Privacy policy
1. Data Controller
The entity responsible for processing personal data in connection with byloopstudio.com is:
Building Brands LLC
30 N Gould St, Suite N
Sheridan, WY 82801
USA
Email: support@byloopstudio.com
Phone: +1 307 449 2556
2. General Information
We process personal data only to the extent necessary and legally permitted to provide our online store, process orders, communicate with customers, prevent fraud, analyze and improve our services, and carry out marketing activities.
Personal data means any information relating to an identified or identifiable individual. This includes, in particular, name, address, email address, phone number, order and payment information, device and usage data, and the content of communications.
3. Hosting and Shopify
Our online store is hosted and provided through Shopify. Depending on the applicable agreement and regional configuration, the service may be provided by a company within the Shopify group. Shopify processes, in particular, customer information, contact details, order information, payment information, device data, log data, and usage data to provide the store, facilitate transactions, maintain security, and provide support.
Processing is carried out as necessary to perform the contract and take pre-contractual steps, to comply with legal obligations, and based on our legitimate interests in operating a secure and commercially viable online store. Where non-essential cookies or similar technologies are used, processing is based on your consent.
Data may be processed in countries outside the EU/EEA, including Canada and the United States. Where applicable, available data transfer mechanisms are used, such as adequacy decisions, Standard Contractual Clauses, and additional safeguards.
4. Server Log Data and Security
When you access our store, certain technical information may be automatically processed, including your IP address, date and time of access, pages viewed, referrer URL, browser type, operating system, device information, and error logs. This processing is used to ensure secure operation, prevent attacks, troubleshoot errors, and prevent misuse.
5. Orders, Customer Accounts, and Contract Processing
When you place an order or use a customer account, we process your customer information, contact details, shipping information, order information, communication data, and payment-related information. This processing is necessary to initiate and fulfill the contract, process payments, deliver products, handle returns and refunds, and comply with legal record-keeping requirements.
Data may be shared with necessary recipients, including payment processors, shipping and logistics providers, IT and hosting providers, customer service providers, tax advisors, and government authorities where legally required.
6. Payment Providers
Depending on the payment method selected at checkout, data may be shared with payment providers such as Shopify Payments, Stripe, PayPal, and Klarna. This may include your name, billing and shipping address, email address, order amount, currency, transaction IDs, payment status, device and risk information, and, where applicable, credit information.
Processing is carried out to process payments, prevent fraud, and assess risk. Certain providers act as independent data controllers for parts of the processing. Depending on the payment method selected, Klarna may perform identity and credit checks. The current privacy information of the selected payment provider should be linked during checkout.
7. Shipping and Logistics
To deliver your order, we share the necessary information with shipping and logistics providers. This may include your name, shipping address, contact information, shipment details, and, where applicable, customs information.
Shipping and logistics providers may include DHL, DPD, Hermes, UPS, Österreichische Post, and Swiss Post.
8. Customer Service
When you contact us by email, contact form, chat, or social media, we process your contact information, the content of your inquiry, and any order or case information necessary to handle your request. Our customer service may be supported by DOIT E-Commerce GmbH in Hamburg.
9. Newsletter with Klaviyo
We use Klaviyo to send newsletters and marketing-related emails. This may include processing your email address, name, order history, product interests, email opens, clicks, device information, audience segments, and records of consent.
Marketing communications are generally sent based on your consent. Where permitted by law, information about existing customers may be used for direct marketing, and you may opt out at any time. A double opt-in process should be used and documented for newsletter subscriptions.
Klaviyo may process data in the United States. Before publication, the current Klaviyo contracting entity, applicable data transfer mechanisms, activated tracking features, and retention periods should be reviewed.
10. Product Reviews with Loox
We use Loox to collect and display product reviews. This may involve processing your name or display name, email address, order and product information, review text, photos or videos, IP address, device information, and timestamps.
This processing is used to provide authentic product reviews and, where review requests are sent, to communicate with customers. Published reviews may remain publicly visible until they are deleted or anonymized. The specific Loox configuration, review request process, and data transfers should be reviewed before publication.
11. Cookies and Similar Technologies
We use cookies, pixels, local storage technologies, SDKs, and similar technologies. Technically necessary technologies are used for purposes including shopping cart functionality, checkout, security, language settings, and session management. Non-essential analytics, personalization, and marketing technologies are activated only with your consent where required by law.
You can change or withdraw your cookie preferences at any time through our cookie settings center.
12. Google Services
We may use Google Analytics 4, Google Ads, and other Google services. This may involve processing usage data, device information, event data, conversion data, advertising data, and approximate location information. Where enabled, information may be associated with a Google Account or used for cross-device measurement.
Non-essential Google services are activated only with your consent. Before going live, the specific products used, Consent Mode configuration, IP and data settings, retention periods, advertising features, and data-sharing settings should be documented.
13. Meta Pixel and Meta Advertising Services
With your consent, we may use technologies provided by Meta to measure the effectiveness of advertising on Facebook and Instagram, create audiences, and personalize ads. This may involve processing page views, purchases, shopping cart activity, device information, IP addresses, and hashed contact information.
Meta may process data under its own responsibility for advertising and security purposes. The specific allocation of responsibilities depends on the feature being used. Before going live, the use of the Meta Pixel, Conversions API, Advanced Matching, and audience features should be reviewed.
14. TikTok Pixel and TikTok Advertising Services
With your consent, we may use the TikTok Pixel or similar TikTok technologies. This may involve processing page views, interactions, purchases, device and browser information, IP addresses, event IDs, and hashed contact information to measure conversions, create audiences, and optimize advertising.
15. Social Media
We may maintain accounts on social media platforms. When you visit or interact with these accounts, the platform operators and we may process personal data. Platform operators may create user profiles and process data outside the EU/EEA. Their respective privacy policies also apply to processing carried out by the platforms.
16. Legal Bases
- Contract performance and pre-contractual measures: Article 6(1)(b) GDPR.
- Legal obligations, including tax and commercial record-keeping requirements: Article 6(1)(c) GDPR.
- Consent for non-essential cookies, newsletters, and personalized advertising: Article 6(1)(a) GDPR and applicable national laws governing access to and storage of information on end-user devices.
- Legitimate interests, including IT security, fraud prevention, legal defense, internal organization, and appropriate direct marketing: Article 6(1)(f) GDPR.
17. International Data Transfers
Because the data controller is based in the United States and several service providers operate internationally, personal data may be processed outside the EU/EEA. Where no adequacy decision applies, we generally rely on mechanisms such as Standard Contractual Clauses and additional technical and organizational safeguards. Data protection standards in third countries may differ from those applicable in the EU.
18. Data Retention
We retain personal data only for as long as necessary for the relevant purposes or as required by applicable legal retention obligations. Contractual and tax-related records are generally retained for the periods required by law. Records of consent are retained for as long as necessary to document its use and thereafter as needed for legal defense. Analytics and marketing data are retained according to the periods configured in our consent management tool and by the respective service providers.
19. Your Rights
Subject to applicable legal requirements, you have the right to request access to your personal data, correction, deletion, restriction of processing, data portability, and to object to certain processing activities. You may withdraw your consent at any time with effect for the future. You also have the right to lodge a complaint with a competent data protection supervisory authority.
To exercise your rights, please contact us at support@byloopstudio.com. To prevent unauthorized access, we may request appropriate proof of identity.
20. Right to Object to Direct Marketing
You may object to the processing of your personal data for direct marketing purposes at any time. Following an objection, your data will no longer be processed for these purposes.
21. Minors
Our store is not specifically directed at children. Individuals below the minimum age applicable under their local laws should only provide personal data with the consent of a parent or legal guardian.
22. Changes to This Privacy Policy
We may update this Privacy Policy when the applicable law, services, or data processing activities change. The current version published on byloopstudio.com applies.