Privacy policy

Last updated: 8 July 2026

1. Data Controller

The controller responsible for processing personal data on this website and in the online shop is:

BLOXS GmbH
Tölzer Straße 37
82031 Grünwald
Germany

Phone: 089 244 182 183
Email: datenschutzⓐfamolino.com

Commercial Register: Munich Local Court, HRB 257573
VAT Identification Number: DE332910108

BLOXS GmbH operates the online shop under the famolino brand. The domain famolino.de redirects to famolino.com.

2. No Data Protection Officer

No Data Protection Officer has currently been appointed for BLOXS GmbH. Based on our current assessment, the size of the company and its current processing activities do not give rise to a statutory obligation to appoint a Data Protection Officer.

We review this assessment regularly, and in particular when there are changes to the size of the company, its data processing activities or the systems it uses. Data protection enquiries may be sent to datenschutzⓐfamolino.com.

3. General Information

We process personal data only to the extent necessary to provide our website and online shop, process orders, manufacture and personalise our products, communicate with you, fulfil legal obligations or act on the basis of your consent.

Personal data means any information relating to an identified or identifiable natural person. This includes, in particular, names, addresses, email addresses, telephone numbers, payment and order data, IP addresses, usage data, photos, URLs and personalised content.

Depending on the purpose, processing is carried out in particular on the following legal bases:

Article 6(1)(a) GDPR, where you have given your consent;
Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or for pre-contractual measures;
Article 6(1)(c) GDPR, where processing is necessary to comply with a legal obligation;
Article 6(1)(f) GDPR, where processing is necessary for the purposes of our legitimate interests and those interests are not overridden by your interests or fundamental rights and freedoms;
Article 9 GDPR, where special categories of personal data are concerned in an individual case;
Section 25 TDDDG, where information is accessed on or stored on your device.

4. Website Visits and Technical Access Data

When you access our website, technically necessary access data is processed. This may include, in particular:

IP address;
date and time of access;
pages and files accessed;
referrer URL;
browser type and version;
operating system;
language settings;
internet service provider;
technical status and error data.

This processing is intended to provide and maintain the technical operation and security of the website, ensure its stability, analyse errors and prevent abusive access. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide a secure and functional online service.

Technical access data is deleted or anonymised as soon as it is no longer required for these purposes, unless longer retention is necessary to investigate a security incident or comply with legal obligations.

5. Shopify and Hosting

Our online shop is operated through Shopify. Shopify provides, in particular, the technical infrastructure for the shop, hosting, checkout and order processing.

When you visit the shop, use the checkout or place an order, the following data may be processed in particular:

contact, billing and delivery details;
order and product data;
payment and transaction information;
customer account and login data, where a customer account is used;
device, browser and usage data;
personalisation data;
communications and support data.

This processing is intended to provide and secure the online shop, process orders and handle customer enquiries. The legal bases include, in particular, Article 6(1)(b), (c) and (f) GDPR.

Depending on the function concerned, Shopify may process personal data as a processor, as an independent controller or in another data protection role for certain processing activities. Shopify’s privacy information also applies:

https://privacy.shopify.com/de

6. Customer Accounts, Orders and Contract Processing

If you create a customer account, place an order or order as a guest, we process the data required to process the order and perform the contract. This includes, in particular:

first and last name;
billing and delivery address;
email address;
telephone number, where required for queries or delivery;
products and product variants ordered;
personalisation and configuration data;
payment and transaction data;
order, shipping, return and complaint data;
communications relating to the order.

This processing is carried out to perform the contract, manufacture and deliver the products ordered, and handle returns, complaints and statutory warranty claims. The legal basis is Article 6(1)(b) GDPR. Where statutory retention obligations apply, Article 6(1)(c) GDPR is the relevant legal basis.

Providing the data required for an order is necessary. As a rule, we cannot process the order without this data.

7. Personalised Products and NFC Cards

famolino offers personalised NFC cards and related products. To design, manufacture and encode them, you may enter or upload, in particular:

names;
text and subtitles;
photos;
telephone numbers;
URLs;
WhatsApp, SMS or FaceTime details;
labels and roles, such as “daughter”, “caregiver”, “family doctor” or “pharmacy”;
other contact and design data.

We process this data to create the requested design, encode the NFC function, process the order, answer queries, and handle repeat orders and complaints. Production and encoding are carried out by BLOXS GmbH itself.

Depending on the product, the NFC card may open an external function or address that you have provided, such as a phone call, FaceTime call, URL, WhatsApp chat or SMS chat. famolino does not provide its own digital landing pages or customer profiles for card recipients. The privacy policies of the relevant providers also apply when using external services.

8. Data Relating to Other People

When personalising a product, you may provide data relating to other people—for example, the names, photos, telephone numbers or other contact details of family members, caregivers, doctors, pharmacies or other contacts.

You may provide us with another person’s data only if you are authorised to do so. In particular, you must ensure that the people concerned are informed about the processing where required by law, and that any necessary consent or other legal basis is in place.

Please do not provide health data or other special categories of personal data unless this is strictly necessary for the requested design. Information such as “caregiver”, “family doctor” or “emergency call” may, in individual cases, allow conclusions to be drawn about someone’s health or other particularly sensitive circumstances. If you nevertheless provide such information, you must have an appropriate legal basis for doing so.

If data is not collected directly from the person concerned, information obligations under Article 14 GDPR may apply. The fact that the customer enters the data does not automatically remove these information obligations.

9. Product Configurator and Shopify Apps

The following Shopify apps, among others, are used to design and operate the shop:

GPTLab;
Translate & Adapt;
Search & Discovery;
XO Insert Code;
Hoppy Free Shipping;
Customix Personalizer;
Knowledge Base;
Forms;
Functions Creator;
Instant AI Page Builder;
Make;
Talon Backups;
Messaging.

Depending on their function, the apps are used for shop design, personalisation, search, communication, automation, backups and technical extensions to the shop.

Customix Personalizer

Customix Personalizer is used for product personalisation. This may involve processing photos, text, telephone numbers, URLs and other configuration data, and transferring them to Shopify.

Make

Make is used for automation and data transfers between Shopify, Pipedrive and other systems in use. Depending on the automation, order, contact, communication and personalisation data may be processed.

Talon Backups

Talon Backups creates backup copies of Shopify data. Depending on the scope of the backup, these may also include order, contact and personalisation data. Backup copies are protected and deleted or overwritten in accordance with the planned backup deletion policy.

Messaging

Messaging is used for customer and marketing communications. This may involve processing email addresses, telephone numbers, message content, order information and communication histories.

GPTLab and Instant AI Page Builder

GPTLab and Instant AI Page Builder are not used to process customers’ personal data. Nevertheless, please do not enter customer, order or personalisation data into these features.

10. Payment Processing

The following payment methods are available in the shop:

Shopify Payments and card payments;
PayPal;
Klarna;
Apple Pay;
Google Pay.

If you select a payment method, the data necessary to process the payment is transferred to the payment service provider involved. This may include your name, billing details, email address, payment and transaction data, IP address and order information.

Processing is carried out to perform the payment and purchase contract under Article 6(1)(b) GDPR and to comply with legal obligations under Article 6(1)(c) GDPR. Depending on the payment method, additional checks to prevent fraud or assess risk may be carried out.

11. Shipping and Delivery

To deliver your order, we transfer the data required for shipping to the shipping service provider commissioned for the delivery. This includes, in particular, your name, delivery address and, where applicable, email address and telephone number, as well as order and shipment data.

Depending on the delivery method, the following shipping service providers may be used in particular:

Deutsche Post or DHL;
UPS;
DPD;
Hermes.

The transfer is carried out to perform the contract under Article 6(1)(b) GDPR. Shipping service providers may also use your data to track shipments and send delivery notifications.

12. CRM and Pipedrive

We use Pipedrive for CRM and data management. The following data may be processed in particular:

names and contact details;
communication and conversation information;
order and customer history;
photos and other personalisation data, where required to process orders or provide customer support;
telephone numbers and URLs;
information relating to enquiries, complaints and repeat orders.

This processing is intended to provide customer support, handle enquiries, track orders and organise repeat orders. The legal bases are Article 6(1)(b) and (f) GDPR.

13. Email, Files and Microsoft Services

We use Microsoft services, in particular Microsoft 365 and/or Outlook, as well as OneDrive or SharePoint. Emails, attachments, contact details, order and communication information, and business documents may be processed in this context.

This processing is intended for business communications, storing and handling documents, and organising business operations. The legal bases are Article 6(1)(b) and (f) GDPR and, for documents that must be retained by law, Article 6(1)(c) GDPR.

Further information is available in Microsoft’s privacy statement:

https://privacy.microsoft.com/de-de/privacystatement

14. Telephony and AI Chatbot

sipgate GmbH and BEK Service GmbH may be used for telephony and communication services.

The following data may be processed in particular:

telephone numbers;
names and contact details;
time and duration of calls;
connection and technical data;
call notes;
information you provide as part of an enquiry.

BEK Service GmbH also provides an AI chatbot or communication solution. Chat content and the contact and communication data you provide may be processed in this context.

Phone calls are recorded or transcribed only if this is expressly announced and an appropriate legal basis exists.

15. Newsletter and Marketing Communications

Sendinblue GmbH, also known as Brevo, is used for newsletters and marketing communications.

This may involve processing, in particular, names, email addresses, telephone numbers, proof of consent, sending history, and email open and click rates. As a rule, newsletters are sent only after valid consent has been obtained through the double opt-in procedure, unless a statutory exception applies.

You may withdraw your consent at any time with effect for the future. You can do so by using the unsubscribe link in a marketing email or by sending a message to datenschutzⓐfamolino.com. The lawfulness of processing carried out before the withdrawal remains unaffected.

Open and click tracking is used only where permitted under data protection law and where the required consent has been obtained. Transactional and service emails required for contract processing are distinct from purely promotional messages.

16. Google Analytics

We use Google Analytics to analyse statistics and improve our online services. Google Analytics 4 is activated only after you have consented to the relevant processing.

The following data may be processed in particular:

online identifiers;
IP address or shortened or otherwise processed IP address;
device and browser data;
pages accessed and interactions;
source of the visit;
technical event and usage data.

The legal basis is your consent under Article 6(1)(a) GDPR. Section 25 TDDDG must also be observed where information is accessed on or stored on your device.

Depending on the configuration and services used, Google may process data outside the European Union or the European Economic Area. Further information is available in Google’s privacy policy:

https://policies.google.com/privacy?hl=de

You may withdraw any consent you have given through the website’s privacy settings, with effect for the future.

17. Cookies and Similar Technologies

Our website uses technically necessary cookies and similar technologies. These are required to provide the shop, shopping cart, checkout, security features and selected settings.

Optional cookies and similar technologies for statistics, marketing, personalised advertising or external content are used only where valid consent has been obtained.

Consent is managed through Shopify’s integrated “Customer Privacy” feature. Consents and preferences are processed to save your choices and control non-essential technologies in accordance with your decision.

You may change or withdraw your choices at any time through the website’s privacy settings. Withdrawal takes effect for the future.

18. Accounting and Statutory Retention

Haufe-Lexware GmbH & Co. KG is used for financial processes and accounting. This may involve processing, in particular, invoice, payment, order and contact data.

Processing is carried out to comply with tax and commercial law obligations under Article 6(1)(c) GDPR. The retention period is determined by the applicable statutory retention requirements.

19. Retention and Deletion

We store personal data only for as long as it is required for the relevant processing purpose. Once that purpose no longer applies, the data is deleted or anonymised unless statutory retention obligations or other legal reasons require it to be retained for longer.

Personalisation data is stored only for as long as necessary for orders, production, encoding, customer support, repeat orders, complaints, or the defence or pursuit of legal claims. Personalisation data that is no longer required is deleted or anonymised.

Order, invoice and payment data is retained to the extent required by statutory retention obligations. These periods are generally six or ten years, depending on the type of document and the applicable commercial and tax law requirements. As a rule, the period begins at the end of the calendar year in which the relevant record was created.

Personalisation data that is not part of business records subject to statutory retention requirements is deleted or anonymised once the necessary processing has been completed and any applicable statutory warranty and limitation periods have expired. As a rule, this takes place no later than three years after the end of the calendar year in which the relevant order was completed, unless longer retention is necessary in an individual case.

Backup copies are retained only for as long as necessary to ensure data security and recovery, and are then deleted or overwritten.

20. Data Security and Fraud Prevention

We implement appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure and unauthorised access. These measures include, in particular, access and authorisation controls, secure transmission procedures, backups and limiting access to data to people who need it to perform their duties.

Absolute security of data transmission and storage cannot be guaranteed.

We may also process personal data to detect, investigate and prevent abusive orders, fraud, security incidents and unlawful use. The legal basis is Article 6(1)(f) GDPR.

21. Recipients of Personal Data

Depending on the order, communication and usage involved, personal data may be transferred to the following recipients or categories of recipients:

Shopify and the Shopify apps in use;
Pipedrive for CRM and data management;
Make for automated data transfers;
Talon Backups for data backups;
Microsoft Ireland for email and file services;
Haufe-Lexware GmbH & Co. KG for financial processes and accounting;
sipgate GmbH and BEK Service GmbH for telephony and communication services;
Sendinblue GmbH, also known as Brevo, for newsletters and marketing communications;
Google for Google Analytics;
payment service providers such as Shopify Payments, PayPal, Klarna, Apple Pay and Google Pay;
shipping service providers such as Deutsche Post/DHL, UPS, DPD and Hermes;
public authorities, courts, lawyers and other bodies, where required by law or necessary for legal defence.

22. International Data Transfers

Individual service providers may process data outside the European Union or the European Economic Area, or enable access from third countries. This may be the case in particular with Shopify, Microsoft, Google, payment providers, marketing providers and certain app providers.

Data is transferred only where the requirements of Articles 44 et seq. GDPR are met. Depending on the provider, this may include an adequacy decision, Standard Contractual Clauses or additional technical and organisational measures.

23. Your Rights

Subject to the statutory requirements, you have in particular the following rights:

Access: You may request information about whether and which personal data we process about you.
Rectification: You may request the correction of inaccurate data or the completion of incomplete data.
Erasure: You may request the deletion of your data, unless a statutory or other permissible exception applies.
Restriction: In certain circumstances, you may request that processing be restricted.
Data portability: Where the statutory requirements are met, you may receive data you have provided to us in a structured, commonly used and machine-readable format, or request that it be transferred to another controller.
Objection: On grounds relating to your particular situation, you may object to processing based on Article 6(1)(f) GDPR.
Objection to direct marketing: You may object at any time to the processing of your data for direct marketing. This also applies to profiling related to such marketing.
Withdrawal: If processing is based on your consent, you may withdraw that consent at any time with effect for the future.

To exercise your rights, simply send a message to datenschutzⓐfamolino.com. If there are reasonable doubts about the identity of the person making the request, we may ask for appropriate information to verify their identity.

24. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority concerning our processing of your personal data. The competent authority is, in particular, the Bavarian State Office for Data Protection Supervision (BayLDA).

25. Children’s Data

Our online shop is not specifically intended for children. We do not knowingly accept orders from people who are not legally competent to enter into contracts under the law applicable to them without the required consent of their legal representatives.

If you believe that a child’s data has been provided to us, please contact datenschutzⓐfamolino.com.

26. Links to Third-Party Websites and Services

Our website may contain links or features that lead to third-party websites, apps or services. The privacy policies of those third parties apply to their processing of personal data.

This applies in particular to external telephony, messaging, FaceTime, SMS, payment, shipping and other third-party features accessed through an NFC card or a link.

27. Changes to This Privacy Policy

We may amend this Privacy Policy if our data processing, services, technical procedures or legal requirements change. The current version will be published on this website. The date of the last update shown above is the applicable date.

28. Contact

If you have questions about data protection, the processing of your personal data or the exercise of your rights, please contact: