Privacy policy

Last updated: 2 October 2026

This policy explains how we process your personal data when you visit supermarket.berlin, place an order or contact us. We process data in line with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

1. Controller

Christopher James Paxton, trading as SUPER Market, Delbrückstraße 41, 12051 Berlin, Germany. Phone: +49 176 61438400. Email: hi@supermarket.berlin.

2. Hosting and server logs (Shopify)

Our shop runs on Shopify. For customers in the EU, the provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes data on our behalf under a data processing agreement (Art. 28 GDPR).

When you visit the shop, the server automatically records technical data: IP address, date and time, pages visited, browser and operating system, and the referring website. We need this to deliver the website securely and to prevent fraud. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working shop).

If you pay with Shop Pay or use other Shopify services linked to your Shopify account, Shopify processes your data as an independent controller. Details: Shopify Consumer Privacy Policy.

3. Cookies and similar technologies

We use technically necessary cookies to run the shop: shopping cart, checkout, security, saving your cookie choice and your age confirmation. Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.

All other cookies and tracking technologies (for example analytics or marketing) are only used with your consent, which you give or refuse in our cookie banner. Legal basis: § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time via the "Cookie settings" link in the footer.

We currently do not use analytics or marketing tools. If we start using them, we will update this policy first.

4. Age verification

We sell alcohol only to adults. When you enter the shop and at checkout, we ask you to confirm that you are at least 18 years old. Your confirmation is stored in your browser and with your order. We do not collect identity documents. Legal basis: Art. 6(1)(c) GDPR in conjunction with § 9 of the German Youth Protection Act (JuSchG), and Art. 6(1)(f) GDPR.

5. Orders

When you order, we process your name, billing and shipping address, email address, phone number (if provided), the products ordered and your payment method. We use this data to process your order, send order and shipping confirmations and handle returns. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Fields marked as required are necessary to conclude the contract.

6. Customer account

If you create a customer account, we store your login details, addresses and order history so you can view past orders and check out faster. Creating an account is voluntary; you can also order as a guest. You can delete your account at any time by emailing us. Legal basis: Art. 6(1)(b) GDPR.

7. Payment

We never see or store your full card details. Payment data goes directly to the payment provider you choose.

Shopify Payments (cards, Apple Pay, Google Pay and other methods shown at checkout) is provided by Shopify International Limited (address above) together with its payment partner Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. They process your payment data and may carry out fraud checks.

PayPal: if you choose PayPal, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal processes your data as an independent controller and may carry out a credit check for some payment methods. Details: PayPal Privacy Statement.

Legal basis: Art. 6(1)(b) GDPR; for fraud prevention, Art. 6(1)(f) GDPR.

8. Shipping with DHL

We ship within Germany with DHL Paket GmbH, Sträßchensteinweg 10, 53113 Bonn, Germany. We pass on your name and shipping address so the parcel can be delivered. Legal basis: Art. 6(1)(b) GDPR.

We pass on your email address or phone number only if you have agreed to this at checkout, so that DHL can notify you about delivery. Legal basis: Art. 6(1)(a) GDPR. You can withdraw this consent at any time by emailing us.

9. Local pickup

If you choose pickup at Gneisenaustraße 57, Berlin, we use your name and order number to hand over your order. Legal basis: Art. 6(1)(b) GDPR.

10. Online withdrawal function

We offer a button on our website to withdraw from your contract online. For this we use the app "EU Widerruf Button", provided by 401layers UG (haftungsbeschränkt), Dorothea-Erxleben-Straße 1a, 40721 Hilden, Germany, which processes data on our behalf. We process your name, email address, order number and the date of your withdrawal. Legal basis: Art. 6(1)(c) GDPR (statutory obligation to offer an electronic withdrawal function) and Art. 6(1)(b) GDPR.

11. Contacting us

If you contact us by email or phone, we process your details and your message to answer your request. Legal basis: Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

12. Transfers outside the EU

Some of our service providers, or their group companies, process data outside the EU, in particular in Canada and the USA. Canada has an EU adequacy decision. For the USA, transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses.

13. How long we keep your data

We delete personal data once it is no longer needed for its purpose. Order and accounting records must be kept for 6, 8 or 10 years, depending on the document type, under German commercial and tax law (§ 257 HGB, § 147 AO). During that time they are only used to meet these obligations.

14. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)). To exercise your rights, email hi@supermarket.berlin.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, Germany.

15. Right to object

Where we process your data based on Art. 6(1)(f) GDPR (legitimate interests), you have the right to object at any time, on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing your data unless we can show compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.

16. Further information

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Our website uses TLS encryption to protect data in transit. Our shop is not intended for people under 18. We may update this policy when our services or the law change; the current version is always available on this page.