Below, we inform you about the nature, scope and purpose of the processing of your personal data when you use our online shop at https://yataoshop.com. Personal data is any information relating to an identified or identifiable natural person.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is: Yatao GmbH, Heimatstraße 19, 79102 Freiburg, phone 0157 53535158, email info@yataoshop.com (hereinafter "we").

2. Hosting and accessing our website

Our online shop is operated on the Shopify platform (Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). When you visit our website, Shopify, as our processor (Art. 28 GDPR), processes the following information from your device: browser type and version, operating system, previously visited page (referrer), IP address and time of the page request.

We process this data to ensure the smooth operation of our website and to detect, prevent and prosecute misuse of our services. The legal basis is Art. 6(1)(f) GDPR. We delete this data no later than twelve months after it was collected.

Shopify may also transfer data to Shopify Inc. in Canada and to sub-processors in the USA. An adequacy decision of the EU Commission exists for Canada; transfers to the USA take place on the basis of the EU-US Data Privacy Framework or EU standard contractual clauses.

3. Cookies and consent management

We use cookies and similar technologies. We set technically necessary cookies (e.g. for the shopping cart, checkout, language setting, security) on the basis of § 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) and Art. 6(1)(b) or (f) GDPR. We use all other cookies and tracking technologies (statistics, marketing, personalisation) only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw or change your consent at any time via the cookie settings or the "Your Privacy Choices" link in the footer.

To manage consents, we use the tool Consentmo (Consentmo GDPR). Your selection, a timestamp and an identifier of your device are stored in order to document and respect your decision (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

4. Orders

When you place an order in our shop, we process your name, delivery and billing address, your email address and – if provided – your phone number in order to perform the contract (delivery, invoicing, payment processing, returns and complaints). The legal basis is Art. 6(1)(b) GDPR.

We store this data until all mutual claims have been settled and the retention periods under commercial and tax law (up to ten years) have expired (Art. 6(1)(c) GDPR). Without this data, it is not possible to conclude a contract. No automated decision-making or profiling takes place in deciding whether to conclude the contract.

For accounting and invoicing, we use Lexware Office (Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg) as a processor.

5. Customer account

You can optionally create a customer account. You log in using a one-time code sent by email. In the customer account, you can view your orders and data. The legal basis is Art. 6(1)(b) GDPR (contract of use for the customer account). We store the data until you delete the customer account; the retention periods under section 4 apply to order data.

6. Shipping

For delivery, we transmit your name, delivery address and – where required for delivery notification – email address and phone number to the commissioned shipping carrier: DHL Paket GmbH or Deutsche Post AG (Charles-de-Gaulle-Straße 20, 53113 Bonn), DHL Express Germany GmbH (Heinrich-Brüning-Straße 5, 53113 Bonn) or United Parcel Service Deutschland S.à r.l. & Co. OHG (Görlitzer Straße 1, 41460 Neuss). For deliveries outside the EU, the information required for customs clearance (including description of goods, value of goods, contact details) is additionally transmitted to the shipping carrier and the customs authorities of the country of destination. To create shipping labels, we use the services Sendcloud (Sendcloud B.V., Stadhuisplein 10, 5611 EM Eindhoven, Netherlands) or the Shopify app "Post & DHL Shipping" as processors. The legal basis is Art. 6(1)(b) GDPR.

7. Payment

Depending on the payment method selected, we transmit the data required for payment to the respective payment service provider, or the provider collects it directly: Shopify Payments (Stripe Payments Europe Ltd., Ireland) for credit card, Apple Pay and Google Pay; Shop Pay (Shopify); PayPal (Europe) S.à r.l. et Cie, S.C.A. (22–24 Boulevard Royal, L-2449 Luxembourg); Klarna Bank AB (publ) (Sveavägen 46, 111 34 Stockholm, Sweden); Alma SAS (176 avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France, only in France). Klarna and Alma may carry out an identity and credit check to verify the payment method; for details, please refer to their privacy notices. For prepayment, we process the details from your bank transfer (name of the account holder, IBAN/BIC, payment reference). The legal basis is Art. 6(1)(b) GDPR; for credit checks, where applicable, Art. 6(1)(f) GDPR.

8. Contacting us, chat and consultation

If you contact us by email or via a contact form, we process your details (name, email address, message and any further details) in order to answer your enquiry. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering the enquiry) or Art. 6(1)(b) GDPR if your enquiry relates to a contract. We delete the data no later than twelve months after the last communication, unless statutory retention obligations apply.

For emails, we use Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as a processor. For contact forms, we use Shopify Forms or Hulk Form Builder.

Chat: On our website, you can write to us via a chat window (Shopify Inbox or Superchat). In doing so, we process your messages and the contact details you provide in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR).

Consultation: For personal consultations (video call), you can book an appointment via the Calendly service (Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA). In doing so, Calendly processes your name, your email address, the selected appointment and, where applicable, the details you enter in the booking form. Calendly is only loaded when you open the booking window or have given your consent. The legal basis is Art. 6(1)(b) GDPR (taking pre-contractual steps at your request). Calendly is certified under the EU-US Data Privacy Framework.

9. Appointment requests to our showroom partners

If you request an appointment to try out instruments via the form on one of our showroom pages, we process the data you enter (name, email address, optionally phone number, preferred date, desired models and your message) as well as the selected showroom in order to process your request and arrange an appointment. Your request is sent to us and, in copy, to the respective showroom partner so that the partner can contact you directly. The partner uses your data exclusively to process your request.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request) and our legitimate interest in arranging appointments quickly (Art. 6(1)(f) GDPR). Our partners are predominantly based in the EU, and also in Switzerland, the United Kingdom and Singapore. An adequacy decision of the EU Commission exists for Switzerland and the United Kingdom. Data is transferred to a partner in Singapore only if you request an appointment there, and the transfer is necessary to carry out this step requested by you (Art. 49(1)(b) GDPR).

To forward your request to the partner, we use Klaviyo (see section 10) as a processor. We delete the data of your request no later than twelve months after your matter has been concluded.

Maps: On the showroom pages, we show the locations on a map from OpenStreetMap. The program library (Leaflet) is hosted on our server; however, the map tiles are loaded directly from the servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). In doing so, your IP address is transmitted; no cookies are set. The legal basis is our legitimate interest in presenting the locations clearly (Art. 6(1)(f) GDPR). An adequacy decision exists for the United Kingdom.

10. Newsletter and email marketing (Klaviyo)

If you subscribe to our newsletter, we will inform you by email about new instruments, offers and content. For registration, we use the double opt-in procedure: after registering, you will receive an email in which you confirm your registration. We store the time of registration, the time of confirmation and the IP address in order to be able to prove the registration. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 of the German Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG)). As a thank-you, you will receive a welcome voucher.

For sending, we use Klaviyo (Klaviyo, Inc., 125 Summer Street, Boston, MA 02111, USA) as a processor. Klaviyo is certified under the EU-US Data Privacy Framework. With your consent, we analyse whether and when emails are opened and which links are clicked in order to improve our newsletters. With your consent (cookie banner), Klaviyo also records which products you view on our website and whether you abandon a purchase in order to send you relevant emails (e.g. shopping cart reminders).

Existing customers: If you have purchased goods from us, we may send you emails with recommendations for our own similar goods even without separate consent (§ 7(3) UWG, Art. 6(1)(f) GDPR). You can object to this at any time without incurring any costs other than the transmission costs according to the basic rates.

"Notify me when available": If you sign up for a notification about a product becoming available again, we use your email address exclusively for this purpose (Art. 6(1)(a) GDPR).

You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending us a message. We will then delete your email address from the mailing list; we retain proof of your previous consent for up to three years (Art. 6(1)(f) GDPR).

11. Product reviews (Judge.me)

After a purchase, we ask you by email to review the product. For this, we use Judge.me (Judge.me Ltd., Ireland) as a processor. For this purpose, we transmit your name, your email address and the products purchased. If you submit a review, we publish it with your first name or the name you have chosen and the note "verified buyer". The legal basis for the review request is our legitimate interest (Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG), and for publication your consent (Art. 6(1)(a) GDPR).

12. Web analytics and marketing

We only use the following services if you have given your consent in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time with effect for the future.

Google Analytics 4: web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies to analyse the use of our website (e.g. pages accessed, time spent, approximate location, device used). IP addresses are not stored by Google Analytics 4. Google may transfer data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Google acts as a processor on the basis of the Google Ads Data Processing Terms.

Google Ads and Google Merchant Center: We use Google Ads conversion tracking and remarketing to measure the success of our ads and to show you relevant ads on other websites. We provide our products via the "Google & YouTube" channel in Google Merchant Center.

Meta Pixel and Conversions API: We use the Meta Pixel of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) to define visitors to our website as a target group for advertisements on Facebook and Instagram and to measure the effectiveness of our ads. In addition, we transmit events (e.g. purchase) server-side via the Conversions API. We are jointly responsible with Meta for the collection and transmission of the data to Meta (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Meta may transfer data to the USA; Meta is certified under the EU-US Data Privacy Framework.

Server-side tagging (Stape): To transmit tracking data to Google and Meta, we use a server-side Google Tag Manager operated via the Stape service (Stape Europe OÜ, Estonia). As a result, data is first transmitted to our server container and from there – only if consent has been given – passed on to the services mentioned.

Microsoft Clarity: analytics tool of Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity records how you interact with our website (mouse movements, clicks, scrolling; session recordings and heatmaps) in order to improve usability. Entries in form fields are masked. Microsoft is certified under the EU-US Data Privacy Framework.

Product recommendations (Rebuy): For personalised product recommendations in the shop and in the shopping cart, we use Rebuy (Rebuy Engine, Inc., USA). For this purpose, Rebuy processes your browsing and shopping cart behaviour in the shop.

Affiliate programme (UpPromote): If you come to us via a partner link or partner discount code, we use the UpPromote app (Secomapp, Vietnam) to process the attribution of your order to the partner (order number, order value, time) in order to settle the commission. The legal basis for cookie-based attribution is your consent; where a discount code is used, it is our legitimate interest in settling the commission (Art. 6(1)(f) GDPR).

13. Embedded content (YouTube, Instagram)

YouTube: We embed videos from YouTube (Google Ireland Limited) in privacy-enhanced mode (youtube-nocookie.com). A connection to YouTube is only established when you play the video or have given your consent in the cookie banner. In doing so, your IP address and information about the video played, among other things, are transmitted to YouTube.

Instagram feed: On individual pages, we display posts from our Instagram profile via the Instafeed app. The images are loaded from servers of Meta or of the app provider; in doing so, your IP address is transmitted.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

14. FAQ page and store functions

For our FAQ page, we use the HelpLab FAQs app; for the location search, the Progus Store Locator app. No personal data is collected beyond the technically necessary connection data.

15. Transfers to third countries

Insofar as we use services of providers based outside the EU or EEA or data is transferred there, this only takes place if an adequacy decision of the EU Commission exists (e.g. for Canada, Switzerland, the United Kingdom or for US companies certified under the EU-US Data Privacy Framework) or appropriate safeguards are in place, in particular EU standard contractual clauses (Art. 46(2)(c) GDPR).

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). We communicate any rectification, erasure or restriction to all recipients to whom we have disclosed your data, unless this proves impossible or involves disproportionate effort (Art. 19 GDPR).

Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected.

RIGHT TO OBJECT: ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, YOU MAY OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA CARRIED OUT ON THE BASIS OF ART. 6(1)(F) GDPR. WE WILL THEN NO LONGER PROCESS THE DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF WE PROCESS YOUR DATA FOR DIRECT MARKETING PURPOSES (E.G. NEWSLETTER, REVIEW REQUESTS), YOU MAY OBJECT TO THIS PROCESSING AT ANY TIME; WE WILL THEN NO LONGER PROCESS YOUR DATA FOR THESE PURPOSES.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart).

Last updated: October 2026