EN
DE
Privacy
This is a courtesy translation. The German version is the legally binding one: Datenschutz
Privacy Policy
We are pleased that you are visiting our online shop Stickershop24. Below we inform you, pursuant to Art. 13, 14 GDPR, about the processing of your personal data.
1. Controller
Hookain Onlineshop GmbH
Grüner Brunnenweg 146, 50827 Cologne, Germany
represented by Johannes Heming
E-mail: info@stickershop24.de · Phone: 0221 999 88 112 (Mon–Fri 12–6 pm CET)
Stickershop24 is a brand of Hookain Onlineshop GmbH.
Data Protection Officer: Elisa Kujat, e-mail: e.kujat@stickershop24.de
2. Legal Bases
- Art. 6(1)(a) GDPR — consent (e.g. newsletter, non-essential cookies)
- Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures
- Art. 6(1)(c) GDPR — legal obligations (retention under commercial and tax law)
- Art. 6(1)(f) GDPR — legitimate interests (technical operation, security, fraud prevention)
Storing information on, and accessing information from, your device is additionally governed by § 25 TDDDG (German Telecommunications Digital Services Data Protection Act).
3. Server Log Files
When you visit our website, information transmitted by your browser is automatically collected: IP address, date and time of access, file/URL accessed, amount of data transferred, notice of successful retrieval, browser type and version, operating system, referrer URL. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing, and ensuring the stability and security of, our services. Deletion after 7 days.
The shop runs on a server in a data centre within the European Union. The hosting provider is Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, with whom a data processing agreement pursuant to Art. 28 GDPR is in place.
4. Cookies and Consent Management
We set technically necessary cookies (shopping cart, login, consent status) on the basis of § 25(2) TDDDG in conjunction with Art. 6(1)(f) or (b) GDPR. We only set any non-essential cookies with your consent pursuant to § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. We ask for your consent on your first visit via a consent banner; you can withdraw it at any time with effect for the future.
Consent management is part of the JTL-Shop software and runs entirely on our own server; no external consent provider is involved. Your decision is not stored as a cookie but in your browser's local storage under the key consent, and remains there until you withdraw it or clear your browser storage.
Only a single cookie is technically necessary: JTLSHOP — the session identifier that keeps the shopping cart and login together. It is only transmitted via an encrypted connection, cannot be read by scripts (secure, HttpOnly), and ends with the session.
We serve fonts and most scripts from our own server. With your consent, we additionally use Google Analytics (GA4) and Google Ads conversion tracking (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA), managed via Google Tag Manager, as well as Brevo (provider: Brevo SAS, 8 rue de Londres, 75009 Paris, France) for sending newsletters and automated, behaviour-based e-mails. The legal basis in each case is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); both services only load after you consent in the consent banner, and no data is transmitted without your consent. Further information: policies.google.com/privacy and de.sendinblue.com/legal/privacypolicy.
5. Customer Account
When you create a customer account, we process your name, address, e-mail address, password (encrypted) and order history in order to provide and manage the account. Legal basis: Art. 6(1)(b) GDPR. You can delete your account, or request its deletion, at any time; statutory retention obligations remain unaffected.
6. Order Processing
To process your order, we process the data provided during the ordering process (name, billing and delivery address, e-mail address, telephone number if applicable, ordered goods, payment data). Legal basis: Art. 6(1)(b) GDPR, and for retention Art. 6(1)(c) GDPR (§ 257 HGB, § 147 AO).
7. Payment Processing via Mollie
Payment is processed via Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. We offer PayPal, Klarna, credit card (incl. Google Pay in supported browsers), Apple Pay, bank transfer/advance payment, purchase on invoice and SEPA direct debit.
We transmit the data required for payment processing to Mollie (name, address, e-mail address, order amount, currency, transaction number, as well as payment-method-specific data such as credit card details, IBAN, or PayPal/Klarna account details, some of which you enter directly with Mollie or with the respective payment service). Depending on the payment method, Mollie forwards this data on, in particular to PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg), Klarna Bank AB (publ) (Sweden), and the banks and card networks involved.
The legal basis is Art. 6(1)(b) GDPR. Insofar as Mollie or the payment service processes data for fraud prevention or due to legal obligations (e.g. anti-money-laundering), Art. 6(1)(c) and (f) GDPR additionally apply. In the case of Klarna and purchase on invoice, a creditworthiness check may be carried out; an automated rejection in an individual case is possible pursuant to Art. 22 GDPR, and the credit agency involved is named by the respective payment service during the ordering process.
As a regulated payment institution, Mollie describes itself as predominantly an independent controller within the meaning of the GDPR, and otherwise as a recipient of your data. Further information: mollie.com/en/privacy
8. Shipping Provider
For delivery, we transmit your name and delivery address to DHL Paket GmbH. Legal basis: Art. 6(1)(b) GDPR. For shipping notifications (tracking link, delivery notices), we also transmit your e-mail address or telephone number to DHL, provided you supplied these during the ordering process; the legal basis is Art. 6(1)(b) GDPR (performance of a contract).
9. Contacting Us
When you contact us via form, e-mail or telephone, we process the data you provide in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where there is a contractual connection, otherwise Art. 6(1)(f) GDPR. Deletion once handling is complete and no retention obligations apply.
10. Newsletter
We use your e-mail address for the newsletter. Registration takes place via a double opt-in procedure. We log the registration and confirmation (time, IP address) as evidence of consent. Legal basis: Art. 6(1)(a) GDPR, and for the logging Art. 6(1)(c) and (f) GDPR. You can unsubscribe at any time via the link at the end of every e-mail.
Sending is carried out via the provider Brevo — details on the provider, purpose and legal basis can be found in section 4.
11. Recipients of Data
We only pass on data insofar as necessary for the purposes stated: to Mollie and the selected payment services (section 7), to DHL (section 8), to our hosting provider Hetzner (section 3), with your consent to Google and Brevo (section 4), and — where legally required — to tax advisors, authorities or courts. Agreements pursuant to Art. 28 GDPR are in place with processors.
12. Transfer to Third Countries
In the course of payment processing and through the use of Google Analytics/Google Ads (section 4), data may be transferred to the USA. The providers involved secure this by way of appropriate safeguards (including EU standard contractual clauses pursuant to Art. 46 GDPR or certification under the EU-U.S. Data Privacy Framework).
13. Retention Period
We only store personal data for as long as necessary for the purposes stated. It is deleted thereafter, unless retention obligations apply: business letters for 6 years, accounting records, invoices and commercial books for 10 years (§ 257 HGB, § 147 AO).
14. Your Rights
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to withdraw consent given (Art. 7(3) GDPR) with effect for the future
Right to object (Art. 21 GDPR): Insofar as we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time for reasons arising from your particular situation. You can object to direct marketing at any time without giving any reason.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information, Kavalleriestraße 2-4, 40213 Düsseldorf.
15. Obligation to Provide Data
Providing the data marked as mandatory is necessary for concluding a contract; without it, we cannot process your order. We do not ourselves carry out automated decision-making, including profiling, pursuant to Art. 22 GDPR; however, as part of the creditworthiness check for Klarna and purchase on invoice, the respective payment service may decide automatically on the payment method (see section 7).
Last updated: 31 August 2026
