Privacy policy

Last updated: November 2026

1. Controller

Grass Publishers, owner Tino Graß
Ehrenfriedstraße 15
50259 Brauweiler
Germany
Telephone +49(0)2234.9790377
Email info@grass-publishers.com

Please contact us at this address with any questions about data protection or to exercise your rights.

2. Overview

We process personal data only insofar as this is necessary to operate this website, process orders, answer enquiries or – with your consent – send our newsletter. The legal bases are Art. 6(1) GDPR, in particular point (a) (consent), point (b) (contract and pre-contractual measures), point (c) (legal obligation) and point (f) (legitimate interests). Access to information on your device (e.g. cookies) is additionally governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

3. Website and online shop (Shopify)

This website and the online shop run on the Shopify platform. Our contracting partner is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify stores and processes the shop’s data (e.g. page views, orders, customer data) on our behalf; we have concluded a data processing agreement with Shopify pursuant to Art. 28 GDPR.

Shopify may transfer data to other companies in the Shopify group, in particular to Shopify Inc. in Canada, and to sub-processors, including in the USA. There is an adequacy decision of the European Commission for Canada. For other third countries, Shopify bases the transfer on binding corporate rules (Art. 47 GDPR), on the European Commission’s standard contractual clauses (Art. 46 GDPR) or, for certified recipients in the USA, on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR). Further information can be found in Shopify’s privacy policy.

When you visit the website, technically necessary data is processed: IP address, date and time of access, page requested, previously visited page (referrer), browser and operating system. This data is required to deliver the website and to ensure its security and stability; it is stored in log files for a limited period. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and functional operation of the online shop.

4. Cookies and your consent

We use cookies and similar technologies. We use technically necessary cookies, for example for the basket, checkout, security and storing your cookie choices, without consent (§ 25(2) no. 2 TDDDG; Art. 6(1)(b) and (f) GDPR).

We use all other cookies, for example for statistics on visits and sales (Shopify analytics), only if you have consented via the cookie banner (§ 25(1) TDDDG; Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.

5. Orders and customer account

When you place an order with us, we process the data required to perform the contract: name, billing and delivery address, email address, telephone number where applicable, the titles ordered and details of payment and shipping. We use this data to fulfil the order, send you order and shipping confirmations and answer queries. The legal basis is Art. 6(1)(b) GDPR.

If you create a customer account, we store your data until you delete the account or ask us to delete it.

We retain order and invoice data for as long as retention obligations under commercial and tax law apply (up to ten years, § 257 HGB, § 147 AO; Art. 6(1)(c) GDPR). After that, it is deleted.

6. Payment with PayPal

Payment is processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg, Luxembourg. If you pay with PayPal, we transmit the data required for payment to PayPal, in particular name, address, email address, order number and invoice amount (Art. 6(1)(b) GDPR). PayPal processes this data under its own responsibility, including for fraud prevention.

Further information can be found in PayPal’s privacy statement.

7. Shipping

For delivery, we pass your name and delivery address on to the carrier we use (Deutsche Post, DHL or another parcel service) (Art. 6(1)(b) GDPR). We only pass on your email address or telephone number if you have expressly consented to this at checkout (Art. 6(1)(a) GDPR). For deliveries to countries outside the European Union, the customs documents also contain details of the contents and value of the parcel (Art. 6(1)(b) and (c) GDPR).

8. Withdrawal via “Withdraw from contract”

If you withdraw from a contract using the “Withdraw from contract” button, we process your name, the order number, the titles withdrawn where applicable, your email address and the date and time of receipt. We use this data to process the withdrawal and to send you the acknowledgement of receipt required by law (Art. 6(1)(b) and (c) GDPR in conjunction with § 356a BGB). The details are transmitted to our email address via Shopify’s contact form. We store them for as long as necessary to process the withdrawal and as evidence in the event of disputes, generally until the statutory limitation period of three years has expired, and beyond that where statutory retention obligations apply.

9. Contact

If you contact us by email or telephone, we process your details in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the data once it is no longer required for this purpose and no retention obligations apply.

10. Newsletter (Mailchimp)

We send our newsletter with information on new titles, events and news from the publishing house only with your consent (Art. 6(1)(a) GDPR). You can sign up in the footer of the website or at checkout. After signing up, you will receive an email in which you confirm your subscription (double opt-in). As proof of consent, we store the time of sign-up and confirmation and your IP address (Art. 6(1)(f) GDPR).

We use Mailchimp, a service of The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave NE, Atlanta, GA 30308, USA (part of the Intuit group), to send the newsletter. Your email address and, where applicable, your name are transferred from the shop to Mailchimp for this purpose. We have concluded a data processing agreement with Mailchimp. Mailchimp is certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the corresponding adequacy decision of the European Commission (Art. 45 GDPR) and additionally on standard contractual clauses.

Mailchimp records whether a newsletter has been opened and which links have been clicked. We use this analysis to improve the newsletter; it is covered by your consent.

You can unsubscribe from the newsletter at any time via the unsubscribe link in every issue or by emailing us. Your data will then be removed from the mailing list. We may store your email address on a block list so that you no longer receive the newsletter (Art. 6(1)(f) GDPR). Further information can be found in Intuit Mailchimp’s privacy statement.

11. Instagram

We refer to our Instagram account with a simple link only. No data is transferred to Instagram when you visit our website. Only when you follow the link do the privacy policies of Instagram and Meta Platforms Ireland Limited apply.

12. Your rights

You have the right to access the data stored about you (Art. 15 GDPR), to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You may object to the use of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

13. Further information

Providing your data is necessary for an order; without it we cannot conclude the contract. Beyond that, you are not obliged to provide us with any data. There is no automated decision-making, including profiling.

The website is protected by an encrypted connection (TLS).

We will update this privacy policy if our data processing or the legal situation changes. The version published here applies.