Privacy policy

Privacy Policy for Red Lobster Golfing

Last updated: October 2026

Controller for Data Processing

Patrick Honeck
Red Lobster Golfing (Sole Proprietorship)
Brückenstr. 42, 60594 Frankfurt, Germany
Email: info@redlobstergolfing.de
Phone: +49 151 40417636

Overview

In the following sections we explain, for each processing activity, for what purpose and on what legal basis we process data, to whom we transfer it and how long we store it. The legal bases are in particular Art. 6 (1) sentence 1 lit. a GDPR (consent), lit. b (contract and pre-contractual measures), lit. c (legal obligation) and lit. f (legitimate interest). We delete data as soon as the purpose no longer applies and there is no statutory retention obligation.

Shop System and Hosting

Our online shop runs on the Shopify platform. The provider for merchants in Europe is Shopify International Limited, Ireland. Shopify processes all data that you enter in the shop or that arises during your visit as our processor (Art. 28 GDPR; Shopify Data Processing Addendum, version of 07.07.2026). Shopify transfers data to its parent company Shopify Inc. in Canada; an adequacy decision of the EU Commission exists for this. For transfers to other third countries, Shopify uses the EU Standard Contractual Clauses. The legal basis is Art. 6 (1) sentence 1 lit. b GDPR, and for the technical operation of the shop lit. f (our legitimate interest in a secure and stable shop).

Data Processing When You Visit This Website

When you visit our shop, our shop system automatically collects information that your browser transmits (server log files). These include:

Browser type/version
Operating system used
Referrer URL (previously visited page)
Hostname of the accessing computer (IP address)
Time of the server request

We use this data to provide the shop securely and reliably. We do not combine this data with other data sources. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR; our legitimate interest is a secure and stable shop. The data is deleted as soon as it is no longer required for this purpose.

Orders, Customer Account, Invoice

For your order we process your name, delivery and billing address, email address, telephone number if applicable, ordered items, prices and payment method (Art. 6 (1) sentence 1 lit. b GDPR). We retain order and invoice data due to obligations under commercial and tax law (lit. c in conjunction with § 147 AO, § 257 HGB): accounting records for up to 8 years, commercial and business letters for 6 years. A customer account is optional; you sign in with a code that we send to your email address.

Payment

Depending on the payment method you choose, we transfer the data required for payment to Shopify Payments, the payment service of our shop system Shopify (for example credit card, Apple Pay, Google Pay), to PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, or, when paying with Klarna, to Klarna Bank AB (publ), Sweden. Some of these providers process data under their own responsibility, for example for fraud prevention and, at Klarna, credit checks; details can be found in their privacy notices. Legal basis: Art. 6 (1) sentence 1 lit. b GDPR.

Shipping

For delivery, we transfer your name and delivery address to our shipping service provider UPS (Art. 6 (1) sentence 1 lit. b GDPR).

Print Motifs for Personalised Golf Balls

What data we process. When you design a motif on the product page "Personalised Golf Balls", we process:

the image file you upload (PNG or JPG), its file name and the metadata contained in the file. The file may contain logos, texts or photos of people;
texts you enter (for example names), as well as font, colour, size, position and rotation;
the print file and a preview generated from this in your browser;
a randomly generated motif code (for example RLG-7F3K9QX2);
files that you send us by email at our request: a new image file for your motif or proof that the rights holder agrees to a logo being printed;
when we prepare your balls for printing and ship your order: as proof, copies of the preview, your image file and the print file, the print sheets with their control images, photos of the printed balls that we take when shipping, and for each of these files a checksum (SHA-256), the file size and the time of upload;
to protect against misuse, a check value (hash) of your IP address formed with a secret key. We do not store the IP address itself for this purpose. For technical reasons, our service provider logs access including the IP address.

The file is uploaded as soon as you select it, i.e. before an order. If you order, we link the motif code to your order and thus to your order data.

Purposes. We process the data to show you the preview, to check whether the motif can be printed and is permissible, to print the balls, to process your order, to handle queries and complaints, to prove the agreed and delivered design and to prevent misuse of the upload service.

Legal bases.

Art. 6 (1) sentence 1 lit. b GDPR: implementation of pre-contractual measures at your request (design before purchase) and performance of the contract.
Art. 6 (1) sentence 1 lit. f GDPR for data of persons who are shown or named in the motif and do not order themselves. Our legitimate interest is to carry out our customer's order. The person ordering assures us that these persons agree.
Art. 6 (1) sentence 1 lit. f GDPR for the IP check value and the access logs. Our legitimate interest is a secure upload service without misuse.
Art. 6 (1) sentence 1 lit. f GDPR for the proof of execution (see below).
Art. 6 (1) sentence 1 lit. c GDPR in conjunction with § 147 AO and § 257 HGB for the information that becomes part of your order.

We do not analyse photos with technical means to identify people. They are therefore not biometric data (Recital 51 GDPR).

Recipients.

Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) stores the files on our behalf as a processor (Art. 28 GDPR). The storage location is a data centre in Frankfurt am Main (region eu-central-1). The upload service also runs in this region.
Shopify (Shopify International Limited, Ireland), our shop system: the motif code, a short description of the motif (for example your text), the design details and the storage paths of the files become part of your order, as do the storage path, checksum, file size and time of the proofs. We do not store the image files themselves at Shopify.

Beyond this, we only pass on motifs if we are legally obliged to do so.

Transfer to third countries. Supabase is based in Singapore and uses sub-processors, including in the USA (for example Supabase, Inc. and Amazon Web Services, Inc.). Access from these countries, for example for operations and support, can therefore not be ruled out. There is no adequacy decision of the EU Commission for Singapore. The transfer is based on the EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914), which are part of our data processing agreement with Supabase (Art. 46 (2) lit. c GDPR). You can request a copy from us.

Proof of execution. When we prepare your balls for printing, we save your image file, the print file and the print sheets we create for this in a separate, non-public storage area at Supabase in Frankfurt am Main. A print sheet is the print template for one printing plate and ball side; it comes with a low-resolution control image that we use to check the position of the motifs on the plate before printing. The print sheet and control image may also contain motifs of other orders; your motif may therefore also be part of the proof for other orders. When we ship your order, we copy the preview of your approved motif (ball with side 1 and, if applicable, side 2) to the same storage area. If you have sent us a new image file at our request, we also save this file there. When shipping, we also photograph the printed balls, without the shipping label and without name or address on the parcel; we remove location data from the photos before uploading. For each file, we record a checksum (SHA-256) in your order so that it can later be shown that the file is unchanged. If we withdraw from the contract for the personalised golf balls, we do not save any proof; we delete any files already saved for this order. This does not apply to print sheets with their control images that we have already printed with and that also contain motifs of other orders; we keep these, including your motif, as proof for those orders. The purpose is to prove which design you approved, which files we printed with, how well your motif could be printed and what we delivered, and to examine, defend or assert claims for defects. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest results from the statutory periods: claims for defects become time-barred 2 years after delivery (§ 438 (1) no. 3, (2) BGB), and if a defect appears within one year, it is presumed that the goods were already defective on delivery (§ 477 (1) BGB). Without the preview, photo, image file, print file and print sheet we could not prove that the print corresponds to the approved preview and how well your motif could be printed. Only Red Lobster Golfing has access to the proofs; Supabase stores them as a processor (see "Recipients"). We delete the proofs automatically 25 months after upload; this is the 2-year limitation period plus a buffer for printing, shipping and delivery.

Storage period.

We automatically delete the image file, print file and preview as soon as 45 days have passed since upload, even if you do not order. The deletion run takes place once a day, so deletion happens on the 46th day at the latest. We may delete motifs of ordered balls as early as after shipping. This does not apply to the copies of the preview, image file and print file that we save as proof of execution (next point).
We automatically delete proofs of execution (copies of the preview, image file and print file, print sheets with their control images and photos of the printed balls) as soon as 25 months have passed since upload. The deletion run takes place once a day. We delete the original photos from our devices (smartphone and computer) directly after uploading.
For printing, we download the files to our work computers and create the print sheets there. We delete these copies as soon as the balls have been shipped and the proofs saved; if we withdraw from the contract, we delete them after the withdrawal.
We process files and proof that you send us by email at our request for the same purposes as uploaded files. We delete the email attachments as soon as the balls have been shipped and the proofs saved or we have withdrawn from the contract. A new image file saved as proof is deleted after 25 months like the other proofs.
We delete the IP check value after 2 days. The access logs of our service provider are deleted after 7 days. Database backups only contain file names and storage paths, no images, and are deleted after 7 days.
Information that has become part of your order (motif code, text, design details, storage paths and checksums of the proofs) is kept with the order data until the statutory retention periods have expired (up to 8 years for accounting records, 6 years for commercial letters).

Persons in the motif. If a motif shows or names persons who do not order themselves, we receive their data from the person ordering. We do not inform these persons separately because we mostly do not know them and this would require disproportionate effort (Art. 14 (5) lit. b GDPR).

Your rights. You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). If you would like a motif to be deleted before the 45 days have expired, send us the motif code at info@redlobstergolfing.de. We only delete proofs of execution before the 25 months have expired if we no longer need them for the establishment, exercise or defence of legal claims (Art. 17 (3) lit. e GDPR).

Right to object. Insofar as we process data on the basis of Art. 6 (1) sentence 1 lit. f GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). For proofs of execution, we examine an objection on a case-by-case basis. We continue to process them if we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if they serve the establishment, exercise or defence of legal claims (Art. 21 (1) sentence 2 GDPR).

Right to lodge a complaint. You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wilhelmstraße 7, 65185 Wiesbaden, Germany, datenschutz.hessen.de.

Obligation to provide data, automated decisions. Uploading is voluntary. Without a motif (image or text) we cannot produce personalised balls. We do not make automated decisions within the meaning of Art. 22 GDPR; the automatic check of file format and size is only a technical pre-check.

Contact Form and Email

If you send us inquiries via the contact form or by email, the information you provide, including your contact details, will be stored for the purpose of processing the inquiry and for potential follow-up questions. The legal basis is Art. 6 (1) sentence 1 lit. b GDPR if your inquiry relates to a contract or an order, otherwise lit. f (our legitimate interest in answering inquiries). We delete the information as soon as your inquiry has been dealt with and no statutory retention obligations prevent this. This data will not be shared without your consent.

If you sign up for our newsletter, we process your email address to send you information about new guides, products and offers. The legal basis is your consent (Art. 6 (1) sentence 1 lit. a GDPR). After signing up, you will first receive an email in which you confirm your registration. The emails are sent by our shop system Shopify. You can unsubscribe at any time via the link in every email; this withdraws your consent with effect for the future. We store your email address for the newsletter until you unsubscribe.

Cookies

Our websites use cookies and similar technologies. Cookies are small text files stored on your computer by your browser. We use technically necessary cookies on the basis of § 25 (2) no. 2 TDDDG and Art. 6 (1) sentence 1 lit. f GDPR; our legitimate interest is a working shop with shopping cart and checkout. We only use all other cookies and similar technologies with your consent via our cookie banner (§ 25 (1) TDDDG, Art. 6 (1) sentence 1 lit. a GDPR). You can withdraw your consent at any time with effect for the future.

Analytics and Marketing

With your consent, we use the Meta Pixel (Meta Platforms Ireland Limited, Ireland) and the TikTok Pixel (TikTok Technology Limited, Ireland). This allows us to measure how visitors use our shop and how our advertising performs. The legal basis is your consent (Art. 6 (1) sentence 1 lit. a GDPR, § 25 (1) TDDDG).

Google Analytics and Google Ads (Google Ireland Limited, Ireland) are integrated via the Google channel of our shop system in so-called Consent Mode. The Google tag is loaded when you open our pages. As long as you have not consented, Google does not set analytics or advertising cookies and only receives limited information without a cookie identifier, for example that a page was viewed or a purchase was completed, plus technical information such as time, browser and your IP address. The legal basis for this is our legitimate interest in measuring the success of our advertising (Art. 6 (1) sentence 1 lit. f GDPR); you can object at any time. With your consent, Google also sets cookies and uses the data for analytics and personalised advertising (Art. 6 (1) sentence 1 lit. a GDPR, § 25 (1) TDDDG).

Customer Match (Google Ads): For advertising in Google services, we transfer our customers' email addresses from our shop system to Google Ads in encrypted form (as a hash value). Google matches the hash values with Google accounts. This allows us to show existing customers advertising in Google services or to exclude them from it and to manage our campaigns. The legal basis is our legitimate interest in advertising to our customers (Art. 6 (1) sentence 1 lit. f GDPR). You can object to this at any time without giving reasons (Art. 21 (2) GDPR), for example by email to info@redlobstergolfing.de; we will then remove your address from these lists.

These providers may also transfer data to third countries, in particular to the USA. Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework.

Social Media

Our shop links to our profiles on Instagram and TikTok. These are simple links. Data is only transferred to the respective provider when you click a link and open their page.

Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7 (3)). Please write to info@redlobstergolfing.de.

Right to object: If we process data on the basis of Art. 6 (1) sentence 1 lit. f GDPR, you can object at any time on grounds relating to your particular situation. You can object to direct marketing at any time without giving reasons (Art. 21 GDPR).

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wilhelmstraße 7, 65185 Wiesbaden, Germany, datenschutz.hessen.de.

Obligation to provide data: For an order we need the information marked as mandatory; without it we cannot conclude the contract. Automated decisions pursuant to Art. 22 GDPR do not take place.

Changes to Our Privacy Policy

We reserve the right to adapt this privacy policy occasionally to ensure compliance with current legal requirements or to reflect changes in our services, such as when introducing new features. The new privacy policy will apply on your next visit.

Questions About Data Protection

If you have any questions about data protection, please email us or contact the person responsible using the information provided above.

Privacy policy created with support from datenschutzbeauftragter-info.de

Your cart is currently empty.