In the following, we inform you about the handling of your personal data when using our website. This Privacy Policy should be read in line with our Cookie Policy and follows the legal requirements set out in the United Kingdom Data Protection ACT 2018 (DPA) and the General Data Protection Regulation (GDPR).


The person responsible for data processing is:
ECRU LABEL 
61 Bridge Street Kington HR5 3DJ
contact@ecrulabel.co.uk


ECRU LABEL respects your right to privacy and is committed to the following key principles:

  • We protect your privacy and aim to provide you with a service that is tailored to your needs.
  • Personal data is collected for specific purposes based on your consent or a legitimate interest when you contact us.
  • You have the right to information and access to your personal data at any time and may request its correction or deletion.
  • We do not sell your personal data to third parties. However, if necessary and if explicitly mentioned afterwards or if you have consented, we may share your data with group companies, brand licensees, partners and other service providers. In this case, their own privacy policies may also apply.
  • We take all reasonable measures to ensure the security and protection of your data from misuse.
Legal Basis
The term "personal data" under data protection law refers to all information relating to an identified or identifiable individual.
We process personal data in compliance with the relevant data protection regulations, in particular the GDPR and the DPA. Data processing by us only takes place on the basis of legal permission. We process personal data,
  • only with your consent,
  • for the performance of a contract to which you are a party,
  • at your request for the performance of pre-contractual measures,
  • to comply with a legal obligation,
  • or if the processing is necessary to protect our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights or freedoms which require the protection of personal data override.

The processing of your personal data may be based on the following legal grounds:
  • Art. 6 (1) lit. a GDPR serves as our legal basis for processing operations where we obtain your consent for a specific processing purpose.
  • Art. 6 (1) lit. b GDPR, insofar as the processing of personal data is necessary for the performance of a contract, e.g., if you purchase a product. The same applies to such processing operations that are necessary for the performance of pre-contractual measures, for example in the case of enquiries about our products or services.
  • Art. 6 (1) lit. c GDPR, insofar as we are subject to a legal obligation that requires the processing of personal data, such as for the fulfilment of tax obligations.
  • Art. 6 (1) lit. d GDPR in the event that vital interests of you or another natural person require the processing of personal data.
  • Art. 6 (1) lit. f GDPR applies on the basis of our legitimate interests, e.g., when using service providers as part of order processing, such as shipping service providers or when carrying out statistical surveys and analyses and logging registration procedures. Our interest is directed towards the use of a user-friendly, appealing and secure presentation as well as optimisation of our website, which serves our business interests as well as meeting your expectations.

Access data and hosting
You can visit our web sites without providing any personal information. Each time you visit a web site, the web server automatically saves a so-called server log file, which contains, for example, the name of the requested file, your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data) and documents the access.
This access data is evaluated solely for the purpose of ensuring trouble-free operation of the site and improving our services. In accordance with Art. 6 para. 1 p. 1 lit. f GDPR, this serves to protect our legitimate interests in the correct presentation of our offer, which outweigh our interests in the context of a balancing of interests. All access data is deleted at the latest seven days after the end of your visit to the site.
Hosting services by a third-party provider
As part of processing on our behalf, a third-party provider provides hosting and web site display services for us. All data collected in the course of using this web site or in forms provided for this purpose in the online shop as described below are processed on its servers. Processing on other servers only takes place within the framework explained here.
We use the store system of the service provider Shopify International Limited ("Shopify"), for the purpose of hosting and displaying the online store on the basis of processing on our behalf. All data collected on our website is processed on Shopify's servers. As part of Shopify's services, data may also be transferred to Shopify Inc, 150 Elgin St, Ottawa, ON K2P 1L4, Canada, Shopify Data Processing (USA) Inc, Shopify Payments (USA) Inc or Shopify (USA) Inc as part of further processing on our behalf. In the event that data is transferred to Shopify Inc. in Canada, the appropriate level of data protection is guaranteed by adequacy decision of the European Commission. Further processing on servers other than the aforementioned of Shopify will only take place within the framework communicated below.
Cookies
In order to make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your terminal device. Some of the cookies we use are deleted after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your end device and allow your browser to be recognised the next time you visit (so-called persistent cookies). If cookies are set, they collect and process certain user information such as browser and location data as well as IP address values to an individual extent. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie. The duration of the respective cookie storage can be found in the overview of the cookie settings of your web browser. You can learn more about Cookies in general by visiting www.allaboutcookies.com and  more about the cookies we use in our Cookie Policy.
Data collection and use for contract processing, contacting and opening a customer account
We collect personal data if you voluntarily provide it to us in the context of your order, when contacting us or when opening a customer account. Mandatory fields are marked as such because in these cases we absolutely need the data to process the contract, or to process your contact or open a customer account, and you cannot complete the order and/or open an account or send the contact without providing it. Which data is collected can be seen from the respective input forms.
We use the data you provide in accordance with Art. 6 Para. 1 S. 1 lit. b GDPR for the purpose of processing the contract and dealing with your enquiries. After complete processing of the contract or deletion of your customer account, your data will be restricted for further processing and deleted after expiry of the retention periods under tax and commercial law, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration. The deletion of your customer account is possible at any time and can be done either by sending a message to the contact option described below or via a function provided for this purpose in the customer account.
Data transfer
In order to fulfil the contract in accordance with Art. 6 para. 1 p. 1 lit. b GDPR, we pass on your data to the shipping company commissioned with the delivery, insofar as this is necessary for the delivery of ordered goods. Depending on which payment service provider you select in the ordering process, we pass on the payment data collected for this purpose to the credit institution commissioned with the payment and, if applicable, to payment service providers commissioned by us or to the selected payment service. In some cases, the selected payment service providers also collect this data themselves if you create an account with them. In this case, you must register with the payment service provider with your access data during the ordering process. In this respect, the privacy policy of the respective payment service provider applies.
Data transfer to shipping service providers
If you have given us your express consent to do so during or after your order, we will pass on your e-mail address to the selected shipping service provider in accordance with Art. 6 Para. 1 Sentence 1 lit. a GDPR so that the shipping service provider can contact you before delivery for the purpose of delivery notification or coordination.
You can revoke your consent at any time by sending a message to the contact option described below or directly to the shipping service provider at the contact address listed below. After revocation, we will delete your data provided for this purpose, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration.
E-mail advertising with newsletter registration
If you register for our newsletter, we will use the data required for this purpose or separately provided by you to send you our e-mail newsletter on a regular basis based on your consent pursuant to Art. 6 (1) p. 1 lit. a GDPR.
Unsubscribing from the newsletter is possible at any time and can be done either by sending a message to the contact option described below or via a link provided for this purpose in the newsletter. After unsubscribing, we will delete your email address from the list of recipients, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this, which is permitted by law and about which we inform you in this declaration.
The newsletter is sent as part of processing on our behalf by a service provider to whom we pass on your e-mail address for this purpose. This service provider is located within a country of the European Union or the European Economic Area.
Postal advertising and your right to object
In addition, we reserve the right to use your first and last name as well as your postal address for our own advertising purposes, e.g., to send you interesting offers and information about our products by post. This serves to protect our legitimate interests in addressing our customers in an advertising manner in accordance with Art. 6 Para. 1 S. 1 lit. f GDPR.
Use of Google (Universal) Analytics for web analysis
Insofar as you have given your consent to this in accordance with Art. 6 (1) sentence 1 lit. a of the GDPR, this web site uses Google (Universal) Analytics for the purpose of web site analysis. The web analytics service is provided by Google Ireland Limited, a company incorporated and operated under the laws of Ireland, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. (www.google.de). Google (Universal) Analytics uses methods that enable an analysis of your use of the web site, such as cookies. The information automatically collected about your use of this web site is usually transmitted to a Google server in the USA and stored there. By activating IP anonymisation on this web site, the IP address is shortened before transmission within the Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. The anonymised IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data. After the end of the purpose and the end of the use of Google Analytics by us, the data collected in this context will be deleted.
You can revoke your consent at any time with effect for the future by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de. This will prevent the collection of the data generated by the cookie and related to your use of the web site (incl. your IP address) as well as the processing of this data by Google.
Shopify Statistics
We use the Shopify Statistics feature on our website. This allows us to measure the reach of our website and provides us with statistical analysis of visitor behaviour on our website. The data is processed on servers of Shopify, which we have commissioned with the processing.
The legal basis for the data processing in connection with the Shopify statistics function is our legitimate interest in the analysis of user behaviour on our website and the possible design according to requirements. You can object to this processing at any time in the cookie settings.
Shopify Analytics
We use Shopify Analytics, a web analytics service provided by Shopify, on our website. Shopify Analytics uses cookies, which are text files placed on your computer, to help the website analyse how users use the site.
The information generated by these cookies, such as the time, place and frequency of your web site visit, including your IP address, is transmitted to Shopify and stored there. In this case, your IP address will already be shortened by Shopify within member states of the European Union or in other contracting states of the Agreement on the European Economic Area and thus anonymised.
Shopify will use this information for the purpose of evaluating your use of our website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Shopify may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Shopify's behalf.
Shopify will not, according to its own information, associate your IP address with any other data held by Shopify. You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of this website.
Klaviyo
We use the services of Klaviyo, Inc (Klaviyo) to analyse user behaviour in our online shop for our own advertising and market research purposes. Klaviyo also uses cookies and can link your behavior in our web shop with your data if you have registered for our newsletter, created a customer account or gone through an order process in our web shop. 
Social media
Social buttons from social networks are used on our web site. This serves to protect our legitimate interests in optimal marketing of our offer, which outweigh our interests in the context of a balancing of interests, in accordance with Art. 6 (1) p. 1 lit. f GDPR. In order to increase the protection of your data when visiting our web site, these buttons are not fully integrated as plug-ins, but only using an HTML link on the page. This integration ensures that when you call up a page of our website that contains such buttons, no connection is yet established with the servers of the provider of the respective social network.
If you click on one of the buttons, a new window of your browser opens and calls up the page of the respective service provider, on which you can (if necessary after entering your login data) e.g. click on the Like or Share button.
For the purpose and scope of the data collection and the further processing and use of the data by the providers on their pages, as well as a contact option and your rights and setting options in this regard to protect your privacy, please refer to the privacy policies of the providers:
Our online presence on Facebook, Twitter, Instagram
Our presence on social networks and platforms serves to improve active communication with our customers and interested parties. We provide information about our products and current special offers there. When visiting our online presences on social media, your data may be automatically collected and stored for market research and advertising purposes. So-called usage profiles are created from this data using pseudonyms. These can be used, for example, to place advertisements within and outside the platforms that presumably correspond to your interests. Cookies are generally used on your terminal device for this purpose. Visitor behaviour and user interests are stored in these cookies. This serves in accordance with Art. 6 Para. 1 lit. f. GDPR, this serves to protect our legitimate interests in an optimised presentation of our offer and effective communication with customers and interested parties, which prevail in the context of a balancing of interests. If you are asked by the respective social media platform operators for consent (agreement) to data processing, e.g., by means of a checkbox, the legal basis for data processing is Art. 6 (1) lit. a GDPR.
For detailed information on the processing and use of data by the providers on their sites, as well as a contact option and your rights and setting options in this regard to protect your privacy, in particular opt-out options, please refer to the privacy policies of the providers linked below. Should you still require assistance in this regard, you can contact us.
Data processing is carried out on the basis of an agreement between jointly responsible parties in accordance with Art. 26 of the GDPR, which you can view here.
Your rights
Of course, you have rights with regard to the collection of your data, which we are pleased to inform you of herewith. If you would like to make use of one of the following free rights, a simple message to us will suffice. For your own protection, we reserve the right, in the case of an existing enquiry, to obtain further information necessary to confirm your identity and, if identification is not possible, to refuse to process the enquiry.
a) Right to information
You have the right to request information and/or copies of the personal information stored about you.
b) Right to rectification
You have the right to request that personal information relating to you be corrected and/or completed without delay.
c) Right to object to processing
You have the right to request the restriction of the processing of your personal information, insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you object to its erasure and we no longer require the data, but you need it for the assertion, exercise or defense of legal claims or you have lodged an objection to the processing.
d) Right to deletion
You have the right to request the erasure of your personal information stored by us, unless the exercise of the right to freedom of expression and information, the processing is necessary for compliance with a legal obligation, for reasons of public interest or for the assertion, exercise or defense of legal claims.
e) Right to information
Where you have exercised the right to rectification, erasure or restriction of processing, we will notify all recipients to whom personal information relating to you has been disclosed of such rectification or erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort.
f) Right to data portability
You have the right to have personal information that you have provided to us handed over to you or to a third party in a structured, common and machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done insofar as it is technically feasible.
g) Right of objection
Insofar as your personal information are processed on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to the processing at any time (Art. 21 (1) GDPR).
If we process your for the purpose of direct marketing, you have the right to object at any time to the processing of personal information concerning you for the purpose of such marketing (Art. 21 (2) GDPR); this also applies to profiling insofar as it is related to such direct marketing.
h) Right to withdraw consent
You have the right to cancel your consent to the collection of data at any time with effect for the future. The data collected until the cancellation becomes legally effective will remain unaffected. Please understand that the implementation of your cancellation may take a little time for technical reasons and that you may still receive messages from us in the meantime.
i) Right to complain to a supervisory authority
If the processing of your personal information violates data protection law or if your data protection rights have otherwise been violated in any way, you may complain to the supervisory authority.
You can also exercise your rights of rectification and deletion most quickly, easily and conveniently by logging into your customer account and directly editing or deleting your data stored there. 
j) Automated decision-making including profiling
You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
Contacting us
If you have any questions about this Privacy Policy, please contact us on contact@ecrulabel.co.uk
Privacy Policy Updates
From time to time, our privacy policies may change due to developments in business practice and/or due to changes in the law. You should periodically review this page for the latest information on ECRU LABEL policies and practices.