Free delivery within Germany on orders over €59*

Data protection

Last updated: November 10, 2026

Taiga operates this shop and this website, including all associated information, content, features, tools, products and services, to provide you as a customer with a curated shopping experience (the “Services”). Taiga is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use and disclose your personal data when you visit or use the Services, make a purchase or carry out another transaction through them, or otherwise communicate with us. In the event of a conflict between our Terms and Conditions and this Privacy Policy, this Privacy Policy shall prevail with regard to the collection, processing and disclosure of your personal data.

Please read this Privacy Policy carefully. By using and accessing the Services, you confirm that you have read this Privacy Policy and understand the collection, use and disclosure of your data as described in this Privacy Policy.

Personal data that we collect or process

When we use the term “personal data”, we are referring to information that identifies you or another person, or that can reasonably be associated with you or another person. Personal data does not include information that is collected anonymously or has been de-identified so that it cannot identify you or reasonably be associated with you. We may collect or process the following categories of personal data, including inferences drawn from such personal data, depending on how you interact with the Services, where you live and as permitted or required by applicable law:

  • Contact details including your name, address, billing address, delivery address, telephone number and email address.
  • Financial information including credit card, debit card and financial account numbers, payment card information, financial account information, transaction details, payment method, payment confirmation and other payment details.
  • Account information including your username, password, security questions, preferences and settings.
  • Transaction information including the items you view, add to your basket, add to your wish list or purchase, return, exchange or cancel, as well as your past transactions.
  • Communications with us including the information you provide to us in communications, for example when you contact customer support.
  • Device information including information about your device, browser or network connection, your IP address and other unique identifiers.
  • Usage information including information relating to your interaction with the Services, including how and when you interact with or navigate the Services.

Sources of personal data

We may collect personal data from the following sources:

  • Directly from you, including when you create an account, visit or use the Services, communicate with us or otherwise provide us with your personal data;
  • Automatically through the Services, including from your device when you use our products or services or visit our websites, as well as through the use of cookies and similar technologies;
  • From our service providers, including when we engage them to enable certain technologies and when they collect or process your personal data on our behalf;
  • From our partners or other third parties.

How we use your personal data

Depending on how you interact with us or which of the Services you use, we may use personal data for the following purposes:

  • Providing, customising and improving the Services. We use your personal data to provide the Services to you, including to perform our contract with you, process your payments, fulfil your orders, remember your preferences and items you are interested in, send you notifications relating to your account, process purchases, returns, exchanges or other transactions, create, maintain and otherwise manage your account, arrange delivery, facilitate returns and exchanges, enable you to submit reviews, and provide you with a personalised shopping experience, such as recommending products related to your purchases. This may include using your personal data to better customise and improve the Services.
  • Marketing and advertising. We use your personal data for marketing and advertising purposes, such as sending marketing, advertising and promotional communications by email, text message or post, and showing you online advertisements for products or services on the Services or other websites, including based on items that you have previously purchased or added to your basket, as well as based on other activities on the Services.
  • Security and fraud prevention.We use your personal data to authenticate your account, provide a secure payment and shopping experience, detect, investigate or take action in relation to possible fraudulent, illegal, unsafe or malicious activity, protect public safety and secure our services. If you choose to use the services and register an account, you are responsible for keeping your login credentials secure. We strongly recommend that you do not share your username, password or other access details with anyone else.
  • Communication with you.We use your personal data to provide you with customer support, respond to your concerns, provide you with effective services and maintain our business relationship with you.
  • Legal reasons.We use your personal data to comply with applicable laws or respond to valid legal process, including requests from law enforcement or government authorities, to participate in or investigate civil investigations, potential or actual disputes or other legal proceedings, and to enforce or investigate potential violations of our terms or policies.

How we disclose personal data

Under certain circumstances, we may disclose your personal data to third parties for legitimate purposes in accordance with this Privacy Policy. Such circumstances may include:

  • With Shopify, vendors and other third-party service providers that perform services on our behalf, such as IT management, payment processing, data analytics, customer support, cloud storage, fulfilment and shipping.
  • With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalised advertising with third-party services based on your online activities across different merchants and websites. Our business and marketing partners will use your data in accordance with their own privacy policies. Depending on where you live, you may have the right to instruct us not to share information about you in order to show you targeted advertising and marketing based on your online activities across different merchants and websites.
  • When you direct, request or otherwise consent to our disclosure of certain information to third parties, such as to ship products to you or through your use of social media widgets or login integrations.
  • With our affiliates or otherwise within our corporate group.
  • In connection with a business transaction such as a merger or bankruptcy, to comply with all applicable legal obligations, including responding to subpoenas, search warrants and similar requests, to enforce applicable terms and policies, and to protect or defend the services, our rights and the rights of our users or others.

Relationship with Shopify

The services are hosted by Shopify. Shopify collects and processes personal data relating to your access to and use of the services in order to provide and improve the services for you. Information that you submit through the services is transferred to and shared with Shopify and third parties that may be located in countries other than your country of residence, in order to provide and improve the services for you. In addition, to protect, grow and improve our business, we use certain enhanced Shopify features that integrate data and information from your interactions with our shop, as well as with other merchants and Shopify. To provide these enhanced features, Shopify may use personal data collected through your interactions with our shop, as well as with other merchants and Shopify. In these cases, Shopify is responsible for processing your personal data, including responding to your requests to exercise your rights regarding the use of your personal data for these purposes. To learn more about how Shopify uses your personal data and what rights you may have, you canShopify Consumer Privacy Policyvisit. Depending on where you live, you may exercise certain rights relating to your personal data here:Link to Shopify Privacy Portal.

Third-party websites and links

The Services may contain links to websites or other online platforms operated by third parties. If you follow links to websites that are not affiliated with us or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee the privacy or security of such websites and are not responsible for them. This includes the accuracy, completeness or reliability of the information found on these websites. Information you provide in public or semi-public places, including information you share on third-party social media platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or a third party. Our inclusion of such links does not in itself constitute an endorsement of the content on those platforms or their owners or operators, unless this is disclosed in the Services.

Children's Data

The Services are not intended for use by children and we do not knowingly collect personal information about children who are not yet of legal age in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the contact details provided below to request its deletion. As of the Effective Date of this Privacy Policy, we have no actual knowledge that we “share” or “sell” (as those terms are defined under applicable law) personal information of individuals under 16 years of age.

Security and Retention of Your Data

Please note that no security measures are perfect or impenetrable, and we cannot guarantee “perfect security”. In addition, information you send to us may not be secure while it is in transit. We recommend that you do not use unsecured channels to communicate sensitive or confidential information to us.

How long we retain your personal information depends on various factors, such as whether we need the information to maintain your account, provide the Services to you, comply with legal obligations, resolve disputes or enforce other applicable agreements and policies.

Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances, and in certain cases we may refuse your request to the extent permitted by law.

  • Right of access. You may have the right to request access to the personal information we hold about you.
  • Right to erasure. You may have the right to request that we delete the personal information we hold about you.
  • Right to rectification. You may have the right to request that we rectify inaccurate personal information we hold about you.
  • Right to data portability. You may have the right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party in certain circumstances and subject to certain exceptions.
  • Managing Communication Preferences. We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you unsubscribe, we may continue to send you non-promotional emails, such as those concerning your account or orders you have placed.

If you live in the United Kingdom or the European Economic Area, you may exercise the following additional rights, subject to the exceptions and restrictions provided for under local law, in addition to the rights set out above:

  • Right to object to processing and restriction of processing: You may have the right to ask us to stop or restrict the processing of your personal information for certain purposes.
  • Withdrawal of consent:If we rely on your consent as the legal basis for processing your personal data, you have the right to withdraw that consent. If you withdraw your consent, this does not affect the lawfulness of any processing carried out on the basis of your consent before its withdrawal.

You may exercise any of these rights where indicated in the Services, or by contacting us using the contact details provided below. To learn more about how Shopify uses your personal data and what rights you may have, including rights relating to data processed by Shopify, you can visit https://privacy.shopify.com/en.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required by applicable law. In accordance with applicable law, you may appoint an authorised representative to submit requests on your behalf in order to exercise your rights. Before we accept such a request from a representative, we require the representative to provide proof that you have authorised them to act on your behalf, and we may need to have you verify your identity directly with us. We will respond to your request in a timely manner, as required by applicable law.

Complaints

If you have complaints about how we process your personal data, please contact us using the contact details provided below. Depending on where you live, you may have the right to appeal our decision by contacting us using the contact details provided below, or to submit your complaint to your local data protection authority. For the EEA, you can find here a list of the competent data protection supervisory authorities.

International data transfers

Please note that we may transfer, store and process your personal data outside your country of residence.

If we transfer your personal data out of the European Economic Area or the United Kingdom, we rely on recognised transfer mechanisms such as the European Commission's Standard Contractual Clauses or, where applicable, equivalent contracts issued by the relevant authority of the United Kingdom, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or other operational, legal or regulatory reasons. We will publish the revised Privacy Policy on this website, update the date of the last update and provide notification to the extent required by law.

Contact

If you have any questions about our privacy practices or this Privacy Policy, or wish to exercise any of the rights available to you, please email us at support@taiga.green. You can find our additional contact details at contact information policy. For the purposes of applicable data protection laws, we are the data controller for your personal data.

Analytics and advertising

Principle and consent

We only use the following services if you have given your consent via our cookie banner. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and, insofar as information is stored on or read from your device, Section 25(1) TDDDG. These services are not loaded without your consent. You can withdraw your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page.

Google Analytics 4

We use Google Analytics 4 to understand how visitors use our shop, for example which pages are viewed and which products are viewed, added to the basket or purchased. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The information processed includes, in particular, details about your device and browser, the pages viewed and events, approximate location data and online identifiers. Google Analytics 4 does not store complete IP addresses. The data is stored for a maximum of 14 months and then automatically deleted.

Google Ads: conversion tracking and remarketing

We use Google Ads to display adverts and measure whether an advert has led to a purchase (conversion tracking). For this purpose, an identifier is stored after you click on an advert and matched against a subsequent purchase. We can also show visitors to our shop adverts on other websites and in Google services (remarketing). The provider is Google Ireland Limited (address as above).

Enhanced conversions with Google Ads

To ensure that purchases can also be attributed to an advert when an identifier is missing from the browser, we send certain order data to Google after a purchase in hashed and encrypted form: your email address and, if provided, your telephone number, name and address. Before transmission, this data is hashed in your browser or on our server using the SHA-256 method, meaning that it is converted into an unreadable string of characters. Google compares the string with its own data relating to logged-in users in order to measure the number of purchases statistically, and deletes the transmitted values after the comparison. We do not receive any data relating to individual people in return. The legal basis here is also your consent (see “Principle and consent”).

Microsoft Advertising (Universal Event Tracking)

We use Microsoft Advertising to display adverts in the Bing search engine and the Microsoft advertising network and to measure their success. For this purpose, we use the Universal Event Tracking tag (UET), which records visits and purchases following an advert click. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

Google Customer Match

If you expressly allow us to show you relevant advertising on Google and YouTube, we send your email address to Google in hashed and encrypted form. Before transmission, it is hashed on our server using the SHA-256 method, meaning that it is converted into a string that cannot be reverse-engineered. Google compares this value with its own user accounts and shows our adverts to logged-in users or excludes them from adverts. Google deletes values that cannot be matched after the comparison.

Purpose: adverts for existing customers on Google services (Search, Shopping, YouTube, Gmail, Display).
Legal basis: your consent pursuant to Art. 6(1)(a) GDPR, separately from newsletter and cookie consent.
Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Transmission to Google LLC in the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision by the European Commission of 10 July 2023, Art. 45 GDPR).
Storage period: The list is fully reconciled on a regular basis. Memberships expire after a maximum of 540 days.
Withdrawal: at any time with effect for the future via the unsubscribe link, in your customer account or by email to support@taiga.green. We will remove you during the next reconciliation, and no later than 7 days afterwards.

Transfers to the USA

Google and Microsoft may also transfer data to their parent companies in the USA. Google LLC and Microsoft Corporation are certified under the EU-US Data Privacy Framework. These transfers are therefore covered by an adequacy decision by the European Commission pursuant to Art. 45 GDPR. The European Commission’s standard contractual clauses also apply.

Further information

Google: https://policies.google.com/privacy · Microsoft: https://privacy.microsoft.com/de-de/privacystatement

Customer chat

You will find a chat icon on our pages, as well as an input field on computers. The chat is only loaded when you click on one of these or on a chat link. Until then, no data is sent to the provider and no information is stored on your device. As long as the chat window remains open, the chat stays active when you move between pages.

After you click, your browser loads the chat from the provider’s servers. The provider receives your IP address and technical information about your browser. Information is stored in your browser for the chat (cookies and local storage) so that the conversation can be retained and errors can be identified. We store what you write in the chat and your email address in our customer system and process them to respond to your enquiry. An AI assistant may also generate replies. It can also advise you about products. To do this, it uses the current page, pages and products viewed, your basket and, if you are logged in, previous orders, and uses this to estimate your interest in making a purchase. This has no legal consequences for you.

The provider is Gorgias Inc., San Francisco, USA, which acts on our behalf (Art. 28 GDPR). The AI assistant works with language models from Gorgias and other providers, including Anthropic and OpenAI in the USA. Through Gorgias, these providers are not permitted to use your data for their own models. Gorgias also improves its own AI models using chats; according to Gorgias, personal data is not stored for this purpose. The European Commission’s standard contractual clauses apply to transfers to the USA. Further information: Gorgias privacy notice.

To protect against misuse, the chat integrates Google reCAPTCHA. Google receives your IP address and technical information about your browser and may set a cookie. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; for transfers to the USA, see the section “Transfers to the USA”. The chat loads fonts from Bunny Fonts, provided by BunnyWay d.o.o., Ljubljana, Slovenia, which receives your IP address in the process.

The legal basis for storage in your browser is Section 25(2) no. 2 TDDDG, as you expressly open the chat. We rely on Art. 6(1)(b) GDPR to process your enquiry insofar as it concerns an order or contract; otherwise, we rely on Art. 6(1)(f) GDPR: our legitimate interest is to respond to enquiries quickly, provide suitable advice and protect the chat against misuse. The section “Security and retention of your data” applies to the storage period.

Integration of the Trusted Shops Trustbadge / other widgets

Trusted Shops widgets are integrated into this website to display Trusted Shops services (e.g. quality seal, collected reviews) and to offer Trusted Shops products to buyers after an order. This serves to safeguard our overriding legitimate interests, established as part of a balancing of interests, in optimum marketing by enabling secure purchasing pursuant to Art. 6(1) sentence 1(f) GDPR. The Trustbadge and the services advertised with it are offered by Trusted Shops SE, Subbelrather Str. 15C, 50823 Cologne (“Trusted Shops”), with which we are jointly responsible for data protection pursuant to Art. 26 GDPR. In the following, we inform you of the key contractual content pursuant to Art. 26(2) GDPR as part of this privacy notice.

When you interact with the Trustbadge AI+, session cookies are set to store the login status and display the so-called welcome layer, which shows the details of the relevant online shop (company information, reviews, information about the existence of buyer protection) as well as the #trstd secret. A cookie is set to recognise logged-in users and stored for a maximum of 400 days after login. Session cookies are also set to send push notifications when the app is used, provided that the user has allowed them. This is necessary so that Trusted Shops can provide the digital service you have requested. Trusted Shops is responsible for data processing when you interact with the Trustbadge AI+.

As part of the joint responsibility between us and Trusted Shops, please preferably contact Trusted Shops regarding data protection matters and the exercise of your rights using the contact details provided in the privacy information. Irrespective of this, you can always contact the controller of your choice. If necessary, your enquiry will then be forwarded to the other controller for a response.

Data processing when integrating the Trustbadge / other widgets

The Trustbadge is provided by a US-based CDN provider (content delivery network).
An adequate level of data protection is ensured in each case by an adequacy decision of the European Commission, which is available here for the USA. Service providers used in the USA are generally certified under the EU-U.S. Data Privacy Framework (DPF). Further information is available here. Where service providers used are not certified under the DPF, standard contractual clauses have been concluded as an appropriate safeguard.
 

When the Trustbadge is accessed, the web server automatically stores a so-called server log file, which also contains your IP address, the date and time of access, the amount of data transferred and the requesting provider (access data), and documents the access. The IP address is anonymised immediately after collection, meaning that the stored data can no longer be attributed to you. The anonymised data is used in particular for statistical purposes and error analysis.

Data processing after completion of an order

After an order has been completed, order information (order total, order number and, where applicable, product purchased) and your email address, hashed using a cryptographic one-way function, are transmitted to Trusted Shops. The legal basis is Art. 6(1) sentence 1(f) GDPR. This serves to check whether you are already registered for services with Trusted Shops and is therefore necessary to fulfil our and Trusted Shops’ overriding legitimate interests in providing the buyer protection and transactional review services linked to the specific order, pursuant to Art. 6(1) sentence 1(f) GDPR. If this is the case, further processing takes place in accordance with the contractual agreement between you and Trusted Shops. If you are not yet registered for the services, you will then have the opportunity to register for the first time. Further processing after registration is likewise governed by the contractual agreement with Trusted Shops. If you do not register, all transmitted data will be automatically deleted by Trusted Shops and can no longer be linked to an individual.

Trusted Shops uses service providers in the areas of hosting, monitoring and logging. The legal basis is Art. 6(1) lit. f GDPR for the purpose of ensuring trouble-free operation. Processing may take place in third countries (USA and Israel). An adequate level of data protection is ensured in each case by an adequacy decision of the European Commission, which is available here for the USA and here for Israel. Service providers used in the USA are generally certified under the EU-U.S. Data Privacy Framework. Further information is available here. Where service providers used are not certified under the DPF, standard contractual clauses have been concluded as an appropriate safeguard.

Controller
Taiga GmbH
Kolonnenstraße 8
10827 Berlin
Email: support@taiga.green