Privacy policy

Last updated: 2026-09-11

1. Who we are

Between Horses ("we", "us", "our") is operated by Jenny Abrahamsson, sole trader, registered in Germany.

Data controller: Jenny Abrahamsson, trading as Between Horses
Address: Am Lasterbach 22, 49740 Haselünne, Germany
Phone: +49 172 815 90 84
Email: info@betweenhorses.com
VAT ID: DE453017262

This Privacy Policy explains how we collect, use, and disclose your personal information when you visit or make a purchase through our online store, which is available to customers across the 27 EU member states. Our store runs on the Shopify platform, which processes data on our behalf and, for certain purposes described below, as an independent controller.

2. Personal information we collect

Depending on how you use our store, we may collect:

Contact details: name, billing and shipping address, phone number, email address
Financial information: payment details processed via our payment providers (we do not store full card numbers ourselves)
Account information: username, password, preferences
Order information: items viewed, added to cart or wishlist, purchase history, returns and exchanges
Communications: anything you send us via email, contact forms, or customer support
Device and usage information: IP address, browser type, and how you interact with our site (collected via functional cookies necessary to operate the store — see Section 6)

3. Legal basis for processing

Under the GDPR, we only process your personal information where we have a valid legal basis:

Purpose	Legal basis
Processing and fulfilling your order, managing your account	Performance of a contract (Art. 6(1)(b) GDPR)
Issuing invoices, complying with tax and commercial record-keeping obligations	Legal obligation (Art. 6(1)(c) GDPR)
Preventing fraud, securing our store, improving our services	Legitimate interest (Art. 6(1)(f) GDPR)
Sending you marketing emails or newsletters	Your consent (Art. 6(1)(a) GDPR) — see Section 7

4. How we use your personal information

To process orders, payments, shipping, returns, and exchanges
To create and manage your account
To respond to customer support requests
To detect and prevent fraud and keep our store secure
To comply with legal obligations (e.g., tax law, commercial law)
With your consent, to send you marketing communications (see Section 7)

5. How we disclose personal information

We may share your personal information with:

Shopify, our e-commerce platform provider, and its sub-processors (e.g., payment processing, hosting, fraud prevention)
Payment providers to process your transaction
Shipping and logistics providers to deliver your order
Professional advisors (e.g., accountant, tax authority) where legally required
Third parties in connection with a business transfer, or where required by law

We do not sell your personal information, and we do not currently use third-party advertising or analytics cookies (see Section 6).

6. Cookies

Our store uses only strictly necessary and functional cookies — for example, to keep items in your cart, remember your login, and secure checkout. These do not require consent under applicable law (§ 25 TTDSG / GDPR), as they are essential to the operation of the store.

We do not currently use analytics or advertising/marketing cookies. If this changes in the future, we will update this Privacy Policy and request your consent through a cookie banner before any non-essential cookies are set.

7. Newsletter and marketing communications

If you choose to sign up for our newsletter or otherwise consent to receive marketing communications, we will use your email address to send you updates, offers, and promotions. This processing is based on your consent, which you may withdraw at any time by using the unsubscribe link in any email or by contacting us directly. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, and you will still receive non-promotional emails related to your account or orders.

8. Relationship with Shopify

Our store is hosted by Shopify, which also processes personal data to provide and improve the underlying platform, including certain cross-store features (e.g., fraud prevention, personalized advertising infrastructure). For these specific purposes, Shopify acts as an independent controller. You can read more in Shopify's Consumer Privacy Policy and exercise certain rights via the Shopify Privacy Portal.

9. Third-party websites

Our store may link to third-party websites. We are not responsible for the privacy practices of those sites, and we recommend reviewing their privacy policies separately.

10. Children's data

Our store is not directed at children, and we do not knowingly collect personal information from anyone under 16 years of age. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Security and retention

We use appropriate technical and organizational measures to protect your personal information, though no method of transmission or storage is completely secure. We retain personal information only as long as necessary to fulfill the purposes described in this policy, including to comply with legal, accounting, or reporting obligations (e.g., German commercial and tax law generally requires retention of invoices for 10 years).

12. Your rights

Under the GDPR, you have the right to:

Access the personal information we hold about you
Rectify inaccurate personal information
Erase your personal information ("right to be forgotten")
Restrict or object to processing
Data portability
Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us using the details in Section 1. We may need to verify your identity before responding, and will respond within the timeframes required by law.

13. Complaints

If you have concerns about how we handle your personal information, please contact us first. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority in Germany is:

Die Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen) Prinzenstraße 5, 30159 Hannover, Germany Website: https://lfd.niedersachsen.de

14. International transfers

As our store operates on Shopify's infrastructure, your personal information may be transferred to and processed in countries outside the EEA/UK. Where this occurs, we rely on approved transfer mechanisms such as the European Commission's Standard Contractual Clauses, or transfers to countries recognized as providing an adequate level of data protection.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. The "Last updated" date at the top reflects the most recent revision.