Privacy Policy

MANUFAKTUR BAVARIA — ROBE SHOP · EXTRA Group GmbH · Last updated: September 2026

Thank you for your interest in our online shop. The protection of your privacy is important to us. Below we explain in detail how we handle your personal data when you visit robe-shop.com and use our services. This policy is written to meet the requirements of the EU General Data Protection Regulation (GDPR) — which applies to all our customers, including customers in the European Union — as well as applicable US state privacy laws (see Section 21).

1. Controller

The controller within the meaning of the GDPR is:

EXTRA Group GmbH
represented by the Managing Director Yeşim Küçükay
Mathes-Deutsch-Weg 24B
84036 Landshut, Germany
Phone: +49 871 9740734-0
Email: service@robe-shop.com

2. General Information on Data Processing

Unless stated otherwise below, providing your personal data is neither legally nor contractually required, nor necessary for the conclusion of a contract. You are not obliged to provide your data, and not providing it has no consequences — except where expressly stated in the individual processing operations described below.

"Personal data" means any information relating to an identified or identifiable natural person.

3. Hosting and Technical Infrastructure

Our online shop is operated on the Shopify platform, a service of Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify processes, on our behalf, the personal data required for operating the online shop and handling orders. Servers are located in Canada, the USA and the EU.

Data transfers to the USA are covered by the adequacy decision of the European Commission based on the EU-US Data Privacy Framework (decision of 10 July 2023). Shopify is certified under the Data Privacy Framework. Data transfers to Canada are covered by the adequacy decision of the European Commission for Canada.

Processing is based on Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and efficient operation of our online shop. Shopify processes personal data on our behalf as our processor under a data processing agreement pursuant to Art. 28 GDPR.

Google Fonts: The fonts used on this website — including those of our chat concierge — are self-hosted and delivered from our own infrastructure and our shop platform’s content delivery network (Shopify). No connection to Google servers is established and no personal data is transmitted to Google for font delivery.

4. Server Log Files

Each time you access our website, your browser automatically transmits usage data which is stored in log files. This data includes: the IP address of the requesting device, date and time of access, name and URL of the page accessed, data volume transferred, browser type and version, operating system, and the referrer URL. This data is used exclusively to ensure trouble-free operation of our website and to improve our services. Processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the security and stability of our services.

5. Cookies and Consent Management

Our website uses cookies — small text files stored by your browser on your device.

a) Strictly necessary cookies. We use technically necessary cookies to make our shop functional and user-friendly (e.g. shopping cart, session management). Processing is based on Art. 6 (1) (f) GDPR; these cookies are strictly required to provide the service you have expressly requested.

b) Analytics and marketing cookies. Beyond that, we use cookies for analytics and marketing purposes only with your express consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time via the cookie settings on our website.

c) Cookie settings. You can prevent the storage of cookies through your browser settings, and delete stored cookies at any time. Please note that some functions of this website may then not be fully available.

6. Customer Account

When you open a customer account, we collect your personal data to the extent indicated there (name, email address, address where applicable). The purpose of this processing is to improve your shopping experience and simplify order handling. Processing is based on Art. 6 (1) (a) GDPR with your consent. You may withdraw your consent at any time by notifying us; the lawfulness of processing carried out before withdrawal remains unaffected. Your customer account will then be deleted.

7. Contact Form and Email Enquiries

When you use our contact form or contact us by email, we collect your personal data (name, email address, message) only to the extent you provide it. In our contact form, name and email address are required so that we can reply to you. Your telephone number is required only if you ask for a callback or a visit to the atelier; otherwise it is voluntary. Your details on your request, occasion, date, robe, cloth, trim and measurements, a callback request and a file you may attach (up to 10 MB) are also voluntary. This data is processed for the purpose of handling your enquiry.

The contact form transmits your details in encrypted form to a server operated by us in a data centre of Hetzner Online GmbH in Nuremberg, Germany. From there they are forwarded by email via our email provider IONOS SE (Montabaur, Germany) to our atelier; you receive a confirmation at the email address you provided. We only store your details on the server if forwarding fails – access-protected and only until we have delivered the enquiry by hand. We use your IP address solely to prevent abusive mass submissions.

If your enquiry relates to a pre-contractual matter (e.g. our robes or made-to-measure services), processing is based on Art. 6 (1) (b) GDPR. In all other cases processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in handling your enquiry, or on Art. 6 (1) (a) GDPR with your consent. Your data is deleted once your enquiry has been fully dealt with, unless statutory retention obligations apply.

8. Orders and Contract Processing

When you place an order, we collect and use your personal data only insofar as this is necessary for the fulfilment and processing of your order and for handling your enquiries. Providing this data is necessary for the conclusion of the contract; without it, no contract can be concluded. Processing is based on Art. 6 (1) (b) GDPR.

Your data is not passed on to third parties without your express consent — with the sole exception of our service partners required for contract fulfilment, in particular: shipping providers (for delivery and tracking), payment providers (see Section 9), and Shopify (as platform operator and processor, see Section 3). The scope of data transferred is limited to the necessary minimum.

Made-to-measure orders. For orders of made-to-measure products (robes, gowns), we additionally process your individual body measurements, fabric selection, embroidery texts and lining design choices. This data is required to manufacture your individual product and is processed on the basis of Art. 6 (1) (b) GDPR. This data is collected via the app Globo Product Options (Globo, Vietnam), which acts as a processor on our behalf; it is used exclusively for order processing.

9. Payment Providers

a) Shopify Payments (Stripe). For credit card payments (Visa, Mastercard, American Express), Shop Pay, Apple Pay and Google Pay we use Shopify Payments, technically processed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; for US customers also Stripe, Inc., USA). When you select one of these payment methods, the data required for payment processing (name, payment details, billing address) is transmitted directly to Stripe. Processing is based on Art. 6 (1) (b) GDPR (contract fulfilment). When the shop is displayed and Shopify’s express checkout (Shop Pay) is available, your browser may load technical resources from Shopify’s domains (shop.app) and Shopify’s content-delivery partners — for example payment-method logos from images.ctfassets.net (Contentful GmbH, Berlin). No payment data is transmitted in the process.

b) PayPal. If you select PayPal, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A. (22-24 Boulevard Royal, L-2449 Luxembourg) or — for US customers — PayPal, Inc. The data required for payment processing is transmitted to PayPal. Processing is based on Art. 6 (1) (b) GDPR. When product pages are displayed, your browser loads scripts from paypal.com for the PayPal payment button; your IP address is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, already when viewing the page. Legal basis: our legitimate interest in displaying the available payment methods (Art. 6 (1) (f) GDPR).

10. Disclosure to Shipping Companies

For the purpose of delivering your order, we pass on your name, delivery address and — where required — your email address and telephone number to the commissioned transport company, insofar as this is necessary for delivery. Your email address is passed on for shipping status notifications only if you have expressly consented to this during the order process (Art. 6 (1) (a) GDPR). You may withdraw this consent at any time.

11. Google Analytics

Where you have given your consent, we use Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; "Google"). Google Analytics uses cookies and similar technologies that enable an analysis of your use of the website. According to Google, Google Analytics 4 does not log or store IP addresses. Your data may also be transferred to the USA; such transfers are covered by the EU-US Data Privacy Framework, under which Google LLC is certified.

Processing takes place exclusively on the basis of Art. 6 (1) (a) GDPR with your consent, given via our cookie settings. You may withdraw your consent at any time. You can additionally prevent collection by Google Analytics by installing the browser add-on available at Google Analytics Opt-out.

11a. Google Ads Conversion Measurement

Where you have given your consent, we use Google Ads conversion measurement (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to see whether our ads lead to visits or orders. Cookies and similar technologies are used only after your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). Transfers to the USA are covered by the EU-US Data Privacy Framework. You can withdraw your consent at any time via the cookie settings.

12. hCaptcha

We use the hCaptcha service of Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA, on our website to distinguish whether an input is made by a human being or by automated processing (bot protection). Your IP address and, where applicable, further data required for the service are transmitted to Intuition Machines, Inc. Transfers to the USA are covered by the EU-US Data Privacy Framework, under which Intuition Machines, Inc. is certified. Processing is based on Art. 6 (1) (f) GDPR on the basis of our legitimate interest in protecting our website against abusive automated access and spam.

13. Social Media Links

Our website contains links to our profiles on social networks (e.g. Facebook, Instagram, LinkedIn). These are simple hyperlinks — no data is transmitted to the providers of the social networks by the mere inclusion of the links. Only when you click a link and visit the respective platform do the privacy policies of the respective provider apply.

14. Transactional Emails

In the course of order processing you will receive automated emails (order confirmation, shipping notification, invoices). These are sent via the Shopify platform. Processing is based on Art. 6 (1) (b) GDPR (contract fulfilment).

15. AI Concierge (Marlene): Chat, Phone and Image Processing

Our website offers an optional AI-based concierge chat (“Marlene”), and we operate an AI-assisted telephone service on +1 (855) 610-4667. Every service of our shop is equally available without the concierge, via the contact details given in Section 1.

Chat. When you use the chat, the messages you type, images you choose to upload, and design sketches created for you are processed in order to advise you on our products and to prepare your inquiry. Chat messages are deleted no later than 30 days after the conversation; session records are deleted after 90 days; uploaded images and sketches are deleted 30 days after creation. If you ask for an individual offer or wish to be contacted, the details you provide (for example your name and e-mail address) and a summary of the conversation are forwarded to our atelier team and are then kept as business correspondence.

Phone. Calls to our concierge line are not recorded. Your speech is transcribed and processed with AI assistance so that we can advise you; transcripts are subject to the same deletion periods as chat messages. You are informed of this at the beginning of each call.

Processors and third-country transfer. For the AI processing we use OpenAI, L.L.C. (USA) and, as a technical fallback, Anthropic PBC (USA); for telephony we use Twilio Inc. (USA). Each of them acts as our processor, and transfers to the USA are safeguarded by the EU Standard Contractual Clauses. Content submitted through our concierge via these providers’ interfaces is not used to train their models.

Legal basis. Art. 6 (1) (b) GDPR (steps prior to entering into a contract, taken at your request) and Art. 6 (1) (f) GDPR (our legitimate interest in efficient, high-quality customer advice). Your rights as a data subject are set out below in this policy.

16. Storage Period

After complete processing of the contract, your data is initially stored for the duration of the applicable warranty period, thereafter in accordance with statutory retention periods — in particular under German commercial and tax law (generally 6 or 10 years pursuant to Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO)) — and deleted after expiry of these periods, unless you have consented to further processing and use.

17. Your Rights as a Data Subject (GDPR)

Where the legal requirements are met, you have the following rights — this applies in particular to customers in the European Union and the European Economic Area:

• Right of access (Art. 15 GDPR) — you may request information about the personal data we process about you.
• Right to rectification (Art. 16 GDPR) — you may request the correction of inaccurate data or the completion of your data.
• Right to erasure (Art. 17 GDPR) — you may request the deletion of your data, unless statutory retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) — you may request that we provide your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR) — you may object at any time to processing based on Art. 6 (1) (f) GDPR (legitimate interests).

Right to object: Where we process your personal data on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to this processing pursuant to Art. 21 GDPR. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing.

To exercise your rights, please contact us using the contact details given in Section 1.

18. Withdrawal of Consent

Where we process data on the basis of your consent, you have the right to withdraw your consent at any time with effect for the future. The lawfulness of the processing carried out until withdrawal remains unaffected. You can declare your withdrawal informally by email to service@robe-shop.com or via our cookie settings.

19. Right to Lodge a Complaint with a Supervisory Authority

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data is unlawful. The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Phone: +49 981 180093-0
Website: www.lda.bayern.de

20. International Data Transfers

Where we process data in countries outside the European Economic Area (EEA), or where this occurs in the context of using third-party services, this is done only in compliance with the special requirements of Art. 44 et seq. GDPR. For data transfers to the USA we rely on the adequacy decision of the European Commission on the EU-US Data Privacy Framework (decision of 10 July 2023, C(2023) 4745), insofar as the receiving companies are certified under the Framework. For transfers to other third countries we rely on Standard Contractual Clauses (Art. 46 (2) (c) GDPR) or other appropriate safeguards.

21. Privacy Notice for US Residents

This section applies to visitors and customers residing in the United States, including California residents, and supplements the information above.

a) Categories of personal information we collect. Depending on how you use our shop, we collect: identifiers (name, postal address, email address, telephone number, IP address); commercial information (products purchased or considered, order history); payment information (processed by our payment providers — we do not store full card numbers); physical characteristics you provide for made-to-measure orders (body measurements); and internet activity information (log files, cookie data as described above).

b) Purposes. We use this information to process and deliver your orders (including manufacturing made-to-measure robes), to communicate with you, to provide customer service, to operate and secure our website, and — only with your consent — for analytics.

c) No sale of personal information. We do not sell your personal information for money. Where the disclosure of information for advertising or analytics purposes could qualify as a "sale" or "sharing" under applicable US state privacy laws (such as the California Consumer Privacy Act as amended by the CPRA), you can opt out at any time via our Your Privacy Choices page. We also honor the Global Privacy Control (GPC) signal.

d) Your rights. Depending on your state of residence, you may have the right to know/access the personal information we hold about you, to request its deletion, to request correction, and not to be discriminated against for exercising these rights. To exercise these rights, contact us at service@robe-shop.com or use our Your Privacy Choices page. We will verify your request using the contact information associated with your order or account.

e) Retention. We retain personal information as described in Section 16.

22. Changes to this Privacy Policy

We reserve the right to amend this privacy policy in order to adapt it to changed legal situations, technical developments or changes in our data processing operations. The current version is always available on this page.

---

Last updated: September 2026 — EXTRA Group GmbH, Landshut, Germany