Your shopping bag is empty.
OUVERTURE GmbH (“OUVERTURE”, “we”, “us” or “our”) takes the protection of your personal data seriously. This Privacy Policy explains how we collect, use, store and share personal data when you visit our website, create a customer account, place an order, contact us, subscribe to our newsletter or otherwise interact with us.
We process personal data in accordance with the General Data Protection Regulation (“GDPR”), the German Federal Data Protection Act (“BDSG”), the German Telecommunications Digital Services Data Protection Act (“TDDDG”) and other applicable data-protection laws.
Personal data is processed only where there is an appropriate legal basis, including where processing is necessary to perform a contract, comply with a legal obligation, pursue a legitimate interest or where you have given your consent.
We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, disclosure or access. However, no transmission of information over the internet can be guaranteed to be completely secure.
This Privacy Policy uses the following terms in accordance with the GDPR:
Personal data means any information relating to an identified or identifiable natural person. A natural person is identifiable where they can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
A data subject is an identified or identifiable natural person whose personal data is processed.
Processing means any operation performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, restriction, erasure or destruction.
Restriction of processing means marking stored personal data with the aim of limiting its processing in the future.
Profiling means automated processing of personal data to evaluate certain personal aspects relating to a natural person, including preferences, interests, behaviour, reliability, economic situation, location or movements.
Pseudonymisation means processing personal data in a manner that prevents it from being attributed to a specific person without the use of additional information, provided that the additional information is kept separately and protected by appropriate technical and organisational measures.
The controller is the natural or legal person that determines the purposes and means of processing personal data.
A processor is a natural or legal person that processes personal data on behalf of the controller.
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed.
A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons authorised to process personal data under the authority of the controller or processor.
Consent means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they agree to the processing of their personal data.
The controller responsible for processing personal data in connection with this website is:
OUVERTURE GmbH
c/o Factory Berlin Mitte
Rheinsberger Straße 76/77
10115 Berlin
Germany
Telephone: +49 30 2327 0207
Email: hello@ouverture-studio.com
Website: ouverture-studio.com
Our online shop is hosted and technically operated using the Shopify ecommerce platform.
For merchants located in Europe, the relevant Shopify contracting entity is generally:
Shopify International Limited
Dublin
Ireland
Shopify processes personal data on our behalf where this is necessary to provide the ecommerce platform and related services. Depending on how you interact with our shop, this may include:
name and contact details;
billing and delivery addresses;
order and transaction information;
customer-account information;
products viewed or placed in the shopping bag;
device, browser and network information;
IP address;
cookie and consent preferences; and
information relating to your interaction with our online shop.
For the core ecommerce services, OUVERTURE generally acts as the controller and Shopify acts as a processor on our behalf.
Where you use services offered directly by Shopify, such as Shop, Shop Pay or certain enhanced or personalised Shopify services, Shopify may process personal data as an independent controller. Further information is available in Shopify’s Consumer Privacy Policy and through the Shopify Privacy Portal.
Where Shopify Network Intelligence or other enhanced Shopify services are enabled, Shopify may use information concerning interactions with our shop to provide security, analytics, personalisation and advertising-related services. Where legally required, such processing takes place only after the relevant consent has been obtained.
Shopify and its authorised affiliated companies and subprocessors may process data in countries outside the European Economic Area. Such transfers are carried out using recognised transfer mechanisms, including adequacy decisions, binding corporate rules or the European Commission’s Standard Contractual Clauses, where required.
The legal bases for processing through Shopify are Article 6(1)(b) GDPR for processing necessary to perform a contract or take pre-contractual steps, Article 6(1)(c) GDPR for compliance with legal obligations, Article 6(1)(f) GDPR for our legitimate interests in securely operating and improving our online shop and Article 6(1)(a) GDPR where consent is required.
Our website uses cookies and similar technologies. Cookies are small files stored on your browser or device when you visit a website.
Some cookies are strictly necessary for the operation of the website and online shop. These may be used, for example, to:
remember the contents of your shopping bag;
enable checkout and payment functions;
maintain secure sessions;
remember privacy and cookie choices;
enable customer-account functions; and
protect the website against fraud and misuse.
Strictly necessary cookies may be used without consent where they are required to provide a digital service expressly requested by you. The legal basis for accessing or storing information on your device is § 25(2) TDDDG. Any subsequent processing of personal data is based on Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the purpose.
Analytics, personalisation and marketing cookies are used only where you have given your consent through our cookie banner or privacy settings. The legal bases are § 25(1) TDDDG and Article 6(1)(a) GDPR.
You may give, refuse or withdraw your consent at any time through the cookie-preference function available on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
You may also restrict or delete cookies through your browser settings. Disabling strictly necessary cookies may affect the operation of certain parts of the website, including the shopping bag, customer account and checkout.
The cookies and technologies used may change as our website, Shopify configuration and installed services are updated. Current information about available cookie choices is provided through our cookie-preference function.
When you access our website, certain technical data may be collected automatically and stored in server log files. This may include:
browser type and version;
operating system;
referring website;
pages visited;
date and time of access;
IP address;
internet service provider;
device and network information; and
information relating to errors, security events or attempted misuse.
This information is processed to deliver the website correctly, maintain security, prevent fraud and misuse, diagnose technical problems and ensure the reliable operation of our systems.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of our website and the protection of our systems, customers and business against misuse and cyberattacks.
Server-log data is retained only for as long as necessary for these purposes, unless longer storage is required to investigate a security incident, establish or defend legal claims or comply with a legal obligation.
You may be able to create a customer account through our online shop. The personal data collected is determined by the information requested through the relevant registration or account form and may include:
name;
email address;
telephone number;
billing and delivery addresses;
order history;
account preferences; and
login and security information.
We process this information to create and administer your account, provide account functions, display your orders, facilitate future purchases and respond to account-related enquiries.
The legal basis is Article 6(1)(b) GDPR.
Technical information such as the IP address and date and time of registration may also be processed to protect customer accounts and prevent misuse. The legal basis is Article 6(1)(f) GDPR.
You may update certain account information through your customer account. You may also request the correction or deletion of your account by contacting us. Account data may continue to be retained where necessary to comply with statutory retention obligations or establish, exercise or defend legal claims.
When you place an order, we process the information required to accept, prepare, fulfil and deliver the order. This may include:
name;
email address;
telephone number;
billing and delivery addresses;
order details;
selected designs, sizes and variations;
payment status;
correspondence concerning the order;
customs and delivery information; and
information concerning returns, exchanges, repairs or refunds.
The legal basis is Article 6(1)(b) GDPR.
We may also process order and transaction information to meet accounting, tax, customs, product-safety and other legal obligations. The legal basis is Article 6(1)(c) GDPR.
Where necessary, order information may be disclosed to:
Shopify;
payment providers;
banks and financial institutions;
our atelier and production partners;
packaging and fulfilment providers;
shipping and courier companies;
customs authorities;
tax advisers and accountants;
IT and customer-service providers; and
public authorities where legally required.
Recipients receive only the information reasonably necessary to perform their respective services.
Payment-card details are generally entered directly into the systems of the selected payment provider and are not stored by OUVERTURE in complete form.
If you contact us by email, telephone, contact form, social media or another communication channel, we process the information you provide, including your contact details and the content of your enquiry.
The data is processed to respond to your request, provide customer service, manage an existing order or take steps at your request before entering into a contract.
The legal basis is Article 6(1)(b) GDPR where the communication concerns a contract or potential purchase. In other cases, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to respond to enquiries and maintain our customer and business relationships.
Correspondence is retained for as long as necessary to resolve the enquiry and may be retained for longer where required for legal, accounting or evidentiary purposes.
You may subscribe to our newsletter by providing the personal data requested through the relevant subscription form, usually your email address.
We use newsletter data to send information about OUVERTURE, our designs, collections, events, projects, services and other brand-related updates.
The legal basis is your consent under Article 6(1)(a) GDPR.
Where a double opt-in process is used, you will receive an email asking you to confirm your subscription. We may store the date and time of registration and confirmation, together with the relevant IP address, to document that valid consent was obtained.
We may use a service provider, including Shopify or another email-service provider acting on our behalf, to manage and send newsletters.
You may withdraw your consent at any time by using the unsubscribe link included in each newsletter or by contacting us at hello@ouverture-studio.com. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.
Where permitted by applicable law, we may send existing customers information by email concerning our own similar designs or services. You may object to such communications at any time without incurring any costs other than the basic costs of transmitting the objection.
Where you have given the required consent, newsletters may contain tracking technologies that allow us to determine whether a newsletter has been opened and which links have been selected.
This information may include:
time of delivery and opening;
links selected;
device and browser information;
IP address; and
technical delivery information.
We use this information to evaluate the performance of our communications and improve the relevance of future newsletters.
The legal basis is Article 6(1)(a) GDPR.
You may withdraw your consent at any time by unsubscribing from the newsletter or contacting us. Data required solely for newsletter tracking will no longer be processed for this purpose following withdrawal, unless another legal basis applies.
We retain personal data only for as long as necessary for the purposes for which it was collected.
Personal data may be retained for longer where required by commercial, tax, accounting, customs or other statutory retention obligations, or where necessary to establish, exercise or defend legal claims.
In particular:
customer-account data is generally retained until the account is deleted, subject to statutory obligations;
order and invoice data is retained for the applicable statutory retention period;
payment and transaction information is retained as required for accounting, tax and fraud-prevention purposes;
newsletter data is retained until consent is withdrawn or the newsletter service is discontinued;
cookie-consent records may be retained for the period necessary to demonstrate compliance;
customer-service correspondence is retained for as long as necessary to resolve the matter and protect legal interests; and
applicant data is retained in accordance with the section concerning applications below.
When the relevant purpose and any applicable retention period have expired, the data will be deleted or anonymised in accordance with legal requirements.
Subject to the requirements and limitations provided by applicable law, you have the following rights:
You have the right to request confirmation as to whether we process personal data concerning you and, where this is the case, to receive access to that data and the information required under Article 15 GDPR.
You have the right to request the correction of inaccurate personal data and completion of incomplete personal data.
You have the right to request the deletion of personal data where the requirements of Article 17 GDPR are met, including where:
the data is no longer necessary for the purpose for which it was collected;
consent has been withdrawn and no other legal basis applies;
you have successfully objected to the processing;
the data has been processed unlawfully; or
deletion is required by law.
The right to deletion does not apply where continued processing is necessary, including for compliance with legal obligations or the establishment, exercise or defence of legal claims.
You have the right to request that processing be restricted where:
you contest the accuracy of the data;
processing is unlawful and you request restriction rather than deletion;
we no longer require the data, but you require it for legal claims; or
you have objected to processing and the assessment of that objection remains pending.
Where processing is based on consent or a contract and is carried out by automated means, you have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format.
Where technically feasible, you may also request that this data be transmitted directly to another controller, provided that this does not adversely affect the rights and freedoms of others.
Where processing is based on Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.
We will stop processing the relevant data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is required for the establishment, exercise or defence of legal claims.
You may object at any time to the processing of personal data for direct-marketing purposes. Where you object to direct marketing, your personal data will no longer be processed for that purpose.
Where processing is based on consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.
You have the right, subject to Article 22 GDPR, not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
You have the right to lodge a complaint with a data-protection supervisory authority.
The supervisory authority responsible for OUVERTURE is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
Germany
Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
You may also contact the supervisory authority in the EU or EEA country in which you live or work, or where you believe a data-protection infringement has occurred.
To exercise any of these rights, please contact us at:
We may request information reasonably necessary to verify your identity before responding to a request.
If you submit an employment application to OUVERTURE, we process the personal data contained in your application and related correspondence for the purpose of managing the recruitment process.
This may include:
name and contact details;
curriculum vitae;
employment and education history;
qualifications;
portfolio or work samples;
references; and
information provided during interviews or correspondence.
The legal basis is § 26 BDSG and, where applicable, Article 6(1)(b) GDPR.
If an employment relationship is established, relevant application data may be transferred to the employment file and processed for the employment relationship.
If an application is unsuccessful, the data will generally be retained for up to six months after the recruitment process has ended, unless a longer period is required for legal claims or you have consented to longer retention for consideration in future opportunities.
We maintain profiles on Facebook and Instagram and may integrate Meta advertising or analytics technologies, including the Meta Pixel, into our website.
The relevant provider for users in the European Economic Area is generally:
Meta Platforms Ireland Limited
Ireland
Where Meta technologies are integrated into our website, they may process information including:
IP address;
browser and device information;
pages viewed;
products viewed;
interactions with the website;
purchases or other conversion events;
cookie identifiers; and
information concerning interactions with our advertisements.
Meta technologies used for analytics, advertising, remarketing or personalised advertising are activated only after you have given the required consent through our cookie settings.
The legal bases are § 25(1) TDDDG and Article 6(1)(a) GDPR.
Depending on the service, Meta may process certain data as an independent controller or as a joint controller with OUVERTURE. Meta may combine information received through our website with information associated with a Facebook or Instagram account.
Meta may process data outside the European Economic Area. Where required, international transfers are protected using recognised transfer mechanisms.
Further information about Meta’s processing and privacy choices is available in Meta’s Privacy Policy and privacy settings.
Simply following an external link to our Facebook or Instagram profile does not cause OUVERTURE to control the subsequent processing carried out on those platforms.
Where you have given consent, we use Google Analytics to understand how visitors use our website and to improve its performance.
The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Google Analytics may process information such as:
shortened or complete IP address, depending on the configuration;
browser and device information;
operating system;
approximate location;
referring website;
pages viewed;
interactions with the website;
session duration;
purchases and conversion events; and
cookie or device identifiers.
The purpose is to analyse website use, measure performance and generate reports concerning visitor behaviour.
Google Analytics is used only after the relevant consent has been obtained. The legal bases are § 25(1) TDDDG and Article 6(1)(a) GDPR.
You may withdraw your consent at any time through the cookie-preference function.
Google may process information outside the European Economic Area. Where required, such transfers are based on recognised safeguards, including adequacy decisions or Standard Contractual Clauses.
Further information is available in Google’s Privacy Policy and Google Analytics privacy documentation.
Where you have given consent, we may use Google Ads technologies, including conversion measurement and remarketing.
These services allow us to:
measure whether an advertisement resulted in a visit or purchase;
understand the effectiveness of advertising campaigns;
display advertising to previous visitors; and
create or use audience groups for advertising.
Google may process information including IP address, device and browser data, pages viewed, advertisement interactions, purchases, conversion events and cookie or advertising identifiers.
The provider is Google Ireland Limited.
The legal bases are § 25(1) TDDDG and Article 6(1)(a) GDPR.
You may withdraw your consent through our cookie-preference function. You may also manage advertising choices through Google’s advertising and privacy settings.
International transfers may take place subject to recognised transfer safeguards.
We maintain a profile on Pinterest and may use Pinterest advertising, conversion or analytics technologies on our website.
The relevant provider in the European Economic Area is:
Pinterest Europe Ltd.
Ireland
Where Pinterest technologies are used, Pinterest may process information including:
IP address;
browser and device information;
pages and products viewed;
website interactions;
purchases and conversion events;
cookie or advertising identifiers; and
interactions with Pinterest advertisements.
Pinterest technologies used for analytics, advertising, remarketing or conversion measurement are activated only after you have given the required consent.
The legal bases are § 25(1) TDDDG and Article 6(1)(a) GDPR.
Pinterest may process data outside the European Economic Area using recognised transfer mechanisms. Further information is available in Pinterest’s Privacy Policy.
When you select a payment method at checkout, the information necessary to process that payment is transmitted to the selected payment provider.
The categories of data may include:
name;
billing and delivery address;
email address;
telephone number;
IP address;
order information;
payment amount and currency;
payment-status information; and
other information required for identity verification, fraud prevention or payment processing.
The legal basis is Article 6(1)(b) GDPR. Processing required to comply with financial, anti-fraud, anti-money-laundering or other legal obligations may also be based on Article 6(1)(c) or Article 6(1)(f) GDPR.
Payment providers process certain data under their own responsibility and in accordance with their own privacy policies.
Where Klarna or a Klarna payment method, including Sofort or another immediate bank-transfer service provided through Klarna, is available and selected, relevant information is transmitted to:
Klarna Bank AB
Sveavägen 46
111 34 Stockholm
Sweden
Klarna may process data for payment administration, identity verification, fraud prevention and, where applicable, creditworthiness assessments.
Depending on the payment method, Klarna may obtain information from or disclose information to banks, payment networks, credit-reference agencies, identity-verification providers and other service providers.
Klarna may use automated procedures when deciding whether a particular payment method can be offered. Further information is available in Klarna’s Privacy Notice.
Where PayPal is available and selected, relevant information is transmitted to:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
Luxembourg
PayPal processes information for payment administration, fraud prevention, risk assessment, identity verification and compliance with legal obligations.
PayPal may disclose information to affiliated companies, banks, card networks, credit-reference agencies and service providers where necessary for these purposes.
Further information is available in PayPal’s Privacy Statement.
Depending on the relevant purpose, we process personal data on the following legal bases:
This applies where you have consented to a particular processing activity, including newsletters, newsletter tracking, analytics cookies or marketing technologies.
This applies where processing is necessary to:
respond to a purchase enquiry;
create and administer a customer account;
process and fulfil an order;
arrange payment;
deliver an order;
process a return, exchange, repair or refund; or
otherwise perform a contract with you.
This applies where processing is necessary to comply with tax, accounting, customs, commercial, product-safety or other legal obligations.
This applies where processing is necessary for our legitimate interests or those of a third party and those interests are not overridden by your rights and freedoms.
Such interests may include:
operating and securing our website and online shop;
preventing fraud and misuse;
responding to enquiries;
maintaining customer and business relationships;
improving our services;
establishing, exercising or defending legal claims;
maintaining records of consent;
protecting our property and systems; and
sending legally permitted direct marketing to existing customers.
We may disclose personal data to service providers and recipients where necessary for the purposes described in this Privacy Policy.
These may include:
Shopify and its subprocessors;
website-hosting and IT providers;
customer-account providers;
payment providers;
banks and payment networks;
our atelier and production partners;
packaging, fulfilment and logistics providers;
shipping and courier companies;
newsletter and communication providers;
analytics, advertising and social-media providers, subject to consent;
fraud-prevention and security providers;
accountants, tax advisers, auditors and legal advisers;
insurers;
customs and tax authorities;
courts, regulators and law-enforcement authorities; and
prospective purchasers or advisers in connection with a corporate transaction.
Where a service provider processes personal data on our behalf, we enter into a data-processing agreement where required by law.
Some service providers may process personal data outside the European Economic Area.
Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we use appropriate safeguards where required, including:
the European Commission’s Standard Contractual Clauses;
approved binding corporate rules;
an applicable adequacy decision;
the EU–US Data Privacy Framework, where the recipient is validly certified; or
another legally recognised transfer mechanism.
Further information concerning the safeguards used for a particular transfer may be requested by contacting us.
Certain personal data is required to enter into or perform a contract with you.
For example, we require sufficient contact, billing, payment and delivery information to accept and fulfil an order.
Where required information is not provided, we may be unable to create an account, process a payment, conclude a contract, deliver an order or provide a requested service.
Other information is voluntary. Where the provision of information is optional, this will generally be apparent from the relevant form or context.
OUVERTURE does not generally make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
Certain independent payment providers may use automated systems for fraud prevention, risk assessment, identity verification or creditworthiness checks. Such processing is carried out under the responsibility of the relevant payment provider and is described in that provider’s privacy information.
We maintain appropriate technical and organisational measures designed to protect personal data against:
unauthorised access;
unlawful processing;
accidental loss;
destruction;
alteration; and
unauthorised disclosure.
Access to personal data is restricted to persons and service providers who require it for the relevant purpose.
Payment information is transmitted using encrypted connections. However, internet-based communication cannot be guaranteed to be entirely secure.
We may update this Privacy Policy where our services, technologies, providers or legal obligations change.
The current version is published on this page. Material changes will be communicated in an appropriate manner where required by law.
Questions about this Privacy Policy or the processing of your personal data may be directed to:
Client Services | OUVERTURE
Email: hello@ouverture-studio.com
Telephone: +49 30 2327 0207