Privacy policy
Unless stated otherwise below, providing your personal data is neither legally nor contractually required, nor necessary to conclude a contract. You are not obliged to provide your data. Not providing it has no consequences, except where stated otherwise in the individual sections below. "Personal data" means any information relating to an identified or identifiable natural person.
1. Controller
ooloo software UG (haftungsbeschränkt)
Mühlenstr. 8a
14167 Berlin
Germany
Email: johannes@office-walker.com
Telephone: +49 151 47234795
Represented by Johannes Kettmann, Managing Director.
We have not appointed a data protection officer, as we are not required to do so under § 38 BDSG.
2. Server log files
Each time our website is accessed, your browser automatically transmits certain data to us or to our hosting provider, which is stored in server log files. This includes the page requested, the date and time of the request, your IP address, the volume of data transferred, and your provider.
Purpose: secure and stable operation of the website, and the detection and analysis of faults and attacks.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure, functional operation of our website.
3. Hosting and shop platform
Our shop is operated on Shopify, provided by Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.
Shopify processes personal data on our behalf as a processor under Art. 28 GDPR, including data you enter when browsing, creating an account, or placing an order. Data may be transferred to Shopify Inc. in Canada and to sub-processors in the United States. Canada is covered by an adequacy decision of the European Commission. For transfers to the United States, Shopify relies on the EU-US Data Privacy Framework and on standard contractual clauses approved by the European Commission.
Legal basis: Art. 6 (1) (b) GDPR for contract performance, Art. 6 (1) (f) GDPR for the secure operation of the shop.
Further information: https://www.shopify.com/legal/privacy
4. Contacting us by email
If you contact us by email, we collect the personal data you provide (name, email address, content of your message) to the extent you provide it, to handle and respond to your enquiry.
Where the contact serves to take steps prior to entering into a contract, or relates to a contract already concluded between us, the legal basis is Art. 6 (1) (b) GDPR.
Where the contact is for other reasons, the legal basis is Art. 6 (1) (f) GDPR and our legitimate interest in responding to enquiries addressed to us. In this case you have the right to object at any time, on grounds relating to your particular situation.
We use your email address only to process your enquiry. Your data is then deleted, subject to statutory retention periods, unless you have consented to further use.
5. Orders
When you place an order we collect and use your personal data only insofar as this is necessary to perform and process your order and to handle any enquiries relating to it. Providing this data is necessary to conclude the contract. Without it, no contract can be concluded.
Legal basis: Art. 6 (1) (b) GDPR.
Your data is passed to the shipping company, the payment service provider you selected, and, where required, to the customs authorities of the destination country and to providers who handle order processing on our behalf. The scope of any transfer is limited to what is necessary.
Retention: after the contract has been performed, your data is retained for the duration of the statutory warranty period and thereafter in accordance with commercial and tax retention periods, principally six and ten years under §§ 257 HGB and 147 AO. It is then deleted.
6. Shipping
We ship using DHL, provided by DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany.
To deliver your order we transmit your name, delivery address, and where you have provided it your email address and telephone number, so that the carrier can notify you about the delivery.
For deliveries outside the European Union, we additionally transmit the data required for customs clearance to the carrier and to the customs authorities of the destination country.
Legal basis: Art. 6 (1) (b) GDPR. Where an email address or telephone number is passed on for delivery notification and you have consented to this, Art. 6 (1) (a) GDPR.
7. Waitlist and newsletter
If you sign up for our waitlist or newsletter, we process the email address you provide, and technical data associated with the sign-up, to send you the emails you signed up for.
We use a double opt-in procedure. After you enter your address, we send you an email asking you to confirm. Your address is only added once you confirm. We record the time of sign-up, the time of confirmation and the IP addresses used, to demonstrate that consent was given.
At sign-up we also derive an approximate location (country, region, city) from your IP address, so that we can send content and delivery information relevant to your country. This is done using ip-api.com, operated by IP-API.com, Weyhe, Germany.
Legal basis: Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with effect for the future, using the unsubscribe link in every email or by contacting us. This does not affect the lawfulness of processing carried out before withdrawal.
Our email service provider is Brevo, operated by Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, acting as our processor. Brevo processes opens and clicks so that we can measure whether our emails are useful and improve them.
9. Cookies and consent
Our website uses cookies and comparable technologies. Cookies are small text files stored in your browser.
Some are technically necessary for the website to work, for example to keep your basket and to remember your language and consent choices. These are set on the basis of § 25 (2) TDDDG and Art. 6 (1) (f) GDPR.
All other cookies and comparable technologies, in particular those used for analytics and advertising, are only set once you have given your consent through our consent banner. The legal basis is § 25 (1) TDDDG together with Art. 6 (1) (a) GDPR.
You can change or withdraw your consent at any time through the consent settings on our website. You can also configure your browser to notify you before cookies are set, and to block or delete them. If you block cookies, some functions of the website may not be available.
10. Analytics
10.1 Plausible Analytics
We use Plausible Analytics, operated by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia.
Plausible does not use cookies and does not track individual visitors across websites or over time. It processes your IP address and user agent to generate a daily-rotating, non-reversible hash, which is used to count unique visits and is discarded at the end of the day. No personal data is stored beyond this. Data is processed on servers in the European Union.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is understanding how our website is used, in a way that does not track individuals. You may object at any time on grounds relating to your particular situation.
Further information: https://plausible.io/data-policy
10.2 SiteBehaviour
We use SiteBehaviour, a cookieless website analytics service, to understand how our pages are used. SiteBehaviour processes your IP address to derive approximate location and to distinguish visits, without setting cookies and without building a cross-site profile.
Legal basis: Art. 6 (1) (f) GDPR, on the same basis as above.
10.3 Google Analytics 4
We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics uses cookies and comparable technologies to analyse how you use our website. The following may be collected: IP address, date and time of access, pages viewed, click path, referrer URL, approximate location, browser and device information, and interactions such as sign-ups. IP anonymisation is enabled.
Data may be transferred to Google LLC in the United States. Google is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission of 10 July 2023, and additionally relies on standard contractual clauses.
Legal basis: Art. 6 (1) (a) GDPR. This processing takes place only with your consent, which you may withdraw at any time with effect for the future.
Further information: https://policies.google.com/privacy
10.4 Google Tag Manager and server-side tagging
We use Google Tag Manager to manage the tags on our website. Tag Manager itself does not store cookies and does not process personal data, but it triggers other tags which may do so, as described in this policy.
We operate server-side tagging using Stape, provided by Stape Inc. Data from your browser is sent first to a server-side container operated on our behalf within the European Union, and forwarded from there to the services described below. This means we control what data leaves our infrastructure and can reduce what is transmitted.
Legal basis: the legal basis of each downstream tag applies, as set out in the relevant section.
11. Advertising
11.1 Meta Pixel and Conversions API
We use the Meta Pixel and the Meta Conversions API, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
These allow us to measure whether our advertising on Facebook and Instagram leads to actions on our website, and to show relevant advertising to people who have visited our website. The following may be processed: IP address, browser and device information, pages viewed, actions taken such as a waitlist sign-up, and, where the Conversions API is used, a hashed version of your email address if you have provided one. Hashing is carried out before transmission.
Meta may combine this information with your Facebook or Instagram account if you have one and are logged in.
Data may be transferred to Meta Platforms, Inc. in the United States. Meta is certified under the EU-US Data Privacy Framework and additionally relies on standard contractual clauses.
We and Meta are joint controllers for the collection and transmission of this data. The joint controller arrangement is available at https://www.facebook.com/legal/controller_addendum
Legal basis: Art. 6 (1) (a) GDPR. This processing takes place only with your consent, which you may withdraw at any time with effect for the future.
Further information: https://www.facebook.com/privacy/policy
12. Content delivery and embedded media
12.1 Cloudinary
Images on our website are delivered through Cloudinary, operated by Cloudinary Ltd. When an image loads, your IP address is transmitted to Cloudinary so that the image can be delivered to your device.
Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in delivering our website quickly and reliably.
12.2 YouTube
We embed videos from YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube's privacy-enhanced mode, which means YouTube does not set cookies until you start playing a video. When you play a video, your IP address and information about the video are transmitted to YouTube, and YouTube may associate this with your Google account if you are logged in.
Legal basis: Art. 6 (1) (f) GDPR for the embedding itself in privacy-enhanced mode, and Art. 6 (1) (a) GDPR for any processing that occurs once you choose to play a video.
Further information: https://policies.google.com/privacy
12.3 Discord
We link to a Discord community. Discord is operated by Discord Netherlands BV, Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands. We do not transmit any data to Discord when you visit our website. If you follow the link and join our community, your use of Discord is governed by Discord's own privacy policy and by any information we provide within that community.
Further information: https://discord.com/privacy
13. Where your data is processed
We have chosen our infrastructure so that personal data is processed within the European Union wherever we control that choice. Our server-side tagging container, our analytics providers and our email provider all process data on servers within the EU.
Two categories of processing are an exception, and both take place only with your consent:
- Google Analytics 4. Data may be transferred to Google LLC in the United States.
- Meta Pixel and Conversions API. Data may be transferred to Meta Platforms, Inc. in the United States.
Both providers are certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission of 10 July 2023, and both additionally rely on standard contractual clauses approved by the European Commission. If you do not consent to analytics and advertising cookies, no data is transmitted to either.
Our shop platform, Shopify, is contracted through its Irish entity and may use sub-processors in Canada and the United States. Canada is covered by an adequacy decision. Transfers to the United States are covered by the EU-US Data Privacy Framework and standard contractual clauses.
Where personal data is transferred to any recipient in a country for which the European Commission has not issued an adequacy decision, we ensure appropriate safeguards under Art. 46 GDPR are in place, in particular standard contractual clauses, or that a derogation under Art. 49 GDPR applies.
14. Your rights
Where the statutory requirements are met, you have the following rights under Art. 15 to 22 GDPR:
- the right of access
- the right to rectification
- the right to erasure
- the right to restriction of processing
- the right to data portability
- the right to object to processing based on Art. 6 (1) (e) or (f) GDPR, on grounds relating to your particular situation
- the right to object at any time to processing for direct marketing purposes, without needing to give reasons
- the right to withdraw consent at any time with effect for the future
To exercise any of these rights, contact us at johannes@office-walker.com.
Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR. The authority responsible for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61
10555 Berlin
Germany
You may also contact the supervisory authority in your country of residence or place of work.
15. Automated decision-making
We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
Last updated: 14 August 2026
To request access to your data, correct it, or have it deleted, use our privacy request pages.