basis of § 25 (2) TTDSG and Art. 6 (1)(f) GDPR. Anything not strictly necessary is set only after you have consented, on the basis of § 25 (1) TTDSG and Art. 6 (1)(a) GDPR, and you can change or withdraw that choice at any time. Details are at cookie policy.

2.7 Fonts

Typefaces are served from our own domain. No request is made to a third-party font service, so no IP address is disclosed to one.

3. Recipients

We disclose personal data only where necessary, and only to:

  • our hosting provider, as a processor under Art. 28 GDPR;
  • the payment provider, for the processing of your payment;
  • the carrier, for delivery — name, address and, where you give it, a phone number;
  • our tax adviser and the tax authorities, where required by law.

We do not sell personal data, do not pass it to advertisers, and do not use it to build profiles.

4. Transfers outside the EU/EEA

Our hosting and infrastructure are configured to process data within the EU. Where a processor exceptionally processes data in a third country, this takes place on the basis of an adequacy decision or the European Commission’s Standard Contractual Clauses under Art. 46 (2)(c) GDPR, with supplementary measures where required.

5. Retention

  • Server logs: 14 days.
  • Order and invoicing data: 10 years (§ 147 AO, § 257 HGB).
  • Engraving text outside the invoice record: deleted after the return window.
  • Contact enquiries: up to 6 months after resolution.
  • Photo wall submissions: until consent is withdrawn or the photo is taken down.
  • Cart storage in your browser: up to 12 months, or until you clear it.

6. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Art. 15);
  • have inaccurate data corrected (Art. 16);
  • have data erased where the conditions are met (Art. 17);
  • restrict processing (Art. 18);
  • receive your data in a portable format (Art. 20);
  • object to processing based on legitimate interest (Art. 21), on grounds relating to your particular situation;
  • withdraw consent at any time (Art. 7 (3)), with effect for the future.

To exercise any of these, write to support@haroldssswaren.shop. We respond within one month. We do not charge for this and we do not require a particular form.

7. Right to lodge a complaint

You have the right to complain to a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.

The competent authority for our registered office is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Germany.

8. Is providing data mandatory?

For an order, the delivery and contact details are necessary to conclude and perform the contract; without them we cannot deliver. Everything else — a phone number for the contact form, a photo wall submission, a note at checkout — is voluntary, and declining has no consequence beyond the obvious one.

9. Automated decision-making

We do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR. The size and fit tool is a fixed rule mapping that runs in your browser: the same numbers always produce the same answer, nothing about you is stored by it, and it does not learn.

10. Changes

We update this policy when our processing changes or the law requires it. The version in force is the one published here, with the date shown at the top of this page.

Lämmerspieler Strasse 40-42, 63179 Obertshausen, Germany