Privacy policy

Privacy Policy

1) Introduction and Contact Details of the Controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below, we inform you about how we handle your personal data when you use our website. Personal data is any data with which you can be personally identified.

1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is CLOUVOU GmbH, Mittelweg 43, 25479 Ellerau, Germany, Tel.: +49 4106 9789940, Email: info@clouvou.de. The controller responsible for the processing of personal data is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.

2) Data Collection When You Visit Our Website

2.1 When you use our website for information purposes only, i.e. if you do not register or otherwise provide us with information, we only collect data that your browser transmits to our server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

Our visited website
Date and time of access
Amount of data sent in bytes
Source/referrer from which you reached the page
Browser used
Operating system used
IP address used (if applicable: in anonymized form)

The processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to check the server log files retrospectively should there be specific indications of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string “https://” and the padlock symbol in your browser bar.

3) Hosting & Content Delivery Network

Shopify
We use the system of the following provider to host our website and display its content: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”).

Data is also transferred to: Shopify Inc., 150 Elgin St, Ottawa, ON K2P 1L4, Canada.

All data collected on our website is processed on the provider's servers. We have concluded a data processing agreement with the provider, which ensures the protection of our website visitors' data and prohibits unauthorized disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is guaranteed by an adequacy decision of the European Commission.

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after you close your browser (so-called “session cookies”); others remain on your device for longer and allow page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage period in the overview of your web browser's cookie settings.

If personal data is also processed by individual cookies we use, the processing is carried out either in accordance with Art. 6 (1) (b) GDPR to perform the contract, in accordance with Art. 6 (1) (a) GDPR if you have given your consent, or in accordance with Art. 6 (1) (f) GDPR to protect our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the website visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or exclude the acceptance of cookies for certain cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contacting Us

5.1 Trusted Shops
We use the services of the following provider for review reminders: Trusted Shops AG, Subbelrather Str. 15c, 50823 Cologne, Germany.

Exclusively on the basis of your express consent in accordance with Art. 6 (1) (a) GDPR, we transmit your email address and, if applicable, other customer data to the provider so that it can contact you by email with a review reminder. You can withdraw your consent at any time with effect for the future, either to us or to the provider.

We are jointly responsible with the provider for the processing described above in accordance with Art. 26 GDPR. The joint controllership agreement can be viewed here: https://help.etrusted.com/hc/de/articles/4402587369105-Vertrag-%C3%BCber-die-gemeinsame-Verantwortlichkeit-nach-DSGVO

5.2 When you contact us (e.g. via contact form or email), personal data is processed exclusively for the purpose of handling and responding to your request and only to the extent necessary for this. The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) (f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) (b) GDPR. Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively resolved, provided there are no statutory retention obligations to the contrary.

6) Data Processing When Opening a Customer Account

In accordance with Art. 6 (1) (b) GDPR, personal data will continue to be collected and processed to the extent necessary when you provide it to us when opening a customer account. You can see which data is required to open an account in the input mask of the corresponding form on our website.

You can delete your customer account at any time by sending a message to the controller's address given above. After your customer account has been deleted, your data will be deleted, provided that all contracts concluded through it have been fully processed, no statutory retention periods prevent this, and we have no continuing legitimate interest in storing it further.

7) Use of Customer Data for Direct Marketing

Subscription to Our Email Newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing further data is voluntary and is used to address you personally. For sending the newsletter, we use the so-called double opt-in procedure, which ensures that you only receive the newsletter after you have expressly confirmed your consent to receive it by clicking a verification link sent to the email address you provided.

By activating the confirmation link, you give us your consent to use your personal data in accordance with Art. 6 (1) (a) GDPR. In doing so, we store the IP address registered by your Internet Service Provider (ISP) as well as the date and time of registration in order to be able to trace any possible misuse of your email address at a later date. The data we collect when you subscribe to the newsletter is used strictly for its intended purpose.

You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the controller named at the beginning. After you unsubscribe, your email address will be deleted from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to use the data in a way that goes beyond this, which is permitted by law and about which we inform you in this policy.

Direct Marketing to Existing Customers (Section 7 (3) UWG)
If you have provided us with your email address in connection with the purchase of goods, we use it in accordance with Section 7 (3) of the German Act Against Unfair Competition (UWG) to send you direct marketing for our own similar goods from our range (in particular ergonomic office furniture such as office chairs and desks, as well as related accessories). We clearly inform you of the intended use of your email address and your right to object at any time when we collect your email address during the ordering process.

According to the case law of the Court of Justice of the European Union (judgment of 13 November 2025, C-654/23), no separate consent and no additional legal basis under Art. 6 GDPR is required for this, as Art. 13 (2) of the ePrivacy Directive (Directive 2002/58/EC) in conjunction with Section 7 (3) UWG applies as lex specialis in this respect. Insofar as a legal basis under the GDPR should also be required, we base the processing on Art. 6 (1) (f) GDPR; our overriding legitimate interest lies in direct marketing to our existing customers.

As part of this direct marketing, we exclusively send advertising for goods that are to be regarded as “similar” to the goods you have purchased within the meaning of Section 7 (3) UWG. As proof, we store the date and source of the collection of your email address as well as the fact that you were given the notice pursuant to Section 7 (3) No. 4 UWG.

Objection: You can object to the use of your email address for direct marketing at any time with effect for the future, without incurring any costs other than the transmission costs according to the basic rates. An unsubscribe link is included in every email; alternatively, an informal message to info@clouvou.de is sufficient. After your objection, your email address will be removed from the marketing distribution list without delay. The objection does not affect the use of your customer account or existing contractual relationships.

Email Service Provider Klaviyo
To send our newsletter and our direct marketing to existing customers, we use the service provider Klaviyo, Inc., 125 Summer Street, Floor 6, Boston, MA 02110, USA (“Klaviyo”). On our behalf, the provider processes in particular your email address, the time and source of the address collection or subscription, your IP address, and delivery and interaction data. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.

The personal data is transferred to the USA. Klaviyo is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the European Commission's adequacy decision pursuant to Art. 45 GDPR. In addition, standard contractual clauses pursuant to Art. 46 (2) (c) GDPR have been concluded.

The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected, at the latest after you unsubscribe or object, provided there are no statutory retention obligations to the contrary. Further information on data protection at Klaviyo: https://www.klaviyo.com/legal/privacy-policy

8) Data Processing for Order Handling

8.1 Transmission of Image Files by Email for Order Handling
On our website, we offer customers the option of commissioning the personalization of products by sending image files by email. The submitted image is used as a template for personalizing the selected product.

Using the email address provided on the website, the customer can send us one or more image files from the storage of the device they are using. We then collect, store and use the files transmitted in this way exclusively to produce the personalized product in accordance with the respective service description on our website. If the transmitted image files are passed on to specialized service providers for the production and processing of the order, you will be explicitly informed of this in the following paragraphs. No further disclosure takes place. If the transmitted files or digital images contain personal data (in particular images of identifiable persons), all of the processing operations just mentioned are carried out exclusively for the purpose of processing your online order in accordance with Art. 6 (1) (b) GDPR.

After the order has been fully processed, the transmitted image files are automatically and completely deleted.

8.2 Insofar as necessary for the performance of the contract for delivery and payment purposes, the personal data we collect will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) (b) GDPR.

If, on the basis of a corresponding contract, we owe you updates for goods with digital elements or for digital products, we process the contact details you provided when ordering (name, address, email address) in order to personally inform you of upcoming updates within the legally prescribed period by suitable means of communication (e.g. by post or email), in accordance with our statutory information obligations under Art. 6 (1) (c) GDPR. Your contact details are used strictly for the purpose of notifications about updates we owe and are processed by us for this purpose only to the extent necessary for the respective information.

To process your order, we also work with the following service provider(s), who support us in whole or in part in performing concluded contracts. Certain personal data is transmitted to these service providers in accordance with the following information.

9) Website Functionalities

Trusted Shops Trustbadge
To display external customer reviews and/or an externally awarded trust mark, graphic elements from the following provider are integrated into our website: Trusted Shops AG, Subbelrather Str. 15C, 50823 Cologne, Germany.

When you visit a page of our website that contains such graphic elements, your browser establishes a direct connection to the provider's servers in order to load the elements properly. In the process, certain browser information, including your IP address, is transmitted to the provider.

If personal data is also processed in the process, this is done in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the optimal marketing of our offer and the attractive design of our website.

In the case of an online order with us, further processing may take place. Depending on your express consent in accordance with Art. 6 (1) (a) GDPR, your order information (order total, order number, and if applicable the purchased product) and your email address are transmitted in encrypted form to the provider via the Trustbadge after an order is completed, in order to check any existing registration for the provider's services (in particular “Buyer Protection”) and, if applicable, to enable a new registration.

If an existing registration is found, or in the event of a new registration with the provider for its services (in particular Buyer Protection), your order information (order total, order number, purchased product) and your email address are transmitted to the provider on the basis of the contractual agreement with the provider in accordance with Art. 6 (1) (b) GDPR and further processed by the provider in order to provide the services (in particular Buyer Protection).

10) Tools and Other Services

Wolters Kluwer
For our accounting, we use the cloud-based accounting software of the following provider: Wolters Kluwer N.V., Zuidpoolsingel 2, 2408 ZE Alphen aan den Rijn, the Netherlands.

The provider processes our company's incoming and outgoing invoices and, if applicable, our bank transactions in order to automatically record invoices, match them to transactions, and use them to prepare the financial accounts in a partially automated process.

If personal data is also processed in the process, the processing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in the efficient organization and documentation of our business transactions.

Amainvoice
For our accounting, we use the cloud-based accounting software “Amainvoice” of amaZervice GmbH, Im Öschle 6, 87499 Wildpoldsried, Germany (“Amainvoice”).

Amainvoice processes our company's incoming and outgoing invoices and, if applicable, our bank transactions in order to automatically record invoices, match them to transactions, and use them to prepare the financial accounts in a partially automated process.

Further information on Amainvoice, the automated processing of data, and its privacy policy can be found at: amainvoice.de/?datenschutzbestimmungen#rechtliches-datenschutz

DATEV
For our accounting, we use the cloud-based accounting software of the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany.

11) Rights of the Data Subject

11.1 Applicable data protection law grants you the following data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the cited legal basis for the respective conditions of exercise:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent given pursuant to Art. 7 (3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

11.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST AS PART OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO CONTINUE PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU CAN EXERCISE YOUR OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

12) Duration of Storage of Personal Data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where applicable, the respective statutory retention period (e.g. retention periods under commercial and tax law).

When personal data is processed on the basis of express consent in accordance with Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

If there are statutory retention periods for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6 (1) (b) GDPR, this data will be routinely deleted after the retention periods expire, provided it is no longer required to perform or initiate a contract and/or we have no continuing legitimate interest in storing it further.

When personal data is processed on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

When personal data is processed for direct marketing purposes on the basis of Art. 6 (1) (f) GDPR, this data is stored until you exercise your right to object under Art. 21 (2) GDPR.

Unless otherwise stated in the other information in this policy about specific processing situations, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.