Last updated: October 2026
1. Controller
The controller within the meaning of Art. 4 (7) GDPR is:
WALD SUPPLY GmbH
Bismarckstraße 98
20253 Hamburg
Germany
Represented by: Ludwig Maximilian Brandt
Commercial register: HRB 174509, Hamburg
VAT ID: DE352561342
Email: info@wald.supply
Telephone: +49 170 9190034
2. Scope
This policy describes how personal data is processed when you visit wald.supply or place an order. The shop frontend is operated by WALD; checkout, payment and order fulfilment are processed via Shopify (see section 6).
3. Data processed when visiting the site
When you load wald.supply, the hosting provider automatically processes server log data: IP address, date and time, requested URL, referrer, user agent and HTTP status. Legal basis: Art. 6 (1)(f) GDPR — legitimate interest in a stable, secure website. Log data is kept only as long as needed for these purposes and is then deleted in line with the hosting provider's retention periods.
4. Cookies and local storage
We only use storage that is strictly necessary for the site to function (e.g. cart state, UI preferences). No tracking, analytics or advertising cookies are set by WALD. Legal basis: § 25 (2) TDDDG and Art. 6 (1)(f) GDPR. Shopify may set additional cookies during checkout (see section 6).
5. Hosting
The storefront is hosted by Lovable and delivered using the Cloudflare network. Technical request data may be processed by these providers, including outside the EU. The legal basis for operating a secure website is Art. 6 (1)(f) GDPR. The exact processing locations and applicable transfer safeguards should be checked against the providers' current documentation.
6. Orders, checkout and payment (Shopify)
When you proceed to checkout you are handed over to Shopify (Shopify International Ltd., 2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes the data required to fulfil your order: name, shipping and billing address, email, phone, order contents, and payment data handled by the payment provider you select. Legal basis: Art. 6 (1)(b) GDPR (performance of a contract) and Art. 6 (1)(c) GDPR (tax/commercial retention obligations). Shopify's own privacy notice applies in addition: https://www.shopify.com/legal/privacy.
7. Contact by email
If you contact us by email, we process the data you provide to answer your enquiry. Legal basis: Art. 6 (1)(b) or (f) GDPR. Data is deleted once the enquiry is resolved and no retention obligations apply.
7a. Electronic withdrawal
When you use the withdrawal form, we process your name, order or contract reference, acknowledgement email, declaration and the date and time received to document your request and send you a receipt. The form is hosted by Lovable and the receipt is sent via Brevo to you and help@wald.supply. Legal basis: Art. 6 (1)(c) GDPR (legal obligations) and Art. 6 (1)(b) GDPR (contract handling). Records are retained as long as necessary for statutory obligations or to establish, exercise or defend legal claims.
8. Newsletter and double opt-in (Brevo)
If you subscribe to the WALD newsletter, we process your email address and, if provided, your first name to send information about drops, restocks and archive releases. We use a double opt-in process: after signup, Brevo sends a confirmation email, and your address is added to the newsletter list only after you click the confirmation link. The legal basis is your consent under Art. 6 (1)(a) GDPR. Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) processes this data on our behalf to manage subscriptions and send newsletter emails. You may withdraw your consent at any time using the unsubscribe link in an email or by contacting info@wald.supply.
8a. Research votes and color preferences
On the Research pages you can register interest in pieces or state a color preference. We process your email address, the selected pieces or color, an optional size, the time of your request and of your confirmation, and a one-way hashed confirmation token. A vote only counts after you click the confirmation link we send by email (via Brevo); unconfirmed requests expire after 24 hours. Each email counts once per piece; a newly confirmed color preference replaces your previous one. Legal basis: Art. 6 (1)(a) GDPR (your request and confirmation). Updates about the selected pieces are sent only if you tick the separate, optional updates box; confirming a vote alone does not authorise marketing emails and does not subscribe you to the newsletter. Public pages show only aggregate counts, never email addresses. Data is stored in our hosted database (Lovable Cloud) and kept while the Research project for the piece is active or until you ask us to delete it at info@wald.supply.
9. Recipients and third parties
Personal data is shared only with processors required to operate the shop: the hosting provider, Shopify (checkout/payment), the shipping carrier you select at checkout, the payment service providers enabled in our Shopify store, and Brevo for newsletter subscriptions, Research confirmation emails and delivery. Where these providers process data on our behalf, this takes place in accordance with Art. 28 GDPR.
10. Retention
Order and invoice data are retained for the statutory periods under German tax and commercial law (up to 10 years per § 147 AO, § 257 HGB). Other personal data is deleted as soon as the purpose of processing no longer applies.
11. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) under the GDPR. You may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority, e.g. the Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit. To exercise your rights, contact info@wald.supply.
12. Changes to this policy
We may update this policy to reflect changes in our processing or legal requirements. The current version is always available at wald.supply/privacy.