Privacy Policy
Last updated: August 21, 2026
KNOT Lab (“KNOT Lab”, “we”, “us”, or “our”) operates this online store and website, including all related content, features, products and services (collectively, the “Services”).
This Privacy Policy explains how and why we collect, use, store and disclose personal data when you visit or use our Services, place an order, communicate with us, or otherwise interact with KNOT Lab.
We process personal data in accordance with applicable data protection laws, including the European Union General Data Protection Regulation (GDPR).
Our online store is powered by Shopify. Shopify provides the technical infrastructure for our online store and processes personal data in connection with providing its services to us. Depending on the Shopify services and features used, Shopify may also process certain personal data as an independent data controller for its own purposes, including certain Enhanced Services.
1. Data Controller
The controller responsible for the processing of your personal data in connection with our Services is:
KNOT Lab
Jenny Chey
Rainäckerstr. 11
70794 Filderstadt
Germany
Email: info@knotlab.eu
If you have any questions about how we process your personal data or wish to exercise your data protection rights, please contact us using the email address above.
2. Personal Data We Collect
Depending on how you interact with our Services, we may collect and process the following categories of personal data.
Contact and identification information
This may include:
- first and last name
- billing address
- delivery address
- email address
- telephone number, where provided
- other contact information you voluntarily provide to us
Order and transaction information
This may include:
- products purchased
- order number
- order history
- products added to your shopping cart
- transaction information
- payment status
- shipping and delivery information
- returns, refunds and cancellations
Payment information
When you place an order, payment information is processed through the payment method and payment provider selected during checkout.
Depending on the payment method, this may include payment card information, bank account information, payment confirmation and other information required to process the transaction.
Where payment information is processed directly by a payment provider, we may not have access to your complete payment details.
Communication information
If you contact us, for example by email, we process the information you provide, including the content of your message and any information necessary to respond to your request.
Customer account information
If customer accounts are available and you choose to create an account, we may process information associated with your account, such as your email address, account details, preferences and order history.
Device and technical information
When you visit our website, certain information may be collected automatically, including:
- IP address
- browser type and version
- operating system
- device type
- network information
- device or browser identifiers
- information about how you interact with our website
Usage information
We may collect information about how you use our Services, including pages visited, products viewed, products added to your shopping cart and other interactions with our online store.
Privacy and consent information
We may process information about your privacy preferences and consent choices, including information relating to cookie preferences, marketing consent and opt-out signals.
3. How We Collect Personal Data
We collect personal data from several sources.
Information you provide directly
We collect information when you:
- place an order
- create or use a customer account
- subscribe to marketing communications
- contact us
- submit information through our website
- communicate with us in another way
Information collected automatically
Certain technical and usage information is collected automatically when you use our website, including through cookies and similar technologies, subject to applicable consent requirements.
Information from service providers
We may receive or process information through service providers that support our online store, such as Shopify, payment providers and shipping providers.
4. How We Use Your Personal Data
We use personal data only for specific and legitimate purposes.
Processing and fulfilling orders
We use your personal data to:
- process and fulfil your order
- process payments
- arrange shipping and delivery
- provide order confirmations
- send shipping and delivery updates
- process returns and refunds
- provide customer service
- maintain our online store
The legal basis for this processing is generally the performance of a contract with you pursuant to Article 6(1)(b) GDPR.
Compliance with legal obligations
We may process personal data where necessary to comply with legal obligations, including:
- accounting and tax obligations
- statutory record-keeping requirements
- consumer protection requirements
- responding to lawful requests from authorities
The legal basis is compliance with a legal obligation pursuant to Article 6(1)(c) GDPR.
Security and fraud prevention
We may process personal data to:
- protect our website and Services
- detect and prevent fraud
- prevent unauthorized access
- protect our customers and business
- maintain the security and integrity of our Services
The legal basis may be our legitimate interests pursuant to Article 6(1)(f) GDPR.
Customer support and communication
We use personal data to respond to inquiries, provide customer support and communicate with you regarding your orders or other requests.
Depending on the circumstances, the legal basis is the performance of a contract, compliance with a legal obligation or our legitimate interests.
Marketing and remarketing
Where permitted by applicable law and, where required, based on your consent, we use certain Shopify marketing features to provide marketing and remarketing communications.
5. Marketing and Remarketing
KNOT Lab currently uses certain Shopify marketing features.
Depending on your interactions with our store, these features may facilitate communications such as:
- abandoned-cart reminders
- back-in-stock notifications
- price-drop notifications
- communications based on repeated interest in our store or products
- email marketing communications
Where consent is required by applicable law, marketing communications are only sent after the required consent has been obtained.
You may withdraw your consent to marketing communications at any time.
You can unsubscribe from marketing emails by using the unsubscribe link contained in the relevant email or by contacting us at:
Transactional communications, such as order confirmations, payment confirmations or shipping notifications, are not marketing communications and may still be sent where necessary to fulfil your order or comply with legal obligations.
6. Marketing Double Opt-In
Where you subscribe to email marketing, KNOT Lab uses a double opt-in process.
After submitting your email address, you may receive a confirmation email asking you to confirm your subscription.
Your email address will only be added to our marketing mailing list after the required confirmation has been completed.
This process helps us ensure that marketing communications are only sent to individuals who have confirmed their subscription.
You may withdraw your consent at any time using the unsubscribe link in our marketing emails or by contacting us at info@knotlab.eu.
7. Cookies and Similar Technologies
Our website uses cookies and similar technologies provided by Shopify and its partners.
These technologies may be used for:
- essential website and shopping-cart functionality
- checkout functionality
- security and fraud prevention
- remembering preferences
- analytics
- personalization
- marketing
- remarketing
- measuring and improving our Services
Where required by applicable law, non-essential cookies and similar technologies are only activated after the required consent has been obtained.
Our cookie banner allows you to accept or reject non-essential cookies and manage your privacy preferences.
You may change or withdraw your cookie consent through the privacy or cookie settings available on our website.
Please note that disabling certain cookies may affect the functionality of the website.
The competent data protection authority in Baden-Württemberg has emphasized that consent for non-essential cookies and tracking must be freely given and that withdrawing consent must be possible as easily as giving it.
8. Shopify
Our online store is hosted and powered by Shopify.
Shopify provides the technical infrastructure required to operate our online store and may process personal data on our behalf as a data processor.
Depending on the Shopify services and features used, Shopify may also process certain personal data as an independent data controller.
Information processed by Shopify may include, depending on the services used:
- name
- email address
- billing and shipping information
- order and transaction information
- products viewed
- products added to shopping carts
- customer activity on our store
- IP address
- device information
- browser information
- network information
- privacy preference and consent signals
Shopify's own privacy practices are described in its Consumer Privacy Policy:
Shopify Consumer Privacy Policy
You can also manage certain privacy choices directly with Shopify:
9. Shopify Network Intelligence and Enhanced Services
Shopify Network Intelligence is currently enabled for our store.
Shopify Network Intelligence enables certain Shopify “Enhanced Services”.
When these services are used, Shopify may process customer personal data in connection with interactions and transactions with our store, with other Shopify merchants and with Shopify itself.
According to Shopify, Enhanced Services may include services relating to:
- analytics
- product and store customization
- advertising
- personalization
- business improvement
- other enhanced Shopify services
Shopify may process relevant customer information for these purposes as an independent data controller or business where applicable.
Shopify states that customer personal data may be used together with information from interactions with Shopify, other merchants and Shopify services to provide, develop and improve these Enhanced Services.
Shopify also states that, where Enhanced Services involve targeted advertising or similar processing, additional privacy rights and obligations may apply depending on the customer's jurisdiction.
For customers in the European Economic Area, the United Kingdom or Switzerland, Shopify's Data Processing Addendum states that consent must be obtained for targeted advertising as part of Enhanced Services where required by applicable data protection law, as well as for cookies or other local-storage technologies where required.
You can find information about Shopify's processing of consumer data and available privacy controls here:
Shopify Consumer Privacy Policy
Shopify Privacy Controls / Opt-Out Options
Shopify Network Intelligence can be disabled by the merchant through Shopify's customer privacy settings. Disabling it may affect the availability of certain Shopify features or services.
10. Payment Providers
Payments are processed through the payment method selected during checkout.
Depending on the payment method, the relevant payment provider may process personal data required to:
- authorize and complete your payment
- verify your identity where necessary
- prevent fraud
- comply with legal obligations
- process refunds
The relevant payment provider may process personal data in accordance with its own privacy policy.
11. Shipping and Delivery Providers
To fulfil your order, we may provide relevant personal data to shipping and delivery providers.
This may include:
- name
- delivery address
- email address
- telephone number, where required for delivery
- order and shipping information
This processing is necessary to fulfil your purchase contract with us.
12. Service Providers and Recipients
We may disclose personal data to selected service providers where this is necessary to operate our business and provide our Services.
Depending on the services we use, recipients may include providers of:
- e-commerce and hosting infrastructure
- payment processing
- shipping and delivery
- customer support
- email communication
- marketing and remarketing
- analytics
- security and fraud prevention
- technical services
Where a service provider processes personal data on our behalf, we take appropriate measures to ensure that the processing is carried out in accordance with applicable data protection requirements.
13. International Data Transfers
Although our Shopify data hosting location is configured for the European Union, certain Shopify services, payment providers, service providers or other recipients may process personal data in countries outside the European Economic Area (EEA).
Shopify's documentation confirms that personal data may be transferred internationally in connection with certain services.
Where personal data is transferred to a country outside the EEA, we rely on an applicable legal transfer mechanism, where required, such as:
- an adequacy decision of the European Commission
- Standard Contractual Clauses approved by the European Commission
- another legally recognized transfer mechanism
Further information about Shopify's international data transfers and safeguards can be found in Shopify's Data Processing Addendum:
Shopify Data Processing Addendum
14. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected.
The specific retention period depends on:
- the purpose of the processing
- the type and sensitivity of the data
- whether the data is required to fulfil a contract
- whether we are legally required to retain the information
- whether the data is required to establish, exercise or defend legal claims
Certain order, accounting and tax information must be retained for periods required by applicable German law.
When personal data is no longer required and no legal retention obligation applies, we will delete or anonymize it.
15. Data Security
We take appropriate technical and organizational measures to protect personal data against:
- unauthorized access
- accidental loss
- destruction
- alteration
- unlawful processing
- unauthorized disclosure
We use security measures provided by Shopify and other relevant service providers where applicable.
However, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure.
16. Your Rights Under the GDPR
If the GDPR applies to you, you have the following rights, subject to the applicable legal requirements and limitations.
Right of access
You have the right to request confirmation as to whether we process your personal data and, where applicable, to request access to your personal data.
Right to rectification
You have the right to request the correction of inaccurate personal data and the completion of incomplete personal data.
Right to erasure
You may request the deletion of your personal data where the legal requirements for erasure are met.
Right to restriction of processing
You may request the restriction of processing of your personal data in certain circumstances.
Right to data portability
Where applicable, you have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to request that it be transferred to another controller.
Right to object
You have the right to object to processing based on legitimate interests where the applicable legal requirements are met.
You have an absolute right to object to the processing of your personal data for direct marketing purposes.
Right to withdraw consent
Where processing is based on your consent, you may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint
You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
These rights are based in particular on Articles 15–22 GDPR.
17. How to Exercise Your Rights
To exercise any of your data protection rights, please contact:
KNOT Lab
Jenny Chey
Rainäckerstr. 11
70794 Filderstadt
Germany
Email: info@knotlab.eu
Please provide sufficient information for us to identify your request.
Where necessary, we may request additional information to verify your identity and protect your personal data from unauthorized disclosure.
We will respond to valid requests within the period required by applicable data protection law.
18. Withdrawal of Consent
Where we process your personal data based on consent, you may withdraw your consent at any time.
You can withdraw marketing consent by using the unsubscribe function included in our marketing emails or by contacting us at:
You can manage cookie consent through the cookie/privacy settings available on our website.
Withdrawal of consent does not affect the lawfulness of processing that took place before the withdrawal.
19. Automated Decision-Making and Profiling
We do not use solely automated decision-making that produces legal effects or similarly significant effects concerning you.
Certain Shopify services may use automated processing, personalization, analytics or customer activity information for marketing, recommendations or other service functions.
Where such processing constitutes automated decision-making or profiling subject to specific legal rights, applicable rights and safeguards will apply.
20. Children's Privacy
Our Services are not directed at children.
We do not knowingly collect personal data from children where such collection is prohibited by applicable law.
If you believe that a child has provided us with personal data, please contact us at:
We will review the matter and take appropriate action where required.
21. Third-Party Websites and Services
Our website may contain links to websites, social media platforms or other services operated by third parties.
We are not responsible for the privacy practices, content or security of third-party websites or services.
When you leave our website and access a third-party service, the privacy policy of that third party applies.
22. Social Media
Our website may contain links to social media platforms, including Instagram or TikTok.
If you click on a social media link, you will leave our website and access the respective third-party platform.
The processing of your personal data by the relevant social media provider is governed by that provider's own privacy policy and your privacy settings on that platform.
23. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- changes to our Services
- changes to our business practices
- changes to technologies we use
- changes to our service providers
- changes in applicable laws or regulatory requirements
When we update this Privacy Policy, we will change the “Last updated” date at the top of this page.
We recommend reviewing this Privacy Policy periodically.
24. Supervisory Authority
You have the right to lodge a complaint with a competent data protection supervisory authority.
As KNOT Lab is based in Baden-Württemberg, Germany, you may contact:
The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI Baden-Württemberg)
Heilbronner Straße 35
70191 Stuttgart
Germany
Phone: +49 711 61 55 41-0
Email: poststelle@lfdi.bwl.de
The LfDI Baden-Württemberg is the state data protection supervisory authority for Baden-Württemberg. Its current official address and contact details are confirmed on its website.
LfDI Baden-Württemberg – Contact
25. Contact
If you have any questions about this Privacy Policy, the processing of your personal data or your privacy rights, please contact:
KNOT Lab
Jenny Chey
Rainäckerstr. 11
70794 Filderstadt
Germany
Email: info@knotlab.eu