Privacy policy
Effective date: 2024-07-20
Updated on: 2026-09-16
This Privacy Policy explains how Siccas Guitars GmbH collects and uses personal information when you use our online store at www.siccasguitars.com and www.siccasguitars.de (the “Service”). Both domains are operated as a single online store by Siccas Guitars GmbH. This Privacy Policy describes your privacy rights and how you are protected under applicable data protection law, in particular the EU General Data Protection Regulation (GDPR).
We process your personal data only where a legal basis under Art. 6(1) GDPR applies – in particular your consent, the performance of a contract, compliance with a legal obligation, or our legitimate interests, as described for each purpose below.
We may update this Privacy Policy from time to time. The current version is always available on this page; the date of the last update is shown above.
Controller
The controller responsible for data processing under the GDPR is:
Siccas Guitars GmbH
Roonstr. 31, 76137 Karlsruhe, Germany
Email: mirco@siccasguitars.com
Phone: +49 721 38143275
Collection and Use of Your Personal Information
Information We Collect
When using our Service, you may be asked to provide personal information used to contact or identify you. We collect in particular the following information:
- Usage Data
- Name
- Email address
- Phone number
- Address (shipping and billing address; as a delivery address you may provide either a private or a business address)
- Payment information
Usage Data includes the following:
- Internet Protocol (IP) address of the devices accessing the site
- Web page requests
- Referring web pages
- Browser used to access the site
- Time and date of access
How We Collect Information
We collect and receive information from you in the following manner:
- When you fill in a form or otherwise submit your personal information.
- When you interact with our Service.
- From external, publicly available sources.
We store your personal data only for as long as necessary for the respective purposes described in this Policy. The data is then deleted, unless statutory retention obligations (for example, commercial and tax-law retention periods for order and invoice data) require longer storage. Information which does not identify you personally may be stored indefinitely.
How We Use Your Information
We may use your information for the following purposes:
- Providing and maintaining our Service and monitoring its usage (Art. 6(1)(b) and (f) GDPR).
- Data analysis to identify usage trends and to evaluate and improve our Service, products, and marketing efforts (Art. 6(1)(f) GDPR).
- Managing your account and enabling access to functions available to registered users (Art. 6(1)(b) GDPR).
- Performing a contract for products or services you have purchased through our Service (Art. 6(1)(b) GDPR).
- Contacting you by email, phone, SMS, or other electronic communication regarding functions, products, services, or security notices where necessary (Art. 6(1)(b) and (f) GDPR).
- Keeping you informed about news, general information, special offers, new services, and events, where you have consented or where permitted by law (Art. 6(1)(a) or (f) GDPR).
- Marketing and promotional initiatives and advertising relevant to your interests, subject to your consent where required (Art. 6(1)(a) or (f) GDPR).
- Testimonials and customer feedback, if you choose to share a review that may be published on the website.
- Managing customer orders placed through our Service (Art. 6(1)(b) GDPR).
- Website administration.
- Dispute resolution and protection of our Service in the event of a legal dispute (Art. 6(1)(f) GDPR).
- User-to-user comments, where your screen name, image, or email may be publicly visible if you post such comments.
Sharing of Your Information
Siccas Guitars GmbH will share your information, when applicable, in the following situations:
- With your consent. We share your information for a specific purpose only with your explicit consent.
- For business transfers. Your information may be shared in the event of a merger, sale of business assets, financing, or acquisition of all or part of our business.
Third-party Sharing
Any third party we share your information with must disclose the purpose for which they intend to use it, retain it only for the disclosed duration, and must not further collect, sell, or use your personal information except as necessary to perform the specified purpose.
Your information may be shared with a third party for reasons including:
- Analytics. To track and analyse website traffic.
- Payment processing. To process payments in the event of a purchase, refund, or similar request.
- Advertising campaigns. With service providers who help improve targeted advertising campaigns.
- Marketing. To generate and send newsletters, email marketing, and advertisements.
Your information may also be disclosed to comply with applicable laws, regulations, or court orders; to respond to claims that your use of our Service violates third-party rights; or to enforce agreements including this Privacy Policy.
Session Recording and Behavior Analytics. We use tools such as Microsoft Clarity and/or Hotjar to better understand how visitors interact with our website. These services may record mouse movements, clicks, scrolling, and page interactions. Session recordings help us identify usability issues and improve user experience. These tools may collect your IP address (anonymized), device type, browser information, and browsing behavior through cookies and similar technologies. Where consent is required, these tools are loaded only after you have given consent via our cookie/consent banner. For more information, please refer to Microsoft Clarity Terms and Hotjar Privacy Policy.
Customer Communication (Chat, Email, WhatsApp – Superchat)
We use the messaging service “Superchat”, provided by SuperX GmbH, Prenzlauer Allee 242–247, 10405 Berlin, Germany (“Superchat”), to receive and respond to inquiries across several channels (e.g. the chat widget on our website, email, and WhatsApp) in one shared inbox.
Superchat processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is in place with SuperX GmbH. Data is stored and processed on servers located in Germany.
Depending on the channel and the information you provide, the following data may be processed: your name, email address, phone number, the content of your messages and communication, timestamps, and technical connection data (e.g. IP address, device and browser information).
We process this data to receive, handle, and respond to your inquiries. The legal basis is our legitimate interest in efficient customer communication (Art. 6(1)(f) GDPR) and, where the communication relates to initiating or performing a contract, Art. 6(1)(b) GDPR. Where consent is required for cookies or similar technologies, processing is based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with future effect.
Website chat widget: When you open or use the chat window on our website, the data you enter and technical data required to provide the chat are processed. If the widget uses cookies or similar technologies that are not strictly necessary, we load it only after you have given consent via our cookie/consent banner.
WhatsApp: If you contact us via WhatsApp, your messages and contact details are additionally processed through the WhatsApp Business services of Meta Platforms Ireland Ltd. / Meta Platforms, Inc. This may involve a transfer of data to the USA. Please do not send us sensitive personal data via WhatsApp. For details, see the WhatsApp/Meta privacy policy (https://www.whatsapp.com/legal/privacy-policy-eea).
Email: If you contact us by email, your message may also be processed via Superchat to handle your request.
Superchat engages sub-processors under Art. 28 GDPR, including Amazon Web Services (hosting, data region Germany), Meta (for the WhatsApp channel, with possible transfer to the USA), and Google. Personal data is retained only as long as necessary to handle your request and is then deleted, unless statutory retention obligations apply.
Advertising Measurement (Reddit Pixel)
We use the Reddit Pixel, a service provided by Reddit, Inc., 548 Market St. #16093, San Francisco, California 94104, USA. Our contracting party is Reddit Netherlands B.V., Looiersgracht 43, 1016 VR Amsterdam, Netherlands.
The Reddit Pixel allows us to measure whether visitors who reached our website through an advertisement on Reddit perform certain actions, such as viewing a product, adding an item to the cart, or completing a purchase. This helps us assess the effectiveness of our advertising.
Reddit also uses the data collected for its own purposes: to improve its own advertising platform, to build audiences for re-engaging visitors to our website, and to build audiences with similar characteristics (lookalike audiences).
The following data is transmitted in particular: your IP address, the user agent, the referring address on our website, the Reddit advertising cookie, device and browser name, operating system version, screen size, and the standard events we have set up, for example adding an item to the cart.
With regard to the data each of us processes, we and Reddit are separate controllers. Each party determines the purposes and means of its own processing independently.
Processing takes place on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The pixel is loaded only after you have given consent via our cookie and consent banner. You may withdraw your consent at any time with future effect through the cookie settings on our website.
Data is transferred to the United States. Reddit, Inc. is certified under the EU-US Data Privacy Framework. Where the Framework does not apply to a transfer, the Standard Contractual Clauses of the European Commission (Module One, controller to controller) pursuant to Art. 46(2)(c) GDPR apply in addition.
Further information can be found in Reddit's privacy policy at https://www.reddit.com/policies/privacy-policy
Newsletter and Email Marketing (Mailchimp)
We use the email marketing service Mailchimp, provided by The Rocket Science Group LLC d/b/a Mailchimp, 405 North Angier Ave. NE, Atlanta, GA 30308, USA, to send our newsletter and to manage our subscriber lists. Mailchimp has appointed Intuit Ireland Software Limited, 112-114 St Stephen's Green, Suite 416, Dublin 2, D02 TD28, Ireland as
its representative in the European Union pursuant to Art. 27 GDPR.
If you subscribe to our newsletter, we process your email address and, where provided, your name. Registration takes place using the double opt-in procedure: after you sign up, we send you a confirmation email, and your address is added to our distribution list only once you have confirmed it. We store the time of registration and confirmation
together with the IP address used, in order to document your consent.
Our newsletters contain a web beacon that allows us to see whether an email was opened and which links were clicked. We use this information to make the content of our newsletter more relevant.
We also use the Mailchimp website pixel, which records visits and actions on our website in order to tailor our email communication and to measure the effect of our campaigns. This pixel is loaded only after you have given consent through our cookie and consent banner.
Mailchimp processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is in place. Mailchimp engages sub-processors; the current list is available at https://mailchimp.com/legal/subprocessors/
The legal basis for sending the newsletter and for analysing opening and click behaviour is your consent pursuant to Art. 6(1)(a) GDPR. For the website pixel, the legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
You may withdraw your consent at any time with future effect. Every newsletter contains an unsubscribe link, and you may also contact us directly. Following withdrawal, your address is removed from the distribution list; we retain a record of the withdrawal in order to document compliance.
Data is transferred to the United States. Mailchimp complies with the EU-US Data Privacy Framework. Where the Framework does not apply to a transfer, the Standard Contractual Clauses of the European Commission (Module Two, controller to processor) pursuant to Art. 46(2)(c) GDPR apply in addition.
Further information can be found in Mailchimp's privacy policy at https://mailchimp.com/legal/privacy/
Workflow Automation and Lead Management (Zapier)
We use the service “Zapier”, provided by Zapier, Inc., 548 Market St #62411, San Francisco, CA 94104, USA (“Zapier”), to automate workflows between the systems we use, in particular our email accounts, our messaging service (Superchat), and our customer relationship management system (Zoho CRM).
Zapier processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is in place with Zapier.
We use Zapier for the following purposes in particular:
- When we send an email to a customer, the recipient's email address is matched against existing leads in our CRM. If a match is found, the corresponding lead is marked as “contacted” so that our sales records remain up to date.
- Inquiries received via Superchat are transferred to our CRM to create or update a lead, including the information you provide about your request and your interest in our products and services.
- When an invoice is created in our CRM, the associated lead is tagged accordingly for our internal sales process.
Depending on the process concerned, the following data may be processed: your name, email address, phone number, the content and subject of your inquiry, your product interests, and the status of our communication with you.
The legal basis is our legitimate interest in efficient sales and customer relationship management and in maintaining accurate records (Art. 6(1)(f) GDPR) and, where the processing relates to initiating or performing a contract, Art. 6(1)(b) GDPR.
As Zapier processes data in the USA, this may involve a transfer of data to the USA. Such transfers are based on the Standard Contractual Clauses of the European Commission and on Zapier's certification under the EU-US Data Privacy Framework. Zapier engages sub-processors under Art. 28 GDPR; information on these sub-processors is available in Zapier's list of subprocessors (https://zapier.com/legal/subprocessors).
For more information, see Zapier's privacy notice (https://zapier.com/legal/data-privacy).
Customer Relationship Management (Zoho CRM)
We use “Zoho CRM”, a customer relationship management service provided by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands (“Zoho”), to manage our leads, customers and sales activities.
Zoho processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is in place with Zoho. Our Zoho CRM data is hosted in Zoho's data centres within the European Union.
We store and process the following data in Zoho CRM, among others: your name, email address, phone number, address, the content and subject of your inquiries, your product interests, and information about our communication and business relationship with you (e.g. inquiries, offers, orders and invoices).
We use this data to respond to your inquiries, advise you on suitable products, process orders, and maintain our business relationship. The legal basis is our legitimate interest in efficient sales and customer relationship management (Art. 6(1)(f) GDPR) and, where the processing relates to initiating or performing a contract, Art. 6(1)(b) GDPR.
Personal data is retained for as long as necessary for the purposes described or for the duration of our business relationship, unless statutory retention obligations require longer storage.
For more information, see Zoho's privacy policy (https://www.zoho.com/privacy.html).
Appointment Scheduling (Calendly)
We use “Calendly”, a scheduling service provided by Calendly, LLC, 271 17th St NW, Suite 1000, Atlanta, GA 30363, USA (“Calendly”), to arrange appointments with customers and interested parties.
Calendly processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is incorporated into Calendly's Terms of Use and applies to our use of the service.
When you book an appointment, the following data may be processed in particular: your name, email address, the selected date and time, and any information you provide about the appointment.
We use this data to schedule, confirm and manage appointments. The legal basis is our legitimate interest in efficient appointment scheduling (Art. 6(1)(f) GDPR) and, where the appointment relates to initiating or performing a contract, Art. 6(1)(b) GDPR.
Calendly hosts data in the USA. This involves a transfer of data to the USA, which is based on the Standard Contractual Clauses of the European Commission and on Calendly's certification under the EU-US Data Privacy Framework. Information on Calendly's sub-processors is available at https://calendly.com/help/calendly-sub-processors-gdpr-ccpa.
For more information, see Calendly's privacy notice (https://calendly.com/legal/privacy-notice).
Affiliate Programme (Awin)
We operate an invitation-only affiliate/partner programme using technology provided by AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany (“Awin”), under advertiser ID 127151. We invite selected partners (for example, classical guitarists) who promote our Siccas Luthiers guitars. Attribution is based on personal discount (voucher) codes.
To operate the programme, the official Awin Shopify integration loads the Awin MasterTag on our pages and reports completed orders to Awin on a server-to-server basis so that the referring partner's commission can be calculated. The data processed includes the order reference, the order value, attribution references, and technical information (e.g. IP address, device and browser information).
Depending on your consent, Awin may set the following first-party cookies (the names contain our advertiser ID 127151): _aw_m_127151 (MasterTag), _aw_channel (deduplication / traffic source) and _aw_j_127151 (user journey), with a lifetime of up to 30 days. These are only set after you have consented to the “Marketing” and “Analytics” categories via our cookie/consent banner; without your consent, no Awin tracking cookies are stored and the tracking pixel is not rendered.
With respect to this processing, Awin and Siccas Guitars GmbH act as joint controllers within the meaning of Art. 26 GDPR. The legal basis for consent-based cookies is your consent pursuant to Art. 6(1)(a) GDPR (in conjunction with Section 25(1) TDDDG); beyond that, our legitimate interest in the correct attribution and settlement of affiliate commissions pursuant to Art. 6(1)(f) GDPR. You can withdraw your consent at any time with effect for the future via the cookie settings.
For more information on Awin's data processing, see Awin's privacy policy at https://www.awin.com/gb/privacy and the cookie overview at https://privacy.awin.com.
Google Services (Tag Manager, Analytics, Ads, Merchant Center)
We use several Google services on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). For users in the European Economic Area and Switzerland, Google Ireland Limited is the responsible entity.
We use the following services:
Google Tag Manager. The Tag Manager handles the integration of the other Google services. It does not collect personal data or set cookies itself, but it enables the services listed below to load.
Google Analytics 4. We analyse how our website is used, for example which pages are viewed, how long a visit lasts, and how visitors reach us. The data processed includes device and browser information, the pages viewed, approximate location data, and a randomly assigned identifier. For visitors from the European Economic Area, IP anonymisation is active and Google does not store the full IP address.
Google Ads. We measure whether a visit originated from one of our advertisements and whether it led to a purchase or an enquiry (conversion measurement). We also build audiences in order to reach visitors to our website again on other websites (remarketing).
Google Merchant Center. We transmit events relating to product views and purchases so that our product data and free product listings can be measured on Google.
Cookies and storage periods
Where consent has been given, these services set the following cookies, among
others:
_ga distinguishes visitors, up to 2 years
_ga_RHJQ866RRN Google Analytics session state, up to 2 years
_ga_6SJ1WZ39MT Merchant Center session state, up to 2 years
_gcl_au attribution of advertisement clicks, up to 90 days
Consent and Google Consent Mode
For visitors from the European Economic Area, the United Kingdom and Switzerland, these Google services only operate with cookies and identifiers after your explicit consent. We use Google Consent Mode V2 for this purpose. Until you make a decision, the default setting for advertising storage and analytics storage is "denied". In that state no cookies are set and no identifiers are stored; only anonymous signals without any recognition feature are sent to Google.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You may withdraw your consent at any time with future effect through the cookie settings on our website.
Roles
For Google Analytics, Google processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is in place on the basis of the Google Ads Data Processing Terms. Where Google processes the data beyond this for its own purposes, for example to improve its own services and advertising products, Google acts as an independent controller in that respect.
Transfer to the United States
Data is transferred to the United States. Google LLC, Mountain View, California, is certified under the EU-US Data Privacy Framework. Where the Framework does not apply to a transfer, the Standard Contractual Clauses of the European Commission pursuant to Art. 46(2)(c) GDPR apply in addition.
Further information and opt-out options
Google privacy policy:
https://policies.google.com/privacy
How Google uses data from partner sites:
https://policies.google.com/technologies/partner-sites
Browser add-on to opt out of Google Analytics:
https://tools.google.com/dlpage/gaoptout
Settings for personalised advertising at Google:
https://myadcenter.google.com
Shop Platform (Shopify)
Our online store runs on the Shopify platform and is hosted by Shopify. For merchants in the European Economic Area, the provider is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland ("Shopify").
Shopify collects and processes our customers' personal data. The data
processed includes order and customer data, payment and shipping details, and technical access data such as IP address, device and browser. Information you submit in our store is shared with Shopify as well as with further service providers, which may be located in other countries.
For the operation of the store and the fulfilment of your order, Shopify processes the data on our behalf as a processor. This processing is necessary for the performance of the contract; the legal basis is Art. 6(1)(b) GDPR. Our store data is stored in data centres within the European Union.
Shopify Network Intelligence
We use the "Shopify Network Intelligence" feature and therefore the services Shopify refers to as "Enhanced Services". With this feature, Shopify uses the customer data arising in our store together with data from interactions with other merchants and with Shopify itself in order to develop and provide analytics, product customisation, personalisation and advertising services. These insights feed into, among other things, the personalisation of our store, search and product discovery, our email communication including reminders for abandoned checkouts, and the targeting of advertising. No other merchant is given access to the data arising in our store.
For this processing, Shopify acts as an independent controller by its own
determination and decides on the purposes and means itself. In this respect,
we and Shopify are separate controllers.
The legal basis for advertising based on your activity, and for the cookies and storage technologies required for it, is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. You give this consent through the "Marketing" category in our cookie and consent banner and may withdraw it at any time with future effect through the cookie settings on our website.
Further information on processing by Shopify can be found in Shopify's consumer privacy policy at https://www.shopify.com/legal/privacy/consumers
You can exercise your rights towards Shopify directly, including objection to and opt-out from certain processing, through Shopify's privacy portal: https://privacy.shopify.com
AI-assisted Handling of Customer Enquiries (Anthropic Claude)
To handle customer enquiries, we use the AI assistance system Claude provided by Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Anthropic processes the data exclusively on our behalf as a processor, on the basis of a data processing agreement pursuant to Art. 28 GDPR.
Scope of the processing. If you contact us by email, the content of your message as well as the contact and order details it contains may be analysed by Claude. This serves to assign your enquiry to the responsible contact person, to prioritise it, and to prepare a draft reply.
No automated decision-making. Every reply sent to you is reviewed and sent by
a member of staff. No automated decision-making within the meaning of Art. 22
GDPR takes place.
Legal basis. The processing takes place for the initiation and performance of a contract pursuant to Art. 6(1)(b) GDPR and on the basis of our legitimate interest in handling enquiries promptly and completely pursuant to Art. 6(1)(f) GDPR.
Transfer to the United States. The processing takes place on servers in the United States. The transfer is based on the Standard Contractual Clauses adopted by the European Commission by Implementing Decision (EU) 2021/914, which form part of our data processing agreement with Anthropic.
No training of AI models. According to Anthropic's contractual commitments, the content we transmit is not used to train AI models.
Storage period. The processing takes place for the duration of our contractual relationship with Anthropic. After it ends, all copies are deleted within 30 days, unless statutory retention obligations prevent this.
Anthropic engages sub-processors pursuant to Art. 28 GDPR; information on these is available at https://www.anthropic.com/subprocessors. Further information can be found in Anthropic's privacy policy (https://www.anthropic.com/legal/privacy).
Cookies
Cookies are small text files placed on your device by websites you visit. Websites use cookies to help users navigate efficiently and perform certain functions. Cookies that are strictly necessary for the website to operate may be set without your consent. All other cookies are only set after you have given your consent via our cookie/consent banner; you can change or withdraw your choice at any time via the cookie settings.
- Strictly necessary cookies. Enable core website functionality such as login and account management. The website cannot be used properly without them.
- Performance cookies. Collect information about how visitors use the website (e.g. analytics) and cannot be used to directly identify a visitor.
- Targeting cookies. Used to identify visitors across websites (e.g. content partners, ad networks) to build interest profiles or show relevant ads on other websites.
- Functionality cookies. Remember visitor information such as language, timezone, or enhanced content.
- Unclassified cookies. Cookies that do not belong to any other category or are in the process of categorization.
| Name | Description | Category | Provider | Duration |
|---|---|---|---|---|
| cookieconsent_status | This cookie is associated with the app Consentmo GDPR Compliance and is used for storing the customer's consent. | Necessary | Consentmo | 1 year |
| cookieconsent_preferences_disabled | This cookie is associated with the app Consentmo GDPR Compliance and is used for storing the customer's consent. | Necessary | Consentmo | 1 day |
| _ab | Used to control when the admin bar is shown on the storefront. | Necessary | Shopify | 1 year |
| _abv | Persist the collapsed state of the admin bar. | Necessary | Shopify | 1 year |
| _checkout_queue_token | Used when there is a queue during the checkout process. | Necessary | Shopify | 1 year |
| _identity_session | Merchant authentication: Main session cookie for Identity authentication. This is the underlying Rails session cookie. It contains the SID. | Necessary | Shopify | 2 years |
| _master_udr | Permanent device identifier. | Necessary | Shopify | Session |
| _merchant_essential | Contains essential information for the correct functionality of merchant surfaces such as the admin area. | Necessary | Shopify | 1 year |
| _pay_session | The Rails session cookie for Shopify Pay | Necessary | Shopify | Session |
| _shopify_country | Used for Plus shops where pricing currency/country is set from GeoIP by helping avoid GeoIP lookups after the first request. | Necessary | Shopify | 30 minutes |
| _shopify_essential | Contains essential information for the correct functionality of a store such as session and checkout information and anti-tampering data. | Necessary | Shopify | 1 year |
| _shopify_essential_ | Contains an opaque token that is used to identify a device for all essential purposes. | Necessary | Shopify | 1 year |
| _shopify_test | Used to check cookie capabilities on the client. | Necessary | Shopify | 1 minute |
| _storefront_u | Used to facilitate updating customer account information. | Necessary | Shopify | 1 minute |
| _tracking_consent | Used to store a user's preferences if a merchant has set up privacy rules in the visitor's region. | Necessary | Shopify | 1 year |
| auth_state_* | Stores authentication state before redirecting customers to third party for authentication. | Necessary | Shopify | 25 minutes |
| cart | Contains information related to the user's cart. | Necessary | Shopify | 2 weeks |
| cart_currency | Used after a checkout is completed to initialize a new empty cart with the same currency as the one just used. | Necessary | Shopify | 2 weeks |
| checkout | Used by checkout to identify the user. | Necessary | Shopify | 21 days |
| checkout_token | Used by checkout to identify the user. | Necessary | Shopify | Session |
| customer_account_locale | Used to keep track of a customer account locale when a redirection occurs from checkout or the storefront to customer accounts. | Necessary | Shopify | 1 year |
| discount_code | Stores a discount code (received from an online store visit with a URL parameter) in order to the next checkout. | Necessary | Shopify | Session |
| hide_shopify_pay_for_checkout | Set when a buyer dismisses the Shop Pay login modal during checkout, informing display to buyer. | Necessary | Shopify | Session |
| identity-state | Stores a hash of the oauth flow state between redirects. | Necessary | Shopify | 1 day |
| identity_customer_account_number | Stores an identifier used to facilitate login across the customer's account and storefront domains. | Necessary | Shopify | 12 weeks |
| in_checkout_profile_preview | Used to determine if a merchant is in a checkout profile preview session. | Necessary | Shopify | Session |
| keep_alive | Used when international domain redirection is enabled to determine if a request is the first one of a session. | Necessary | Shopify | Session |
| localization | Used to localize the cart to the correct country. | Necessary | Shopify | 2 weeks |
| login_with_shop_finalize | Used to facilitate login with Shop. | Necessary | Shopify | 5 minutes |
| master_device_id | Merchant authentication: Permanent device identifier, public version. | Necessary | Shopify | 1 year |
| order | Used to allow access to the data of the order details page of the buyer. | Necessary | Shopify | 3 weeks |
| profile_preview_token | Used for previewing checkout customizations. | Necessary | Shopify | 5 minutes |
| shop_pay_accelerated | Indicates if a buyer is eligible for Shop Pay accelerated checkout. | Necessary | Shopify | 1 year |
| shopify_pay | Used to log in a buyer into Shop Pay when they come back to checkout on the same store. | Necessary | Shopify | 1 year |
| shopify_pay_redirect | Used to accelerate the checkout process when the buyer has a Shop Pay account. | Necessary | Shopify | 1 year |
| skip_shop_pay | Disables Shop Pay as a payment method for a checkout. | Necessary | Shopify | 1 year |
| storefront_digest | Stores a digest of the storefront password, allowing merchants to preview their storefront while it's password protected. | Necessary | Shopify | 1 year |
| theme | Used to determine the theme of the storefront. | Necessary | Shopify | 1 weeks |
| user | Used in connection with Shop login. | Necessary | Shopify | 1 year |
| user_cross_site | Used in connection with Shop login. | Necessary | Shopify | 1 year |
| _landing_page | Capture the landing page of visitor when they come from other sites. | Statistics | Shopify | 2 weeks |
| _merchant_analytics | Contains analytics data for the merchant session. | Statistics | Shopify | 1 year |
| _orig_referrer | Allows merchant to identify where people are visiting them from. | Statistics | Shopify | 2 weeks |
| _shopify_analytics | Contains analytics data for buyer surfaces such as the storefront or checkout. | Statistics | Shopify | 1 year |
| _shopify_ga | Contains Google Analytics parameters that enable cross-domain analytics measurement to work. | Statistics | Shopify | Session |
| _shopify_s | Used to identify a given browser session/shop combination. Duration is 30 minute rolling expiry of last use. | Statistics | Shopify | 30 minutes |
| _shopify_y | Shopify analytics. | Statistics | Shopify | 1 year |
| shop_analytics | Contains the required buyer information for analytics in Shop. | Statistics | Shopify | 1 year |
| _shopify_marketing | Contains marketing data for buyer surfaces such as the storefront or checkout. | Marketing | Shopify | 1 year |
| shopify_override_user_locale | Used as a mechanism to set User locale in admin. | Preferences | Shopify | 1 year |
Your Rights
Under the GDPR you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing based on legitimate interests or to direct marketing (Art. 21 GDPR)
- Right to withdraw consent at any time, with effect for the future, where processing is based on consent (Art. 7(3) GDPR)
To exercise these rights, please contact us using the details in the “Controller” section above.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany – www.baden-wuerttemberg.datenschutz.de
You may also contact the supervisory authority of your habitual residence or the place of the alleged infringement.
Data processing when exercising the right of withdrawal
When you use our online withdrawal form, we process the following data:
- Order number and email address – to identify the order
- IP address – to protect against misuse (rate limiting)
- Comment (optional) – if you choose to leave one
- Date and time of submission – to legally document the moment of withdrawal
Data is processed on the basis of Art. 6(1)(c) GDPR (compliance with a legal obligation) and Art. 6(1)(b) GDPR (performance of a contract). To confirm the withdrawal, a one-time confirmation link is sent to the email address associated with the order, valid for 24 hours. Data is stored in accordance with statutory retention periods.
Security
Your information's security is important to us. We use a range of security measures to prevent the misuse, loss, or alteration of the information you provide. However, because no transmission over the internet can be guaranteed to be fully secure, you access our Service at your own risk.
Siccas Guitars GmbH is not responsible for the performance of websites operated by third parties or your interactions with them. When you leave this website, we recommend you review the privacy practices of other websites you interact with.
Contact Us
For any questions, please contact us through the following methods:
Name: Siccas Guitars GmbH
Address: Roonstr. 31, 76137 Karlsruhe, Germany
Email: mirco@siccasguitars.com
Website: www.siccasguitars.com
Phone: +49 721 38143275