Privacy Policy of LOQAL GmbH
1. Responsible Party
LOQAL GmbH
Findorffstraße 22
28215 Bremen
Germany
Email: info@loqal.world
We have not appointed a data protection officer as we are not legally required to do so. For any questions regarding data protection, you can reach us at the address mentioned above.
2. Overview
We process personal data in accordance with the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications-Telemedia Data Protection Act (TDDDG). Personal data is any data that can be used to identify you personally.
Our website does not use any analytics or advertising tools (no Google Analytics, no Meta or TikTok pixels). Fonts, program libraries, and map tiles are delivered from our own server, so no data is transmitted to Google, content delivery networks, or map providers when visiting the website.
3. Hosting and Server Log Files
The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers located in Germany. We have a data processing agreement with Hetzner (Art. 28 GDPR).
With each access, the server automatically stores: IP address, date and time, accessed page, referrer, browser type, and operating system. This data serves the security and stability of operations and will be deleted after a maximum of 14 days, unless it is needed for the clarification of a security incident for a longer period.
Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a secure and stable operation).
4. Language and Currency Selection
To display the website in the appropriate language and currency, we determine the country from your IP address. For this purpose, we use a database on our own server (GeoLite2 by MaxMind); your IP address is not transmitted to third parties and is not stored. Legal basis: Art. 6 para. 1 lit. f GDPR (legitimate interest in a user-friendly presentation).
5. Cookies and Local Storage
We only use cookies and browser storage that are absolutely necessary for the operation of the shop (§ 25 para. 2 no. 2 TDDDG). Consent is not required for this.
- cps_lang and cps_currency (cookies, 180 days): store language or currency – only if you select them yourself.
- Shopping Cart (localStorage/sessionStorage of your browser): contents of your shopping cart and your design until you empty it.
- support_session (localStorage): maintains your session in the support chat as long as you use it.
The marketing cookie lq_src (assignment of an order to one of our advertising links, 30 days) is only set if you have explicitly consented through our cookie notice (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG). You can revoke your consent at any time via “Cookie Settings” in the footer. A “Global Privacy Control” signal from your browser will be treated as a rejection.
6. Location Search and Map View
When you search for a location, we only transmit the entered location name from our server to geo services (OpenStreetMap services and LocationIQ, Unwired Labs Inc., USA) to determine the location boundaries and coordinates. Your IP address or other data about you will not be shared.
The map tiles come from OpenStreetMap (© OpenStreetMap contributors) and are delivered via our own server.
7. Orders and Contract Processing
Our shop system and the ordering process (checkout) are operated via Shopify (Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Product images are partially loaded from Shopify's content delivery network; in this process, Shopify receives your IP address. To process your order, we process your name, delivery and billing address, email address, possibly phone number, order content, and payment information.
During checkout, Shopify sets its own cookies and processes data according to the Shopify Privacy Policy. Shopify may transfer data to Shopify Inc. (Canada) and subcontractors in the USA; Canada has an adequacy decision from the EU Commission, while Shopify relies on the EU-U.S. Data Privacy Framework or standard contractual clauses for the USA.
Legal basis: Art. 6 para. 1 lit. b GDPR (contract fulfillment) as well as Art. 6 para. 1 lit. c GDPR (commercial and tax retention obligations).
8. Payment Processing
Depending on the chosen payment method, we transmit the necessary payment data to:
- Shopify Payments (credit and debit cards, Apple Pay, Google Pay, Shop Pay) – payment processing by Shopify and their payment partners (including Stripe Payments Europe Ltd., Ireland);
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg),
- Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden) – for orders from Europe. Klarna receives your contact and order data and may query credit agencies to verify identity and creditworthiness; the Klarna Privacy Policy applies.
If additional payment methods are offered during checkout, the privacy policy of the respective provider applies. Legal basis: Art. 6 para. 1 lit. b GDPR.
9. Production and Shipping
Our products are manufactured and shipped by Printful (Printful Latvia AS, Ojāra Vācieša iela 6B, Riga, LV-1004, Latvia, as well as affiliated production facilities, including in the USA) after your order. For this purpose, we transmit your name, delivery address, possibly phone number, and email address as well as the order content. Printful forwards the delivery data to the respective shipping company. In the case of production outside the EU, the transmission is based on standard contractual clauses or the EU-U.S. Data Privacy Framework.
Legal basis: Art. 6 para. 1 lit. b GDPR.
10. Contact Form and Email
If you contact us via the contact form or by email, we process your information (name, email address, message) to respond to your inquiry. Email transmission is handled by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Legal basis: Art. 6 para. 1 lit. b GDPR if it concerns a contract, otherwise Art. 6 para. 1 lit. f GDPR.
11. Support Chat
Our support chat answers questions using an AI language model from OpenAI, L.L.C. (USA). Your chat messages are transmitted to OpenAI. To obtain information about an order, you must first confirm the order number and email address via a one-time code or link; the chat then queries the order data from Shopify. Please do not enter sensitive data (e.g., payment information) in the chat.
The transmission to the USA is based on standard contractual clauses of the EU Commission. OpenAI does not use data transmitted via the API to train its models. Legal basis: Art. 6 para. 1 lit. b GDPR (order inquiries) or Art. 6 para. 1 lit. f GDPR (general inquiries). You can always contact us by email instead.
12. Newsletter
If you subscribe to our newsletter, we store your email address, the time, and the IP address of the registration and confirmation. You will initially receive an email with a confirmation link (double opt-in); only after clicking it will the subscription become effective. We delete unconfirmed registrations.
The data is stored on our own server; we currently do not use an external newsletter service provider. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR), which you can revoke at any time via the unsubscribe link in each newsletter or by email to us.
13. Links to Social Networks
On our website, we link to our profiles on social networks. These are simple links; data is only transmitted when you click a link and access the network's page.
14. Storage Duration
We only store personal data as long as necessary for the respective purpose. Order and billing data are retained for up to 10 years due to commercial and tax obligations (§ 147 AO, § 257 HGB).
15. Your Rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), deletion (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), as well as to withdraw consents granted with effect for the future (Art. 7 para. 3).
Right to Object (Art. 21 GDPR): If we process your data based on a legitimate interest, you can object at any time for reasons arising from your particular situation.
Please contact us at info@loqal.world.
16. Right to Complain
You can file a complaint with a data protection supervisory authority. The responsible authority for us is: The State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen, Am Wall 140, 28195 Bremen.
17. Data Security
The transmission between your browser and our server is encrypted via TLS. We implement further technical and organizational measures to protect your data.
18. Changes
We will adjust this privacy policy if our data processing or the legal situation changes. The currently published version applies.
As of: 09.10.2026