Privacy Policy

Last updated: 5 September 2026

1. Data Protection at a Glance

General Information

This Privacy Policy explains what happens to personal data when you visit this website, contact us, subscribe to our newsletter, use our online shop, or consent to analytics or marketing technologies.

Personal data means any information that can identify you directly or indirectly.

Who Is Responsible for Data Collection?

The controller responsible for processing personal data on this website is:

Alexander Fürgut, Lydia Antonia Röntgen GbR
Friedenstr. 8
89073 Ulm
Germany

Email: contact@hemahell.com

How Do We Collect Your Data?

Some data are provided directly by you. This includes information entered into a contact form, sent by email, submitted through a newsletter form, or entered while placing an order.

Other data are generated automatically when you visit the website. These may include your IP address, browser type, operating system, referrer, time of access, pages viewed, and technical identifiers.

Analytics and marketing data are processed only after the corresponding consent has been granted through our cookie settings, unless processing is technically necessary for providing the website.

What Do We Use Your Data For?

We process personal data for the following purposes:

1. To provide and secure the website.
2. To respond to enquiries.
3. To provide newsletter subscriptions.
4. To operate our online shop through Spreadshop.
5. To understand how visitors use the website, where consent has been granted.
6. To measure advertising campaigns and create advertising audiences, where consent has been granted.
7. To comply with legal obligations.

Online Shop

Our online shop is operated through Spreadshop. When you visit the shop or place an order, personal data are also processed by sprd.net AG. Further information is provided in the Spreadshop section below.

Your Rights

Depending on the applicable legal requirements, you have the right to:

1. Request access to your personal data.
2. Request correction of inaccurate data.
3. Request deletion of your data.
4. Request restriction of processing.
5. Receive certain data in a portable format.
6. Object to processing based on legitimate interests.
7. Withdraw consent at any time with effect for the future.
8. Lodge a complaint with a competent data protection authority.

2. Hosting

Hetzner

This website is hosted by:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

When you visit the website, Hetzner processes technical connection data, including IP addresses, in server log files. This processing is necessary to provide a secure, reliable, and technically functional website.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and efficient provision of our website.

Where processing is necessary for entering into or performing a contract, Article 6(1)(b) GDPR also applies.

We have concluded a data processing agreement with Hetzner as required by Article 28 GDPR.

Further information is available in the Hetzner Privacy Policy.

3. General Information

Data Protection

We handle personal data confidentially and in accordance with applicable data protection law.

Internet based data transmission can have security vulnerabilities. Complete protection against access by third parties cannot be guaranteed.

Controller

The controller responsible for this website is:

Alexander Fürgut, Lydia Antonia Röntgen GbR
Friedenstr. 8
89073 Ulm
Germany

Email: contact@hemahell.com

The controller determines the purposes and means of processing personal data.

Legal Bases for Processing

We process personal data on the following legal bases where applicable:

Article 6(1)(a) GDPR where you have given consent.

Article 6(1)(b) GDPR where processing is necessary for a contract or for steps taken before entering into a contract.

Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation.

Article 6(1)(f) GDPR where processing is necessary for a legitimate interest and your interests or fundamental rights do not override that interest.

Where information is stored on or accessed from your device, Section 25 of the German Telecommunications Digital Services Data Protection Act may also apply.

Storage Period

Unless a more specific storage period is stated in this Privacy Policy, personal data are stored only for as long as necessary for the purpose for which they were collected.

Data may be retained for longer periods where required by statutory retention obligations, legal claims, or other applicable legal requirements.

If you withdraw consent or submit a justified request for deletion, the affected data will be deleted unless there is another legal basis or statutory reason for retaining them.

Recipients of Personal Data

We disclose personal data only where this is necessary for providing our services, performing a contract, complying with a legal obligation, pursuing a legitimate interest, or where you have given consent.

Service providers acting on our behalf receive personal data only where necessary for their respective tasks. Where required, these providers are bound by data processing agreements.

International Data Transfers

Some service providers described in this Privacy Policy are based in or process data in countries outside the European Economic Area.

Where personal data are transferred internationally, the transfer is based on an applicable adequacy decision, the EU Standard Contractual Clauses, the EU US Data Privacy Framework, or another legally recognised safeguard.

Withdrawal of Consent

You may withdraw consent at any time with effect for the future.

For analytics and marketing technologies, you can change or withdraw your consent through the cookie settings on this website.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Right to Object

Where processing is based on Article 6(1)(f) GDPR, you have the right to object to that processing for reasons arising from your particular situation.

If personal data are processed for direct marketing, you may object to that processing at any time. This also applies to profiling related to direct marketing.

Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data have been processed unlawfully.

Access, Correction, and Deletion

You may request information about the personal data we process, the purposes of processing, the recipients, and the planned storage period.

You may also request correction of inaccurate data or deletion of your data, subject to applicable legal requirements.

Restriction of Processing

You may request restriction of processing where:

1. You dispute the accuracy of the data.
2. Processing is unlawful and you prefer restriction instead of deletion.
3. We no longer need the data, but you require them for legal claims.
4. You have objected to processing and the assessment of that objection is pending.

Data Portability

Where processing is based on consent or a contract and carried out by automated means, you may request your data in a structured, commonly used, and machine readable format.

SSL and TLS Encryption

This website uses SSL or TLS encryption. You can normally recognise an encrypted connection by the address beginning with “https” and the lock symbol displayed by your browser.

Encryption helps protect information transmitted through the website against access by third parties.

4. Data Collection on This Website

Cookies and Similar Technologies

This website uses cookies and similar technologies.

Cookies are small data records stored in your browser or device. Some cookies are necessary for the operation, security, and basic functionality of the website. Other technologies are used for analytics or marketing.

We use the following consent categories:

Necessary

Necessary technologies are required for functions such as security, consent storage, navigation, and basic website operation. They cannot be disabled through the cookie settings.

The legal basis for access to your device is Section 25(2) of the German Telecommunications Digital Services Data Protection Act. Subsequent processing is based on Article 6(1)(f) GDPR or Article 6(1)(b) GDPR where necessary for a requested service or contract.

Analytics

Analytics technologies help us understand how visitors use the website. They are disabled by default and activated only after you have given consent.

The legal bases are Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act.

Marketing

Marketing technologies are used to measure advertising campaigns, attribute conversions, optimise advertisements, create advertising audiences, and display relevant advertising.

They are disabled by default and activated only after you have given consent.

The legal bases are Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act.

You can change or withdraw your selection at any time through the cookie settings.

Server Log Files

The hosting provider automatically records technical information in server log files. This may include:

1. Browser type and version.
2. Operating system.
3. Referring page.
4. Host name of the accessing device.
5. Time of the request.
6. IP address.
7. Requested page or file.
8. HTTP status code.

These data are processed to provide the website, investigate technical errors, detect attacks, and maintain security.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and technically reliable operation of the website.

Log data are not combined with other sources unless this is necessary for investigating security incidents.

Tournament Prize Claims via Forminator

We use a form created with the Forminator WordPress plugin to receive and process tournament prize claims. When you submit the form, we process your voucher code, selected design, garment model and size, first and last name, email address, delivery address, country, and any optional address information you provide.

Forminator stores the submitted form fields and the submitting IP address in our WordPress database. An internal email notification containing the submitted form fields and the submission number is sent to contact@hemahell.com.

We use this information to check the voucher, prevent repeated or abusive claims, contact you if information is missing, and arrange delivery of the prize.

Processing is based on Article 6(1)(b) GDPR where it is necessary to provide the promised prize. Processing needed to verify the voucher and prevent repeated or abusive claims is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable administration of the prize voucher system.

The complete submission is retained until the voucher has been checked, the prize has been fulfilled, and related questions have been resolved. A minimal record of the voucher code and its redemption status may be retained for longer where necessary to prevent repeated use or to establish, exercise, or defend legal claims. Statutory retention obligations remain unaffected.

Google Forms for Design Submissions

We use Google Forms to receive voluntary design ideas. For users in the European Economic Area, the service is provided by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

The design submission form is hosted directly by Google and is not embedded into this website. When you open the form, you leave our website and establish a direct connection to Google.

Google may process technical connection data such as your IP address, browser and device information, referring page, and time of access.

The current form contains one required free text field named “Design Idea”. It does not request your name or email address. Signing in to a Google account is not required to submit the form. Google offers optional sign in to save your progress. If you are signed in, Google may associate your use of the form with your Google account in accordance with its own Privacy Policy.

If you submit the form, we receive and process the design idea and any personal data that you voluntarily include in the free text response.

The purpose of processing is to receive and evaluate suggestions for future designs and products. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is providing a simple submission channel and evaluating voluntary design suggestions. Where a submission is intended to initiate a contractual collaboration, Article 6(1)(b) GDPR may also apply.

Submitted ideas are retained until their evaluation has been completed. They may be retained for longer where this is necessary to document the origin and permitted use of a suggestion, pursue a possible collaboration, or establish, exercise, or defend legal claims.

Google may process data outside the European Economic Area. Google uses recognised transfer safeguards, including the EU Standard Contractual Clauses where applicable.

Further information about data processing by Google is available in the Google Privacy Policy.

Enquiries by Email

If you contact us by email, we process your email address, your message, and any other information you provide.

Processing is based on Article 6(1)(b) GDPR where the enquiry relates to a contract or steps before entering into a contract. Otherwise, processing is based on Article 6(1)(f) GDPR because we have a legitimate interest in responding to legitimate enquiries.

The data are deleted when the enquiry has been resolved and no statutory retention obligation or other legal reason requires further storage.

5. Google Tag Manager

We use Google Tag Manager, a tag management service provided for users in the European Economic Area by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Our Google Tag Manager container ID is GTM-P7S53G5R.

Google Tag Manager allows us to manage and deploy website tags through a central container. We currently use it to load Google Analytics 4.

Google Tag Manager is assigned to the Analytics category in our cookie settings. It is loaded only after you have given Analytics consent. The tags managed through Google Tag Manager may process data and use cookies according to the respective service described in this Privacy Policy.

According to Google, Google Tag Manager may collect aggregated information about tag firing for stability, performance, diagnostics, and installation quality. Google states that these diagnostic data do not contain visitor IP addresses or measurement identifiers associated with a particular individual. Standard HTTP request logs may contain technical connection data. According to Google, these request logs are deleted within 14 days.

The legal bases are your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) of the German Telecommunications Digital Services Data Protection Act.

You can withdraw your consent through the cookie settings at any time. Withdrawal does not affect processing carried out before the withdrawal.

Data may be processed by Google companies and service providers outside the European Economic Area. Google uses recognised transfer safeguards, including the EU Standard Contractual Clauses where applicable.

Further information is available in the Google Tag Manager privacy and security documentation, the Google Tag Manager Use Policy, and the Google Privacy Policy.

6. Google Analytics

We use Google Analytics 4, a web analytics service provided for users in the European Economic Area by:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

Our Google Analytics measurement ID is G-QJMSFC56SM.

Google Analytics is assigned to the Analytics category in our cookie settings. It is activated only after you have given Analytics consent.

Google Analytics processes information about how visitors use the website. Depending on your consent and the available technical information, this may include:

1. Pages viewed.
2. Time and duration of visits.
3. Approximate location.
4. Browser and device information.
5. Referring pages and campaign information.
6. Interactions with website content.
7. A pseudonymous client identifier stored in the _ga cookie.

The client identifier does not directly contain your name. It is used to distinguish browsers and sessions pseudonymously.

Google states that individual IP addresses from visitors in the European Union are not logged or stored by Google Analytics. IP addresses are used to derive approximate location information and are then discarded.

Google signals, personalised advertising features, detailed location data, and detailed device data are disabled in our Google Analytics property. Email addresses and selected query parameters are redacted where supported by the configuration.

The retention period for user level and event level data in our Google Analytics property is configured to two months. This setting does not necessarily remove aggregated data from standard reports.

The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act.

You can withdraw consent through the cookie settings at any time.

We have concluded the applicable data processing terms with Google. Data may be processed by Google companies and service providers outside the European Economic Area. Google uses recognised transfer safeguards, including the EU Standard Contractual Clauses where applicable.

Further information is available in the Google Privacy Policy, the Google Analytics data collection documentation, and the Google Analytics information for EU based traffic.

7. Meta Pixel

We use the Meta Pixel provided for users in the European Economic Area by:

Meta Platforms Ireland Limited
ATTN: Privacy Operations
Merrion Road
Dublin 4
D04 X2K5
Ireland

Our Meta dataset and Pixel ID is 27831300136493469.

The Meta Pixel is assigned to the Marketing category in our cookie settings. It is activated on this website only after you have given Marketing consent.

The Meta Pixel allows us to measure whether visitors interact with our website or online shop after seeing or clicking an advertisement on Facebook or Instagram. It can also be used to optimise advertising and create audiences for advertising or retargeting.

Depending on your actions and consent, Meta may receive:

1. Page views and page addresses.
2. Product views.
3. Products added to the shopping cart.
4. Initiated checkout processes.
5. Purchases where purchase tracking is available.
6. Product identifiers, values, currencies, and quantities.
7. Referring pages and campaign parameters.
8. Browser and device information.
9. IP address.
10. Meta cookies or other technical identifiers.

Meta may associate this information with an existing Facebook or Instagram account where it is able to do so. Meta may also process the data for its own security, advertising, and platform purposes in accordance with its terms and Privacy Policy.

The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act.

You can withdraw consent through the cookie settings at any time.

For certain measurement services, Meta may process data on our behalf. For the collection and transmission of event data used for targeting or measuring advertising, Meta and the website operator may be joint controllers for the relevant processing stages. Meta is independently responsible for subsequent processing within its services.

Information about the allocation of responsibilities is available in Meta’s applicable Business Tools Terms and Controller Addendum.

Personal data may be processed in the United States or other countries outside the European Economic Area. Meta states that it uses recognised transfer mechanisms, including the EU US Data Privacy Framework and the EU Standard Contractual Clauses where applicable.

Meta applies storage periods according to its current Business Tools Terms, service settings, and Privacy Policy. The duration for which campaign and event reports remain available in our Meta business account depends on the relevant Meta service and our continued need for campaign measurement.

Further information is available in the Meta Privacy Policy, the Meta Business Tools Terms, and the Meta Data Privacy Framework information.

8. Spreadshop Online Shop

Our European online shop is provided by:

sprd.net AG
Gießerstraße 27
04229 Leipzig
Germany

The shop is available at hema-hell-apparel.myspreadshop.net.

When you visit the shop, add products to your cart, begin checkout, or place an order, Spreadshop processes the information required to provide the shop and fulfil the order.

This may include:

1. Name and contact details.
2. Billing and delivery addresses.
3. Products ordered.
4. Order value and currency.
5. Payment and transaction information.
6. Information required for production, delivery, returns, and customer support.
7. IP address, device data, and shop activity.

Contract related processing is based on Article 6(1)(b) GDPR. Processing required for tax, accounting, or commercial retention obligations is based on Article 6(1)(c) GDPR.

Spreadshop provides the shop platform, payment processes, production, delivery, returns, and related customer services. Responsibilities for the respective processing activities are allocated according to the applicable Spreadshop partner and customer terms.

Spreadshop uses its own consent mechanism within the hosted shop. Analytics and marketing technologies in the Spreadshop shop are controlled through the consent settings displayed by Spreadshop.

The Spreadshop integration currently sends consent based events to Google Analytics and the Meta Pixel. These may include page views, product views, products added to the shopping cart, initiated checkout processes, and purchases where supported.

Further information about Spreadshop’s processing, recipients, retention periods, payment services, and international transfers is available in the Spreadshop Privacy Policy.

9. Newsletter

Newsletter via Kit

We use Kit, formerly known as ConvertKit, to provide our newsletter and subscription forms.

The service provider is:

Kit, Inc.
United States

Email: legal@kit.com

When you subscribe to the newsletter, we process your email address and any other information you enter into the subscription form.

The purpose of processing is to send the requested newsletter, manage subscriptions, document consent, prevent misuse, and process unsubscribe requests.

The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw consent at any time by using the unsubscribe link included in each newsletter or by contacting us.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

When the embedded subscription form is displayed, your browser establishes a connection to Kit. Kit may receive technical connection data such as your IP address, browser information, referring page, and time of access.

Kit may also process newsletter delivery and interaction data, such as successful delivery, failed delivery, opens, and link clicks, where these functions are enabled. We use such information to operate and improve the newsletter.

Kit acts as a processor for subscriber data under its Data Processing Addendum.

Subscriber data are generally retained for as long as the newsletter subscription remains active. After an unsubscribe request, the address may be retained on a suppression list where this is necessary to ensure that no further newsletters are sent and to document compliance with the withdrawal request.

Kit processes data in the United States and may use additional service providers. International transfers are protected through recognised safeguards, including the EU US Data Privacy Framework and the EU Standard Contractual Clauses where applicable.

Further information is available in the Kit Privacy Policy, the Kit Data Processing Addendum, and the Kit GDPR information.

10. Google Fonts

This website currently loads the fonts Oswald, Inter, and Space Grotesk through Google Fonts.

For users in the European Economic Area, the responsible Google entity is:

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

When your browser requests a font from Google’s servers, technical data are transmitted to Google. According to Google, these data may include:

1. IP address.
2. Requested font and URL.
3. Browser and device information.
4. User agent.
5. Referring page.
6. Time of the request.

Google states that Google Fonts requests are not used to create advertising profiles or for targeted advertising.

We use Google Fonts to provide a consistent and technically reliable presentation of the website. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is a consistent visual presentation of our website.

Data may be processed outside the European Economic Area. Google uses recognised transfer safeguards, including the EU Standard Contractual Clauses where applicable.

Further information is available in the Google Fonts Privacy FAQ and the Google Privacy Policy.