Privacy policy

Last updated: 5 October 2026

Who we are and how to contact us

Sixfab GmbH, Berliner Straße 143, 10715 Berlin, Germany, operates eu.sixfab.com and is the controller of personal data processed for this store. This policy covers our hardware store, customer accounts, purchases, support and marketing. Separate services you obtain from another provider are covered by that provider's privacy notice.

For privacy questions, complaints or requests concerning your personal data, email [email protected], telephone +49 30 54448434, or write to the address above. For ordinary order and product support, use our contact form. You do not have to use a form to exercise your privacy rights.

Personal information we collect

Depending on your interaction with us, we process:

• Contact and business details, including name, email, telephone, company, billing and delivery addresses, and relevant VAT information.
• Orders, products purchased or placed in a cart, payment and refund status, transaction references, deliveries and returns.
• Account identifiers, authentication information and preferences.
• Correspondence and information you provide when requesting support.
• IP address, browser and device information, security logs, cookie identifiers and website activity.
• Marketing subscriptions, consent choices and information used for consented analytics or marketing.

Information comes from you, your use of the store, and providers handling payments, authentication, delivery and related services. For business purchases, your employer or an authorised colleague may supply contact and order details.

Shopify Payments and its payment partners collect payment credentials. Our order records contain payment status and limited transaction information; full card data and payment credentials are not supplied to Sixfab, Inc. as part of its operational processing for us.

We need the information identified as required at checkout to process and deliver your order. Without it, we may be unable to fulfil the purchase. Optional marketing and tracking consent is not a condition of purchase.

How and why we use your information

Orders, accounts and support. We process information to fulfil purchases, authenticate account access, take payment, arrange delivery, handle returns and answer related questions. Where you are the contracting individual, this is necessary to perform our contract or take steps you request before a contract, under Article 6(1)(b) GDPR. For business customer representatives and other professional enquiries, we rely on our legitimate interest in administering the relationship and responding to requests, under Article 6(1)(f).

Legal obligations. We process information to meet applicable accounting, tax, product-safety and other legal obligations under Article 6(1)(c).

Security and legal claims. We process relevant account, technical and transaction information to prevent fraud and abuse, protect customers and systems, investigate incidents, and establish, exercise or defend legal claims. We rely on these legitimate interests under Article 6(1)(f), or a legal obligation where applicable.

Marketing and analytics. With the required consent under Article 6(1)(a), we use HubSpot for email campaigns, other marketing emails and reminders about incomplete carts or checkouts, and Google Analytics 4 to understand use of the store. Reminders use your email, cart or checkout contents and checkout status. We use Google Ads to advertise our products; optional advertising tracking on our store is subject to consent. Google services are connected through Shopify's Google & YouTube app.

You can unsubscribe from marketing using the link in our emails or by contacting [email protected]. Necessary order, payment and shipping messages continue separately. Tracking choices are managed through the cookie controls described below.

Shopify and other recipients

Shopify hosts our store and provides checkout and transactional communications. It processes store information on our behalf under its data-processing terms. Payment providers also process information for their own financial and regulatory responsibilities where applicable.

Our store is hosted by Shopify. Information you submit is shared with Shopify and service partners, including in other countries, to provide store services and Shopify Enhanced Services powered by Shopify Network Intelligence. For Enhanced Services, Shopify acts as an independent controller and combines information from interactions with our store, other merchants and Shopify for personalisation, analytics and advertising-related services. See Shopify's Consumer Privacy Policy. You can exercise applicable rights, including opting out of or objecting to certain processing, through Shopify's privacy portal.

We share relevant information with the following recipients for the purposes described in this policy:

• Group operational support: Sixfab, Inc. in the United States provides central administration and support as a processor under our instructions. Dene Teknoloji A.Ş. in Türkiye provides authorised remote IT, operational and support assistance within that arrangement.
• Fulfilment and shipping: byrd technologies Germany GmbH and the carriers handling your shipment or return receive the contact, address, item and shipment information they need. Carriers may also act as independent controllers for their own obligations.
• Business systems: HubSpot for CRM, support, consent-based email marketing and incomplete cart or checkout reminders; QuickBooks (Intuit) and its Shopify connector for invoicing and accounting; Google Workspace for business communications; Auth0 for integrated customer authentication; DigitalOcean for hosting; and Cloudflare for traffic delivery and security.
• Analytics and advertising: Google for the Google Analytics 4 and Google Ads activities described above, subject to the required consent.
• Professional and legal recipients: accountants, advisers, banks and public authorities where necessary for the stated purposes or required by law.

Access and data sharing are limited to the relevant service. Different providers receive different information; not all participate in every visit or transaction.

International transfers

Our processing includes transfers to the United States and authorised access from Türkiye. Shopify and other providers may also process information outside the EEA or the UK.

Our group arrangement with Sixfab, Inc. and Dene Teknoloji A.Ş. includes the European Commission's Standard Contractual Clauses, transfer assessments and supplementary safeguards for the covered EU transfers.

For processing covered by Shopify’s Data Processing Addendum, Shopify describes the use of Binding Corporate Rules for relevant EEA and Swiss transfers between its entities, and Standard Contractual Clauses and the UK Addendum where applicable. Shopify’s independent processing for Enhanced Services is described in its Consumer Privacy Policy linked above.

For restricted transfers covered by the UK GDPR within our group, we use the European Commission's Standard Contractual Clauses together with the ICO's International Data Transfer Addendum. For other international transfers, we require an applicable adequacy decision or appropriate safeguards, such as Standard Contractual Clauses with the UK Addendum where required. The mechanism depends on the recipient, destination and processing concerned.

You may contact [email protected] for information about the safeguard applicable to your data and to obtain a copy, subject to proportionate protection of confidential information. Where the UK GDPR applies, restricted transfers must also have an applicable UK transfer basis; EU Standard Contractual Clauses alone are not a UK transfer mechanism.

Cookies and similar technologies

We use essential technologies for functions such as the cart, checkout, authentication, security and remembering your privacy choices. Where strictly necessary to provide a service you request, storage or access relies on the applicable exemption under section 25(2) of Germany's TDDDG and, for UK users, the applicable PECR exemption. Related personal-data processing relies on the appropriate basis described above.

Optional analytics and advertising technologies require your consent. We use Shopify's cookie banner and privacy controls to collect and manage these choices. You can reject optional tracking without losing the ability to purchase and change or withdraw your choices through the store's cookie privacy controls. Withdrawal does not affect the lawfulness of earlier processing.

Further information about the cookie technologies used by our platform and Google services is available from their providers:

• Shopify: the Merchant storefronts section of Shopify’s Cookie Policy lists platform cookies, their purposes and durations, including store functionality, privacy preferences and analytics.
• Google Analytics 4: we use consent-based analytics to understand store visits and activity. Google’s GA4 cookie documentation describes its cookie identifiers, purposes and default expiration settings.
• Google Ads: optional advertising measurement uses cookies and similar technologies subject to the required consent. Google’s explanation of cookies describes advertising technologies, their purposes and lifetimes.

These provider references cover a range of features; the technologies used during your visit depend on the store features you use, your consent choices and the applicable configuration. Browser settings can also block or delete cookies, although blocking essential cookies may affect store functions.

How long we keep information

We retain information for its stated purpose and applicable legal obligations, then delete or anonymise it. The retention period depends on the data category:

• Tax and accounting records: German requirements generally provide eight years for accounting documents, six years for business correspondence and ten years for accounting books and certain other records. UK VAT records are generally retained for at least six years where required. The applicable record category and legal starting point determine the period; proceedings can require longer retention.
• Accounts, orders and support: for the active account or transaction and to resolve outstanding delivery, return, defect or support issues. Relevant evidence may be retained for the applicable legal claim period or an existing dispute; this does not justify retaining unrelated information.
• Marketing: while your subscription and consent remain effective. On withdrawal, we stop the affected marketing and retain only necessary suppression and consent evidence to respect your choice and demonstrate compliance.
• Technical and analytics data: according to the period necessary for incident detection or the consented analysis, considering the event's age, relevance and whether aggregate information can serve the purpose. Relevant incident evidence may be kept until the investigation and related claims are resolved.
• Privacy requests: until the request and any related complaint or claim are resolved, and for the period needed to demonstrate our response. Unnecessary identity-verification material is removed earlier.

Where several legal retention requirements apply to the same record, the longest applicable required period governs. Records retained for legal reasons are not thereby available for unrelated marketing.

Your rights and complaints

Subject to applicable legal conditions, you may request access, correction, deletion, restriction of processing and portability of your personal data. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time, including related profiling; we will stop that processing.

Contact [email protected] to exercise these rights. We may request proportionate information to verify identity. We normally respond within one month; if a lawful extension is necessary, we explain it within that month. Requests are normally free of charge.

You may complain to a data protection authority, including in the place of your habitual residence, work or alleged infringement. Our local authority is the Berlin Commissioner for Data Protection and Freedom of Information. You do not need to contact us first to exercise that right.

Payments and security services may use automated checks to flag suspicious transactions. We review suspected fraudulent orders before deciding whether to accept or cancel them. Payment providers may make their own payment-authorisation decisions.

Additional information for the United Kingdom

Where the UK GDPR applies, we rely on the corresponding bases of contract, consent, legitimate interests and applicable UK legal obligations for the purposes above. Where a recordkeeping duty arises solely under German or EU law, our UK GDPR basis is our legitimate interest in meeting that duty, subject to the relevant balancing assessment. UK rules on cookies and electronic marketing also apply where relevant.

To raise a privacy complaint with us, email [email protected] or write to our address above. We acknowledge UK data protection complaints within 30 days, investigate without undue delay and inform you of the outcome. This does not replace the separate deadline for responding to a rights request.

You may also complain to the UK Information Commissioner's Office. The ICO normally asks you to give the organisation an opportunity to resolve your concern first; your statutory complaint rights remain unaffected.

Our representative in the United Kingdom under Article 27 UK GDPR is Sait Borlak, based in the United Kingdom. You and the Information Commissioner may contact him about our processing of personal data at [email protected]. Please mark your message “UK GDPR Representative”.

Changes to this policy

We update this policy when our practices or legal requirements change. The latest revision date appears above. Where a change requires additional notice or fresh consent, we provide it before relying on the change.