Privacy Policy

This policy explains what personal data we collect when you visit hendrikxgolf.com, buy from us or write to us, why we process it, on what legal basis, who receives it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR). You may object at any time, on grounds relating to your particular situation, to processing that rests on our legitimate interests, and without giving reasons to direct marketing: see §12, Your Right to Object.

1. Data Controller

Hendrikx Golf GmbH

Hansaallee 135, 40549 Düsseldorf, Germany

Telephone: +49 15679 820847

Email: atelier@hendrikxgolf.com

2. Categories of Data We Process

• Account data: your name, email address, password (stored only as a secure hash) and any details you add to your account, such as a telephone number or a delivery address. When you order without an account, we keep a customer record with your name and email address, which your orders belong to and for which you may later set a password.
• Order and payment data: the pieces you order, your order history, your name, email address and delivery address, the Stripe reference of your payment and whether it went through, and any return you request with the reason you choose. We never see or store your card details: you enter them in Stripe’s payment field, and Stripe processes the payment (§8).
• Gift card data: when you send a gift card to someone, their name and email address, the names on the card and your message. We use them only to send the card and to tell you if it could not be delivered.
• Communication data: your emails, contact-form messages, WhatsApp messages and telephone calls to our business number, what we note from a call, and our replies.
• Withdrawal data: when you withdraw from a contract, what you declared (your name, the order number, the pieces, the email address for our acknowledgement and, if you give it, your postal code, which we only compare with your order’s), how it reached us and when, whether it came from your account or from the browser that paid for the order, our acknowledgement and how we handled it, and, for the online form, a keyed fingerprint of your IP address, which lets us recognise repeated misuse without storing the address itself.
• Website technical data (always processed): IP address, browser and device type, referring page, pages requested and times, processed to deliver and secure the website (§7). When a page loads, your browser also fetches one of our typefaces from Adobe (§8).
• Website analytics data (only with your consent): a random identifier stored in your browser (hx_visitor_id), the pages and pieces you view and the page you came from, the kind of device you use (phone, tablet or computer), what you add to your cart, when you start or leave the checkout, a periodic signal while a page is open that lets us estimate time spent on the site, your country as a two-letter code looked up from your IP address and, when you order, which visits led to it. We do not store your IP address in an analytics record.
• Newsletter data (only with your consent): your email address, your name if you give it, where you signed up and your subscription status.

3. Purposes & Legal Bases

We process personal data on the following legal bases under Art. 6(1) GDPR:

• Contract, Art. 6(1)(b): creating and managing your account and the customer record your orders belong to; taking, paying for, delivering and invoicing your orders; handling returns and withdrawals; and answering your questions about an order.
• Consent, Art. 6(1)(a): our own website analytics; the personalised insights described in §5; the measurement and advertising tags; and the newsletter, including what we tell Klaviyo about your orders once you have confirmed a subscription whose sign-up mentioned them (§6). You may withdraw consent at any time with effect for the future.
• Legitimate interests, Art. 6(1)(f): operating and securing the website, including server logs and the protection of our forms; presenting our typeface through Adobe Fonts; asking Klaviyo, after an order, whether your email address holds a confirmed subscription (§6); preventing fraud, spam and abuse, including the keyed fingerprints kept with a gift card purchase and with an online withdrawal; keeping your orders together in one customer record, so that you can later see them in an account; answering questions that do not concern an order; and establishing, exercising or defending legal claims.
• Legal obligation, Art. 6(1)(c): keeping the records that commercial and tax law require, with the help of our tax adviser; and recording and acknowledging your withdrawal.

To place an order we need the details marked as required at checkout: your first and last name, your email address and your delivery address, and a means of payment, which you enter in Stripe’s payment field. Without them we cannot conclude or fulfil the contract. An account needs your email address and a password you set through the link we send you; the newsletter needs your email address; the contact form needs your name, email address, a subject and your message; the online withdrawal form needs your name, the order number and an email address for our acknowledgement; a return request without an account needs the order number, the email address and the postal code of the delivery address. Everything else is optional.

4. Cookies & Similar Storage

Storing information in your browser, or reading information from it, needs your consent unless it is strictly necessary to provide a service you asked for (§ 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG). We ask in the cookie banner. No analytics or advertising runs unless you allow it.

What the shop needs. Some information is kept in your browser because the shop cannot work without it: your cart, your wishlist, your sign-in, the delivery country you chose and, until you close the tab, that you answered our question about it, your cookie choice and, while you check out, the details you have typed. Once you open the checkout with pieces in your bag, Stripe sets cookies that protect the payment against fraud. Where one of our forms uses Cloudflare’s Turnstile check (§8), it reads technical properties of your browser to tell people from automated misuse. For these we rely on the exception for what is strictly necessary for a service you asked for (§ 25(2) no. 2 TDDDG).

Our own analytics (only with your consent). If you allow Analytics, we run our own analytics on our servers in Germany. In that case:

• We store a random identifier (hx_visitor_id) in your browser, to recognise your device from one page and one visit to the next. It contains no name or contact details.
• We record the pages and pieces you view and the page you came from, the kind of device you use (phone, tablet or computer), what you add to your cart, when you start or leave the checkout and, while a page is open, a periodic signal that lets us estimate time spent on the site.
• We look up your country from your IP address in a database on our own server and keep only the two-letter code. We do not store your IP address in an analytics record.

Measurement and advertising (only with your consent). If you allow Marketing, we load the tags of Google Analytics and the Meta Pixel. They set their own cookies in your browser, which these companies can read, and send them what you view and add to your cart, when you start the checkout and what you buy, with the order total (Google also receives the order number, and Meta can read it in the address of our thank-you page). Google and Meta may also use these visits to show our advertising to people who have visited our site. These companies may process the data in the USA (§8, §9).

You can change or withdraw your choices at any time under Cookie Settings, in the Legal group at the foot of every page. When you withdraw Analytics, our analytics stops, and we delete the identifier and the visits recorded with it in this browser, with their link to any order. When you withdraw Marketing, the tags no longer load and we delete the cookies they set on our domain.

With your consent, these are kept in your browser (name · purpose · how long):

Analytics, only with your consent

• hx_visitor_id · recognises your device for our own analytics · until you withdraw consent or clear your browser

Marketing, only with your consent (set and read by these companies)

• _ga, _ga_(id) · Google Analytics · up to two years
• _gcl_au, _gcl_aw, _gac_(id) · Google Ads, linked to our Google Analytics · up to 90 days
• _fbp, _fbc · Meta · up to 90 days

When their tags load, the companies in the Marketing group may also set cookies on their own domains, which we cannot read or delete; their privacy policies give the lifetimes.

5. Optional Personalised Insights (Profiling)

Only if you consent to Analytics do we link the browsing activity described in §4 to your order, and through it to your customer record, to understand the path to purchase: for example, which pages you viewed before buying, how long you spent, and which pieces you added to your cart compared with what you bought.

• We use this solely for our own internal insight, to understand and improve our shop, our pieces and our service.
• If you do not consent to Analytics, we do not create this link and no such profile is built. If you withdraw consent, no further visits are recorded, and the visits already recorded in this browser are deleted with their link to your orders.

6. Newsletter and Notify me

If you subscribe to our newsletter, we process your email address, your name if you give it and where you signed up, on the basis of your consent (Art. 6(1)(a) GDPR). We send the email that asks you to confirm your subscription ourselves, through Resend, and keep the time of your sign-up and of your confirmation as the record of your consent; Klaviyo receives your address only once you have confirmed, and sends the newsletter for us. If you confirmed a subscription whose sign-up line said that our emails may take your orders into account, we also tell Klaviyo when you order: the order number, the pieces, the total and its currency, so that our emails can take account of what you already have. To know whether to, our server asks Klaviyo after each order whether your email address holds such a subscription; if it does not, Klaviyo receives only that question. We also count each sign-up by the form used and the country, which we look up from your IP address. You can unsubscribe at any time through the link in every newsletter, or by writing to atelier@hendrikxgolf.com.

If you ask to be told when a sold-out size is back (Notify me), we process your email address, the piece and the size you chose and the time of your request, to send you one email when that size is in stock again, on the basis of your consent (Art. 6(1)(a) GDPR). It is not a subscription to our newsletter. Klaviyo keeps your address on a separate list for us; when the size is back, our server tells Klaviyo the piece and the size, and Klaviyo sends that email. Two days after it has gone, when the size is no longer offered, or after six months if it does not come back, we delete your request, and your address at Klaviyo with it where Klaviyo held it only for this. You can withdraw your request at any time by writing to atelier@hendrikxgolf.com; the email itself carries a link to unsubscribe.

7. Server Log Files & Hosting

When you visit the website, our servers automatically record log data (IP address, date and time, requested page, referring page, browser and operating system), as technically necessary to deliver and secure the site. This rests on our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR). We keep these logs for 14 days. Our application also keeps an operating log, until it reaches its storage limit; there is no fixed period yet. On each visit our server also looks up the country of your IP address in a country database, to show you the prices and delivery for that country (Art. 6(1)(f) GDPR); nothing is stored for this. The website, its photos and our internal systems run on servers of Hetzner Online GmbH in Germany; the photos and films on our pages reach you through the network of BunnyWay d.o.o. (bunny.net) in Slovenia, from its servers in the EU; our encrypted backups are kept on a Hetzner Storage Box in the EU.

8. Recipients & Third-Party Processors

We pass personal data to other companies only as far as the purposes below need it.

Payment and delivery.

• Stripe: processes your payment by card, Apple Pay, Google Pay, Klarna or PayPal. Stripe receives your name, your email address, the order number and the amount, and what you enter in its payment field; if you pay with the buttons under Details, your wallet gives Stripe and us the name, email address and delivery address you choose in it, and Stripe your card’s billing address. When you open the checkout, Stripe’s script loads, shows the Apple Pay and PayPal buttons where your device offers them, and sets cookies that protect the payment against fraud (§4). Stripe screens each payment for fraud under its own responsibility and may decline one automatically. We never see or store your card details.
• PayPal and Klarna: if you choose one of them, you continue with PayPal or Klarna, which process your data as independent controllers under their own privacy policies. Klarna may check your identity and creditworthiness first.
• Apple and Google: if you pay with Apple Pay or Google Pay, Apple or Google processes the payment in your wallet under its own terms.
• DHL: delivers your order and collects returns. DHL receives your name and your delivery address, and for a parcel to Norway or the United States also your email address, which DHL needs there to clear customs and deliver (Art. 6(1)(b) GDPR); outside Germany, DHL may hand the parcel and these details to a delivery partner in your country.
• Loqate: GBG’s address service suggests addresses while you type in the Address field at checkout. Our server sends GBG what you type there and the delivery country, never your name, your email address or your IP address; when you pick a suggestion, GBG returns that address to fill in. GBG works on our behalf and keeps these details for up to 30 days (§9). Our legitimate interest is a correct delivery address, typed with less effort (Art. 6(1)(f) GDPR).

Email and messages.

• Resend: sends our service emails, such as the order confirmation, dispatch notices, acknowledgements of a withdrawal, return labels, invoices, sign-in links, the email that asks you to confirm a newsletter subscription and our replies to your messages. Resend receives your name, your email address and the content of these emails.
• Microsoft: hosts our mailbox, atelier@hendrikxgolf.com, and so processes the emails you send us and our answers.
• Klaviyo: sends our newsletter if you subscribe and the one email you asked for when a sold-out size is back, and answers our server’s question whether an address holds a confirmed subscription (§6).
• WhatsApp: if you write to us on WhatsApp, WhatsApp (Meta) processes the conversation.
• sipgate: carries calls to our business number.

Site and security.

• Hetzner: runs the servers of our website and our systems in Germany and keeps our encrypted backups (§7).
• bunny.net: delivers the photos and films on our pages from its servers in the EU, so they load quickly. It receives your IP address and the address of the file your browser asks for, as needed to deliver it (§7).
• Cloudflare: Turnstile protects our forms against automated abuse: the newsletter, Notify me, sign-in, registration, password reset, contact and the account you may create after an order. When you open the sign-in, registration or password reset page or Notify me, or start to fill in one of our other forms, your browser loads Turnstile from Cloudflare, which evaluates your IP address and technical properties of your browser. When you send the form, our server asks Cloudflare to confirm the check and passes on your IP address. Our legitimate interest is keeping our forms and your account safe from misuse (Art. 6(1)(f) GDPR).
• Adobe: one of our typefaces comes from Adobe Fonts. When a page loads, and inside Stripe’s payment field, your browser fetches it from Adobe’s servers, which receive your IP address, your browser details and the address of our website. Our legitimate interest is a consistent presentation of our website (Art. 6(1)(f) GDPR).

Measurement and advertising, only with your consent (§4).

• Google: Google Analytics measures visits, views and purchases. Google may also use these visits to show our advertising to people who have visited our site.
• Meta: the Meta Pixel measures our advertising on Meta’s platforms, and Meta may use these visits to show our advertising there to people who have visited our site. For collecting these data on our site and passing them to Meta, we and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, are joint controllers (Art. 26 GDPR). In our agreement with Meta (its Controller Addendum) we are responsible for informing you and for your consent to the collection on our site; Meta is responsible for your rights of access, rectification, erasure, restriction and portability for the data it stores once received. Meta’s contact details and those of its data protection officer, the legal basis Meta relies on and how to exercise your rights with Meta are in Meta’s Privacy Policy at facebook.com/about/privacy. You may exercise your rights with either of us.

Advisers and authorities.

• Our tax adviser receives our invoices and accounting records, which carry your name, your address and your order, for our bookkeeping and tax returns.
• Lawyers and courts receive what a legal claim requires, and authorities receive data where the law obliges us.

9. International Data Transfers

Some of the companies in §8 process data in the USA. Adobe, Cloudflare, Google, Klaviyo, Meta (with WhatsApp), Microsoft, Resend and Stripe are certified under the EU-US Data Privacy Framework; for them the transfer rests on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR).

GBG answers an address suggestion from its data centres in the United Kingdom, Germany, Belgium or the USA. For the United Kingdom the transfer rests on the European Commission’s adequacy decision, renewed on 19 December 2025 (Art. 45 GDPR); for the USA on the European Commission’s standard contractual clauses in our agreement with GBG (Art. 46(2)(c) GDPR).

When DHL delivers to Switzerland or the United Kingdom, your delivery details go there on the European Commission’s adequacy decisions (Art. 45 GDPR); to the United States, because your delivery needs them there (Art. 49(1)(b) GDPR).

10. Data Retention

• Account data, and the customer record of an order placed without an account: until you ask us to delete them, except what the law requires us to keep with your orders.
• Orders and invoices, with the confirmations and refunds that belong to them: as commercial and tax law require, up to ten years from the end of the year in which each document was made, such as the order, the invoice or a refund (§ 147 AO, § 257 HGB).
• Gift cards: the card, its balance and its use, with the order (above); the name and email address of the person you sent it to, the names on the card and your message, until 30 days after the card is used up or cancelled.
• Withdrawal declarations and our acknowledgements: kept with the order they name, as above; one that names none of our orders, for three years from the end of the year in which it reached us, or for 90 days if it is plainly spam. The keyed fingerprint of the IP address is deleted after 90 days.
• Gift card fraud checks: the keyed fingerprints of a purchase, 31 days from the payment; of a refused gift card code, 7 days.
• First-party analytics events: deleted after 400 days (about 13 months). The identifier that links your visits to an order (§5) is removed from the order at the same time.
• Newsletter data: until you unsubscribe. We then keep your address on a list that stops further newsletters, and the record of your consent as long as we may need to prove it. A sign-up you never confirm is deleted after 30 days.
• Notify me: until two days after the email about your size has gone, or until the size is no longer offered, at most six months; your address at Klaviyo goes then too, where Klaviyo held it only for this (§6).
• Contact-form messages: about an order, or from an address that bought from us in the three years before, six years from the end of the year of the last message on the matter (§ 257 HGB, § 147 AO); otherwise deleted from our support system two years after the last message on the matter. The copy that reaches our mailbox is kept like our other emails (next line).
• Emails, telephone notes and WhatsApp conversations: as long as needed to handle your request and to defend potential claims.
• Server logs: the web server’s access logs for 14 days; the operating log of our application until it reaches its storage limit, as it has no fixed period yet.
• Backups: a deleted record can remain in our encrypted backups for up to 12 months, until the oldest backup is overwritten.

11. Your Rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21, see §12). Where processing is based on consent, you may withdraw consent at any time with effect for the future (Art. 7(3)). To exercise any right, write to atelier@hendrikxgolf.com or to our address in §1.

You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR).

12. Your Right to Object

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), for example our server logs or the protection of our forms, you may object at any time on grounds relating to your particular situation. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims (Art. 21(1) GDPR).

Where we use your data for direct marketing, you may object at any time without giving reasons, and we will no longer use it for that purpose (Art. 21(2) and (3) GDPR).

To object, write to atelier@hendrikxgolf.com or to our address in §1.

Last updated: 5 November 2026.