1. Who is responsible for your data?

The party responsible for data processing on this website is:

My First Book Europe GmbH
Managing Director: Jona Lim
Simrockstr. 88, 40235 Düsseldorf
Email: team@myfirstbookmall.com
Phone: +49 152 23111123

2. What data do we collect and why?

a) When visiting the website (server log files)
As soon as you visit our site, your browser automatically transmits data (IP address, date/time, browser type).

  • Purpose: stability and security of the website.
  • Legal basis: legitimate interest (Art. 6 (1) (f) GDPR).

b) When placing an order
We collect your name, email address, postal address, phone number and your chosen payment method.

  • Purpose: performance of the contract (shipping your books, payment processing).
  • Legal basis: Art. 6 (1) (b) GDPR.

c) Newsletter & contact
If you sign up for our newsletter or write to us, we store your email address.

  • Legal basis: your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time.

d) Back-in-stock notification (“waiting list”)
If an item is sold out, you can sign up on the product page for a one-off notification. For this we store only your email address and the item you signed up for. We do not collect any further details – your name, for example.

  • Purpose: to tell you once that the item you wanted is available again.
  • Legal basis: your consent (Art. 6 (1) (a) GDPR).
  • Confirmation (double opt-in): after signing up you first receive an email in which you confirm your address. Only then do we send a notification. This ensures that nobody can enter someone else's address.
  • Withdrawal: you can withdraw your consent at any time with effect for the future – via the unsubscribe link in every email or informally to team@myfirstbookmall.com. The lawfulness of processing carried out up to that point remains unaffected.
  • Storage period: we delete your entry as soon as the notification has been sent, and at the latest six months after you signed up. If you do not confirm your address, we delete the entry after 30 days.
  • Purpose limitation: your address is used exclusively for this notification. You will not receive a newsletter or any other advertising as a result. The newsletter requires a separate sign-up.

3. Who receives your data? (Disclosure to third parties)

We never sell your data. We only pass it on when it is necessary for your purchase:

  • Shopify: our shop system. Shopify processes data on our behalf (a data processing agreement is in place).
  • Klaviyo: our service provider for sending email (newsletter, back-in-stock notifications, order and service emails). Klaviyo processes your data exclusively on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place. The provider is Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02111, USA. Klaviyo is certified under the EU-US Data Privacy Framework; the transfer to the USA takes place on that basis. Where the Framework does not apply, the standard contractual clauses of the EU Commission apply in addition. Further information: Klaviyo's privacy notice.
  • Shipping partners: so that DHL, UPS or Hermes know where to deliver your parcel.
  • Payment service providers: your payment data is processed directly by the providers (PayPal, Stripe, Amazon Pay, etc.). We do not have access to your full credit card details.

4. Cookies & analysis tools

We use cookies to make the shop functional (e.g. the shopping cart) and to learn how we can improve.

  • Google Analytics & Facebook Pixel: these tools help us improve our advertising. They are only activated once you have consented in the cookie banner.
  • Objection: you can change your settings at any time via the small icon at the bottom left of the page, or delete cookies in your browser.

5. Data transfer to third countries (e.g. USA)

Through the use of Shopify, Klaviyo, Google or Facebook, data may be transferred to countries outside the EU (e.g. the USA). For this we use the standard contractual clauses of the EU Commission or – where the provider is certified under it – the EU-US Data Privacy Framework, in order to ensure a high level of protection.

6. How long do we store your data?

We only store your data for as long as is necessary for the purposes:

  • Orders: 10 years (statutory retention period for accounting records).
  • Enquiries: until final clarification.
  • Newsletter: until you unsubscribe.
  • Waiting list (back-in-stock notification): until the notification has been sent, at the latest six months. Unconfirmed sign-ups are deleted after 30 days.

7. Your rights – you are in control!

You have the right at any time to:

  • Access: what do we know about you? (Art. 15 GDPR)
  • Rectification: correction of incorrect data. (Art. 16 GDPR)
  • Erasure: we remove your data, provided there is no statutory retention obligation. (Art. 17 GDPR)
  • Restriction of processing: in certain cases you can have the processing restricted. (Art. 18 GDPR)
  • Data portability: you receive your data in a common, machine-readable format. (Art. 20 GDPR)
  • Objection: you can object to the processing. (Art. 21 GDPR)
  • Withdrawal of consent: you can withdraw consent you have given at any time with effect for the future. (Art. 7 (3) GDPR)
  • Complaint: you can complain to the competent supervisory authority: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).

8. Data security

Your connection to us is secured by SSL encryption. We use state-of-the-art technical measures to protect your data from unauthorised access.