Privacy Policy
Last updated: 27 October 2026
1. Controller
The controller responsible for data processing on this website is:
Mabou GmbH
Leopoldstr. 154
80804 Munich
Germany
E-mail: info@mabou-experience.com
Managing Director: Marie-Christine Haffa
Register court: Amtsgericht München (Munich Local Court)
Register number: HRB 260378
VAT ID: DE336029551
2. General information
We take the protection of your personal data seriously. We process personal data only within the framework of applicable data protection law, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Personal data means any data that can be used to identify you personally.
3. Your rights
You have the following rights with regard to your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
To exercise your rights, an informal message to the e-mail address above is sufficient. You also have the right to lodge a complaint with the competent supervisory authority. For Bavaria this is the Bavarian Data Protection Commissioner. An overview of German supervisory authorities is available at: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table.html.
4. Hosting and shop system (Shopify)
Our online shop is operated on the Shopify platform. Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. When you visit the shop and place orders, Shopify processes inter alia IP address, device and browser data, pages visited, order, payment and address data, and customer account login data. Processing is carried out to provide and secure the shop and to initiate and perform contracts (Art. 6(1)(b) and (f) GDPR). Further information: https://www.shopify.com/legal/privacy.
5. Orders and contract performance
When you place an order with us, we process the data you provide (e.g. name, address, e-mail address, telephone number, payment data) insofar as this is necessary to establish, perform and process the purchase contract (Art. 6(1)(b) GDPR). Statutory retention obligations (in particular under commercial and tax law) remain unaffected.
6. Payment service providers
Depending on your selection, we use payment service providers for payment processing, in particular Shopify Payments as well as PayPal and other methods shown at checkout (e.g. Apple Pay, where available). Data required for payment are transmitted to the respective provider. Legal basis: Art. 6(1)(b) GDPR. Examples:
- PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg – PayPal privacy information
- Shopify Payments / Stripe – information via Shopify or the respective payment provider at checkout
7. Shipping carriers
To deliver goods we pass on name and delivery address and, where necessary, contact details to the shipping carrier commissioned with delivery, to the extent required (Art. 6(1)(b) GDPR).
8. Contact
If you contact us via contact form, e-mail or other channels, we store your details to handle the enquiry and for follow-up questions (Art. 6(1)(b) or (f) GDPR).
9. Customer account
If you create a customer account, we store the master data you provide and your order history for as long as the account exists or statutory periods require (Art. 6(1)(b) GDPR). You may request deletion of the account at any time.
10. Cookies and consent
Our website uses cookies and similar technologies. Technically necessary cookies are required to operate the shop (e.g. shopping cart, session, security) and are set on the basis of Art. 6(1)(b) or (f) GDPR. Other cookies (e.g. statistics, marketing) are used only if you have consented via our cookie/consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You may withdraw or change your consent at any time via the cookie banner settings. You can also restrict or delete cookies in your browser.
11. Google Analytics
Where you have consented, we use Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics uses cookies and similar technologies to analyse use of the website. Your IP address may be processed in shortened form. Information generated by cookies may be transmitted to and stored on Google servers. Legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw consent via the cookie banner. Further information: https://policies.google.com/privacy.
12. Klaviyo (e-mail marketing)
For newsletters and e-mail marketing we use Klaviyo, Inc., 125 Summer Street, Boston, MA 02110, USA. In particular, e-mail address and, where applicable, name and interaction data (e.g. opens, clicks) are processed where you have consented (Art. 6(1)(a) GDPR) or processing is necessary for pre-contractual or contractual measures. You may withdraw consent at any time, e.g. via the unsubscribe link in every e-mail. Further information: https://www.klaviyo.com/legal/privacy/privacy-notice.
13. Judge.me (reviews)
To display and manage product and shop reviews we use Judge.me Ltd., 22 Upper Ground, London SE1 9PD, United Kingdom. Name, e-mail address and review content may be processed when you submit a review or we display reviews (Art. 6(1)(a) or (f) GDPR). Further information: https://judge.me/privacy.
14. Server log files
When you visit the website, technical information is collected automatically (e.g. browser type/version, operating system, referrer URL, host name, time, IP address). Processing serves the technical delivery and security of the website (Art. 6(1)(f) GDPR).
15. SSL/TLS encryption
This site uses SSL or TLS encryption for security. You can recognise an encrypted connection by “https://” in the address bar and the lock symbol in the browser.
16. Storage period
We store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. After the purpose ceases or periods expire, data are deleted or blocked.
17. Transfers to third countries
Where providers outside the European Economic Area are used (e.g. USA), data are transferred only if an adequacy decision applies, appropriate safeguards exist (e.g. standard contractual clauses), or a statutory exception applies.
18. Objection to advertising e-mails
We hereby object to the use of contact data published under the legal notice obligation for sending unsolicited advertising. We reserve the right to take legal action in the event of unsolicited advertising information being sent.
This English version is provided for convenience. In the event of any discrepancy, the German version shall prevail.
