Privacy Policy

Last updated: 5 October 2026

1. Controller

The controller for data processing on this website is:

Just Good Things Retail GmbH
Kaiserswerther Str. 215
40474 Düsseldorf
Germany
E-mail: hello@wauwow.store
Managing Director: Marc Schiefelbusch
Amtsgericht Düsseldorf (Düsseldorf Local Court), HRB 107246
VAT ID no.: DE454568832

2. Hosting and shop system (Shopify)

Our shop runs on the e-commerce platform Shopify, a service of Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify processes on our behalf all data that arises when you visit the shop and place orders (Art. 28 GDPR, data processing agreement). Data may also be transferred to Shopify Inc. in Canada and to Shopify service providers in the USA. For Canada there is an adequacy decision of the EU Commission; transfers to the USA are based on the EU-U.S. Data Privacy Framework or on EU standard contractual clauses.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in a secure, stable shop operation).

3. Server log data

When the website is accessed, information is recorded automatically (IP address, date and time, page accessed, browser type, operating system, referrer URL). This data is technically necessary in order to display the website and to ensure stability and security (Art. 6(1)(f) GDPR). It is not merged with other data sources.

4. Cookies and consent

This website uses technically necessary cookies that are required to operate the shop (e.g. cart, checkout) (§ 25 Abs. 2 TDDDG, German Telecommunications Digital Services Data Protection Act; Art. 6(1)(f) GDPR). This includes a cookie that attributes partner referrals (wauwow_ref, 90 days): it is only set when you enter the shop through a partner's personal referral link and serves solely to attribute that referral to your order. It contains only the partner's identifier. All non-essential cookies — for statistics or marketing, for example — are only set with your express consent via the cookie banner (§ 25 Abs. 1 TDDDG; Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future via the cookie settings. Sections 11 to 14 describe the services we use with your consent.

5. Orders and customer account

In order to process your order we process the data you provide (name, address, e-mail address, chosen payment method, items ordered) on the basis of Art. 6(1)(b) GDPR. We pass your delivery address and — where required for delivery — your e-mail address on to shipping service providers. Payment data is collected and processed directly by the respective payment service provider; we do not receive complete payment data.

If you create a customer account, we store your data until the account is deleted. You can have a customer account deleted at any time.

6. Payment service providers

Depending on the payment method you choose, we pass the data required for payment to the respective payment service provider. This includes in particular PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg) and Klarna (Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden), as well as the providers of card payments and of the wallets Apple Pay, Google Pay and Shop Pay. The payment service providers process the data under their own privacy notices. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

7. Contacting us

If you contact us by e-mail, we process the details you provide in order to handle your enquiry (Art. 6(1)(b) or (f) GDPR). We do not pass this data on without your consent. For phone calls, section 8 also applies.

8. Phone support with an AI assistant

When you call our phone hotline, an AI-based voice assistant answers the call first. We process your phone number, the time and duration of the call, the content of the conversation as a recording and as text, and any details you give us yourself, such as your name, order number or request. We receive a log by email with a summary, a transcript and a link to the recording, so that we can handle your request and call you back if needed.

We use service providers for this: Sipgate GmbH (Düsseldorf) for telephony, Vapi to run the voice assistant, OpenAI for the language model, ElevenLabs for speech output, Soniox for speech recognition, and a server operated by us to send the log. Several of these providers are based in the USA. Transfers rely on appropriate safeguards under Art. 46 GDPR, in particular EU standard contractual clauses or certification under the EU-U.S. Data Privacy Framework.

The legal basis is Art. 6(1)(b) GDPR (handling your request) and, where the call is recorded, your consent (Art. 6(1)(a) GDPR). You can object to the recording at any time by writing to hello@wauwow.store. On request, a member of our team will call you back.

9. Storage period

We store personal data only for as long as is necessary for the purposes stated. Retention periods under commercial and tax law (6 to 10 years) remain unaffected; once these periods expire, the data is deleted.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing based on legitimate interests under Art. 21 GDPR; consent you have given can be withdrawn at any time with effect for the future. To do so, please contact hello@wauwow.store.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (the North Rhine-Westphalia State Commissioner for Data Protection and Freedom of Information), Kavalleriestraße 2-4, 40213 Düsseldorf.

11. Newsletter (Klaviyo)

For our newsletter we use the service Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA). When you sign up, we process your e-mail address as well as information about your orders and your use of the shop (such as products viewed or checkouts started) in order to send you our newsletter and product-related e-mails. The legal basis is your consent (Art. 6(1)(a) GDPR); you confirm your sign-up by double opt-in. You can unsubscribe at any time via the link in every e-mail. Klaviyo also processes data in the USA; the transfer is based on Klaviyo’s certification under the EU-U.S. Data Privacy Framework and on a data processing agreement pursuant to Art. 28 GDPR.

12. Meta pixel (Facebook and Instagram)

If you have given your consent via the cookie banner (Art. 6(1)(a) GDPR, § 25 Abs. 1 TDDDG), we use the Meta pixel of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) in order to measure the effectiveness of our ads on Facebook and Instagram and to show you relevant ads. Events such as page views, cart actions and purchases are transmitted to Meta; for this collection we are joint controllers with Meta (Art. 26 GDPR). Data may also be transferred to the USA; Meta is certified under the EU-U.S. Data Privacy Framework. Without your consent the pixel remains completely deactivated. You can withdraw your consent at any time via the cookie settings.

13. Google Analytics, Google Ads and Google tag

If you have consented via the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), we use Google Analytics 4, Google Ads and the Google tag of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). We use them to measure how our shop is used (page views, cart actions, purchases) and how well our ads perform on Google, and to build audiences for advertising. Cookies (including _ga and _gcl_au) are set and data such as IP address, device, browser and behaviour in the shop is sent to Google, including to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time in the cookie settings.

14. Microsoft Clarity (usage analysis)

If you have consented via the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), we use Microsoft Clarity of Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to understand how visitors use our shop. Pseudonymous identifiers as well as clicks, mouse movements and scrolling are recorded, which can result in recordings and heatmaps. Clarity masks sensitive input in form fields by default. Cookies (including _clck, _clsk and MUID) may be set and data may be sent to Microsoft Corporation in the USA. Microsoft is certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time in the cookie settings.

15. Use of artificial intelligence

On our phone hotline, an AI-based voice assistant answers calls, see section 8. It does not make decisions about you that have legal effect. Some atmosphere and illustration images on this website are created with the help of AI. Product images always show the actual item.