Privacy policy

Controller

The controller for the processing of your personal data is Bendix Konsulting AS, Overlege Helsingens veg 18, 7805 Namsos, Norway. You can reach us at hello@innenwerk.net; the full contact details are in the legal notice. We are not required to appoint a data protection officer under Art. 37 GDPR and have not done so.

If you only visit the shop

When a page is called up, our hosting provider processes technical access data: IP address, date and time, page requested, volume of data transferred, browser and operating system details. A website cannot be delivered or defended against attack without that processing. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a functioning and secure shop.

If you place an order

For an order we process your name, delivery and billing address, e-mail address, the items ordered and the payment details. The legal basis is Art. 6(1)(b) GDPR: without those details no contract of sale comes about and no goods can be delivered. We additionally process order and invoice data to meet commercial and tax retention obligations, on the legal basis of Art. 6(1)(c) GDPR.

Who we pass data to

  • Shopify. This shop runs on the platform of Shopify International Limited, Dublin, Ireland. Shopify processes the data on our behalf under a processing agreement pursuant to Art. 28 GDPR.
  • Payment provider. You enter your payment details directly with the payment provider shown at the checkout. We never see the full payment details; we receive the information whether a payment succeeded.
  • Shipping and fulfilment. For shipping we transfer your name, delivery address and the items ordered to our fulfilment partner CJ Dropshipping in the People's Republic of China and to the appointed carrier. There is no adequacy decision of the European Commission for that third country. The transfer is permitted under Art. 49(1)(b) GDPR because it is necessary for the performance of your contract of sale: without an address the parcel cannot be delivered.

Cookies and audience measurement

We use technically necessary cookies so that the cart, the checkout and the language selection work. They are stored without consent; the storage is strictly necessary under § 25(2) no. 2 TDDDG in order to provide the service you requested.

For audience measurement we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. With it we evaluate which pages are called up, how visitors move through the shop and which orders result. Whether we ask for your consent beforehand depends on the region you visit the shop from. Where consent is required we show our cookie notice first and set the analytics cookies only after you have given consent there; for visits from Germany that is always the case. The legal basis for the storage on your device is then § 25(1) TDDDG, and the legal basis for the subsequent processing is Art. 6(1)(a) GDPR. If you visit from a region where consent is not required, the notice does not appear and the audience measurement relies on Art. 6(1)(f) GDPR, our legitimate interest in evaluating how the shop is used. You can object to that processing at any time under Art. 21 GDPR by writing to us at hello@innenwerk.net.

Google also processes the data in the United States. Google LLC participates in the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023; the Commission's standard contractual clauses apply in addition. You can withdraw your consent at any time with effect for the future by opening the cookie settings in the footer of this website again. The lawfulness of processing carried out before the withdrawal is unaffected.

Contact form

If you write to us through the contact form, we process the details you provide in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where a contract or its initiation is concerned, and otherwise Art. 6(1)(f) GDPR.

Newsletter

If you sign up for our newsletter we process your e-mail address in order to send you the information announced. The legal basis is your consent under Art. 6(1)(a) GDPR. You can unsubscribe at any time using the link in every e-mail, which also withdraws your consent.

How long we keep data

Order and invoice data are kept for as long as the statutory retention periods run. Contact form enquiries are deleted once they have been dealt with and no retention obligation stands in the way. Newsletter data are deleted after you unsubscribe.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). Consent given can be withdrawn at any time with effect for the future.

You may also lodge a complaint with a supervisory authority. The competent authority for us is the Norwegian Datatilsynet; you may equally approach the data protection authority of your German federal state.

Version

This policy applies in the version dated 20 August 2026.