Privacy policy
Last updated: August 18, 2026
1. Controller
The controller responsible for processing personal data through the KnowDrugs merchandise shop is:
Plant Product Design UG (haftungsbeschränkt)
Mahlower Str. 24
12049 Berlin
Germany
Represented by: Philipp Kreicarek
Email: shop@knowdrugs.app
Telephone: +49 30 710 78616
Commercial register: Amtsgericht Charlottenburg, HRB 203638 B
VAT ID: DE322831923
This Privacy Policy applies to the online shop at shop.knowdrugs.app, including checkout, customer-account and order-status functions, and the electronic withdrawal function.
2. Personal data we process
Depending on how you use the shop, we may process identification and contact data; order and contract data; payment and transaction information; customer-account information; communications that you send to us; technical and usage data such as IP address, device and browser information, operating system, approximate location, pages viewed, interactions, referral information and identifiers used for analytics or security; and consent choices relating to cookies and analytics.
Full payment-card details are handled by the payment provider and are not made available to us in full.
We receive data directly from you, automatically from your device when you use the shop, and from service providers involved in operating the shop, processing payments, fulfilling orders and handling withdrawals.
3. Purposes and legal bases
Shop operation, checkout and contract performance. We process the information required to display the shop, create and administer customer accounts, receive and process orders, communicate about orders, accept payments, arrange production and delivery, handle returns and refunds and provide customer support. The legal basis is Article 6(1)(b) GDPR where processing is necessary to take steps at your request or perform a contract.
Legal obligations. We process and retain information where necessary to comply with tax, accounting, commercial, consumer-protection and other statutory obligations, including documenting withdrawal declarations and transactions. The legal basis is Article 6(1)(c) GDPR.
Security, fraud prevention and reliable operation. We may process technical, transaction and account information to protect the shop, our customers and our services against abuse, fraud, security incidents and technical failures. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of the shop and the prevention of fraud and misuse.
Customer communication and legal claims. We process correspondence and relevant transaction information to answer questions, resolve problems and establish, exercise or defend legal claims. Depending on the context, the legal basis is Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR.
Analytics. We use Google Analytics 4 through the Pasilobus Google Analytics Shopify app to understand how the shop is used and to measure ecommerce events. In regions where consent is required, analytics is activated only after the relevant consent has been granted. The legal basis for processing personal data for analytics is Article 6(1)(a) GDPR. Where information is stored on or accessed from your device for analytics, consent is also obtained in accordance with section 25(1) TDDDG. You can withdraw your analytics consent at any time through the shop's Cookie preferences without affecting the lawfulness of processing before withdrawal.
Strictly necessary storage or access to information on your device that is required to provide a service you expressly request does not require consent to the extent permitted by section 25(2) TDDDG.
4. Shopify
The shop is operated using Shopify. For customers in the EEA, UK and Switzerland, customer personal data is initially processed by Shopify International Limited in Ireland. Shopify provides the ecommerce platform, checkout, customer accounts, order administration, payment-related services, security, hosting and related technical functions.
We provide Shopify with the data necessary to operate the shop and fulfil orders. Shopify may use affiliated companies and subprocessors and may process data outside the EEA. Such international processing is governed by Shopify's contractual and data-transfer safeguards.
5. Payments
Payments are processed through Shopify Payments and the payment networks, banks and other financial-service providers involved in the selected payment method.
For payment processing, fraud prevention and transaction administration, the relevant providers receive information such as your name, billing and shipping details, order amount, payment method and transaction information. We do not receive your complete payment-card details.
The principal legal basis for payment processing is Article 6(1)(b) GDPR. Processing required for accounting, anti-fraud, regulatory or statutory obligations may also be based on Article 6(1)(c) or 6(1)(f) GDPR.
6. Printful — production and fulfilment
We use Printful as a print-on-demand production and fulfilment provider. When an order needs to be produced and shipped, we provide Printful with the information necessary to fulfil it, in particular the recipient's name, delivery address, order/product information and, where necessary for delivery, contact details.
Printful and the shipping carriers involved use this information to produce, pack and deliver the order and to manage delivery-related issues. The legal basis is Article 6(1)(b) GDPR.
Depending on the fulfilment location and delivery destination, data may be processed outside Germany or the EEA where this is necessary to fulfil the order, subject to applicable data-protection safeguards.
7. Revoq — electronic withdrawal function
We use Revoq – EU Withdrawal Button, provided by BuschBytes, to provide and document the electronic withdrawal function at shop.knowdrugs.app/pages/withdrawal.
When you use this function, Revoq processes information required to submit and document your withdrawal, such as your name, email address, order or contract reference, information about the goods concerned, the content of the withdrawal declaration, and the date and time of receipt. Technical information such as IP address, browser or device information may also be processed in connection with operation and security of the service.
Revoq can match withdrawal information with Shopify order data and stores withdrawal records for administration of the withdrawal process.
Processing is based on Article 6(1)(b) GDPR insofar as it is necessary to process the withdrawal of the contract, and Article 6(1)(c) GDPR insofar as processing is necessary for us to comply with and document statutory consumer-protection obligations.
8. Google Analytics and Pasilobus
We use the Pasilobus Google Analytics Shopify app to integrate Google Analytics 4 and measure shop usage and ecommerce events. The app can technically process device and activity information such as IP address, browser and operating-system information, approximate geolocation, browsing behaviour and a client identifier, as well as ecommerce/order-event information.
Google Analytics processes analytics information on our behalf. Google states that it acts as a processor for Google Analytics data under its applicable data-processing terms, subject to the settings used by the customer.
Our Shopify pixel configuration requires analytics permission. In the EEA and other consent-required regions, we use Google Analytics only after analytics consent has been granted. You can change or withdraw this choice through Cookie preferences.
Pasilobus is a US-based service provider and Google may process information internationally. Where personal data is transferred outside the EEA, the providers' applicable transfer mechanisms and safeguards are used.
The Google & YouTube sales channel is installed, but its web pixel is currently disconnected and is not used by this shop for marketing or analytics tracking. If this configuration changes materially, this policy will be updated.
9. Cookies and similar technologies
The shop uses cookies and similar technologies.
Some are strictly necessary for functions such as navigation, checkout, security, customer accounts, consent management and other services you expressly request. Other technologies, especially analytics technologies, are used only where the required consent has been obtained.
For visitors in the EEA and other configured regions, Shopify's cookie banner is used to obtain and manage consent. You can review or change your choices through the Cookie preferences link in the shop.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
10. Recipients of personal data
We disclose personal data only where necessary for the purposes described in this policy. Categories of recipients include Shopify and its affiliated companies and subprocessors; Shopify Payments, payment networks, banks and other payment-service providers; Printful and shipping, postal and logistics providers; BuschBytes/Revoq for the electronic withdrawal function; Pasilobus and Google in connection with consent-based analytics; and professional advisers, authorities, courts or other recipients where disclosure is required by law or necessary to establish, exercise or defend legal claims.
We do not sell personal data for money.
11. International data transfers
Some service providers operate internationally. Personal data may therefore be processed in countries outside Germany and the EEA, including the United States and other locations in which Shopify, its subprocessors, Google, Pasilobus, Printful or logistics providers operate.
Where GDPR rules on international transfers apply, transfers are based on an applicable legal transfer mechanism, such as an adequacy decision, the EU Standard Contractual Clauses, or another legally recognised safeguard.
12. Retention
We keep personal data only for as long as necessary for the respective purpose.
Order, payment, invoice and transaction information is retained for the periods required by applicable tax, accounting and commercial-law obligations.
Customer-service, return, defect and withdrawal information is retained for as long as necessary to process the matter, document compliance with legal obligations and establish, exercise or defend legal claims, after which it is deleted unless a statutory retention obligation requires longer storage.
Customer-account information is retained while the account is active and thereafter only to the extent required for order history, statutory obligations or legal claims.
Analytics information is retained according to the retention settings and deletion mechanisms configured for the relevant analytics services. Consent information may be retained as necessary to document consent choices and withdrawals.
Service providers may retain data according to their own legally applicable retention obligations and contractual processing arrangements.
13. Your rights
Subject to the applicable legal requirements, you may have the right to obtain information about personal data we process about you; obtain a copy; correct inaccurate or incomplete data; request deletion; request restriction of processing; receive data you provided in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller; object to processing based on legitimate interests for reasons relating to your particular situation; and withdraw consent at any time with effect for the future.
Where processing is based on consent, withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, contact us at shop@knowdrugs.app. We may need to verify your identity before fulfilling a request.
You also have the right to lodge a complaint with a competent data-protection supervisory authority, in particular the supervisory authority for your habitual residence, place of work, or the place of an alleged infringement.
14. Changes to this Privacy Policy
We may update this Privacy Policy when our services, providers, legal obligations or data-processing practices change. The current version is published in the shop.