PRIVACY POLICY

Privacy Policy

MANUFAKTUR BAVARIA — ROBE SHOP · EXTRA Group GmbH · Last updated: July 2026

Thank you for your interest in our online shop. The protection of your privacy is important to us. Below we explain in detail how we handle your personal data when you visit robe-shop.com and use our services. This policy is written to meet the requirements of the EU General Data Protection Regulation (GDPR) — which applies to all our customers, including customers in the European Union — as well as applicable US state privacy laws (see Section 20).

1. Controller

The controller within the meaning of the GDPR is:

EXTRA Group GmbH
represented by the Managing Director Yeşim Küçükay
Mathes-Deutsch-Weg 24B
84036 Landshut, Germany
Phone: +49 871 9740734-0
Email: service@robe-shop.com

2. General Information on Data Processing

Unless stated otherwise below, providing your personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide your data, and not providing it has no consequences — except where expressly stated in the individual processing operations described below.

"Personal data" means any information relating to an identified or identifiable natural person.

3. Hosting and Technical Infrastructure

Our online shop is operated on the Shopify platform, a service of Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes, on our behalf, the personal data required for operating the online shop and handling orders. Servers are located in Canada, the USA and the EU.

Data transfers to the USA are covered by the adequacy decision of the European Commission based on the EU-US Data Privacy Framework (decision of 10 July 2023). Shopify is certified under the Data Privacy Framework. Data transfers to Canada are covered by the adequacy decision of the European Commission for Canada.

Processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the secure and efficient operation of our online shop, and on Art. 28 GDPR (processing on behalf of the controller).

Google Fonts: To present our typography consistently, we embed fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you visit our pages, your browser loads these fonts from Google servers, which involves the transmission of your IP address to Google. Processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in a consistent and appealing presentation of our services. Transfers to the USA are covered by the EU-US Data Privacy Framework, under which Google LLC is certified.

4. Server Log Files

Each time you access our website, your browser automatically transmits usage data which is stored in log files. This data includes: the IP address of the requesting device, date and time of access, name and URL of the page accessed, data volume transferred, browser type and version, operating system, and the referrer URL. This data is used exclusively to ensure trouble-free operation of our website and to improve our services. Processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the security and stability of our services.

5. Cookies and Consent Management

Our website uses cookies — small text files stored by your browser on your device.

a) Strictly necessary cookies. We use technically necessary cookies to make our shop functional and user-friendly (e.g. shopping cart, session management). Processing is based on Art. 6 (1) (f) GDPR; these cookies are strictly required to provide the service you have expressly requested.

b) Analytics and marketing cookies. Beyond that, we use cookies for analytics and marketing purposes only with your express consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time via the cookie settings on our website.

c) Cookie settings. You can prevent the storage of cookies through your browser settings, and delete stored cookies at any time. Please note that some functions of this website may then not be fully available.

6. Customer Account

When you open a customer account, we collect your personal data to the extent indicated there (name, email address, address where applicable). The purpose of this processing is to improve your shopping experience and simplify order handling. Processing is based on Art. 6 (1) (a) GDPR with your consent. You may withdraw your consent at any time by notifying us; the lawfulness of processing carried out before withdrawal remains unaffected. Your customer account will then be deleted.

7. Contact Form and Email Enquiries

When you use our contact form or contact us by email, we collect your personal data (name, email address, message) only to the extent you provide it. This data is processed for the purpose of handling your enquiry.

If your enquiry relates to a pre-contractual matter (e.g. our robes or made-to-measure services), processing is based on Art. 6 (1) (b) GDPR. In all other cases processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in handling your enquiry, or on Art. 6 (1) (a) GDPR with your consent. Your data is deleted once your enquiry has been fully dealt with, unless statutory retention obligations apply.

8. Orders and Contract Processing

When you place an order, we collect and use your personal data only insofar as this is necessary for the fulfilment and processing of your order and for handling your enquiries. Providing this data is necessary for the conclusion of the contract; without it, no contract can be concluded. Processing is based on Art. 6 (1) (b) GDPR.

Your data is not passed on to third parties without your express consent — with the sole exception of our service partners required for contract fulfilment, in particular: shipping providers (for delivery and tracking), payment providers (see Section 9), and Shopify (as platform operator and processor, see Section 3). The scope of data transferred is limited to the necessary minimum.

Made-to-measure orders. For orders of made-to-measure products (robes, gowns), we additionally process your individual body measurements, fabric selection, embroidery texts and lining design choices. This data is required to manufacture your individual product and is processed on the basis of Art. 6 (1) (b) GDPR. This data is collected via the app Globo Product Options (Globo, Vietnam), which acts as a processor on our behalf; it is used exclusively for order processing.

9. Payment Providers

a) Shopify Payments (Stripe). For credit card payments (Visa, Mastercard, American Express), Shop Pay, Apple Pay and Google Pay we use Shopify Payments, technically processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; for US customers also Stripe, Inc., USA). When you select one of these payment methods, the data required for payment processing (name, payment details, billing address) is transmitted directly to Stripe. Processing is based on Art. 6 (1) (b) GDPR (contract fulfilment).

b) PayPal. If you select PayPal, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg) or — for US customers — PayPal, Inc. The data required for payment processing is transmitted to PayPal. Processing is based on Art. 6 (1) (b) GDPR.

c) Klarna. If you select a Klarna payment method (e.g. Pay Later or instalments), payment is processed by Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (for US customers: Klarna Inc.). The data required for processing (name, address, email, order details; where applicable, further data in the context of an identity and credit assessment) is transmitted to Klarna. Klarna decides independently on the payment options it offers and, in this respect, acts as an independent controller. Processing is based on Art. 6 (1) (b) GDPR.

10. Disclosure to Shipping Companies

For the purpose of delivering your order, we pass on your name, delivery address and — where required — your email address and telephone number to the commissioned transport company, insofar as this is necessary for delivery. Your email address is passed on for shipping status notifications only if you have expressly consented to this during the order process (Art. 6 (1) (a) GDPR). You may withdraw this consent at any time.

11. Google Analytics

Where you have given your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). Google Analytics uses cookies and similar technologies that enable an analysis of your use of the website. IP anonymisation is activated on this website. Your data may also be transferred to the USA; such transfers are covered by the EU-US Data Privacy Framework, under which Google LLC is certified.

Processing takes place exclusively on the basis of Art. 6 (1) (a) GDPR with your consent, given via our cookie settings. You may withdraw your consent at any time. You can additionally prevent collection by Google Analytics by installing the browser add-on available at Google Analytics Opt-out.

12. Google reCAPTCHA

We use the reCAPTCHA service of Google Ireland Limited on our website to distinguish whether an input is made by a human being or by automated processing (bot protection). Your IP address and, where applicable, further data required by Google for the service are transmitted to Google. Transfers to the USA are covered by the EU-US Data Privacy Framework. Processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in protecting our website against abusive automated access and spam.

13. Social Media Links

Our website contains links to our profiles on social networks (e.g. Facebook, Instagram, LinkedIn). These are simple hyperlinks — no data is transmitted to the providers of the social networks by the mere inclusion of the links. Only when you click a link and visit the respective platform do the privacy policies of the respective provider apply.

14. Transactional Emails

In the course of order processing you will receive automated emails (order confirmation, shipping notification, invoices). These are sent via the Shopify platform. Processing is based on Art. 6 (1) (b) GDPR (contract fulfilment).

15. Storage Period

After complete processing of the contract, your data is initially stored for the duration of the applicable warranty period, thereafter in accordance with statutory retention periods — in particular under German commercial and tax law (generally 6 or 10 years pursuant to Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)) — and deleted after expiry of these periods, unless you have consented to further processing and use.

16. Your Rights as a Data Subject (GDPR)

Where the legal requirements are met, you have the following rights — this applies in particular to customers in the European Union and the European Economic Area:

  • Right of access (Art. 15 GDPR) — you may request information about the personal data we process about you.
  • Right to rectification (Art. 16 GDPR) — you may request the correction of inaccurate data or the completion of your data.
  • Right to erasure (Art. 17 GDPR) — you may request the deletion of your data, unless statutory retention obligations apply.
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR) — you may request that we provide your data in a structured, commonly used and machine-readable format.
  • Right to object (Art. 21 GDPR) — you may object at any time to processing based on Art. 6 (1) (f) GDPR (legitimate interests).

Right to object: Where we process your personal data on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to this processing pursuant to Art. 21 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing.

To exercise your rights, please contact us using the contact details given in Section 1.

17. Withdrawal of Consent

Where we process data on the basis of your consent, you have the right to withdraw your consent at any time with effect for the future. The lawfulness of the processing carried out until withdrawal remains unaffected. You can declare your withdrawal informally by email to service@robe-shop.com or via our cookie settings.

18. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data is unlawful. The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Phone: +49 981 180093-0
Website: www.lda.bayern.de

19. International Data Transfers

Where we process data in countries outside the European Economic Area (EEA), or where this occurs in the context of using third-party services, this is done only in compliance with the special requirements of Art. 44 et seq. GDPR. For data transfers to the USA we rely on the adequacy decision of the European Commission on the EU-US Data Privacy Framework (decision of 10 July 2023, C(2023) 4745), insofar as the receiving companies are certified under the Framework. For transfers to other third countries we rely on Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or other appropriate safeguards.

20. Privacy Notice for US Residents

This section applies to visitors and customers residing in the United States, including California residents, and supplements the information above.

a) Categories of personal information we collect. Depending on how you use our shop, we collect: identifiers (name, postal address, email address, telephone number, IP address); commercial information (products purchased or considered, order history); payment information (processed by our payment providers — we do not store full card numbers); physical characteristics you provide for made-to-measure orders (body measurements); and internet activity information (log files, cookie data as described above).

b) Purposes. We use this information to process and deliver your orders (including manufacturing made-to-measure robes), to communicate with you, to provide customer service, to operate and secure our website, and — only with your consent — for analytics.

c) No sale of personal information. We do not sell your personal information for money. Where the disclosure of information for advertising or analytics purposes could qualify as a "sale" or "sharing" under applicable US state privacy laws (such as the California Consumer Privacy Act as amended by the CPRA), you can opt out at any time via our Your Privacy Choices page. We also honor the Global Privacy Control (GPC) signal.

d) Your rights. Depending on your state of residence, you may have the right to know/access the personal information we hold about you, to request its deletion, to request correction, and not to be discriminated against for exercising these rights. To exercise these rights, contact us at service@robe-shop.com or use our Your Privacy Choices page. We will verify your request using the contact information associated with your order or account.

e) Retention. We retain personal information as described in Section 15.

21. Changes to this Privacy Policy

We reserve the right to amend this privacy policy in order to adapt it to changed legal situations, technical developments or changes in our data processing operations. The current version is always available on this page.

Last updated: July 2026 — EXTRA Group GmbH, Landshut, Germany