Privacy Policy

Privacy Policy

Last updated: 27 October 2026

1. Controller

The controller responsible for data processing on this website is:

Mabou GmbH
Leopoldstr. 154
80804 Munich
Germany
E-mail: info@mabou-experience.com
Managing Director: Marie-Christine Haffa (née Junkersdorf)
Register court: Amtsgericht München (Munich Local Court)
Register number: HRB 260378
VAT ID: DE336029551

2. General information

We take the protection of your personal data seriously. We process personal data only within the framework of applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Personal data means any data that can be used to identify you personally.

3. Your rights

You have the following rights with regard to your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)
  • Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to the e-mail address above is sufficient. You also have the right to lodge a complaint with the competent supervisory authority. The authority competent for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de. An overview of German supervisory authorities is available at: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html.

4. Hosting and shop system (Shopify)

Our online shop is operated on the Shopify platform. Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. When you visit the shop and place orders, Shopify processes inter alia IP address, device and browser data, pages visited, order, payment and address data, and customer account login data. Processing is carried out to provide and secure the shop and to initiate and perform contracts (Art. 6(1)(b) and (f) GDPR). Further information: https://www.shopify.com/legal/privacy.

5. Orders and contract performance

When you place an order with us, we process the data you provide (e.g. name, address, e-mail address, telephone number, payment data) insofar as this is necessary to establish, perform and process the purchase contract (Art. 6(1)(b) GDPR). Statutory retention obligations (in particular under commercial and tax law) remain unaffected.

5a. Invoicing and accounting (Lexware Office)

For invoices, order confirmations and our accounting we use Lexware Office provided by Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. Order data (e.g. name, billing and delivery address, e-mail address, items ordered, amounts) are transferred from our shop via an interface and processed there. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and compliance with obligations under commercial and tax law (Art. 6(1)(c) GDPR). A data processing agreement is in place with the provider. Further information: https://office.lexware.de/datenschutz/.

6. Payment service providers

Depending on your selection, we use payment service providers for payment processing, in particular Shopify Payments as well as PayPal and other methods shown at checkout (e.g. Apple Pay, where available). Data required for payment are transmitted to the respective provider. Legal basis: Art. 6(1)(b) GDPR. Examples:

  • PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg – PayPal privacy information
  • Shopify Payments / Stripe – information via Shopify or the respective payment provider at checkout
  • Shop Pay – express checkout by Shopify (Shopify International Limited, address see section 4). If you use Shop Pay, Shopify stores your contact, shipping and payment details for future purchases at your request – Shopify privacy information
  • Google Pay – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – Google privacy information
  • Apple Pay – Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland – Apple privacy information
  • Klarna – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. If you pay with Klarna (e.g. invoice, instalments), we transmit the required order and contact data to Klarna; Klarna may carry out its own identity and credit checks – Klarna privacy information

7. Shipping carriers

To deliver goods we pass on name and delivery address and, where necessary, contact details to the shipping carrier commissioned with delivery, to the extent required (Art. 6(1)(b) GDPR).

We generally ship with DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, or DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany, and for international shipments the respective competent DHL company). We create shipping labels using the “Post & DHL Shipping” app. We pass your e-mail address or telephone number to DHL only if you have consented (Art. 6(1)(a) GDPR) or if this is necessary to arrange the delivery date or send a delivery notification (Art. 6(1)(b) GDPR). You may withdraw consent at any time. Further information: https://www.dhl.de/datenschutz.

8. Contact

If you contact us via contact form, e-mail or other channels, we store your details to handle the enquiry and for follow-up questions (Art. 6(1)(b) or (f) GDPR).

8a. Live chat (Shopify Inbox)

For the chat on our website we use Shopify Inbox provided by Shopify International Limited (address see section 4). If you use the chat, we process your messages and, where applicable, your name, e-mail address, cart details and the page you are viewing in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR; our legitimate interest is fast customer communication). The chat history is deleted once it is no longer required and no statutory retention obligations apply. Further information: https://www.shopify.com/legal/privacy.

9. Customer account

If you create a customer account, we store the master data you provide and your order history for as long as the account exists or statutory periods require (Art. 6(1)(b) GDPR). You may request deletion of the account at any time.

10. Cookies and consent

Our website uses cookies and similar technologies. Technically necessary cookies are required to operate the shop (e.g. shopping cart, session, security) and are set on the basis of Art. 6(1)(b) or (f) GDPR. Other cookies (e.g. statistics, marketing) are used only if you have consented via our cookie/consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You may withdraw or change your consent at any time via the cookie banner settings. You can also restrict or delete cookies in your browser.

11. Google Analytics

Where you have consented, we use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies and similar technologies to analyse use of the website. Your IP address may be processed in shortened form. Information generated by cookies may be transmitted to and stored on Google servers. Legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw consent via the cookie banner. Further information: https://policies.google.com/privacy.

11a. Google Ads (conversion tracking and remarketing) and Google Merchant Center

Where you have consented, we use Google Ads and Google Merchant Center provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Conversion tracking measures whether users perform certain actions (e.g. page view, add to cart, purchase) after clicking one of our ads on Google. Remarketing allows us to show ads on Google and partner sites to people who have visited our website. Via Merchant Center we provide our product data for Google Shopping and measure the performance of these listings. Cookies or similar technologies are used, and data including IP address, device and browser data, pages visited and order information (e.g. order value) are transmitted to Google. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time via the cookie banner. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. You can also deactivate personalised advertising at https://adssettings.google.com. Further information: https://policies.google.com/privacy.

11b. Meta Pixel and Conversions API (Facebook, Instagram)

Where you have consented, we use the Meta Pixel and the Conversions API provided by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). This allows us to measure the effectiveness of our advertising on Facebook and Instagram (e.g. whether a purchase follows an ad click), to show relevant ads there to visitors of our website and to optimise the delivery of our ads. The Meta Pixel transmits from your browser data including IP address, device and browser data, pages visited and events such as add to cart or purchase (including order value). Via the Conversions API we additionally transmit these events directly from our shop server to Meta; contact data such as e-mail address or telephone number may be transmitted in encrypted (hashed) form. Both take place only if you have consented via the cookie banner. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time via the cookie banner.

We and Meta are joint controllers for the collection and transmission of the data to Meta (Art. 26 GDPR); the arrangement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for subsequent processing. A transfer to the United States cannot be ruled out; Meta is certified under the EU-US Data Privacy Framework. You can adjust your ad preferences in your Facebook or Instagram account. Further information: https://www.facebook.com/privacy/policy/.

11c. Pinterest Tag

Where you have consented, we use the Pinterest Tag provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland (“Pinterest”). This allows us to measure the effectiveness of our Pinterest advertising (e.g. purchases after an ad click) and to show relevant ads on Pinterest to visitors of our website. Cookies or similar technologies are used, and data including IP address, device and browser data, pages visited and events such as add to cart or purchase are transmitted to Pinterest. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time via the cookie banner. A transfer to Pinterest Inc. in the USA cannot be ruled out; it takes place on the basis of the EU-US Data Privacy Framework or standard contractual clauses. Further information: https://policy.pinterest.com/en/privacy-policy.

11d. AfterShip Email Marketing (marketing pixel)

Where you have consented, we use the Shopify app “AfterShip Email Marketing, SMS” (formerly Automizely Marketing) provided by Automizely Pte. Ltd., 120 Robinson Road #13-01, Singapore 068913 (AfterShip). A pixel in our shop processes usage data (e.g. pages visited, add-to-cart and purchase events, device and browser data) and, where applicable, your e-mail address in order to evaluate and manage marketing e-mails and campaigns. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time via the cookie banner. There is no EU Commission adequacy decision for Singapore; transfers are based on standard contractual clauses (Art. 46(2)(c) GDPR). Further information: https://www.aftership.com/legal/privacy.

12. Klaviyo (e-mail marketing)

For newsletters and e-mail marketing we use Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. In particular, e-mail address and, where applicable, name and interaction data (e.g. opens, clicks) are processed where you have consented (Art. 6(1)(a) GDPR) or processing is necessary for pre-contractual or contractual measures. You may withdraw consent at any time, e.g. via the unsubscribe link in every e-mail. Further information: https://www.klaviyo.com/legal/privacy/privacy-notice.

Where you have consented via the cookie banner, we also use Klaviyo on our website (onsite tracking). Klaviyo records which products you view and add to your cart. If you are already known to us (e.g. as a newsletter subscriber or after clicking in one of our e-mails), we link these data to your profile in order to send you relevant e-mails, such as a cart reminder. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you may withdraw at any time via the cookie banner. Transfers to the USA are based on the EU-US Data Privacy Framework, under which Klaviyo is certified, or on standard contractual clauses.

13. Judge.me (reviews)

To display and manage product and shop reviews we use Judge.me Ltd., 22 Upper Ground, London SE1 9PD, United Kingdom. Name, e-mail address and review content may be processed when you submit a review or we display reviews (Art. 6(1)(a) or (f) GDPR). Further information: https://judge.me/privacy.

13a. Meta Custom Audiences (customer lists)

We use the “Custom Audiences” feature of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). We transmit e-mail addresses and, where applicable, telephone numbers of our customers to Meta in encrypted (hashed) form. Meta matches these data against its own user accounts in order to create audiences for our advertising on Facebook and Instagram, including to reach people with similar interests (“Lookalike Audiences”). Data that cannot be matched are deleted by Meta after the matching process.

The legal basis is our legitimate interest in advertising our products (Art. 6(1)(f) GDPR). For this processing, we and Meta are joint controllers (Art. 26 GDPR); the arrangement is available at https://www.facebook.com/legal/controller_addendum. A transfer to the United States cannot be ruled out; Meta is certified under the EU-US Data Privacy Framework.

You may object to this use at any time by informal e-mail to info@mabou-experience.com. Your data will then no longer be included in future transmissions and will be removed from existing customer lists.

14. Server log files

When you visit the website, technical information is collected automatically (e.g. browser type/version, operating system, referrer URL, host name, time, IP address). Processing serves the technical delivery and security of the website (Art. 6(1)(f) GDPR).

15. SSL/TLS encryption

This site uses SSL or TLS encryption for security. You can recognise an encrypted connection by “https://” in the address bar and the lock symbol in the browser.

16. Storage period

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. After the purpose ceases or periods expire, data are deleted or blocked. In particular:

  • Invoices, accounting vouchers and other tax-relevant records: 8 or 10 years; commercial and business letters (e.g. order confirmations, business e-mails): 6 years (Section 257 HGB, Section 147 AO); the period begins at the end of the respective calendar year.
  • Newsletter: until you unsubscribe or withdraw your consent; we keep proof of consent for up to 3 years thereafter.
  • Customer account: until the account is deleted; order data remain stored within the retention periods above.
  • Contact enquiries and chat: until the enquiry has been fully dealt with, unless a retention obligation applies.
  • Cookies and tracking: for the duration stated in the cookie banner or until you withdraw your consent.

17. Transfers to third countries

Where providers outside the European Economic Area are used (e.g. USA), data are transferred only if an adequacy decision applies, appropriate safeguards exist (e.g. standard contractual clauses), or a statutory exception applies.

18. Objection to advertising e-mails

We hereby object to the use of contact data published under the legal notice obligation for sending unsolicited advertising. We reserve the right to take legal action in the event of unsolicited advertising information being sent.

This English version is provided for convenience. In the event of any discrepancy, the German version shall prevail.