Data Protection

Privacy Policy

Protecting your data is our top priority. We handle all personal data entrusted to us responsibly and strictly comply with the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

Note on the “nydo” brand:
“nydo” is a brand of Designmöbel Direkt GmbH. The contractual partner for orders in the online shop www.nydo-studio.de as well as the provider of all services mentioned therein is exclusively Designmöbel Direkt GmbH. Where “nydo” is referred to in this privacy policy, it legally refers to Designmöbel Direkt GmbH.

Below, you will find information about what data we collect, how we use it, the legal basis for doing so, and what rights you have.

I. Data Controller

Designmöbel Direkt GmbH
c/o K1 Business Club
Neue Rothofstraße 13–19
60313 Frankfurt am Main
E-mail: service@nydo-studio.de

II. Categories of Personal Data

In particular, we process the following data:

  • Usage data: IP address, log files, cookie settings, shopping cart contents
  • Customer data: Name, address, e-mail, phone number, encrypted password
  • Order data: Products, payment information, delivery details
  • Communication data: Inquiries via e-mail, phone, contact form, or WhatsApp
  • Marketing data: Newsletter consents, click and open rates, survey responses
  • Social networks: Statistics (Insights) regarding our accounts on Facebook, Instagram, TikTok, and Pinterest

III. Purposes and Legal Bases

We process personal data only when there is a legal basis for doing so:

Purpose Legal Basis
Performance of contract (orders, delivery, customer account) Art. 6 (1) (b) GDPR
Customer service & communication Art. 6 (1) (b) GDPR; Art. 6 (1) (f) GDPR (legitimate interest)
Newsletter & direct marketing Consent (Art. 6 (1) (a) GDPR) or Section 7 (3) UWG in conjunction with Art. 6 (1) (f) GDPR
Payment processing & fraud prevention Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR
IT security & abuse prevention Art. 6 (1) (f) GDPR
Competitions Art. 6 (1) (b) GDPR
Social media statistics (Insights) Art. 6 (1) (f) GDPR (joint controllership with Meta/Pinterest/TikTok)


IV. Recipients

  • External service providers (IT, hosting, logistics, payment services, marketing tools)
  • Public authorities, if we are legally obligated to do so
  • Partners for competitions or credit checks (e.g., Klarna, SCHUFA)

A complete list of the service providers used can be requested from us at any time.

    V. Data Transfer to Third Countries

    Transfers to countries outside the EU/EEA (“third countries”) only occur if:

    • an adequacy decision by the EU Commission exists (e.g., EU–US Data Privacy Framework), or
    • appropriate safeguards are in place, such as EU Standard Contractual Clauses (Art. 46 GDPR).

    Information regarding specific services (e.g., transfers to the USA) can be found in the respective sections of this policy.

    VI. Retention Periods

    • Contract and invoicing data: 10 years (statutory retention requirements)
    • Customer accounts: Deletion after a maximum of 6 years of inactivity
    • Log files: 20 days, in individual cases up to 180 days
    • Cookies & marketing data: As long as consent exists or until withdrawn

    VII. Your Rights

    Under the GDPR, you have the following rights at any time:

    • Access to your stored data (Art. 15 GDPR)
    • Rectification of inaccurate data (Art. 16 GDPR)
    • Erasure (“right to be forgotten”) (Art. 17 GDPR)
    • Restriction of processing (Art. 18 GDPR)
    • Data portability in a common format (Art. 20 GDPR)
    • Objection to processing based on legitimate interests (Art. 21 GDPR)
    • Withdrawal of consent (Art. 7 (3) GDPR)

    To exercise these rights, simply send an e-mail to service@nydo-studio.de.
    You also have the right to lodge a complaint with a data protection supervisory authority at any time.

    VIII. Cookies and Tracking

    • Necessary cookies: For basic functions, legally permitted without consent (Art. 6 (1) (f) GDPR, Section 25 (2) TTDSG)
    • Functional, analytical, and marketing cookies: Only with your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TTDSG).

    Services used: Google Analytics 4, Meta Pixel, Pinterest Tag, TikTok Pixel, Microsoft Bing Ads, YouTube, Microsoft Clarity, Klar! Insights

    You can withdraw your consent at any time via the cookie consent manager.

    Klar! Insights – Attribution

    We use the services of Klar Insights GmbH, Clemensstr. 2, 80803 Munich, Germany, a SaaS provider of business intelligence solutions for eCommerce companies. On our behalf, Klar Insights GmbH collects, processes, and stores data (user and session IDs, e-mail address, IP address, online identifiers (cookie ID, device ID)) on this website and its subpages for reach measurement and statistical analysis. We have concluded a data processing agreement with Klar Insights GmbH for this purpose.

    Personal data is collected based on your consent pursuant to Art. 6 (1) sentence 1 (a) GDPR. If the user grants consent, the data to be processed is collected on a user-specific basis, taking into account Section 25 (1) sentence 1 TDDDG.

    For the aforementioned different types of collection, the following cookies are used to ensure the respective collection method: september_id, september_has_consent, september_do_not_track (in case of objection).

    Cookie objection: To generally object to the use of Klar! Insights, please use this link. This will set a cookie named “september_do_not_track” from the domain “nydo-studio.de”. Please do not delete this, as otherwise it cannot be guaranteed that you will not be tracked by Klar.

    Information on data protection and data usage by Klar can be found on the following website: https://app.getklar.com/legal/data-protection

      IX. Social Media

      • Facebook & Instagram: Joint controllership with Meta (Page Insights Addendum)
      • TikTok, Pinterest, YouTube: The respective platform is responsible. nydo only receives aggregated statistics that do not allow for direct identification.

      Legal basis: Art. 6 (1) (f) GDPR (marketing/statistics) or Art. 6 (1) (a) GDPR (if cookies/pixels are set).

      X. Data Security

      • SSL encryption for all data transfers
      • Access limited to authorized personnel only
      • Regular technical checks and security updates

      XI. Changes

      We reserve the right to amend this privacy policy if new services are added or if the legal situation changes.

      Status: 19-09-2026