Last updated: May 2026
1. Controller
The controller within the meaning of Art. 4 (7) GDPR is:
WALD SUPPLY GmbH
Bismarckstraße 98
20253 Hamburg
Germany
Represented by: Ludwig Maximilian Brandt
Commercial register: HRB 174509, Hamburg
VAT ID: DE352561342
Email: info@wald.supply
2. Scope
This policy describes how personal data is processed when you visit wald.supply or place an order. The shop frontend is operated by WALD; checkout, payment and order fulfilment are processed via Shopify (see section 6).
3. Data processed when visiting the site
When you load wald.supply, the hosting provider automatically processes server log data: IP address, date and time, requested URL, referrer, user agent and HTTP status. Legal basis: Art. 6 (1)(f) GDPR — legitimate interest in a stable, secure website. Logs are deleted or anonymised after 14 days.
4. Cookies and local storage
We only use storage that is strictly necessary for the site to function (e.g. cart state, UI preferences). No tracking, analytics or advertising cookies are set by WALD. Legal basis: § 25 (2) TDDDG and Art. 6 (1)(f) GDPR. Shopify may set additional cookies during checkout (see section 6).
5. Hosting
The site is hosted on Cloudflare Workers (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) on EU edge nodes where available. Data transfers outside the EU are safeguarded by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. Legal basis: Art. 6 (1)(f) GDPR.
6. Orders, checkout and payment (Shopify)
When you proceed to checkout you are handed over to Shopify (Shopify International Ltd., 2nd Floor, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes the data required to fulfil your order: name, shipping and billing address, email, phone, order contents, and payment data handled by the payment provider you select. Legal basis: Art. 6 (1)(b) GDPR (performance of a contract) and Art. 6 (1)(c) GDPR (tax/commercial retention obligations). Shopify's own privacy notice applies in addition: https://www.shopify.com/legal/privacy.
7. Contact by email
If you contact us by email, we process the data you provide to answer your enquiry. Legal basis: Art. 6 (1)(b) or (f) GDPR. Data is deleted once the enquiry is resolved and no retention obligations apply.
8. Recipients and third parties
Personal data is shared only with processors required to operate the shop: the hosting provider, Shopify (checkout/payment), the shipping carrier you select at checkout, and the payment service providers enabled in our Shopify store. Data processing agreements under Art. 28 GDPR are in place where required.
9. Retention
Order and invoice data are retained for the statutory periods under German tax and commercial law (up to 10 years per § 147 AO, § 257 HGB). Other personal data is deleted as soon as the purpose of processing no longer applies.
10. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) under the GDPR. You may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority, e.g. the Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit. To exercise your rights, contact info@wald.supply.
11. Changes to this policy
We may update this policy to reflect changes in our processing or legal requirements. The current version is always available at wald.supply/privacy.