Privacy and data protection


As of 11 Oct 2026

Privacy Policy

We are pleased that you are visiting our website https://ridingboutique.com/ and thank you for your interest in our company and our products. Protecting your privacy when using our website is important to us. We take data protection very seriously and treat your data in accordance with the statutory provisions.

You can find definitions of the terms used (e.g. "personal data" or "processing") in Art. 4 GDPR.

Name and contact details of the controller:

 

Riding Boutique

Owner Daniela Pettinger 

Königsöd 18 in 94486 Osterhofen

E-mail: contact@ridingboutique.de

 

1. Collection and storage of personal data and the nature and purpose of their use

We only collect, use and pass on your personal data if this is permitted within the legal framework or you consent to the data collection.

Personal data is all information that serves to identify you and can be traced back to you, for example your name, your e-mail address and telephone number.

You can also visit this website without providing any personal details. However, to improve our online offer we process your access data for this website. This access data includes, for example, the file you requested or the name of your internet provider. Technically, this access data also includes your IP address, which is personal data. We do not combine the data with other data sources and delete it after a short time (see below).

You can find further information below:

 

 

a) When visiting the website

 

Access data

When you open our website, the browser used on your device automatically sends information to the server of our website. This information is stored temporarily in a so-called log file. The following information is collected without any action on your part and stored until automated deletion:

 

• Website visited

• Time of access

• Amount of data sent in bytes

• Source/referrer, from which you reached the page

• Browser used

• Operating system used

• IP address used

 

The server log files are stored for a maximum of 7 days and then deleted. The data is stored for security reasons, e.g. to be able to clarify cases of misuse. If data has to be retained for evidentiary reasons, it is exempt from deletion until the incident has been finally clarified.
  

The legal basis for data processing is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest follows from the purposes of data collection listed above.

Hosting: This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes data on our behalf (commissioned processing under Art. 28 GDPR). The legal basis is our legitimate interest in the secure and efficient operation of our online offer (Art. 6 (1) sentence 1 lit. f GDPR). The server is located in a data centre in Germany. IONOS privacy notice: https://www.ionos.de/terms-gtc/datenschutzerklaerung/

 

Cookies

To make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device. The use of cookies increases the user-friendliness and security of this website. Some of the cookies we use are deleted again after the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your device and enable us to recognise your browser on your next visit (persistent cookies). You can set your browser so that you are informed about the setting of cookies and decide individually whether to accept them, or exclude the acceptance of cookies for certain cases or in general.

If cookies are not accepted, the functionality of our website may be limited.

We use technically necessary cookies (e.g. for the shopping cart, login and security) on the basis of Section 25 (2) no. 2 TDDDG and Art. 6 (1) sentence 1 lit. f GDPR. We only use analytics cookies (Google Analytics 4) if you consent in the cookie notice (see next section; Section 25 (1) TDDDG, Art. 6 (1) sentence 1 lit. a GDPR). We do not use marketing cookies.

 

Web analytics and conversion measurement (Google Tag Manager, Google Analytics 4)

If you choose "Allow cookies" in our cookie notice, we load Google Tag Manager and use Google Analytics 4 through it. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google). Without your consent the Tag Manager is not loaded and no usage data is sent to Google. We store your decision in a technically necessary cookie (user_allowed_save_cookie if you accept, rb_cookies_declined if you decline); you can change it at any time via "Cookie settings" in the footer.

We use it to measure how our website is used: pages and products viewed, searches, products in the cart, the individual steps of the checkout and completed orders (order value, items, shipping and payment method, without name or address). The evaluation uses a randomly assigned identifier in a cookie, not your name. Google Analytics 4 does not store full IP addresses. We use the data to improve our offer, our site navigation and our advertising (SEO and online marketing) and to measure their effectiveness. We have set the retention period of the usage data to 14 months.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future via "Necessary only" in the cookie settings (footer) or by deleting the cookies of this website in your browser. Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission). We have concluded the data processing terms with Google. More information: https://policies.google.com/privacy

Social networks (links)

On our website we link to our profiles on Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). These are simple links, not social plugins: only when you click a link is a connection to the respective network established; then its privacy policy applies.

 

b) When contacting us

If you contact us as website operator through the contact options offered, your details are stored so that they can be used to process and answer your enquiry.

If you order goods and thereby a contract with us is concluded, the personal data you provide is processed and stored to carry out the contract.

After the contract has been fully processed, your data is stored in consideration of tax and commercial law retention periods, but blocked for other purposes and deleted after these periods have expired.

For further information please also read the sections "Disclosure of data", "Data subject rights" and "Right to object" below.

 

Use of our contact form

For questions of any kind we offer you the option to contact us via a form provided on the website. Your name and a valid e-mail address are required so that we know who the enquiry comes from and can answer it. Further information can be provided voluntarily. Data processing for the purpose of contacting us takes place under Art. 6 (1) sentence 1 lit. b GDPR (if your enquiry concerns a contract or its preparation) or lit. f GDPR (legitimate interest in answering your enquiry). We delete the data as soon as your enquiry has been dealt with, unless statutory retention obligations apply.

 

Creating and using a customer account

If you want to buy a product from us, you can set up a password-protected customer account or order as a guest. This is a direct online access to your master data stored with us. In your customer account you can view and, if applicable, manage the following data:

  • Your contact data stored with us (title, name, addresses, e-mail address, telephone, password change)
  • Your orders and their status
  • Your newsletter settings and social media accounts linked to your account (Google)

 

Access to your customer account is only possible after entering your personal password. You should always treat your access information confidentially and close the browser window when you have finished communicating with us, especially if you share the computer with others.

To prevent unauthorised access by third parties to your personal data, the connection is encrypted using TLS technology.

If you do not want a password-protected customer account, you can of course delete it at any time. Please then send us an e-mail to contact@ridingboutique.de with a corresponding request.

 

Newsletter subscription

We offer you a newsletter in which we inform you about current events and offers. If you want to subscribe to the newsletter you must provide a valid e-mail address. By subscribing to the newsletter you agree to receiving the newsletter and to the procedure described. We use the double opt-in procedure: after you sign up we send you a confirmation e-mail; your subscription only becomes active once you confirm the link in it. We use the double opt-in procedure: after you sign up we send you a confirmation e-mail; your subscription only becomes active once you confirm the link in it.

You subscribe to the newsletter by expressly consenting under Art. 6 (1) sentence 1 lit. a GDPR:

"Stay informed with our newsletter! Special promotions, bargains, new arrivals exclusively for our newsletter subscribers. Don't miss any special offer, discount or announcement!

Sign up NOW (you can withdraw your consent to receiving the newsletter at any time)"

 

Withdrawal and cancellation: you can withdraw your consent to receive the newsletter at any time and thereby cancel the newsletter subscription. After your cancellation your personal data will be deleted. Your consent to the sending of the newsletter expires at the same time.

You can unsubscribe from the newsletter via the link provided in the newsletter or by a corresponding message to contact@ridingboutique.de .

 

Login and registration with Google (social login)

If you log in or register with your Google account, our website redirects you to Google. After your confirmation Google transmits to us your name, your e-mail address and a Google identifier (and, if applicable, your profile picture); with this we create your customer account or link it to your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to Google LLC in the USA (EU-US Data Privacy Framework). The legal basis is Art. 6 (1) sentence 1 lit. b GDPR (initiation and performance of a contract) or your consent by confirming with Google (lit. a). You can remove the link at any time under "My Account > My social media accounts". Further information: https://policies.google.com/privacy

 

2. Disclosure of data

Your data is not transferred to third parties for purposes other than those listed below. We only pass on your personal data to third parties if:

  • you have given your express consent under Art. 6 (1) sentence 1 lit. a GDPR,
  • disclosure is necessary under Art. 6 (1) sentence 1 lit. f GDPR to assert, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed, 
  • in case there is a legal obligation for the disclosure under Art. 6 (1) sentence 1 lit. c GDPR, and
  • this is legally permissible and, under Art. 6 (1) sentence 1 lit. b GDPR, necessary for the performance of contractual relationships with you , in particular
    • in the course of contract processing to the transport company commissioned with the delivery (depending on your choice DHL, DPD, GLS or Hermes) insofar as this is necessary for delivering the goods,
    • We currently do not integrate external payment service providers (e.g. PayPal). You can pay in advance (bank transfer), on invoice or by cash on delivery; for cash on delivery the transport company collects the amount.
    • to service providers who process data on our behalf: our hosting provider IONOS and, if you have consented or log in with Google, Google (see above).

 

 

3. Data subject rights:

You have the right:

  • under Art. 15 GDPR to request information about your personal data processed by us. In particular you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, and about the existence of automated decision-making including profiling and, where applicable, meaningful information about its details;
  • under Art. 16 GDPR to demand the immediate rectification of inaccurate or completion of your personal data stored by us;
  • under Art. 17 GDPR to demand the erasure of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
  • under Art. 18 GDPR to demand the restriction of the processing of your personal data insofar as you contest the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer need the data, but you need it for the establishment, exercise or defence of legal claims or you have objected to the processing under Art. 21 GDPR;
  • under Art. 20 GDPR to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to demand its transmission to another controller;
  • under Art. 7 (3) GDPR to withdraw your consent once given at any time towards us. As a consequence we may no longer continue the data processing that was based on your consent in the future and
  • under Art. 77 GDPR to lodge a complaint with a supervisory authority. As a rule you can contact the supervisory authority of your habitual residence or place of work or of our registered office for this.
  • The supervisory authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), 91522 Ansbach, www.lda.bayern.de.

 

4. Right to object

Insofar as your personal data is processed on the basis of legitimate interests under Art. 6 (1) sentence 1 lit. f GDPR, you have the right under Art. 21 GDPR to object to the processing, provided there are grounds relating to your particular situation or the objection is directed against direct marketing. In the latter case you have a general right to object, which we will implement without you stating a particular situation. If you would like to exercise your right of withdrawal or objection, an e-mail to the following address is sufficient: contact@ridingboutique.de

 

5. Data security

During your website visit we use the widespread TLS procedure (Transport Layer Security) in connection with the highest level of encryption supported by your browser. This is usually 256-bit encryption. You can recognise that a page is transmitted encrypted by the padlock symbol in the address bar of your browser.

Furthermore, we use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

 

6. Currentness and amendment of this privacy policy

This privacy policy is currently valid. It is dated As of 11 Oct 2026. 

Due to the further development of our website and offers, or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current privacy policy can be accessed by you at any time on the website athttps://ridingboutique.com/privacy-policy.