Last updated: November 2026
1. Controller
The controller responsible for the processing of personal data on this website and in our online shop is:
UPRAIL GmbH (People’s Store)
Richard-Byrd-Straße 12
50829 Cologne
Germany
Managing Directors: Bahar Bayrak, Harry Schmid
Phone: +49 (0)221 500057-20
E-mail: mail@uprail.de
If you have any questions about data protection or would like to exercise your rights, please contact us at the address above or by e-mail.
2. Overview and legal bases
We process personal data in particular to operate our online shop, to process orders, payments, withdrawals and returns, to communicate with you, to display product reviews and – with your consent – to send newsletters, to analyse the use of our website and to show advertising.
We process personal data on the following legal bases:
- Consent (Art. 6(1)(a) GDPR), e.g. for the newsletter, review requests and optional cookies. Where information is stored on or read from your device, this is also based on § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You can withdraw your consent at any time with effect for the future.
- Performance of a contract and pre-contractual measures (Art. 6(1)(b) GDPR), e.g. to process and deliver your order.
- Legal obligation (Art. 6(1)(c) GDPR), e.g. retention obligations under commercial and tax law and the handling of withdrawals.
- Legitimate interests (Art. 6(1)(f) GDPR), e.g. the secure and efficient operation of our shop, the prevention of fraud and the assertion or defence of legal claims. Technically necessary access to information on your device is based on § 25(2) No. 2 TDDDG.
Obligation to provide data: The data marked as mandatory in the checkout are required for the conclusion and performance of the contract. Without them we cannot process your order. Otherwise, providing data is voluntary.
3. Shop platform and hosting (Shopify)
Our online shop runs on the e-commerce platform Shopify. For merchants in Europe, the service provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). Shopify hosts our shop and processes on our behalf the data required to operate it, e.g. contact, order, payment and shipping data as well as technical data (IP address, date and time of access, pages visited, browser type, operating system and referrer URL). We have concluded a data processing agreement with Shopify (Art. 28 GDPR). The legal bases are Art. 6(1)(b) GDPR and our legitimate interest in the secure, stable and efficient operation of our shop (Art. 6(1)(f) GDPR).
Shopify may transfer data to Shopify Inc. in Canada as well as to other Shopify group companies and sub-processors in third countries (e.g. the USA). Transfers to Canada are based on the European Commission’s adequacy decision for Canada; transfers to other Shopify companies and sub-processors are based on Shopify’s Binding Corporate Rules or the EU Standard Contractual Clauses.
For certain services – e.g. if you use the Shop app or Shop Pay, or for certain analysis and marketing features of Shopify – Shopify processes personal data under its own responsibility. You can find more information in the Shopify Consumer Privacy Policy. You can exercise your rights vis-à-vis Shopify via the Shopify Privacy Portal.
4. Orders, customer account and contact
Orders: When you place an order, we process the data required for the conclusion and performance of the contract, in particular your name, billing and delivery address, e-mail address, telephone number (if provided), the items ordered, payment and shipping information and your communication with us (Art. 6(1)(b) GDPR). We retain these data in accordance with the statutory retention periods (Art. 6(1)(c) GDPR, see section 14).
Customer account: You can create a customer account on a voluntary basis. We then store the data you provide and your orders so that you can view them in your account (Art. 6(1)(b) GDPR). You can request the deletion of your customer account at any time, unless statutory retention obligations prevent this.
Contact: If you contact us by e-mail, telephone, contact form or WhatsApp (see section 10), we process your details in order to handle your request (Art. 6(1)(b) GDPR if your request relates to a contract, otherwise Art. 6(1)(f) GDPR).
5. Withdrawal and returns
If you declare a withdrawal – e.g. via our online withdrawal function, by e-mail or by letter – we process your name, the information identifying the contract (e.g. order number), the contact details you provide for the acknowledgement of receipt (e.g. e-mail address), the content of your declaration and the date and time of its receipt. We use these data to process the withdrawal and the return and to send you the acknowledgement of receipt required by law (Art. 6(1)(b) and (c) GDPR).
6. Shipping
To deliver your order, we pass on your name, your delivery address and – where necessary for the delivery – your telephone number to the shipping company commissioned by us (DHL, UPS or, for bulky goods such as bikes, a freight forwarder, e.g. DACHSER) (Art. 6(1)(b) GDPR). We only pass on your e-mail address to the parcel service for delivery notifications if you have consented to this (Art. 6(1)(a) GDPR); you can withdraw this consent at any time with effect for the future. If you choose Pickup, no data are passed on to shipping companies.
7. Payment
Depending on the payment method you choose, we pass on the data required for the payment (e.g. name, address, e-mail address, order amount and order details) to the respective payment service provider (Art. 6(1)(b) GDPR). The payment service providers process your data partly under their own responsibility, in particular to comply with legal obligations (e.g. anti-money laundering rules) and to prevent fraud. We do not receive your full card details.
- PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. For certain payment methods offered via PayPal (e.g. payment in instalments or later payment), PayPal may carry out a credit check. Details can be found in PayPal’s privacy statement.
- Credit card, Apple Pay and Google Pay: These payments are processed via Shopify Payments, Shopify’s payment service. The payment data are processed by the payment processors used by Shopify Payments (currently Stripe Payments Europe, Limited, Ireland; Adyen N.V., Netherlands; PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). If you use Apple Pay or Google Pay, Apple or Google also process data in accordance with their own privacy policies.
- Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. If you choose a Klarna payment option, we pass on your contact and order data to Klarna. Klarna uses these data under its own responsibility to check your identity and creditworthiness – in some cases by means of automated decisions – and to decide whether it can offer you the selected payment option. Details can be found in Klarna’s privacy notice.
- Prepayment (bank transfer): Your payment is processed by your bank and our bank (Sparkasse KölnBonn). We process the payment information we receive (e.g. name, IBAN, amount and payment reference) in order to allocate your payment.
- Cash payment on pickup in our store in Cologne: If you pay in cash when you collect your order, no payment data are passed on to a payment service provider.
Fraud prevention: To protect against payment fraud, orders are checked for indications of fraud using Shopify’s fraud analysis (Art. 6(1)(f) GDPR; our legitimate interest is the prevention of losses due to fraud).
8. Newsletter and notifications
Newsletter: If you subscribe to our newsletter (e.g. via a sign-up form or in the checkout), we use your e-mail address and, where provided, your name to send you information about products, offers and news from our shop. We only send the newsletter with your consent (Art. 6(1)(a) GDPR). To confirm your subscription, you will receive a confirmation e-mail (double opt-in). We store the time of your subscription and confirmation as proof of your consent (Art. 6(1)(f) GDPR). The newsletter is sent via Shopify Email; sign-up forms are provided via Shopify Forms (both services of Shopify, see section 3). Shopify Email may record whether a newsletter is opened and which links are clicked, so that we can evaluate the reach of our newsletter. You can unsubscribe at any time via the link in every newsletter or by sending us a message; the lawfulness of the processing carried out until then remains unaffected.
Back-in-stock and pre-order notifications: If you ask to be notified when a product is available again, or about your pre-order, we process your e-mail address and the product concerned in order to send you this notification (Art. 6(1)(a) GDPR; for pre-orders Art. 6(1)(b) GDPR). For this purpose we use a Shopify app for back-in-stock notifications and pre-orders, whose provider processes the data on our behalf. You can withdraw your consent at any time.
9. Product reviews (Judge.me)
For product and shop reviews we use the service Judge.me, provided by Judge.me Ltd, 2nd Floor, 1–3 Worship Street, London EC2A 2AB, United Kingdom, which processes data on our behalf (Art. 28 GDPR). If you submit a review, we publish it together with your rating, the name you have entered and, where applicable, the note “verified buyer” (Art. 6(1)(a) GDPR). We only send you an e-mail asking you to review your purchase if you have consented to this (Art. 6(1)(a) GDPR). When our pages are loaded, the review widget is loaded from Judge.me’s servers, whereby your IP address is transmitted to Judge.me (Art. 6(1)(f) GDPR; our legitimate interest is the presentation of customer reviews).
Transfers to the United Kingdom are based on the European Commission’s adequacy decision for the United Kingdom. Judge.me uses service providers in the USA (e.g. for hosting); for this, Judge.me uses the EU Standard Contractual Clauses.
10. WhatsApp and social media
WhatsApp: Our website contains a WhatsApp chat button. Data are only transmitted to WhatsApp when you click on this button. WhatsApp is operated in Europe by WhatsApp Ireland Limited, Dublin, Ireland. If you contact us via WhatsApp, WhatsApp processes your telephone number, your messages and other data under its own responsibility; data may also be transferred to the USA (Meta is certified under the EU-US Data Privacy Framework). We process the messages you send us in order to handle your request (Art. 6(1)(b) or (f) GDPR). If you do not want this, please contact us by e-mail or telephone instead.
Social media profiles: We maintain profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). Our website contains links to these profiles; data are only transmitted to Meta when you click on such a link. When you visit our profiles, Meta processes your data under its own responsibility. For the statistics that Meta provides to us about the use of our profiles (“Insights”), we are jointly responsible with Meta (Art. 26 GDPR); under the agreement with us, Meta has assumed primary responsibility for this processing. Further information can be found in Meta’s privacy policy.
11. Cookies and consent management
We use cookies and similar technologies (e.g. local storage and pixels). Some of them are technically necessary to provide our shop (e.g. shopping cart, checkout, login, security and storing your consent settings); these are used on the basis of § 25(2) No. 2 TDDDG and Art. 6(1)(b) and (f) GDPR. All other cookies and technologies – for analytics, personalisation and marketing – are only used with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).
When you first visit our shop, our cookie banner asks for your consent. You can accept or decline all categories or select individual categories (“Required”, “Analytics”, “Personalization”, “Marketing”) via “Manage preferences”. You can change or withdraw your consent at any time with effect for the future via the cookie settings. If you consent to marketing cookies, we and our partners, including Shopify, may use information about your use of our shop to show you personalised advertising, including on other websites. Information on the cookies used by Shopify can be found in Shopify’s cookie policy.
Google Analytics: If you have consented to analytics cookies, we use Google Analytics, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), to analyse the use of our shop (e.g. pages visited, time spent, device and browser information and approximate location) and to improve our offer (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google Analytics 4 does not store IP addresses. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. You can withdraw your consent at any time via the cookie settings.
YouTube videos: Our website may contain embedded YouTube videos (provider: Google Ireland Limited, address as above). Embedded videos are only loaded – and data such as your IP address and device information only transmitted to YouTube/Google – after you have given your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). If you are logged in to YouTube, YouTube can associate your viewing behaviour with your account; you can prevent this by logging out beforehand.
12. Other recipients
In addition to the service providers named above, we use further Shopify apps that extend the functionality of our shop (e.g. for product bundles); where these apps process personal data, they do so on our behalf. Where necessary, we also pass on data to professional advisers who are bound to secrecy (e.g. tax advisers) and, where we are legally obliged to do so, to public authorities.
13. Transfers to third countries
Some of the service providers named above are located in countries outside the EU/EEA (Canada, the United Kingdom, the USA) or transfer data there. We only allow such transfers if the European Commission has adopted an adequacy decision for the country concerned (e.g. Canada, the United Kingdom, and the USA for companies certified under the EU-US Data Privacy Framework) or if appropriate safeguards are in place, in particular the EU Standard Contractual Clauses or Binding Corporate Rules.
14. Storage period
We delete personal data as soon as they are no longer required for the purposes for which they were collected, unless statutory retention obligations require longer storage. Under German commercial and tax law, we retain books and records for 10 years, accounting vouchers such as invoices for 8 years and commercial letters for 6 years (§ 257 HGB, § 147 AO); these periods begin at the end of the calendar year. Data of your customer account are stored until you delete the account. Newsletter data are stored until you unsubscribe; we may keep the proof of your consent for up to three years thereafter. Data required for the assertion or defence of legal claims are stored until the claims become time-barred.
15. Your rights
You have the right to:
- access your personal data (Art. 15 GDPR);
- have inaccurate data rectified (Art. 16 GDPR);
- have your data erased (Art. 17 GDPR);
- have the processing restricted (Art. 18 GDPR);
- receive your data in a structured, commonly used and machine-readable format (data portability, Art. 20 GDPR);
- withdraw your consent at any time with effect for the future (Art. 7(3) GDPR);
- lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. Where your data are processed for direct marketing purposes, you can object at any time without giving reasons; we will then no longer process your data for this purpose.
To exercise your rights, simply contact us at mail@uprail.de.
Customers in Switzerland: The Swiss Federal Act on Data Protection (FADP) also applies. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).
16. Automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. When checking creditworthiness, Klarna may make automated decisions under its own responsibility (see section 7).
17. Data security
Our website uses SSL/TLS encryption. Please note that data transmission over the internet (e.g. by unencrypted e-mail) may have security gaps.
18. Changes to this privacy policy
We will update this privacy policy if our data processing or the legal requirements change. The current version is always available on this page.
