As of: July 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Argesteel, Owner: Olena Hil

Saarstraße 21, 38440 Wolfsburg, Germany

Email: support@argesteel.com

Tel.: +49 151 7053 6878 (for business identification purposes only)

2. Principles of Data Processing

We process personal data only to the extent necessary to provide our services or if you have given your consent. The legal bases are:

Art. 6 para. 1 lit. a GDPR – Consent

Art. 6 para. 1 lit. b GDPR – Performance of a contract

Art. 6 para. 1 lit. c GDPR – Legal obligation

Art. 6 para. 1 lit. f GDPR – Legitimate interests

3. What personal data do we collect? Depending on how you interact with the services, we may collect or process the following categories of personal data:

Contact details: Name, postal address, billing address, delivery address, telephone number, email address

Financial data: Payment card information, transaction details, payment method and confirmation (transmitted directly to the payment service provider – we do not store full card details)

Account information: Username, password, security questions, configurations

Transaction information: Items ordered, returned, or cancelled; order history

Communication: Content you submit via customer support or other forms of contact

Device information: IP address, browser type, network connection, unique identifiers

Usage information: Interactions with our website, click and scroll behavior

4. Hosting – Shopify

Our online store is operated on the Shopify Inc. platform (151 O’Connor Street, Ottawa, ON K2P 2L8, Canada). Shopify is certified under the EU-US Data Privacy Framework. Server access data (IP address, date/time, page accessed, referrer URL, browser type) is automatically stored whenever you visit our website.

Shopify processes data on our behalf in order to provide and improve the services for us. In addition, we use certain advanced Shopify features where Shopify may act as an independent data controller. The Shopify Consumer Privacy Policy applies to these processing activities:

https://www.shopify.com/legal/privacy

You can exercise your rights regarding data processed by Shopify here:

https://privacy.shopify.com/en

5. Order processing & Customer Data

When you place an order, we process the following data to fulfill the contract (Art. 6(1)(b) GDPR):

Name, delivery address, email address, telephone number

Payment data (transmitted directly to the payment service provider)

Order history and communication

This data is stored for the duration of statutory retention periods (business correspondence: 6 years; tax-relevant documents: 10 years, in accordance with Sections 238 and 257 of the German Commercial Code [HGB] and Section 147 of the German Fiscal Code [AO]).

6. Payment Service Providers

We use the following service providers for payment processing:

Shopify Payments / Stripe – https://stripe.com/de/privacy

PayPal – https://www.paypal.com/de/privacy

These service providers have their own privacy policies and are independently responsible for the data processed by them.

7. Shipping Service Providers

To deliver your order, we transmit your name and delivery address to our shipping partners. This transmission takes place on the basis of Art. 6(1)(b) GDPR for the purpose of contract fulfillment.

8. Cookies & Tracking

Our website uses cookies. Technically necessary cookies are set without consent (Section 25(2) TTDSG). All other cookies and tracking tools are activated only after you have given your express consent (Section 25(1) TTDSG, Art. 6(1)(a) GDPR). You may withdraw your consent at any time via our cookie banner.

9. Microsoft Clarity (Heatmaps & Session Recording)

With your consent, we use Microsoft Clarity, an analysis tool provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. This tool records how visitors interact with our website (mouse movements, clicks, scrolling behavior) and generates heatmaps. The data is stored on Microsoft servers in the USA. Data transfer to the USA takes place on the basis of Standard Contractual Clauses in accordance with Art. 46 GDPR. Microsoft Clarity is activated only after you have given your consent.

Microsoft Privacy Statement: https://privacy.microsoft.com/de-de/privacystatement

10. Google Fonts

Our website uses Google Fonts. The fonts are hosted locally on our server, meaning no connection to Google servers is established and no IP address is transmitted to Google.

11. Third-party apps in the store

We use the following apps to optimize our store. These are activated only with your consent, insofar as they involve tracking or marketing functions:

Loox (product reviews) – https://loox.app/privacy

Vitals (store optimization, upsells) – https://vitals.co/privacy

Uppromote (affiliate marketing) – https://uppromote.com/privacy-policy

BOGOS.io (free gift promotions) – https://bogos.io/privacy

12. Marketing & advertising

We may use your personal data for marketing and advertising purposes—for example, to send you marketing communications via email or to display personalized advertisements. The legal basis for this is either your consent (Art. 6(1)(a) GDPR) or our legitimate interest (Art. 6(1)(f) GDPR). You may object to receiving promotional emails at any time by using the unsubscribe link included in our emails.

13. Children's data

The Services are not intended for use by children. We do not knowingly collect personal data from individuals under the age of 16. If you are the parent or guardian of a child who has submitted personal data to us, you may contact support@argesteel.com to request the deletion of that data.

14. Third-party websites and links

The Services may contain links to external websites. We are not responsible for their privacy practices. We recommend reading the privacy policies of these websites before entering any personal data there.

15. International data transfers

Your personal data may be transferred to countries outside the European Economic Area (EEA), particularly to the USA (e.g., via Shopify, Stripe, Microsoft). Where such a transfer takes place, we rely on recognized transfer mechanisms such as the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) or the EU-US Data Privacy Framework.

16. Your Rights

Under the GDPR, you have the following rights regarding us:

Right of access (Art. 15 GDPR)

Right to rectification (Art. 16 GDPR)

Right to erasure (Art. 17 GDPR), provided there are no statutory retention obligations to the contrary

Right to restriction of processing (Art. 18 GDPR)

Right to data portability (Art. 20 GDPR)

Right to object (Art. 21 GDPR) to processing based on legitimate interests

Right to withdraw consent (Art. 7 para. 3 GDPR) – without affecting the lawfulness of processing prior to withdrawal

Right to opt out of the sale/sharing of data for targeted advertising (depending on place of residence)

To exercise your rights, please contact: support@argesteel.com

17. California Privacy Rights (CCPA/CPRA)

If you are a resident of California, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These include:

The right to know what categories of personal information we collect, use, and disclose (see Section 3 above)

The right to request deletion or correction of your personal information

The right to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising

The right not to be discriminated against for exercising any of these rights

We do not sell personal information for money. Where the use of advertising and analytics cookies may qualify as “sharing” under the CCPA/CPRA, you can opt out at any time via our cookie banner or by contacting us at support@argesteel.com.

To exercise your CCPA/CPRA rights, please contact us at support@argesteel.com with the subject line “California Privacy Request”. We will verify your request and respond within the timeframes required by law.

18. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Lower Saxony is:

State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen)

Prinzenstraße 5, 30159 Hannover

Tel.: +49 511 120-4500

E-mail: poststelle@lfd.niedersachsen.de

https://www.lfd.niedersachsen.de

A list of all EU data protection supervisory authorities can be found at: https://edpb.europa.eu/about-edpb/about-edpb/members

19. Currency of this Privacy Policy

This privacy policy is currently valid and is dated July 2026. Further development of our website or changes in the legal situation may make it necessary to amend this privacy policy. The current version is available on our website.

20. Contact

If you have any questions regarding our data protection practices or this privacy policy, or if you wish to exercise any of your rights, please contact:

Argesteel, Owner: Olena Hil

Saarstraße 21, 38440 Wolfsburg, Germany

Email: support@argesteel.com

For the purposes of applicable data protection laws, we are the data controller for your personal data.