Privacy policy

Last updated: 21 August 2026

This Privacy Policy describes how ASTERISK (“ASTERISK”, “we”, “us” or “our”) collects, uses, stores, discloses and otherwise processes personal data when you visit or use asteriskonline.eu, make a purchase, create or use a customer account, contact us, subscribe to marketing communications or otherwise interact with our online store and related services (collectively, the “Services”).

Our online store is powered by Shopify.

For the purposes of the General Data Protection Regulation (“GDPR”) and other applicable data protection laws, ASTERISK is the controller of the personal data described in this Privacy Policy unless otherwise stated.

1. CONTROLLER

The controller responsible for this website is:

ASTERISK
Memhardstraße 6
10178 Berlin
Germany

Email: contact@asteriskonline.eu
Website: asteriskonline.eu

2. PERSONAL DATA WE COLLECT

The personal data we collect depends on how you interact with our Services.

Contact Information

We may process information including:

  • name;
  • billing address;
  • shipping address;
  • email address;
  • telephone number; and
  • other contact information you voluntarily provide.

Order & Transaction Information

We may process:

  • products viewed, ordered or purchased;
  • shopping cart information;
  • order history;
  • transaction details;
  • returns, exchanges, cancellations and repair requests;
  • shipping and delivery information;
  • order notes; and
  • information required to fulfil bespoke, personalized or made-to-order commissions.

Payment Information

Payments are processed through Shopify and/or payment providers available through our store.

Depending on the payment method selected, these providers may process information such as your payment method, payment card or account information, billing information, transaction amount and payment confirmation.

ASTERISK generally does not receive or store complete payment-card details.

Customer Account Information

If customer accounts are available, we may process information associated with your account, including your contact information, saved addresses, order history, preferences and account settings.

Communications

When you contact us, we may process your contact details, the content of your communication, photographs or attachments you provide and other information necessary to respond to your inquiry.

This may include information relating to an order, bespoke commission, repair or customer-service request.

Technical & Device Information

When you use our website, certain technical information may be collected automatically, including:

  • IP address;
  • browser type and version;
  • operating system;
  • device type;
  • network information;
  • device or browser identifiers;
  • referring URL;
  • date and time of access; and
  • technical information relating to your interaction with the website.

Usage, Analytics & Advertising Information

Depending on your consent settings, we may process information about how you interact with our website, including:

  • pages and products viewed;
  • searches;
  • links clicked;
  • shopping-cart activity;
  • checkout activity;
  • purchases and conversions;
  • interactions with advertisements and marketing emails; and
  • cookie, device or advertising identifiers.

3. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

  • directly from you when you place an order, contact us, create an account, request a repair, subscribe to marketing communications or otherwise provide information to us;
  • automatically through your use of our website, including through cookies, pixels, log files and similar technologies;
  • from Shopify and other service providers that assist us in operating our online store;
  • from Klaviyo when you interact with our signup forms, newsletters and marketing communications;
  • from payment and shipping providers where necessary to fulfil transactions; and
  • from advertising and social-media platforms, including Meta, where permitted by applicable law and your consent settings.

4. PURPOSES & LEGAL BASES FOR PROCESSING

We process personal data only where we have an appropriate legal basis.

Orders & Contract Fulfilment

We process personal data to:

  • process and fulfil orders;
  • process payments;
  • manufacture or prepare ordered products;
  • provide order confirmations;
  • arrange shipping and delivery;
  • communicate regarding orders;
  • manage customer accounts;
  • process repairs, returns or complaints; and
  • fulfil bespoke, personalized and made-to-order commissions.

The legal basis is generally Article 6(1)(b) GDPR, because processing is necessary to perform a contract with you or take steps at your request before entering into a contract.

Customer Service & Communications

We process personal data to respond to inquiries, provide customer support and manage our relationship with customers.

Where communication relates to a contract or potential contract, the legal basis is generally Article 6(1)(b) GDPR.

For other communications, processing may be based on our legitimate interests under Article 6(1)(f) GDPR in operating our business and responding efficiently to inquiries.

Legal, Accounting & Tax Obligations

We may process and retain personal data where necessary to comply with tax, accounting, commercial, regulatory and other legal requirements.

The legal basis is Article 6(1)(c) GDPR.

Security & Fraud Prevention

We may process personal data to secure our website, prevent fraudulent transactions, detect unauthorized or malicious activity and protect our customers, business and legal rights.

The legal basis may be our legitimate interests under Article 6(1)(f) GDPR.

Where processing is legally required, Article 6(1)(c) GDPR may apply.

Legal Claims

We may process or retain personal data where necessary to establish, exercise or defend legal claims.

The legal basis is generally our legitimate interests under Article 6(1)(f) GDPR.

Marketing Communications

If you subscribe to our newsletter or otherwise consent to marketing communications, we may use your contact information to send information about ASTERISK products, releases, events, collaborations and other news.

Where consent is required, the legal basis is Article 6(1)(a) GDPR.

You may withdraw your consent at any time, including through the unsubscribe link contained in our marketing emails.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

5. SHOPIFY

Our online store is hosted and powered by Shopify.

Shopify provides the technical e-commerce infrastructure necessary to operate our online store, including storefront operation, checkout, customer accounts, order processing, security, fraud prevention and other e-commerce functionality.

In connection with these services, Shopify may process personal data including contact information, customer-account information, order and transaction information, IP addresses, device information and usage information.

For many merchant services, ASTERISK acts as controller and Shopify acts as processor. Certain Shopify services may involve Shopify processing data under a different role. Shopify's current Data Processing Addendum explains these respective roles.

Shopify operates internationally and may process personal data through affiliated companies and service providers in countries outside Germany or the European Economic Area.

Further information about Shopify's processing of consumer personal data is available in Shopify's Consumer Privacy Policy.

6. COOKIES & SIMILAR TECHNOLOGIES

Our website uses cookies, pixels and similar technologies.

Cookies are small pieces of information that may be stored on or accessed from your device.

Strictly Necessary Technologies

Certain cookies and technologies are necessary for our website and online store to function correctly. These may be used for functions such as:

  • maintaining your shopping cart;
  • processing checkout;
  • authentication;
  • security and fraud prevention;
  • remembering essential settings; and
  • providing website functionality requested by you.

Where storage of or access to information on your device is strictly necessary to provide a service requested by you, consent may not be required under applicable German law.

Non-Essential Technologies

Other cookies, pixels and similar technologies may be used for:

  • advertising;
  • conversion measurement;
  • analytics;
  • audience creation;
  • personalization;
  • email marketing;
  • website-behavior tracking; and
  • marketing attribution.

Where required by law, these technologies are activated only after you have provided your consent.

Where personal data is subsequently processed based on your consent, the legal basis is generally Article 6(1)(a) GDPR.

You can manage or withdraw your consent at any time through the cookie or privacy settings available on our website.

Shopify itself categorizes storefront cookies into areas such as strictly necessary, performance, advertising and social-media/content cookies.

7. META PIXEL & META BUSINESS TOOLS

We use the Meta Pixel, provided by Meta Platforms, for advertising measurement and marketing purposes.

Subject to your consent, the Meta Pixel may process information relating to your interaction with our website, including:

  • pages viewed;
  • products viewed;
  • shopping-cart activity;
  • checkout activity;
  • purchases and other conversion events;
  • browser and device information;
  • IP address;
  • cookie or advertising identifiers; and
  • technical information about your interaction with our website.

We use this information to understand the effectiveness of our advertising, measure conversions, create advertising audiences and improve our advertising campaigns.

For visitors in Germany and the EEA, Meta Pixel is used for non-essential advertising and tracking purposes only after the required consent has been provided.

The subsequent processing of personal data by us for these purposes is based on your consent pursuant to Article 6(1)(a) GDPR.

You may withdraw your consent at any time through the cookie or privacy settings available on our website.

Information collected through Meta Pixel may be transmitted to Meta Platforms and combined with other information available to Meta.

Depending on the particular processing activity, Meta may process information under its own responsibility or the respective responsibilities of ASTERISK and Meta may be governed by Meta's applicable Business Tools terms.

Meta operates internationally and personal data may therefore be processed outside the European Economic Area.

8. KLAVIYO – EMAIL MARKETING & CUSTOMER COMMUNICATION

We use Klaviyo as our email-marketing and customer-communication platform.

Klaviyo allows us to manage newsletter subscriptions, customer profiles, marketing campaigns and automated communications and to understand the performance of our marketing communications.

Our Shopify store may synchronize certain information with Klaviyo. Depending on your interaction with ASTERISK and our Klaviyo configuration, this may include:

  • name;
  • email address;
  • telephone number where provided;
  • newsletter and marketing consent status;
  • customer profile information;
  • order history;
  • products purchased;
  • shopping-cart information;
  • browsing and website interaction data where tracking has been consented to;
  • products viewed;
  • searches;
  • add-to-cart events;
  • interactions with emails;
  • email delivery information;
  • email opens and clicks where technically available and legally permitted; and
  • other information necessary to operate our email-marketing and automated communication flows.

Klaviyo's Shopify integration can synchronize customer profiles, orders and consent data and can enable onsite behavioral tracking and signup forms.

Newsletter & Marketing Emails

If you subscribe to our newsletter or otherwise consent to receive marketing communications, we use Klaviyo to manage and deliver these communications.

The legal basis for sending consent-based marketing communications is Article 6(1)(a) GDPR.

You can withdraw your consent at any time by clicking the unsubscribe link contained in our marketing emails or by contacting us at contact@asteriskonline.eu.

Withdrawal applies for the future and does not affect the lawfulness of processing carried out before withdrawal.

Klaviyo Onsite Tracking

Klaviyo may use cookies and similar technologies to recognize visitors and associate website activity with an existing customer or subscriber profile.

For example, Klaviyo states that its __kla_id cookie can identify visitors who submit a Klaviyo signup form or click a link in a Klaviyo email or SMS. Depending on the configuration, this can allow subsequent website behavior to be associated with that profile.

Where Klaviyo's non-essential onsite tracking is used, it is activated for visitors in Germany and the EEA only where the required consent has been provided.

Klaviyo's Shopify documentation likewise states that, depending on Shopify Customer Privacy settings, onsite events for visitors in the EU/EEA, UK and Switzerland may not be tracked unless they have consented.

The subsequent processing of personal data by us for marketing analytics and personalization based on such tracking is based on Article 6(1)(a) GDPR where consent is required.

You may withdraw your consent through our cookie or privacy settings.

Automated Marketing Flows

Klaviyo may be used to automate communications based on customer actions or profile information.

Depending on our active campaigns, this may include communications relating to:

  • newsletter signup;
  • product interest;
  • shopping-cart activity;
  • previous purchases;
  • customer status; or
  • other interactions with ASTERISK.

Marketing communications are sent only where we have an appropriate legal basis to do so.

Klaviyo as Service Provider

Klaviyo processes customer personal data on behalf of its customers in connection with its marketing platform. Klaviyo states that this commonly includes names, email addresses, phone numbers, IP addresses and cookie data and that its Data Processing Agreement is incorporated into its customer Terms.

Klaviyo operates internationally. Personal data processed through Klaviyo may therefore be transferred outside the EEA. Klaviyo states that its Data Protection Addendum incorporates European Commission Standard Contractual Clauses for relevant international transfers.

Further information is available in Klaviyo's Privacy Policy.

9. PAYMENT PROVIDERS

Payments through our online store are processed by Shopify and/or third-party payment providers.

When you select a payment method, information necessary to process and verify the transaction may be transmitted to the relevant provider.

This may include:

  • name;
  • billing information;
  • transaction amount;
  • selected payment method;
  • payment credentials; and
  • fraud-prevention information.

Where processing is necessary to complete your purchase, the legal basis is generally Article 6(1)(b) GDPR.

Payment providers may independently process personal data to comply with legal obligations, prevent fraud or provide their services.

Their respective privacy policies apply to processing carried out under their own responsibility.

10. SHIPPING & LOGISTICS

To fulfil and deliver orders, we may provide necessary personal data to shipping and logistics providers, including DHL and UPS.

This may include:

  • name;
  • shipping address;
  • email address;
  • telephone number;
  • shipment or order reference; and
  • information required for customs clearance where applicable.

Where processing is necessary to fulfil your order, the legal basis is generally Article 6(1)(b) GDPR.

Where information must be provided to customs authorities or other authorities to comply with legal requirements, the legal basis may be Article 6(1)(c) GDPR.

11. OTHER SERVICE PROVIDERS & RECIPIENTS

We may disclose personal data to third parties where necessary to operate our business, provide the Services or comply with legal obligations.

Recipients may include:

  • Shopify;
  • Klaviyo;
  • payment providers;
  • DHL, UPS and other shipping or logistics providers;
  • Meta Platforms where you have provided the required consent;
  • website and technical service providers;
  • accountants and tax advisers;
  • legal advisers;
  • government, regulatory, tax or customs authorities where legally required; and
  • other service providers necessary to operate our business.

Where a service provider acts as a processor on our behalf, it is required to process personal data in accordance with applicable data-protection requirements and our contractual arrangements.

We do not sell personal data in the conventional sense of exchanging customer information for money.

12. INTERNATIONAL DATA TRANSFERS

Some of our service providers, including Shopify, Klaviyo and Meta, operate internationally.

Personal data may therefore be processed in countries outside Germany or the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA to a country that has not been recognized by the European Commission as providing an adequate level of data protection, an appropriate transfer mechanism is used where required by law.

Depending on the recipient and destination, this may include:

  • an adequacy decision by the European Commission;
  • the European Commission's Standard Contractual Clauses;
  • the EU-U.S. Data Privacy Framework where applicable to an eligible and certified recipient; or
  • another legally recognized safeguard.

You may contact us for additional information regarding applicable safeguards.

13. DATA RETENTION

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law.

The applicable retention period depends on the nature of the data, the purpose of processing and relevant legal requirements.

In particular:

  • order, invoice, payment and accounting information may be retained for the periods required under German commercial and tax law;
  • contractual information may be retained for the duration necessary to fulfil the contract and applicable limitation periods;
  • customer-service communications may be retained where necessary to resolve inquiries or establish, exercise or defend legal claims;
  • newsletter and marketing information may be retained until consent is withdrawn or the information is no longer required for the relevant purpose, subject to applicable legal requirements;
  • suppression information may be retained where necessary to ensure that an unsubscribe or objection continues to be respected; and
  • records of consent may be retained where necessary to demonstrate compliance with applicable law.

When personal data is no longer required and no legal basis for further retention exists, it will be deleted or anonymized as appropriate.

14. SECURITY

We use reasonable technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

You should avoid transmitting sensitive or confidential information through unsecured communication channels.

15. CHILDREN

Our Services are not specifically directed toward children.

We do not knowingly collect personal data from children where such processing would be prohibited under applicable law.

If you believe that a child has provided personal data to us improperly, please contact us so that we can review the matter and delete the information where appropriate.

16. YOUR RIGHTS UNDER THE GDPR

Where the GDPR applies, you may have the following rights concerning your personal data.

Right of Access

Under Article 15 GDPR, you may request confirmation as to whether we process personal data relating to you and, where applicable, obtain access to that data and related information.

Right to Rectification

Under Article 16 GDPR, you may request correction of inaccurate personal data and completion of incomplete personal data.

Right to Erasure

Under Article 17 GDPR, you may request deletion of your personal data where the applicable legal requirements are met.

This right may be restricted where continued retention is required by law or another legal basis permits continued processing.

Right to Restriction of Processing

Under Article 18 GDPR, you may request restriction of processing in certain circumstances.

Right to Data Portability

Under Article 20 GDPR, where the legal requirements are met, you may receive personal data you provided to us in a structured, commonly used and machine-readable format and may have the right to transmit that information to another controller.

Right to Object

Under Article 21 GDPR, where processing is based on Article 6(1)(e) or (f) GDPR, you may have the right to object to processing for reasons arising from your particular situation.

Where personal data is processed for direct-marketing purposes, you have the right to object to such processing at any time.

Right to Withdraw Consent

Where processing is based on your consent under Article 6(1)(a) GDPR, you may withdraw that consent at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Automated Decision-Making

Where applicable, you may have rights under Article 22 GDPR relating to decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

We do not currently intend to make decisions of this kind about customers solely through automated processing unless otherwise disclosed.

Exercising Your Rights

To exercise your data-protection rights, please contact:

contact@asteriskonline.eu

We may request information reasonably necessary to verify your identity before fulfilling certain requests.

17. RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that your personal data has been processed in violation of applicable data-protection law.

As ASTERISK is based in Berlin, the competent supervisory authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

You may also contact another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the location of an alleged infringement.

You are welcome to contact us first at contact@asteriskonline.eu so that we can attempt to resolve your concern.

18. THIRD-PARTY WEBSITES & SOCIAL MEDIA

Our Services may contain links to third-party websites, social-media platforms or other services.

When you follow a link to a third-party service, that provider may independently collect and process personal data.

ASTERISK does not control the privacy practices of independent third parties.

We recommend reviewing the relevant provider's privacy information before providing personal data or interacting with their services.

19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our Services, technologies, service providers, business practices or applicable legal requirements.

The current version will be published on our website and the “Last updated” date will be changed accordingly.

Where required by law, we will provide additional notice or obtain consent for material changes.

20. CONTACT

If you have questions about this Privacy Policy, our processing of personal data or would like to exercise your data-protection rights, please contact:

ASTERISK
Memhardstraße 6
10178 Berlin
Germany

Email: contact@asteriskonline.eu
Website: asteriskonline.eu