Privacy policy

Effective date: 2024-07-20

Updated on: 2026-07-25

This Privacy Policy explains how Siccas Guitars GmbH collects and uses personal information when you use our online store at www.siccasguitars.com and www.siccasguitars.de (the “Service”). Both domains are operated as a single online store by Siccas Guitars GmbH. This Privacy Policy describes your privacy rights and how you are protected under applicable data protection law, in particular the EU General Data Protection Regulation (GDPR).

We process your personal data only where a legal basis under Art. 6(1) GDPR applies – in particular your consent, the performance of a contract, compliance with a legal obligation, or our legitimate interests, as described for each purpose below.

We may update this Privacy Policy from time to time. The current version is always available on this page; the date of the last update is shown above.

Controller

The controller responsible for data processing under the GDPR is:
Siccas Guitars GmbH
Roonstr. 31, 76137 Karlsruhe, Germany
Email: mirco@siccasguitars.com
Phone: +49 721 38143275

Collection and Use of Your Personal Information

Information We Collect

When using our Service, you may be asked to provide personal information used to contact or identify you. We collect in particular the following information:

• Usage Data
• Name
• Email address
• Phone number
• Address (shipping and billing address; as a delivery address you may provide either a private or a business address)
• Payment information

Usage Data includes the following:

• Internet Protocol (IP) address of the devices accessing the site
• Web page requests
• Referring web pages
• Browser used to access the site
• Time and date of access

How We Collect Information

We collect and receive information from you in the following manner:

• When you fill in a form or otherwise submit your personal information.
• When you interact with our Service.
• From external, publicly available sources.

We store your personal data only for as long as necessary for the respective purposes described in this Policy. The data is then deleted, unless statutory retention obligations (for example, commercial and tax-law retention periods for order and invoice data) require longer storage. Information which does not identify you personally may be stored indefinitely.

How We Use Your Information

We may use your information for the following purposes:

• Providing and maintaining our Service and monitoring its usage (Art. 6(1)(b) and (f) GDPR).
• Data analysis to identify usage trends and to evaluate and improve our Service, products, and marketing efforts (Art. 6(1)(f) GDPR).
• Managing your account and enabling access to functions available to registered users (Art. 6(1)(b) GDPR).
• Performing a contract for products or services you have purchased through our Service (Art. 6(1)(b) GDPR).
• Contacting you by email, phone, SMS, or other electronic communication regarding functions, products, services, or security notices where necessary (Art. 6(1)(b) and (f) GDPR).
• Keeping you informed about news, general information, special offers, new services, and events, where you have consented or where permitted by law (Art. 6(1)(a) or (f) GDPR).
• Marketing and promotional initiatives and advertising relevant to your interests, subject to your consent where required (Art. 6(1)(a) or (f) GDPR).
• Testimonials and customer feedback, if you choose to share a review that may be published on the website.
• Managing customer orders placed through our Service (Art. 6(1)(b) GDPR).
• Website administration.
• Dispute resolution and protection of our Service in the event of a legal dispute (Art. 6(1)(f) GDPR).
• User-to-user comments, where your screen name, image, or email may be publicly visible if you post such comments.

Sharing of Your Information

Siccas Guitars GmbH will share your information, when applicable, in the following situations:

• With your consent. We share your information for a specific purpose only with your explicit consent.
• For business transfers. Your information may be shared in the event of a merger, sale of business assets, financing, or acquisition of all or part of our business.

Third-party Sharing

Any third party we share your information with must disclose the purpose for which they intend to use it, retain it only for the disclosed duration, and must not further collect, sell, or use your personal information except as necessary to perform the specified purpose.

Your information may be shared with a third party for reasons including:

• Analytics. To track and analyse website traffic.
• Payment processing. To process payments in the event of a purchase, refund, or similar request.
• Advertising campaigns. With service providers who help improve targeted advertising campaigns.
• Marketing. To generate and send newsletters, email marketing, and advertisements.

Your information may also be disclosed to comply with applicable laws, regulations, or court orders; to respond to claims that your use of our Service violates third-party rights; or to enforce agreements including this Privacy Policy.

Session Recording and Behavior Analytics. We use tools such as Microsoft Clarity and/or Hotjar to better understand how visitors interact with our website. These services may record mouse movements, clicks, scrolling, and page interactions. Session recordings help us identify usability issues and improve user experience. These tools may collect your IP address (anonymized), device type, browser information, and browsing behavior through cookies and similar technologies. Where consent is required, these tools are loaded only after you have given consent via our cookie/consent banner. For more information, please refer to Microsoft Clarity Terms and Hotjar Privacy Policy.

Customer Communication (Chat, Email, WhatsApp – Superchat)

We use the messaging service “Superchat”, provided by SuperX GmbH, Prenzlauer Allee 242–247, 10405 Berlin, Germany (“Superchat”), to receive and respond to inquiries across several channels (e.g. the chat widget on our website, email, and WhatsApp) in one shared inbox.

Superchat processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is in place with SuperX GmbH. Data is stored and processed on servers located in Germany.

Depending on the channel and the information you provide, the following data may be processed: your name, email address, phone number, the content of your messages and communication, timestamps, and technical connection data (e.g. IP address, device and browser information).

We process this data to receive, handle, and respond to your inquiries. The legal basis is our legitimate interest in efficient customer communication (Art. 6(1)(f) GDPR) and, where the communication relates to initiating or performing a contract, Art. 6(1)(b) GDPR. Where consent is required for cookies or similar technologies, processing is based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with future effect.

Website chat widget: When you open or use the chat window on our website, the data you enter and technical data required to provide the chat are processed. If the widget uses cookies or similar technologies that are not strictly necessary, we load it only after you have given consent via our cookie/consent banner.

WhatsApp: If you contact us via WhatsApp, your messages and contact details are additionally processed through the WhatsApp Business services of Meta Platforms Ireland Ltd. / Meta Platforms, Inc. This may involve a transfer of data to the USA. Please do not send us sensitive personal data via WhatsApp. For details, see the WhatsApp/Meta privacy policy (https://www.whatsapp.com/legal/privacy-policy-eea).

Email: If you contact us by email, your message may also be processed via Superchat to handle your request.

Superchat engages sub-processors under Art. 28 GDPR, including Amazon Web Services (hosting, data region Germany), Meta (for the WhatsApp channel, with possible transfer to the USA), and Google. Personal data is retained only as long as necessary to handle your request and is then deleted, unless statutory retention obligations apply.

Workflow Automation and Lead Management (Zapier)

We use the service “Zapier”, provided by Zapier, Inc., 548 Market St #62411, San Francisco, CA 94104, USA (“Zapier”), to automate workflows between the systems we use, in particular our email accounts, our messaging service (Superchat), and our customer relationship management system (Zoho CRM).

Zapier processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is in place with Zapier.

We use Zapier for the following purposes in particular:

• When we send an email to a customer, the recipient's email address is matched against existing leads in our CRM. If a match is found, the corresponding lead is marked as “contacted” so that our sales records remain up to date.
• Inquiries received via Superchat are transferred to our CRM to create or update a lead, including the information you provide about your request and your interest in our products and services.
• When an invoice is created in our CRM, the associated lead is tagged accordingly for our internal sales process.

Depending on the process concerned, the following data may be processed: your name, email address, phone number, the content and subject of your inquiry, your product interests, and the status of our communication with you.

The legal basis is our legitimate interest in efficient sales and customer relationship management and in maintaining accurate records (Art. 6(1)(f) GDPR) and, where the processing relates to initiating or performing a contract, Art. 6(1)(b) GDPR.

As Zapier processes data in the USA, this may involve a transfer of data to the USA. Such transfers are based on the Standard Contractual Clauses of the European Commission and on Zapier's certification under the EU-US Data Privacy Framework. Zapier engages sub-processors under Art. 28 GDPR; information on these sub-processors is available in Zapier's list of subprocessors (https://zapier.com/legal/subprocessors).

For more information, see Zapier's privacy notice (https://zapier.com/legal/data-privacy).

Customer Relationship Management (Zoho CRM)

We use “Zoho CRM”, a customer relationship management service provided by Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands (“Zoho”), to manage our leads, customers and sales activities.

Zoho processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is in place with Zoho. Our Zoho CRM data is hosted in Zoho's data centres within the European Union.

We store and process the following data in Zoho CRM, among others: your name, email address, phone number, address, the content and subject of your inquiries, your product interests, and information about our communication and business relationship with you (e.g. inquiries, offers, orders and invoices).

We use this data to respond to your inquiries, advise you on suitable products, process orders, and maintain our business relationship. The legal basis is our legitimate interest in efficient sales and customer relationship management (Art. 6(1)(f) GDPR) and, where the processing relates to initiating or performing a contract, Art. 6(1)(b) GDPR.

Personal data is retained for as long as necessary for the purposes described or for the duration of our business relationship, unless statutory retention obligations require longer storage.

For more information, see Zoho's privacy policy (https://www.zoho.com/privacy.html).

Appointment Scheduling (Calendly)

We use “Calendly”, a scheduling service provided by Calendly, LLC, 271 17th St NW, Suite 1000, Atlanta, GA 30363, USA (“Calendly”), to arrange appointments with customers and interested parties.

Calendly processes personal data on our behalf as a processor. A data processing agreement pursuant to Art. 28 GDPR is incorporated into Calendly's Terms of Use and applies to our use of the service.

When you book an appointment, the following data may be processed in particular: your name, email address, the selected date and time, and any information you provide about the appointment.

We use this data to schedule, confirm and manage appointments. The legal basis is our legitimate interest in efficient appointment scheduling (Art. 6(1)(f) GDPR) and, where the appointment relates to initiating or performing a contract, Art. 6(1)(b) GDPR.

Calendly hosts data in the USA. This involves a transfer of data to the USA, which is based on the Standard Contractual Clauses of the European Commission and on Calendly's certification under the EU-US Data Privacy Framework. Information on Calendly's sub-processors is available at https://calendly.com/help/calendly-sub-processors-gdpr-ccpa.

For more information, see Calendly's privacy notice (https://calendly.com/legal/privacy-notice).

Affiliate Programme (Awin)

We operate an invitation-only affiliate/partner programme using technology provided by AWIN AG, Eichhornstraße 3, 10785 Berlin, Germany (“Awin”), under advertiser ID 127151. We invite selected partners (for example, classical guitarists) who promote our Siccas Luthiers guitars. Attribution is based on personal discount (voucher) codes.

To operate the programme, the official Awin Shopify integration loads the Awin MasterTag on our pages and reports completed orders to Awin on a server-to-server basis so that the referring partner's commission can be calculated. The data processed includes the order reference, the order value, attribution references, and technical information (e.g. IP address, device and browser information).

Depending on your consent, Awin may set the following first-party cookies (the names contain our advertiser ID 127151): _aw_m_127151 (MasterTag), _aw_channel (deduplication / traffic source) and _aw_j_127151 (user journey), with a lifetime of up to 30 days. These are only set after you have consented to the “Marketing” and “Analytics” categories via our cookie/consent banner; without your consent, no Awin tracking cookies are stored and the tracking pixel is not rendered.

With respect to this processing, Awin and Siccas Guitars GmbH act as joint controllers within the meaning of Art. 26 GDPR. The legal basis for consent-based cookies is your consent pursuant to Art. 6(1)(a) GDPR (in conjunction with Section 25(1) TDDDG); beyond that, our legitimate interest in the correct attribution and settlement of affiliate commissions pursuant to Art. 6(1)(f) GDPR. You can withdraw your consent at any time with effect for the future via the cookie settings.

For more information on Awin's data processing, see Awin's privacy policy at https://www.awin.com/gb/privacy and the cookie overview at https://privacy.awin.com.

Cookies

Cookies are small text files placed on your device by websites you visit. Websites use cookies to help users navigate efficiently and perform certain functions. Cookies that are strictly necessary for the website to operate may be set without your consent. All other cookies are only set after you have given your consent via our cookie/consent banner; you can change or withdraw your choice at any time via the cookie settings.

• Strictly necessary cookies. Enable core website functionality such as login and account management. The website cannot be used properly without them.
• Performance cookies. Collect information about how visitors use the website (e.g. analytics) and cannot be used to directly identify a visitor.
• Targeting cookies. Used to identify visitors across websites (e.g. content partners, ad networks) to build interest profiles or show relevant ads on other websites.
• Functionality cookies. Remember visitor information such as language, timezone, or enhanced content.
• Unclassified cookies. Cookies that do not belong to any other category or are in the process of categorization.

You can change your choice at any time: open cookie settings.

Name	Description	Category	Provider	Duration
cookieconsent_status	This cookie is associated with the app Consentmo GDPR Compliance and is used for storing the customer's consent.	Necessary	Consentmo	1 year
cookieconsent_preferences_disabled	This cookie is associated with the app Consentmo GDPR Compliance and is used for storing the customer's consent.	Necessary	Consentmo	1 day
_ab	Used to control when the admin bar is shown on the storefront.	Necessary	Shopify	1 year
_abv	Persist the collapsed state of the admin bar.	Necessary	Shopify	1 year
_checkout_queue_token	Used when there is a queue during the checkout process.	Necessary	Shopify	1 year
_identity_session	Merchant authentication: Main session cookie for Identity authentication. This is the underlying Rails session cookie. It contains the SID.	Necessary	Shopify	2 years
_master_udr	Permanent device identifier.	Necessary	Shopify	Session
_merchant_essential	Contains essential information for the correct functionality of merchant surfaces such as the admin area.	Necessary	Shopify	1 year
_pay_session	The Rails session cookie for Shopify Pay	Necessary	Shopify	Session
_shopify_country	Used for Plus shops where pricing currency/country is set from GeoIP by helping avoid GeoIP lookups after the first request.	Necessary	Shopify	30 minutes
_shopify_essential	Contains essential information for the correct functionality of a store such as session and checkout information and anti-tampering data.	Necessary	Shopify	1 year
_shopify_essential_	Contains an opaque token that is used to identify a device for all essential purposes.	Necessary	Shopify	1 year
_shopify_test	Used to check cookie capabilities on the client.	Necessary	Shopify	1 minute
_storefront_u	Used to facilitate updating customer account information.	Necessary	Shopify	1 minute
_tracking_consent	Used to store a user's preferences if a merchant has set up privacy rules in the visitor's region.	Necessary	Shopify	1 year
auth_state_*	Stores authentication state before redirecting customers to third party for authentication.	Necessary	Shopify	25 minutes
cart	Contains information related to the user's cart.	Necessary	Shopify	2 weeks
cart_currency	Used after a checkout is completed to initialize a new empty cart with the same currency as the one just used.	Necessary	Shopify	2 weeks
checkout	Used by checkout to identify the user.	Necessary	Shopify	21 days
checkout_token	Used by checkout to identify the user.	Necessary	Shopify	Session
customer_account_locale	Used to keep track of a customer account locale when a redirection occurs from checkout or the storefront to customer accounts.	Necessary	Shopify	1 year
discount_code	Stores a discount code (received from an online store visit with a URL parameter) in order to the next checkout.	Necessary	Shopify	Session
hide_shopify_pay_for_checkout	Set when a buyer dismisses the Shop Pay login modal during checkout, informing display to buyer.	Necessary	Shopify	Session
identity-state	Stores a hash of the oauth flow state between redirects.	Necessary	Shopify	1 day
identity_customer_account_number	Stores an identifier used to facilitate login across the customer's account and storefront domains.	Necessary	Shopify	12 weeks
in_checkout_profile_preview	Used to determine if a merchant is in a checkout profile preview session.	Necessary	Shopify	Session
keep_alive	Used when international domain redirection is enabled to determine if a request is the first one of a session.	Necessary	Shopify	Session
localization	Used to localize the cart to the correct country.	Necessary	Shopify	2 weeks
login_with_shop_finalize	Used to facilitate login with Shop.	Necessary	Shopify	5 minutes
master_device_id	Merchant authentication: Permanent device identifier, public version.	Necessary	Shopify	1 year
order	Used to allow access to the data of the order details page of the buyer.	Necessary	Shopify	3 weeks
profile_preview_token	Used for previewing checkout customizations.	Necessary	Shopify	5 minutes
shop_pay_accelerated	Indicates if a buyer is eligible for Shop Pay accelerated checkout.	Necessary	Shopify	1 year
shopify_pay	Used to log in a buyer into Shop Pay when they come back to checkout on the same store.	Necessary	Shopify	1 year
shopify_pay_redirect	Used to accelerate the checkout process when the buyer has a Shop Pay account.	Necessary	Shopify	1 year
skip_shop_pay	Disables Shop Pay as a payment method for a checkout.	Necessary	Shopify	1 year
storefront_digest	Stores a digest of the storefront password, allowing merchants to preview their storefront while it's password protected.	Necessary	Shopify	1 year
theme	Used to determine the theme of the storefront.	Necessary	Shopify	1 weeks
user	Used in connection with Shop login.	Necessary	Shopify	1 year
user_cross_site	Used in connection with Shop login.	Necessary	Shopify	1 year
_landing_page	Capture the landing page of visitor when they come from other sites.	Statistics	Shopify	2 weeks
_merchant_analytics	Contains analytics data for the merchant session.	Statistics	Shopify	1 year
_orig_referrer	Allows merchant to identify where people are visiting them from.	Statistics	Shopify	2 weeks
_shopify_analytics	Contains analytics data for buyer surfaces such as the storefront or checkout.	Statistics	Shopify	1 year
_shopify_ga	Contains Google Analytics parameters that enable cross-domain analytics measurement to work.	Statistics	Shopify	Session
_shopify_s	Used to identify a given browser session/shop combination. Duration is 30 minute rolling expiry of last use.	Statistics	Shopify	30 minutes
_shopify_y	Shopify analytics.	Statistics	Shopify	1 year
shop_analytics	Contains the required buyer information for analytics in Shop.	Statistics	Shopify	1 year
_shopify_marketing	Contains marketing data for buyer surfaces such as the storefront or checkout.	Marketing	Shopify	1 year
shopify_override_user_locale	Used as a mechanism to set User locale in admin.	Preferences	Shopify	1 year

Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests or to direct marketing (Art. 21 GDPR)
• Right to withdraw consent at any time, with effect for the future, where processing is based on consent (Art. 7(3) GDPR)

To exercise these rights, please contact us using the details in the “Controller” section above.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany – www.baden-wuerttemberg.datenschutz.de
You may also contact the supervisory authority of your habitual residence or the place of the alleged infringement.

Data processing when exercising the right of withdrawal

When you use our online withdrawal form, we process the following data:

• Order number and email address – to identify the order
• IP address – to protect against misuse (rate limiting)
• Comment (optional) – if you choose to leave one
• Date and time of submission – to legally document the moment of withdrawal

Data is processed on the basis of Art. 6(1)(c) GDPR (compliance with a legal obligation) and Art. 6(1)(b) GDPR (performance of a contract). To confirm the withdrawal, a one-time confirmation link is sent to the email address associated with the order, valid for 24 hours. Data is stored in accordance with statutory retention periods.

Security

Your information's security is important to us. We use a range of security measures to prevent the misuse, loss, or alteration of the information you provide. However, because no transmission over the internet can be guaranteed to be fully secure, you access our Service at your own risk.

Siccas Guitars GmbH is not responsible for the performance of websites operated by third parties or your interactions with them. When you leave this website, we recommend you review the privacy practices of other websites you interact with.

Contact Us

For any questions, please contact us through the following methods:
Name: Siccas Guitars GmbH
Address: Roonstr. 31, 76137 Karlsruhe, Germany
Email: mirco@siccasguitars.com
Website: www.siccasguitars.com
Phone: +49 721 38143275