Privacy policy
Effective date: 1 October 2026
1. Controller
C.A. Götz jr. GmbH, Landwüster Straße 17, 08258 Markneukirchen OT Wernitzgrün, Germany
Telephone +49 37422 5880, e-mail contact@cagoetzjr.com
Represented by managing directors Dr Simon Goetz and Maximilian Duesberg
This policy applies to the online shops www.conrad-goetz.com and catalog.cagoetzjr.com. Where a service is used only in one of the two shops, we name that shop. The privacy policy published there applies to our company website www.cagoetzjr.com.
2. Your Rights
You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw any consent given at any time with effect for the future (Article 7(3)). An informal message to contact@cagoetzjr.com is sufficient.
Right to object (Article 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time for reasons arising from your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.
You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), Maternistraße 17, 01067 Dresden.
3. Accessing the Websites, Hosting
When you access the website, the server technically processes necessary data: IP address, date and time, page accessed, referrer, browser and operating system. The purpose is to deliver the website and ensure its security. The legal basis is Article 6(1)(f) GDPR. Log data is deleted after a short time, at the latest after 30 days, unless it is needed to investigate a security incident.
- Shops (conrad-goetz.com, catalog.cagoetzjr.com): Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, Ireland. Shopify may transfer data to Shopify Inc. (Canada) and to service providers in the USA. For Canada, an adequacy decision of the European Commission exists; for the USA, the transfer is based on the EU-US Data Privacy Framework (Article 45 GDPR) and, additionally, on standard contractual clauses (Article 46 GDPR).
A data processing agreement (Article 28 GDPR) is in place with Shopify.
4. Contact
If you write to us by e-mail, telephone or contact form, we process your details to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where a contract is concerned, otherwise Article 6(1)(f) GDPR. We delete the data once the enquiry has been dealt with and no retention obligation applies.
5. Ordering and Customer Account (Shops)
For orders, we process name, address, e-mail address, telephone number where applicable, and order and payment data. The legal basis is Article 6(1)(b) GDPR. Mandatory fields are marked; without them we cannot conclude the contract. A customer account is optional. You may have it deleted at any time.
Under commercial and tax law, we must retain accounting vouchers and invoices for eight years and the remaining contract and accounting records (in particular commercial books, inventories and annual financial statements) for ten years (Section 257 German Commercial Code (HGB), Section 147 German Fiscal Code (AO); Article 6(1)(c) GDPR). We delete them thereafter.
6. Payment
To process payment, we pass on the data required for this purpose to the chosen payment service provider (Article 6(1)(b) GDPR):
- Shopify Payments (cards, Apple Pay, Google Pay, Shop Pay and other payment methods displayed): Shopify International Limited, address as in Section 3.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
- Klarna (catalog.cagoetzjr.com): Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For invoice and instalment purchase, Klarna may carry out an identity and creditworthiness check and, for this purpose, transmit data to credit agencies. Klarna is independently responsible for this; details are set out in Klarna's own privacy notices.
The payment service providers are themselves responsible for their own processing activities, such as fraud prevention.
7. Shipping
We pass your name and delivery address to the shipping company engaged (Article 6(1)(b) GDPR). It receives your e-mail address or telephone number only if you consented during the ordering process, so that it can inform you about delivery (Article 6(1)(a) GDPR).
8. Newsletter (catalog.cagoetzjr.com)
For the newsletter, we need your e-mail address and your consent (Article 6(1)(a) GDPR). You confirm registration via a link in a confirmation e-mail. Dispatch and management are carried out via Shopify's newsletter function. This measures whether and when an e-mail is opened and which links are clicked, in order to improve content. You may unsubscribe at any time via the unsubscribe link in every e-mail.
9. Cookies and Consent
We use technically necessary cookies and comparable technologies (for example for the shopping basket, checkout, language setting and security) without consent (Section 25(2) No. 2 German Telecommunications-Digital-Services-Data-Protection Act (TDDDG), Article 6(1)(b) and (f) GDPR).
All services listed in Section 10, as well as the Instagram feed in Section 11, load only once you have agreed in the consent banner (Section 25(1) TDDDG, Article 6(1)(a) GDPR). You can change or withdraw your choice at any time via "Cookie settings" in the footer of the website.
10. Analytics and Marketing (Consent-Based Only)
| Service | Provider | Website | Purpose |
|---|---|---|---|
| Shopify Analytics | Shopify International Limited (Section 3) | both shops | statistics on visits and sales in the shop (cookies _shopify_y, _shopify_s) |
| Google Tag Manager | Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | catalog.cagoetzjr.com | management and triggering of the services listed below |
| Google Analytics 4 | Google Ireland Limited | conrad-goetz.com | audience measurement, usage statistics (IP addresses truncated) |
| Contentsquare | Contentsquare SAS, 7 rue de Madrid, 75008 Paris, France | catalog.cagoetzjr.com | analysis of website usage (clicks, scrolling) to improve the shop |
| Meta Pixel | Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland | conrad-goetz.com | measuring the success of, and defining audiences for, advertising on Facebook and Instagram |
| LinkedIn Insight Tag | LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland | conrad-goetz.com | measuring the success of, and defining audiences for, advertising on LinkedIn |
These providers may transfer data to the USA. The legal basis is the EU-US Data Privacy Framework (Article 45 GDPR), supplemented by standard contractual clauses. For the Meta Pixel, we are joint controllers together with Meta for the collection and transmission of data (Article 26 GDPR); Meta is responsible for further processing. The essential content of this arrangement and your contact point for exercising your data subject rights are made available by Meta in its joint-controller information (Controller Addendum), accessible via Meta's privacy notices. The data is deleted once the purpose no longer applies, at the latest after 14 months (Google Analytics) or in accordance with the respective providers' retention periods.
11. Embedded Content and Shop Extensions
- Instagram feed: via Instafeed (conrad-goetz.com). When loaded, your IP address and browser data are transmitted to the widget provider and to Instagram (Meta Platforms Ireland Limited). The feed loads only after you have given your consent (Article 6(1)(a) GDPR).
- Shop extensions: certain functions of the shops (such as notification bars) are provided by the app provider Hextom; in doing so, your IP address is transmitted to its servers (Article 6(1)(f) GDPR, interest: functionality of the shop).
- jQuery library (conrad-goetz.com): loaded from the content delivery network code.jquery.com (OpenJS Foundation). In doing so, your IP address is transmitted to its servers, including to the USA (Article 6(1)(f) GDPR, interest: fast and stable display of the website).
- Links to social networks are simple links. Data is only transmitted once you click the link.
12. Automated Decisions
We do not carry out any automated individual decision-making within the meaning of Article 22 GDPR. Regarding the creditworthiness check by Klarna, see Section 6.
13. Changes
We adapt this policy where our websites or the legal situation change. The version published here at any given time applies.