Privacy Policy

Last updated: Oct 13, 2026

EST. NOTE operates this store and website, including all related information, content, features, tools, products, and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). EST. NOTE

 is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. In the event of a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy shall govern with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described herein.

1. Collection and Processing of Personal Information
When we use the term "personal information," we refer to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that has been collected anonymously or de-identified. We may collect or process the following categories of personal information:

  • Contact Details: including your name, address, billing address, shipping address, phone number, and email address.
  • Financial Information: including credit card, debit card, and bank account numbers, payment card information, transaction details, and payment confirmations.
  • Account Information: including your username, password, security questions, and settings.
  • Transaction Information: including items you view, put in your cart, add to your wishlist, or purchase, return, exchange, or cancel, as well as your past transactions.
  • Communications: information you provide in correspondence with us, such as customer support inquiries.
  • Device Information: information about your device, browser, or network connection, your IP address, and other unique identifiers.
  • Usage Information: information regarding how and when you interact with the Services.

2. Cookies
We use cookies to operate and improve our Services, conduct analytics, and better understand user interaction.

  • Necessary Cookies: Essential for the operation of the website (e.g., login, shopping cart).
  • Performance and Analytics Cookies: Help us understand how visitors use our store (e.g., Google Analytics).
  • Advertising and Marketing Cookies: Help us show you relevant advertisements. Management: You can manage your preferences through the cookie banner that appears upon your first visit to our website.

3. Sources of Personal Information
We collect data directly from you, automatically via your device (through cookies), and from our service providers (such as Shopify) and partners.

4. How We Use Your Personal Information

  • Provision of Services: To fulfill our contract with you (Art. 6(1)(b) GDPR), including payment processing and shipping.
  • Marketing and Advertising: Based on your consent (Art. 6(1)(a) GDPR) or our legitimate interest (Art. 6(1)(f) GDPR).
  • Security and Fraud Prevention: To ensure the security of our website (Art. 6(1)(f) GDPR).
  • Communication: For customer support and responding to inquiries.
  • Legal Reasons: To comply with legal obligations (Art. 6(1)(c) GDPR).

5. Disclosure of Personal Information
We may disclose your data to third parties, including:

  • To service providers such as Shopify for IT management, payments, and shipping.
  • To business and marketing partners based on your consent.
  • In connection with business transactions (e.g., mergers) or for legal reasons.

6. Relationship with Shopify
The Services are hosted by Shopify. Information you submit will be transmitted to and processed by Shopify. Shopify may also use your data to improve its own services. Further information can be found in the Shopify Privacy Policy.

7. Security and Retention
No security measure is perfect. We retain your data for as long as necessary to provide the Services, fulfill legal obligations, or resolve disputes.

8. Your Rights As a user in the EEA, you have the following rights:

  • Right of Access: You can request information about your stored data.
  • Right to Erasure: You can request the deletion of your data.
  • Right to Rectification: You can have inaccurate data corrected.
  • Right to Data Portability: You can request a copy of your data in a standard format.
  • Right to Object: You can object to the processing of your data.
  • Right to Withdraw Consent: You can withdraw previously given consent at any time.

9. Complaints
If you have complaints, please contact us at the address provided below. You also have the right to lodge a complaint with your local data protection supervisory authority.

10. International Transfers
We may transfer your data to countries outside the EEA (e.g., Canada or the USA). In doing so, we rely on recognized mechanisms such as the European Commission's Standard Contractual Clauses.

11. Contact
For questions regarding this Privacy Policy or to exercise your rights, please contact us at:

EST. NOTE
Representative: Hyemin Lee
Address: Bartelsstraße 35, 20357 Hamburg, Germany
Email: contact@estnote.com

For the purposes of applicable data protection laws, we are the data controller of your personal information.

12. Video Surveillance in Our Shop

12.1 Controller

The Kind Company GmbH (operating as EST. NOTE)
Bartelsstraße 35, 20357 Hamburg, Germany
Represented by the Managing Director: Hyemin Lee
Register Court: Amtsgericht Hamburg, HRB 198481
VAT ID (USt-IdNr.): DE461895846
Telephone: +49 163 968 3920
Email: contact@estnote.com
Website: https://estnote.com

12.2 Monitored Areas

Three stationary video cameras (Ring) are operated within our retail shop: specifically targeting the checkout area, the entrance/exit, and the internal staircase. Audio recording functions are strictly and permanently deactivated. Public spaces outside our shop premises (such as public sidewalks or adjacent properties) are not deliberately captured or monitored.

12.3 Purposes of Processing

Processing is carried out for:

  • Exercising our domiciliary rights (Hausrecht);
  • Protecting our property and merchandise against theft, vandalism, and property damage;
  • Ensuring the safety of customers, visitors, and employees;
  • Prevention and investigation of criminal offences, as well as establishing, exercising, or defending legal claims (preservation of evidence).

12.4 Legal Basis

The legal basis for this video surveillance is Art. 6(1)(f) GDPR in conjunction with Section 4 of the German Federal Data Protection Act (§ 4 BDSG - Video surveillance of publicly accessible spaces). Where recordings exceptionally capture special categories of personal data (Art. 9(1) GDPR, such as health data visible via physical mobility aids), processing is carried out as a precaution pursuant to Art. 9(2)(f) GDPR in conjunction with Art. 6(1)(f) GDPR.

12.5 Legitimate Interests

Our legitimate interests pursuant to Art. 6(1)(f) GDPR are the protection of our proprietary property and our largely handmade, curated, and unique items against loss and damage; safeguarding our employees and patrons; crime prevention; and securing reliable evidence to enforce or defend civil and criminal claims.

12.6 Retention Period and Deletion

  • Video recordings: Automatically overwritten and permanently deleted after a maximum of 72 hours.
  • Snapshots (still images): Automatically overwritten and permanently deleted after 7 days.
  • Incident-related retention: If a concrete incident occurs (e.g., theft, property damage, physical assault, or workplace accident), the relevant footage is extracted and stored separately only for as long as strictly necessary for investigation, police reporting, or the enforcement/defense of legal claims. Once final proceedings are concluded, this footage is immediately erased.

12.7 Recipients of Personal Data

  • Processor: Ring LLC and its affiliates (Amazon group), providing camera hardware, software infrastructure, and encrypted cloud storage under a formal Data Processing Agreement (Art. 28 GDPR).
  • Third Parties: Strictly on a case-by-case basis and only where legally permissible or required: competent law enforcement authorities, public prosecutors, legal counsel, courts, and liability/property insurers.
  • Internal Access: Restricted strictly to the Managing Director and designated authorized personnel on a strict need-to-know basis.

12.8 Transfers to Third Countries (USA)

As camera data is stored via cloud infrastructure provided by Ring LLC / Amazon, personal data may be transferred to or accessed from servers in the United States. Ring LLC is certified under the EU-U.S. Data Privacy Framework (DPF), ensuring an adequate level of data protection in accordance with the European Commission's adequacy decision pursuant to Art. 45 GDPR. In addition, Standard Contractual Clauses (SCCs pursuant to Art. 46(2)(c) GDPR) have been concluded as supplementary safeguards.

12.9 Rights of the Data Subject

Provided the statutory requirements are met, you have the right to request access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR).

  • Right to Object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on Art. 6(1)(f) GDPR. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
  • Note on technical feasibility: Due to the automated deletion cycle of 72 hours (7 days for snapshots), requests for footage export or identification must be submitted without undue delay (providing the exact date, time, and appearance/clothing) to contact@estnote.com. Once recordings are automatically overwritten, retrieval is technically impossible.

12.10 Supervisory Authority and Right to Lodge a Complaint

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a competent supervisory authority. The authority responsible for our company location is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI)

Ludwig-Erhard-Straße 22, 7. OG, 20459 Hamburg, Germany

Email: mailbox@datenschutz.hamburg.de | Website: https://datenschutz-hamburg.de

12.11 Provision of Data

The provision of personal data is neither legally nor contractually mandatory. Entering our premises is voluntary; visitors who do not wish to be recorded may refrain from entering the designated and marked surveillance zones.

12.12 Automated Decision-Making and Biometrics

No automated individual decision-making, including profiling pursuant to Art. 22 GDPR, takes place. Biometric recognition technologies, such as automated facial recognition, are not utilized.

12.13 On-Site Notice

This comprehensive policy supplements the transparent warning signs (video surveillance pictogram) visibly displayed at the entrance of our retail premises in accordance with Art. 13 GDPR and § 4(2) BDSG. A printed copy of this complete information is accessible at our checkout counter upon request.