PRIVACY POLICY – August 2026

Data Protection Contact:

Christian Kernchen e.K.
Joergstr. 31 | D-80689 Munich | Germany

Tel.: +49 89 289 747 35
Fax: +49 89 289 747 36

Email: privacy@froosty.ai
Website: froosty.ai

Registry Court: Amtsgericht München
Registration Number: HRA 96743

1) INFORMATION ABOUT THE COLLECTION OF PERSONAL DATA AND THE CONTROLLER

1.1 This Privacy Policy explains how personal data is processed when you visit froosty.ai, use our online shop, place an order, submit a form, subscribe to marketing communications or otherwise interact with FROOSTY®. Personal data means any information relating to an identified or identifiable natural person.

1.2 The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (“GDPR”) is:

Christian Kernchen e.K.
Joergstr. 31
80689 Munich
Germany

Tel.: +49 89 289 747 35
Fax: +49 89 289 747 36
Email: contact@froosty.ai

1.3 Questions and requests relating specifically to data protection may be sent to privacy@froosty.ai.

1.4 For security reasons and to protect the transmission of personal data and other confidential content, including orders, enquiries and withdrawal declarations, this website uses SSL or TLS encryption. An encrypted connection can generally be recognised by “https://” in the address bar and the lock symbol displayed by the browser.

2) DATA PROCESSING WHEN VISITING OUR WEBSITE

When you use our website for informational purposes, technical data transmitted by your browser may be processed by our systems and the technical service providers used to operate the website. This data is required to display the website, establish a connection and maintain the security, stability and proper technical operation of the online shop.

The data processed may include:

the page or file accessed;
the date and time of access;
the amount of data transferred;
the referring page or source;
browser type and browser version;
operating system and device information;
IP address;
language and regional settings;
technical connection, security, error and log data.

Processing is carried out on the basis of our legitimate interest in the secure, stable and functional operation of our website pursuant to Article 6(1)(f) GDPR. Where processing is necessary to fulfil legal obligations, Article 6(1)(c) GDPR applies. Log data may also be processed to investigate misuse, security incidents, fraudulent activity or unlawful access.

3) SHOPIFY – HOSTING AND SHOP INFRASTRUCTURE

We use the ecommerce platform, hosting services and technical shop infrastructure provided by Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).

Shopify provides essential functions required to operate and display our online shop, including hosting, storefront delivery, checkout, customer accounts, order processing, security, technical forms, shop analytics and associated ecommerce functions. Personal data collected through our online shop may therefore be processed on Shopify systems and by Shopify affiliates and authorised subprocessors.

Depending on the respective processing activity, processing is carried out for the performance of a contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR, compliance with legal obligations pursuant to Article 6(1)(c) GDPR, our legitimate interest in operating a secure, efficient and reliable online shop pursuant to Article 6(1)(f) GDPR or, where required, on the basis of consent pursuant to Article 6(1)(a) GDPR.

For the core services provided to us, Shopify generally processes customer personal data as our processor. For certain Shopify consumer services or enhanced services, such as Shop, Shop Pay or Shopify Network Intelligence where enabled, Shopify may process personal data as an independent controller in accordance with its applicable terms and privacy information.

Where Shopify services involve analytics, personalisation, advertising or the use of non-essential cookies and comparable technologies, such processing is permitted only to the extent that the applicable legal requirements, including any consent requirements, are fulfilled.

Further information is available in the Shopify Privacy Policy, the Shopify Consumer Privacy Policy and the Shopify Data Processing Addendum.

4) COOKIES, SIMILAR TECHNOLOGIES AND CONSENT MANAGEMENT

Our website uses cookies and comparable technologies. Cookies are small data files that may be stored on your device. Session cookies are normally deleted when the browser is closed. Persistent cookies may remain stored for a specified period and may save settings, technical preferences or consent decisions.

The storage of information on your terminal device or access to information already stored on your terminal device is governed, where applicable, by Section 25 of the German Telecommunications Digital Services Data Protection Act (“TDDDG”).

Technologies that are strictly necessary to provide a digital service expressly requested by you or that are required solely for the transmission of a communication may be used without consent where the requirements of Section 25(2) TDDDG are fulfilled.

Cookies and comparable technologies that are not strictly necessary are used only after the legally required consent has been obtained pursuant to Section 25(1) TDDDG. Where personal data is processed on the basis of this consent, Article 6(1)(a) GDPR applies.

The legal basis under the GDPR for processing connected with technically necessary technologies depends on the respective purpose and may in particular be Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.

Where a cookie banner or cookie preference function is provided, you can use it to grant, refuse or change your consent choices. Consent may be withdrawn at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You may also configure your browser to notify you about cookies, restrict their acceptance or delete stored cookies. Disabling technically necessary functions may restrict the functionality of the website.

5) SHOP ANALYTICS AND GOOGLE ANALYTICS

We use technical shop statistics provided through Shopify and, subject to the required consent, Google Analytics 4 to understand how visitors use our website, measure website performance, identify technical problems and improve the structure and content of the online shop.

Shopify analytics functions may process information about page views, browser sessions, device and browser characteristics, approximate location derived from the IP address, referring pages, search activity, product views, cart events, checkout events, purchases and other interactions with the online shop.

Where analytics processing is strictly necessary for the security and technical operation of the shop, processing may be based on Article 6(1)(f) GDPR. Non-essential analytics and any associated storage of or access to information on the terminal device are based on consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.

We also use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics may process data such as page views, session and event data, browser and device information, referring pages, approximate location, interaction data and technical identifiers.

Google Analytics is used only on the basis of your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future through the cookie preference function provided on the website.

Data may also be processed by Google affiliates and service providers outside the European Economic Area. Such transfers are subject to the requirements described in Section 18 of this Privacy Policy.

Further information is available in the Google Privacy Policy and in Google’s information on data and privacy in Google Analytics. Google also provides a Google Analytics opt-out browser add-on.

6) MINTT INSTAFEED AND INSTAGRAM CONTENT

Where Instagram content is displayed on our website, we use the Mintt Instafeed service provided by Mintt Studio, Rua Parque da Republica 116, 4430-164 Vila Nova de Gaia, Portugal.

When a page containing an Instagram feed is accessed, technical requests may be sent to Mintt Studio infrastructure in order to deliver the feed. This may involve processing technical data such as the IP address, browser and device information, the requested page and the date and time of access.

Displaying Instagram content may also cause the browser to request content from Instagram or other services provided by Meta. In this case, Meta may receive technical connection data and process it under its own responsibility.

Processing required solely for the technical delivery of the feed is based on our legitimate interest in presenting our artistic work and social media content on our website pursuant to Article 6(1)(f) GDPR. Where optional usage measurement, tracking, cookies or comparable technologies are used, processing is carried out only on the basis of the required consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.

Further information is available in the Mintt Studio Privacy Policy and the Meta Privacy Policy.

7) CUSTOMER ACCOUNTS, ORDERS AND CONTRACT PROCESSING

If you place an order, create or use a customer account, use checkout functions, request delivery or otherwise provide information for the conclusion or performance of a contract, we process the personal data required to administer the contractual relationship.

This may include your name, billing address, delivery address, email address, telephone number, customer account data, order data, product data, invoice data, payment status, delivery data, communication data and other information required to process the respective order.

Processing is carried out for the performance of a contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR. Where processing is necessary to comply with tax, commercial, accounting or documentation obligations, Article 6(1)(c) GDPR applies. Processing required for proper administration, security, fraud prevention and the assertion, exercise or defence of legal claims is based on Article 6(1)(f) GDPR.

Account and order data is stored for as long as necessary for the contractual relationship and thereafter in accordance with applicable statutory retention and limitation periods.

8) PAYMENT PROCESSING

Depending on the payment method selected during checkout, the data required for payment processing may be transmitted to Shopify, the relevant payment service provider, bank, card issuer, payment processor or payment platform.

The data processed may include your name, billing address, email address, order amount, currency, transaction data, payment method, payment status and information required for authentication, fraud prevention, chargeback handling and legal documentation.

Processing is carried out for the performance of a contract pursuant to Article 6(1)(b) GDPR, compliance with legal obligations pursuant to Article 6(1)(c) GDPR and, where applicable, our legitimate interest in secure, reliable and fraud-resistant payment processing pursuant to Article 6(1)(f) GDPR.

We do not generally receive or store complete payment-card credentials. The respective payment service provider may process data under its own responsibility and in accordance with the privacy information displayed during checkout or on its website.

9) DELIVERY, SHIPPING AND FULFILMENT

Where goods are delivered, the personal data necessary for delivery may be transmitted to the selected shipping service provider, logistics partner, fulfilment service provider or other delivery partner.

This may include your name, delivery address, email address, telephone number, order number, shipment data, tracking data and information required for delivery, shipment notifications or the handling of delivery problems.

Processing is carried out for the performance of a contract pursuant to Article 6(1)(b) GDPR and, where applicable, on the basis of our legitimate interest in reliable shipment processing, tracking, customer communication and proper documentation pursuant to Article 6(1)(f) GDPR.

10) CONTACT, ENQUIRIES AND COMMUNICATION

If you contact us by email, contact form, telephone or other means, we process the information you provide in order to receive, review and respond to your enquiry.

This may include your name, email address, telephone number, message content, order references, attachments, communication history and other information voluntarily provided by you.

Where your enquiry relates to a contract or pre-contractual measures, processing is carried out pursuant to Article 6(1)(b) GDPR. In other cases, processing is based on our legitimate interest in properly responding to enquiries, documenting communication and managing our business communications pursuant to Article 6(1)(f) GDPR. Article 6(1)(c) GDPR applies where processing is required by law.

Communication data is retained for as long as necessary to process the enquiry and thereafter only where statutory retention requirements or legitimate interests in documentation and legal defence require further storage.

11) ELECTRONIC WITHDRAWAL FUNCTION

We provide an electronic withdrawal function at Withdraw from contract.

If you use this function, we process the personal data required to receive, identify, document, confirm and process your withdrawal declaration.

This may include your name, email address or other electronic contact details, order number, information identifying the affected contract or items, the content of the withdrawal declaration, the date and time of receipt, technical submission data and subsequent communication.

Processing is carried out for the performance and reversal of a contract pursuant to Article 6(1)(b) GDPR, compliance with legal obligations concerning consumer rights, confirmation of receipt and documentation pursuant to Article 6(1)(c) GDPR and, where applicable, our legitimate interest in proper documentation, fraud prevention and legal defence pursuant to Article 6(1)(f) GDPR.

The legally required confirmation of receipt may contain the content of the withdrawal declaration and the date and time of receipt. This confirmation documents receipt of the declaration but does not itself constitute a final legal assessment of its validity, timeliness or scope.

12) SHOPIFY FORMS AND TECHNICAL FORM SERVICES

We use Shopify Forms and associated Shopify functions where electronic forms are provided on our website, including for withdrawal declarations and selected contact or enquiry functions.

Depending on the form, the data processed may include your name, email address, order number, message content, form submission, timestamps, technical metadata and other information entered voluntarily.

Depending on the purpose of the form, processing is carried out pursuant to Article 6(1)(b), Article 6(1)(c), Article 6(1)(f) or, where consent is required, Article 6(1)(a) GDPR.

Shopify processes this data in accordance with the applicable contractual and data protection arrangements. Further information is available in the Shopify Privacy Policy.

13) TRANSACTIONAL EMAILS AND TECHNICAL NOTIFICATIONS

Shopify and, where required for the respective process, other technical email or messaging providers may be used to send order confirmations, payment and shipping information, withdrawal confirmations, customer-service messages, internal notifications and other operational communications.

The data processed may include your name, email address, order number, form or message content, timestamps, delivery status and technical email metadata.

Processing is carried out for the performance of a contract pursuant to Article 6(1)(b) GDPR, compliance with legal obligations pursuant to Article 6(1)(c) GDPR and our legitimate interest in secure, reliable and documented business communication pursuant to Article 6(1)(f) GDPR.

Transactional and legally required communications are not marketing emails. They may be sent independently of any newsletter subscription where they are necessary to process a contract, provide a requested service or fulfil a legal obligation.

14) COLLECTOR’S EDITIONS AND INDIVIDUAL ENQUIRIES

If you use an enquiry form or contact option for a Collector’s Edition, limited artwork, special edition or individual request, we process the data submitted in order to receive, review and respond to the enquiry.

This may include your name, email address, telephone number, country, requested artwork or edition, product reference, message content, enquiry details and subsequent communication.

Processing is carried out for pre-contractual measures pursuant to Article 6(1)(b) GDPR and, where applicable, on the basis of our legitimate interest in responding to enquiries, documenting communication and managing prospective customer relationships pursuant to Article 6(1)(f) GDPR.

15) OMNISEND, NEWSLETTER AND EMAIL MARKETING

We use services provided by UAB Omnisend, Verkių g. 25C-1, LT-08223 Vilnius, Lithuania (“Omnisend”) for newsletter and email-marketing functions and associated technical administration.

If you subscribe to marketing communications, the data processed may include your email address, name where provided, subscription and consent status, registration and confirmation timestamps, IP address, language, marketing preferences, delivery status and communication data.

Marketing emails are sent on the basis of your consent pursuant to Article 6(1)(a) GDPR unless another statutory legal basis expressly permits the communication. Registration and consent data may be retained to demonstrate that legally valid consent was obtained.

Where individual opening, click or usage behaviour is measured or marketing profiles and segments are created, such processing and any associated access to the terminal device are carried out only on the basis of the required consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link contained in a marketing email or by contacting privacy@froosty.ai.

Omnisend processes customer data as a service provider in accordance with the applicable contractual arrangements. Further information is available in the Omnisend Privacy Policy and the Omnisend Data Processing Agreement.

16) SECURITY, ABUSE PREVENTION AND LEGAL DEFENCE

We may process personal data, technical data, communication data, transaction data and documentation data where necessary to protect our website, systems, customers, rights and business operations against misuse, fraud, unlawful access, spam, security incidents, contractual breaches or other unlawful conduct.

Processing is based on our legitimate interest in secure and lawful business operations, IT security, fraud and abuse prevention, documentation and the assertion, exercise or defence of legal claims pursuant to Article 6(1)(f) GDPR. Where legal obligations apply, processing may also be carried out pursuant to Article 6(1)(c) GDPR.

17) RECIPIENTS, CATEGORIES OF RECIPIENTS AND DATA SOURCES

Personal data may be disclosed to service providers and other recipients where this is necessary for the respective processing purpose.

Recipients may include Shopify and its authorised subprocessors, payment service providers, banks and card issuers, shipping and logistics providers, fulfilment partners, email and communication providers, form services, IT and security providers, analytics and marketing providers used in accordance with the law, tax advisers, accounting providers, legal advisers, public authorities and other recipients legally entitled to receive the data.

Data is disclosed only to the extent necessary and on the basis of an applicable legal basis. Where a recipient processes personal data on our behalf, an appropriate data-processing agreement or another legally required arrangement is used.

Personal data is generally obtained directly from you or collected through your use of the website. Where data is not obtained directly from you, it may originate from Shopify, payment providers, shipping providers, communication providers or other parties involved in processing your order or enquiry. This may include payment status, delivery status, fraud or security indicators and technical transaction information.

18) TRANSFERS TO THIRD COUNTRIES

Some service providers, affiliated companies or subprocessors used in connection with our online shop may be located outside the European Economic Area or may process personal data in countries outside the European Economic Area.

Such transfers are carried out only where the requirements of Chapter V GDPR are fulfilled. Depending on the recipient and destination country, the transfer may be based on an adequacy decision of the European Commission, approved standard contractual clauses, binding corporate rules or another legally recognised safeguard. Where necessary, supplementary technical, contractual or organisational measures are implemented.

Where a recipient in the United States is certified under the EU-U.S. Data Privacy Framework and the adequacy decision applies to the respective transfer, the transfer may be based on that adequacy decision. Otherwise, approved standard contractual clauses or another legally recognised transfer mechanism may be used.

Information about the safeguards applicable to a particular transfer and, where legally required, a copy of the relevant safeguards may be requested at privacy@froosty.ai. Legally protected or confidential information may be redacted where necessary.

19) STORAGE PERIODS AND DELETION

Personal data is stored only for as long as necessary for the respective processing purpose or as required by statutory retention periods, documentation obligations or legitimate interests in the assertion, exercise or defence of legal claims.

The applicable period depends on the type of data, the processing purpose, the legal basis and any commercial, tax, accounting, consumer-protection or limitation requirements.

Once the processing purpose has ceased to apply and no statutory or other lawful reason for continued storage exists, the data is deleted or anonymised. Where immediate deletion is not possible, processing is restricted until deletion becomes permissible.

20) OBLIGATION TO PROVIDE DATA AND AUTOMATED DECISION-MAKING

You are not legally or contractually required to provide personal data merely in order to visit our website for informational purposes.

Data marked as mandatory during checkout, account registration, payment, delivery or the use of a legally required function is necessary for the conclusion or performance of the contract, fulfilment of legal obligations or provision of the requested function. Without this data, we may be unable to conclude or perform the contract, process the payment, deliver the order or respond to the respective request.

Information not marked as mandatory is generally provided voluntarily. Newsletter registration and marketing consent are voluntary and are not required to place an order.

Unless separately disclosed in a specific case, we do not carry out solely automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

Payment service providers and fraud-prevention providers may perform automated security, identity, payment or fraud checks under their own responsibility. Information about such processing and any associated rights is provided by the respective provider.

Consent-based analytics or marketing functions may involve evaluating interaction data and assigning users to statistical or marketing segments. Such processing is not used by us to make decisions that produce legal or similarly significant effects within the meaning of Article 22 GDPR.

21) YOUR RIGHTS AS A DATA SUBJECT

Subject to the applicable statutory requirements, you have the following rights:

the right of access pursuant to Article 15 GDPR;
the right to rectification pursuant to Article 16 GDPR;
the right to erasure pursuant to Article 17 GDPR;
the right to restriction of processing pursuant to Article 18 GDPR;
the right to be informed pursuant to Article 19 GDPR;
the right to data portability pursuant to Article 20 GDPR;
the right to object pursuant to Article 21 GDPR;
the right to withdraw consent pursuant to Article 7(3) GDPR;
the rights relating to automated decisions pursuant to Article 22 GDPR, where applicable;
the right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

RIGHT TO OBJECT: Where personal data is processed on the basis of Article 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object to such processing at any time. Where personal data is processed for direct-marketing purposes, you have the right to object at any time to processing for such marketing, including related profiling.

To exercise your rights, please contact us using the contact details provided in Section 1, preferably by email to privacy@froosty.ai.

You also have the right to lodge a complaint with a competent supervisory authority. The supervisory authority responsible for our registered office is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany

Website: www.lda.bayern.de

22) CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy where necessary to reflect changes in our processing activities, services, technical systems or legal requirements.

The current version is available on froosty.ai. The date shown at the beginning of this Privacy Policy indicates the version currently published.