Last updated: 1 November 2026.
Controller and scope
The controller is Gabriel Matrescu, a sole trader trading as Imagine It Delivered, Polizeimeister-Kaspar-Straße 28, 60320 Frankfurt am Main, Germany. Contact: sales@imagineitdelivered.de, +49 174 7545472. This notice covers iidelivered.com, wholesale.iidelivered.com and their associated ordering, account and contact functions.
Store operation and technical data
We use Shopify to provide our store, cart, checkout and customer accounts. Shopify International Limited in Ireland initially processes data relating to people in the European Economic Area. Shopify generally acts as a processor when providing our store services. Separate controller responsibilities apply to certain services that Shopify provides itself and to enhanced services.
Visiting the site involves processing data such as your IP address, device and browser information, requested pages, access times and technical logs. We use these to deliver the website, resolve faults, maintain security and prevent abuse. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in a secure, functioning store. Data necessary for an order you request is processed under Article 6(1)(b) GDPR.
Orders delivery and payment
We process contact, billing and delivery details, ordered products, prices, payment status and information needed for shipping, withdrawal, refunds and complaints. Article 6(1)(b) GDPR supports this processing. Statutory record retention and tax processing rely on Article 6(1)(c) GDPR.
Necessary order information is shared with Shopify, our fulfilment provider BigBox-Fulfilment (IID), Große Isel 9, 89233 Neu-Ulm, and DHL or DPD according to the shipment. Payment data is transmitted to the payment provider you select. Recipients receive data needed for their respective tasks.
Customer accounts
You do not need an account to buy from us. Sign-in uses a one-time code sent to your email address; this Shopify customer account does not use a permanent password. We process sign-in details and the contact, address and order information associated with your account to provide its functions. The legal basis is Article 6(1)(b) GDPR. Security checks to protect your account rely on Article 6(1)(f) GDPR.
You may also sign in using an existing Shop account. If you choose this option, Shopify processes the required account information and information about your use of our store after sign-in as a separate controller. The Shopify Consumer Privacy Policy applies to that processing. Email-code sign-in remains available as an alternative.
Checkout rules
We use Essential Checkout from Essential Apps to apply checkout rules. This involves processing cart and delivery address information within Shopify's infrastructure to apply the configured order rules. The legal basis is Article 6(1)(b) GDPR where necessary for your requested order. Further information is available in the Essential Checkout privacy policy.
Contact and wholesale enquiries
For contact and wholesale enquiries, we process the information you provide, including your name, email, company, country, requested products and quantities, and optional details such as VAT number, business type and message. We use this to answer the enquiry and prepare possible contracts. Article 6(1)(b) GDPR applies to enquiries about a contract with you. For company representatives and other business correspondence, Article 6(1)(f) GDPR applies, with our legitimate interest in responding to the enquiry. An enquiry does not by itself constitute newsletter consent.
Protecting forms
Our Shopify forms use hCaptcha from Intuition Machines, Inc., USA, to detect automated submissions and abuse. This can involve processing technical connection and device data and information about interactions with the form. Provider information: hCaptcha privacy notice.
Security processing relies on Article 6(1)(f) GDPR where it is necessary to prevent abuse and justified by the balancing of interests. Device access is additionally subject to section 25 TDDDG: only strictly necessary operations qualify for an exemption from consent; other operations require your consent.
Cookies and consent
Shopify uses cookies and similar storage for purposes including the cart, session, security and remembering your privacy choices. Strictly necessary storage and access may rely on section 25(2) TDDDG. Consent-based analytics and marketing technologies fall under section 25(1) TDDDG; the associated personal data processing relies on Article 6(1)(a) GDPR.
You can change your choices and withdraw consent for future processing through our website's privacy settings. Withdrawal does not affect the lawfulness of processing that took place before it. Rejecting optional purposes does not cancel an order.
Shopify Network Intelligence
Shopify Network Intelligence is enabled in our store. Shopify combines data about your interactions with our store with information from your interactions with other merchants and Shopify to provide enhanced services, such as security and service improvements. Shopify acts as a separate controller for this processing. Shopify and other service providers in other countries may receive this information.
Personalised advertising that requires consent is subject to your consent. Details and ways to withdraw consent or object are available in the Shopify Consumer Privacy Policy and Shopify privacy portal. You can change our store's optional-purpose settings through the privacy settings linked above.
Transfers outside the European Economic Area
Shopify and service providers may process data outside the EEA. An EU hosting region does not exclude these transfers. Where applicable, transfers rely on adequacy decisions or appropriate safeguards under Article 46 GDPR. Shopify uses binding corporate rules for transfers within its group and, for other relevant transfers, safeguards including standard contractual clauses. Details are available in the Shopify Data Processing Addendum and Shopify subprocessor information. You may also contact us for information about safeguards applicable to your data.
Retention and required information
We keep data for as long as it is needed for its purpose. Order and accounting records are retained for the applicable statutory commercial and tax retention periods. Completed enquiries are deleted unless retention is legally required or justified for legal claims. When an account is deleted, unnecessary account data is removed; transaction information that must be retained is kept with appropriate restrictions. Cookie lifetimes are stated in the privacy settings or service inventory.
Required fields are identified. Without information necessary for an order or delivery, we cannot perform the relevant contract. Without an email address, sign-in by one-time code is unavailable. Optional additional information and consent to optional purposes are separate from these requirements.
Your rights
Subject to the GDPR's conditions, you can request access, correction, deletion, restriction of processing and data portability. You may withdraw consent at any time for future processing. You can object to processing based on legitimate interests for reasons relating to your particular situation. You can object to direct marketing at any time without giving a particular reason. Contact sales@imagineitdelivered.de to exercise these rights.
You may complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. The authority responsible for our registered business location is the Hessian Commissioner for Data Protection and Freedom of Information: datenschutz.hessen.de.
Updates
We update this notice when our services or data processing change. Any required new consent is requested separately. The current version is available on this website.