Privacy Policy

Protecting your personal data is important to us. This Privacy Policy explains what data we collect when you visit hendrikxgolf.com or buy from us, why we process it, on what legal basis, how long we keep it, and what rights you have. We process personal data only in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Data Controller

Hendrikx Golf GmbH

Hansaallee 135, 40549 Düsseldorf, Germany

Managing Director: Jan Hendrikx

Register court: Amtsgericht Düsseldorf, HRB 110802

VAT ID: DE458036732

E-Mail: atelier@hendrikxgolf.com

We have not appointed a Data Protection Officer, as we are not legally required to do so. For any data-protection matter, contact us at the address above.

2. Categories of Data We Process

• Account data: name, email, password (stored only as a secure hash), and any details you add to your account.
• Order & payment data: items ordered, order history, billing and shipping address, phone number, chosen payment method, and payment status. We do not store your full card number — card payments are processed by Stripe (see §8).
• Communication data: emails, contact-form and customer-service messages, and WhatsApp conversations where you contact us on our business number.
• Website technical data (always processed): IP address, browser and device type, referring page, pages requested, and timestamps — processed transiently to deliver, secure, and stabilise the website.
• Website analytics data (only with your consent): a randomly-generated device identifier stored in your browser (hx_visitor_id), the pages and products you view, add-to-cart / checkout / purchase actions, periodic “heartbeat” signals that let us estimate time spent on the site, and your approximate country — a two-letter country code derived from your IP address. We do not store your full IP address as part of an analytics record.
• Newsletter data (only with your consent): your email address and subscription status.

3. Purposes & Legal Bases

We process personal data on the following legal bases under Art. 6(1) GDPR:

• Contract performance — Art. 6(1)(b): creating and managing your account; processing, delivering, invoicing, and handling returns/withdrawals for your orders; and answering order-related enquiries.
• Consent — Art. 6(1)(a): non-essential cookies; our first-party website analytics; the optional personalized insights (profiling) described in §5; third-party marketing/measurement tags; and the newsletter. You may withdraw consent at any time with effect for the future.
• Legitimate interests — Art. 6(1)(f): operating, securing, and improving the website; preventing fraud, spam, and abuse; and defending legal claims.
• Legal obligation — Art. 6(1)(c): meeting statutory retention and tax/commercial-law duties.

4. Cookies & First-Party Website Analytics

Strictly necessary cookies. We use cookies and similar storage necessary to operate the shop (for example, your shopping cart, session, and security). These do not require consent (§ 25(2) TTDSG).

Optional first-party analytics (consent required). Only if you select “Analytics” in our cookie banner do we run our own analytics, hosted on our own infrastructure. In that case:

• We store a randomly-generated identifier (hx_visitor_id) in your browser’s local storage to recognise your device as you move between pages during your visit. It contains no name or contact details.
• We record events such as pages viewed, products viewed, items added to the cart, checkout started, checkout abandoned, and completed purchases. While a page is open we also receive a periodic “heartbeat” signal to estimate how long visitors spend on the site.
• We derive your approximate country from your IP address using a local geolocation database and store only the two-letter country code.
• This data is stored and analysed first-party on our own systems within the European Union. It is not sold and not shared with third parties for their own purposes. One exception is worth naming: our staff use an internal AI assistant to answer operational questions, and where a question concerns website visitors the relevant records are processed by that provider — see §8 and §9.

You can change or withdraw your cookie and analytics choices at any time via “Cookie settings” in the website footer. Declining Analytics means none of the above analytics processing takes place.

5. Optional Personalized Insights (Profiling)

If — and only if — you consent to Analytics, we may link the browsing activity described in §4 to your customer account and orders in order to understand the path to purchase: for example, which pages you viewed before buying, how long you spent, and which items you added to your cart compared with what you purchased.

• We use this solely for our own internal insight, to understand and improve our shop, products, and service.
• We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR. This analysis does not determine prices, availability, or your eligibility for anything.
• If you do not consent to Analytics, we do not create this link and no such profile is built. You can withdraw consent at any time, after which we stop this processing going forward.

6. Newsletter

If you subscribe to our newsletter, we process your email address on the basis of your consent (Art. 6(1)(a) GDPR) using a double opt-in procedure (you confirm via a link we email you). You can unsubscribe at any time via the link in every newsletter.

7. Server Log Files & Hosting

When you visit the website, our hosting provider automatically processes server log data (IP address, date/time, requested page, referrer, browser/OS) as technically necessary to deliver and secure the site, on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Our website and internal systems are hosted with Hetzner Online GmbH (Germany), within the EU, under a data-processing agreement (Art. 28 GDPR).

8. Recipients & Third-Party Processors

We share personal data only as necessary, and with processors bound by data-processing agreements (Art. 28 GDPR) or equivalent safeguards:

• Stripe — payment processing (card, Apple Pay, Google Pay, Klarna). We do not store your full card details.
• DHL — shipping, tracking, and returns.
• Klaviyo — newsletter and email marketing (with your consent; double opt-in).
• Meta Platforms — the Meta Pixel for advertising measurement (loaded only with “Marketing” consent), and WhatsApp Business, which processes conversation content if you contact us on WhatsApp.
• Google — Google Analytics and Google Ads tags (loaded only with “Marketing” consent), and Gemini models available to the internal staff assistant described below.
• Anthropic — the AI assistant our staff use internally to answer operational questions about orders, enquiries and website activity. When a staff member asks something that requires those records, the relevant data is sent to the model to produce the answer. It is used only to answer that question, is not used to train models, and no automated decision with legal or similarly significant effect is taken on this basis.

9. International Data Transfers

Some processors (e.g., Stripe, Meta, Google, Klaviyo and Anthropic) may process data outside the EU/EEA, including in the USA. Where this happens, transfers are safeguarded by an adequacy decision where applicable and otherwise by the EU Standard Contractual Clauses together with supplementary measures. The internal AI assistant described in §8 is one such transfer: questions our staff ask it, and the order or enquiry records needed to answer them, are processed in the USA. Storage of our own first-party analytics and IP-to-country geolocation remains within the EU.

10. Data Retention

• Account data: for the life of your account.
• Order, invoice, and tax-relevant data: up to 10 years, to meet statutory retention obligations (§ 147 AO, § 257 HGB).
• First-party analytics events: retained for 14 months, then deleted or irreversibly aggregated. The browsing-to-account link (§5) is removed when the underlying analytics data is deleted or when your account is erased.
• Newsletter data: until you unsubscribe.
• Support/communication data: as long as needed to handle your request and to defend potential claims.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you (Art. 22 GDPR). The personalized insights in §5 are used only for our internal understanding.

12. Data Security

We use appropriate technical and organisational measures to protect your data, including TLS encryption in transit, hashed passwords, access controls and least-privilege for staff, rate limiting, and secured EU-based servers.

13. Children

Our shop is directed at adults. We do not knowingly collect data from children under 16. If you believe a child has provided us data, please contact us and we will delete it.

14. Your Rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). Where processing is based on consent, you may withdraw consent at any time with effect for the future (Art. 7(3)). To exercise any right, contact atelier@hendrikxgolf.com.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes to our processing or legal requirements. The current version is always available on this page, with the “Last updated” date below.

Last updated: August 2026