Privacy policy

Privacy Policy
Last updated: November 01, 2026

1. Controller
The controller responsible for data processing on this website under data protection law (GDPR) is: Lisa Marie Anderke, trading as foundation, Am Postbahnhof 21, 10243 Berlin, Germany, hello@foundationberlin.de

2. Overview
This policy explains which personal data we process when you visit foundationberlin.de, place an order, contact us or sign up to be notified about our launch, why we do so, on what legal basis and how long we keep your data.

3. Hosting and shop system (Shopify)
Our online shop runs on Shopify. When you visit the shop, technical data such as your IP address, browser type, device information and the pages you view is processed so that the shop can be displayed and kept secure. Shopify also hosts the data of your orders and customer accounts. The provider is Shopify International Limited, Ireland, which works with Shopify Inc., Canada, and other group companies. Data may be transferred to countries outside the EU. In that case the transfer is based on the EU Standard Contractual Clauses and, where applicable, on an adequacy decision such as the EU-U.S. Data Privacy Framework. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and functioning shop) and Art. 6(1)(b) GDPR where processing is necessary for a contract. More information: https://www.shopify.com/legal/privacy

4. Orders and contract performance
If you place an order, we process the data you provide at checkout: name, billing and delivery address, email address, phone number (if you give one), the products you order and your payment details. We use this data to process the order, send confirmations, deliver the goods, handle returns and answer your questions. Legal basis: Art. 6(1)(b) GDPR.

5. Payment
Payments are processed through Shopify Payments and the payment methods offered at checkout. Your payment data is passed on to the respective payment service provider so that your payment can be processed. We do not store your full card or account details ourselves. The providers process this data under their own privacy policies. Legal basis: Art. 6(1)(b) GDPR.
5.1 Klarna. If you pay with Klarna, we pass the data needed to process the payment to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna’s privacy notice applies.

6. Shipping
To deliver your order we pass your name, delivery address and, if needed for the delivery, your email address or phone number to our shipping partner DHL. Legal basis: Art. 6(1)(b) GDPR.

7. Customer account
If you create a customer account, we store the data you give us and your order history so that you can log in and view your orders. You can ask us to delete your account at any time. Legal basis: Art. 6(1)(b) GDPR.

8. Contact and partner enquiries
If you contact us by email or through the contact form on our Contact page or our partner page, we process your name, email address, your message and any further details you give us in order to handle your request. We delete the data once your request has been dealt with, unless statutory retention periods apply. Legal basis: Art. 6(1)(b) GDPR for enquiries relating to a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR.

8a. Withdrawal function. If you withdraw from a contract through our electronic withdrawal function, we process the data you enter (name, email address, order number, selected items) and the time of receipt. We use it to handle your withdrawal and to send you the confirmation of receipt required by law. Legal basis: Art. 6(1)(c) GDPR in conjunction with § 356a German Civil Code. For the technical operation of the form and the confirmation email we use the app “EU Adress-Check & Widerruf Pro” by ECOMBEAT, Garnisonsgasse 4/11, 1090 Vienna, Austria, which processes the data on our behalf as a processor (Art. 28 GDPR). We keep the withdrawal data for as long as needed to document and process the withdrawal.

9. Launch notification
If you sign up with your email address to be notified about our launch, we process your email address to send you one email when the shop opens. We use a double opt-in procedure: you receive a confirmation email and are only added once you confirm. We use Shopify’s tools for sending. You can withdraw your consent at any time with effect for the future, for example by writing to hello@foundationberlin.de. We delete your email address once the notification has been sent, unless you have also given us a separate consent to receive further emails. Legal basis: Art. 6(1)(a) GDPR (consent).

10. Cookies
Our shop uses cookies. Some are technically necessary, for example to keep your cart and to process your order. They are set on the basis of Art. 6(1)(f) GDPR and § 25(2) TDDDG. All other cookies, for example for statistics, are only set if you agree through the cookie banner. You can withdraw or change your consent at any time using the privacy settings of the shop.

11. Links to other websites
Our shop links to external websites, for example our Instagram profile. We are not responsible for the content or data processing of these sites. Please read their privacy policies.

12. Storage period
We delete your personal data as soon as it is no longer needed for the purposes described. We keep order and invoice data for as long as tax and commercial law require us to, up to ten years. Data for enquiries is deleted once the request is completed.

13. Recipients of your data
Your data is passed on only to service providers who work for us under data processing agreements or to parties who need it to perform the contract: Shopify, payment service providers, DHL, our tax advisor, our provider of the withdrawal form (ECOMBEAT) and, where required by law, authorities.

14. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future (Art. 7(3)). To exercise your rights, write to hello@foundationberlin.de. Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation.

15. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de

16. Security
This site uses SSL/TLS encryption. You can recognise it by the padlock symbol and “https” in your browser’s address bar.

17. Changes
We may update this policy when our practices or the law change. The current version is always available on this page.