Privacy Notice
This is a translation. In case of doubt, the German version applies.
Protecting your personal data is important to us. This privacy policy explains which personal data we process when you visit our online shop and place an order, for what purpose, on what legal basis and for how long.
1. Controller
teeblume UG (haftungsbeschränkt)
Managing director: Hermann Blume
Bendhütter Str. 131, 41066 Mönchengladbach, Germany
Phone: +49 (0)1577 5377000
E-mail: mail@tokyo-design-studio.com
2. Your rights
You have the following rights regarding your personal data:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You may object to processing for direct marketing at any time without giving reasons.
To exercise your rights, simply send an e-mail to mail@tokyo-design-studio.com.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
3. Hosting and server log files
Our shop runs on a server in a data centre in Germany. Where we use external service providers for this, we do so on the basis of a data processing agreement (Art. 28 GDPR).
Each time you access our website, your browser automatically transmits data to our server (server log files): IP address, date and time of access, page requested, referrer URL, browser type and version, and operating system. This data is not combined with other data.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security and stability of our website. Log files are deleted after seven days at the latest unless they are needed longer to investigate a security incident.
The connection to our website is SSL/TLS encrypted.
4. Cookies and cookie settings
Our shop uses cookies, small text files stored on your device.
Strictly necessary cookies (e.g. for the shopping cart, login, language setting and storing your cookie choice) are used on the basis of § 25(2) no. 2 TDDDG. Subsequent data processing is based on Art. 6(1)(b) GDPR (pre-contractual measures and contract performance) or Art. 6(1)(f) GDPR (a functioning shop). Session cookies are deleted when you close your browser.
All other cookies and services are only used with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the “Cookie settings” link at the bottom of every page.
You can also delete or block cookies in your browser; some shop functions may then not be available.
5. Orders and contract processing
To process your order, we process the data required for this, e.g. name, billing and delivery address, e-mail address, phone number if provided, items ordered and payment information. Without this data we cannot conclude or perform the contract.
The legal basis is Art. 6(1)(b) GDPR. After the contract has been fully processed, the data is restricted from further use and deleted after the statutory retention periods under tax and commercial law (generally 6 or 10 years, Art. 6(1)(c) GDPR).
6. Shipping with DHL
For delivery, we pass your name and delivery address to Deutsche Post / DHL Group (DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany). The legal basis is Art. 6(1)(b) GDPR.
We only pass your e-mail address and, if provided, phone number to DHL if you have consented to this during checkout, so that DHL can notify you of the delivery date (Art. 6(1)(a) GDPR). You can withdraw this consent at any time with effect for the future, e.g. by e-mail to us or directly to DHL.
7. Payment services
PayPal and credit card: If you pay with PayPal or credit card, your payment data (e.g. name, address, e-mail address, order amount) is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Credit card payments are also processed via PayPal; no PayPal account is required. PayPal is itself responsible for processing the payment. More information: PayPal privacy statement.
PayPal Pay Later, direct debit and Google Pay: These payment methods are also processed via PayPal. For Pay Later (payment after 30 days or in monthly instalments), PayPal usually checks your creditworthiness and may transmit data to credit agencies for this purpose; this is the responsibility of PayPal. With Google Pay, data is also exchanged with Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google privacy policy).
Gambio Hub: Payment methods are integrated into our shop via the Gambio Hub of Gambio GmbH, Parallelweg 30, 28219 Bremen, Germany. The order data required for payment is transmitted to the Gambio Hub and from there to the selected payment provider.
Prepayment: If you pay by bank transfer, we process the data from your transfer (name, IBAN, amount, reference) to allocate the payment.
The legal basis in each case is Art. 6(1)(b) GDPR.
8. Customer account
If you create a customer account, we store the data you provide (e.g. name, address, e-mail address) and your order history so that you can complete future orders faster and view previous orders. The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time; statutory retention periods remain unaffected.
9. Contacting us
If you contact us via the contact form, e-mail or phone, we process your details to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). The data is deleted once your enquiry has been dealt with and no retention obligations apply.
10. Newsletter
If you subscribe to our newsletter, we use your e-mail address exclusively to send the newsletter. Registration uses the double opt-in procedure: you receive an e-mail with a confirmation link, and your address is only activated after confirmation. We store the time of registration and confirmation as proof.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every e-mail or by sending us a message.
11. Google reCAPTCHA
To protect our forms (contact, newsletter) against spam and automated access, we use Google reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Among other things, your IP address and information about your browser and your use of the form are transmitted to Google. Transfer to the USA is possible; Google is certified under the EU-US Data Privacy Framework.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our website against misuse. More information: Google privacy policy.
12. Customer reviews
If you submit a product review, we publish your review, the date and the name or pseudonym you provide. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
13. Trusted Shops
Our website includes the Trusted Shops Trustbadge to display our trust mark and reviews and to offer buyers Trusted Shops products (e.g. buyer protection and reviews) after an order. The provider is Trusted Shops SE, Subbelrather Str. 15c, 50823 Cologne, Germany.
When the Trustbadge is loaded, the web server automatically saves a server log file (including IP address, date and time, amount of data transferred). This data is stored to analyse security incidents and deleted after 90 days at the latest. Trusted Shops also uses service providers from the USA; an adequate level of data protection is ensured.
If you use Trusted Shops products after your order or are already registered for them, further data from your order is transmitted to Trusted Shops. Whether you are already registered is checked using an encrypted value (hash) of your e-mail address, which Trusted Shops cannot decrypt and which is deleted after the check.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure shopping and a trustworthy presentation of our shop. More information: Trusted Shops privacy policy.
14. Links to social networks
Our website links to our pages on Facebook, Instagram and Pinterest. These are simple links – no data is transmitted to these networks when you visit our shop. Only when you click a link do the privacy policies of the respective provider apply.
15. Storage period
We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. After that, the data is deleted.
Last updated: October 2026