Privacy policy

Last updated: August 11, 2026

1. Controller

This Privacy Policy applies to the official website and online store of the band Mental Cruelty.

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (“GDPR”) is:

Blasphemous Arts Entertainment GbR
Hohbergstraße 17
76337 Waldbronn
Germany

Email: info@mentalcrueltyofficial.com

Blasphemous Arts Entertainment GbR operates the official Mental Cruelty website and online store. In this Privacy Policy, Blasphemous Arts Entertainment GbR is also referred to as “we”, “us” or “our”.

2. General Information

This Privacy Policy explains which personal data we process when you visit our website, subscribe to our newsletter, contact us or place an order through our online store.

Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, address, email address, IP address and information concerning your orders.

We process personal data only where a legal basis permits us to do so. Depending on the relevant processing activity, the legal bases are primarily:

Article 6(1)(a) GDPR where you have given us your consent;
Article 6(1)(b) GDPR where processing is necessary in order to take steps prior to entering into a contract or to perform a contract;
Article 6(1)(c) GDPR where processing is necessary for compliance with a legal obligation;
Article 6(1)(f) GDPR where processing is necessary for our legitimate interests or those of a third party, provided that your interests, fundamental rights and freedoms do not override those interests.

3. Operation and Hosting of the Online Store by Shopify

Our online store is operated using Shopify’s e-commerce platform. The Shopify entity generally responsible for merchants based in the European Economic Area is:

Shopify International Limited
2nd Floor, Victoria Buildings
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides the technical infrastructure required to operate our website, display our products, provide the shopping cart and checkout functions and manage customer orders.

When you use our online store, Shopify may process the following categories of data:

IP address;
browser and device information;
date and time of access;
pages and products viewed;
shopping cart contents;
order and transaction information;
name, email address, telephone number, billing address and delivery address;
customer account information, where customer accounts are offered and used;
technical log and security data.

This data is processed to provide and secure the online store, fulfil customer orders and prevent fraud, misuse and attacks.

The legal bases are Article 6(1)(b) GDPR where the processing is necessary to enter into or perform a contract and Article 6(1)(f) GDPR for the remaining technical and security-related processing. Our legitimate interests are the secure, reliable and efficient operation of our online store and the prevention of fraud and misuse.

Shopify generally processes customer data on our behalf. For certain services that customers use directly with Shopify, such as a separate Shop account, Shopify may act as an independent controller. In these cases, Shopify’s own privacy information also applies:

https://www.shopify.com/legal/privacy/consumers

Information about Shopify’s subprocessors is available at:

https://help.shopify.com/en/manual/privacy-and-security/privacy/subprocessors

We do not use additional Shopify apps, external advertising pixels or external analytics services. We do not use Shopify Network Intelligence or the associated enhanced advertising and personalisation features.

4. Website Access and Technical Log Data

When you visit our website, certain technical information is processed so that the website can be delivered to your device and operated securely.

This information may include:

IP address;
date and time of access;
requested page or file;
volume of data transferred;
browser type and browser version;
operating system;
referring URL;
device and network information;
error reports and security events.

The processing is based on Article 6(1)(f) GDPR. Our legitimate interests are the technical availability, stability and security of the website and the detection and prevention of misuse and attacks.

The data is deleted or anonymised when it is no longer required for these purposes, unless statutory retention obligations apply or continued storage is necessary to investigate a specific security incident.

5. Cookies and Similar Technologies

Our website uses cookies and similar technologies. Cookies are small files or information records that can be stored on or read from your device.

Strictly Necessary Cookies

Strictly necessary cookies are used to provide the fundamental functions of the online store. These include:

shopping cart functions;
checkout and order processing;
storage of your privacy preferences;
session management;
load balancing;
security and fraud prevention;
protection against unauthorised access.

Where these technologies store information on or access information from your device, they are used on the basis of Section 25(2) of the German Telecommunications and Digital Services Data Protection Act (“TDDDG”), provided they are strictly necessary to supply a digital service expressly requested by you.

Related processing of personal data is based on Article 6(1)(b) GDPR where it is necessary to enter into or perform a contract and otherwise on Article 6(1)(f) GDPR. Our legitimate interests are the secure and functional operation of the online store.

Optional Shopify Analytics

Where optional analytics or Shopify statistics functions are offered through our cookie banner, the necessary technologies will only be activated after you have given your express consent.

The data processed may include device information, IP address, pages visited, interactions with the store, shopping cart events and information about completed orders. The processing is carried out to compile statistics and improve our online offering.

The legal bases are your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future through the privacy settings available on our website.

We do not use cookies for external advertising networks, cross-site advertising tracking or external advertising pixels.

6. Orders and Contract Fulfilment

When you place an order, we process the information necessary to handle and fulfil that order. This may include:

first and last name;
billing and delivery address;
email address;
telephone number, where provided or required for delivery;
products ordered;
order value;
order and transaction number;
time and date of the order;
payment method and payment status;
shipping and delivery information;
communications relating to the order;
information concerning returns, refunds or cancellations.

Required information is marked accordingly during the checkout process. Without this information, we will generally be unable to enter into or perform the purchase contract.

The processing is necessary to take steps prior to entering into a contract and to perform the purchase contract and is therefore based on Article 6(1)(b) GDPR.

Where we are required to retain order, invoice or payment information under tax, commercial or other statutory requirements, the additional legal basis is Article 6(1)(c) GDPR.

Order information and technical usage data may also be processed to prevent fraudulent orders and protect our online store. This processing is based on Article 6(1)(f) GDPR. Our legitimate interests are preventing fraud, payment defaults and abusive orders.

7. Payment Using PayPal

PayPal is the only payment method offered through our online store. The provider is:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

When you select PayPal as your payment method, the information required to process the payment is transmitted to PayPal. This may include:

name;
email address;
billing and delivery address;
order number;
order value;
currency;
information about the products ordered;
payment and transaction status;
other information required for payment processing, authentication or fraud prevention.

We do not receive your PayPal login credentials or your complete bank or payment card details. PayPal provides us with the information necessary to confirm, allocate, refund or reject the payment.

The transfer to PayPal is necessary to process your payment and perform the purchase contract and is therefore based on Article 6(1)(b) GDPR.

PayPal processes certain information under its own responsibility as an independent controller. PayPal may carry out its own authentication, payment processing, fraud prevention and legal compliance checks.

Further information is available in PayPal’s Privacy Statement:

https://www.paypal.com/de/legalhub/paypal/privacy-full

8. Shipping and Delivery

We use the following companies to ship and deliver orders:

DHL Paket GmbH
Charles-de-Gaulle-Straße 20
53113 Bonn
Germany

Deutsche Post AG
Charles-de-Gaulle-Straße 20
53113 Bonn
Germany

Depending on the type, size and destination of the shipment, your order may be delivered by DHL Paket GmbH, Deutsche Post AG or a postal or delivery partner used by these companies.

For the purpose of shipping and delivery, we may transmit the following information:

name;
delivery address;
order or shipment number;
information necessary for customs clearance in the case of international shipments;
email address and telephone number where required for delivery or where you have consented to a delivery notification.

The transfer of your name, delivery address and required shipment information is necessary to perform the purchase contract and is based on Article 6(1)(b) GDPR.

If your email address or telephone number is not strictly required for delivery, it will only be transferred for delivery notifications where a sufficient legal basis exists, in particular your consent under Article 6(1)(a) GDPR. You may withdraw any consent at any time with effect for the future.

For international shipments, the required recipient, shipment and customs information may be transmitted to foreign postal services, delivery partners, customs authorities and other competent authorities.

DHL Paket GmbH and Deutsche Post AG may process shipment and recipient information under their own responsibility where this is necessary to provide postal and delivery services or comply with legal obligations.

Further privacy information is available at:

https://www.dhl.de/datenschutz

https://www.deutschepost.de/datenschutz

9. Contacting Us

If you contact us by email, through a contact form or by other means, we process the information you provide. This may include your name, email address, the content of your message and, where applicable, information about your order.

Where your enquiry relates to a contract or potential order, the processing is based on Article 6(1)(b) GDPR.

Other enquiries are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is responding to and handling your enquiry and maintaining our customer and business relationships.

Enquiries are deleted once they have been conclusively dealt with and there are no statutory retention obligations or other legitimate grounds for continued storage. Communications relevant to a contract, payment or invoice may be retained for longer in accordance with statutory retention periods.

10. Newsletter

If you subscribe to our newsletter, we process your email address in order to send you information about our store, new products, releases, merchandise and similar offers from us.

The processing is based on your express consent under Article 6(1)(a) GDPR and Section 7(2) of the German Act Against Unfair Competition (“UWG”). To document your subscription, we may also store the date and time of the registration and confirmation together with technical log data.

We use functions provided through Shopify to manage and send the newsletter. Shopify processes the necessary information on our behalf.

You may withdraw your consent at any time with effect for the future, for example by using the unsubscribe link included in every newsletter or by contacting:

info@mentalcrueltyofficial.com

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

After you unsubscribe, your email address will be removed from the active mailing list. Where necessary, your email address may be retained on a suppression list to ensure that your unsubscribe request continues to be respected. This processing is based on Article 6(1)(f) GDPR. Our legitimate interests are respecting your unsubscribe request and preventing unwanted advertising.

Records documenting your consent may be retained until the expiry of the applicable statutory limitation periods where this is necessary to comply with our accountability obligations or defend against legal claims.

11. Recipients of Personal Data

We disclose personal data only where this is necessary to perform a contract, comply with a legal obligation, protect a legitimate interest, or where you have given your consent.

Recipients or categories of recipients may include:

Shopify as the operator and technical service provider of the online store;
PayPal for payment processing;
DHL Paket GmbH and Deutsche Post AG for shipping and delivery;
foreign postal and delivery partners for international shipments;
IT and hosting service providers;
tax advisers, accounting service providers and other professional advisers;
banks and financial service providers where required for payment processing;
authorities, courts or other public bodies where we are legally required to provide information.

We do not sell personal data and do not disclose customer information to advertising networks or data brokers.

12. International Data Transfers

When Shopify is used, personal data may also be processed outside the European Economic Area by companies within the Shopify group or by Shopify’s subprocessors.

Shopify International Limited is based in Ireland. Certain services are provided by Shopify Inc. in Canada and by other affiliated companies and subprocessors.

Where an adequacy decision by the European Commission applies to the relevant recipient country, the transfer is based on that decision. In other cases, Shopify relies in particular on standard contractual clauses approved by the European Commission or other legally recognised safeguards.

Further information about Shopify’s international data transfers is available at:

https://help.shopify.com/en/manual/privacy-and-security/privacy/international-data-transfers

A list of Shopify’s subprocessors is available at:

https://help.shopify.com/en/manual/privacy-and-security/privacy/subprocessors

PayPal may also process information internationally under its own responsibility. Information about the safeguards used by PayPal is available in PayPal’s Privacy Statement.

For international shipments, recipient, shipment and customs information may be transmitted to delivery partners and competent authorities in the destination or transit country. Such transfers are necessary to perform the shipping contract and deliver the order.

You may contact us if you require further information about the safeguards used for a particular international transfer or about how to obtain a copy of those safeguards.

13. Retention Periods

We retain personal data only for as long as it is required for the relevant processing purpose or as long as statutory retention obligations apply.

In particular, the following criteria and periods apply:

Order, invoice, accounting and payment records are generally retained for six, eight or ten years, depending on the type of document and the applicable German tax and commercial-law requirements.
Information required to establish, exercise or defend contractual claims may be retained until the expiry of the applicable statutory limitation periods.
Customer enquiries are generally deleted once they have been conclusively dealt with and no statutory retention obligation or other legitimate reason for continued storage applies.
Newsletter information is retained until you withdraw your consent or unsubscribe. Records of consent and unsubscribe requests may be retained for longer in accordance with statutory accountability and limitation periods.
Technical log and security data is deleted or anonymised when it is no longer required to provide and secure the online store, unless a specific security incident requires longer retention.
Customer account data is retained until the account is deleted or the underlying contractual relationship ends, subject to any statutory retention obligations.
Shipping information may be retained for the duration required to complete delivery, handle returns or complaints and establish, exercise or defend legal claims.

After the applicable retention period expires, the data is deleted or anonymised unless another legal basis permits its continued processing.

14. Sources of Personal Data

We generally receive personal data directly from you, particularly when you use our website, place an order, subscribe to the newsletter or contact us.

We may also receive information:

from PayPal, particularly payment confirmations, payment status and transaction information;
from DHL Paket GmbH, Deutsche Post AG or their delivery partners, particularly information about shipping, delivery, returns or delivery problems;
automatically through Shopify, particularly technical usage, security and order information;
from customs authorities or foreign postal and delivery partners in connection with international shipments.

15. Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

We do not use your personal data for personalised advertising or cross-site advertising profiles.

Shopify or PayPal may use automated systems to assess security and fraud indicators. Where PayPal carries out such checks under its own responsibility, PayPal’s Privacy Statement applies.

16. Your Rights

Subject to the applicable legal requirements, you have the following rights:

the right of access under Article 15 GDPR;
the right to rectification under Article 16 GDPR;
the right to erasure under Article 17 GDPR;
the right to restriction of processing under Article 18 GDPR;
the right to data portability under Article 20 GDPR;
the right to object under Article 21 GDPR;
the right to withdraw consent under Article 7(3) GDPR;
the right to lodge a complaint with a supervisory authority under Article 77 GDPR.

You may exercise these rights by contacting us using the details provided in Section 1.

If we have reasonable doubts concerning your identity, we may request additional information necessary to verify your identity. We will only request information required for this purpose.

Withdrawal of Consent

Where we process your data on the basis of consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

Right to Object

Where your personal data is processed on the basis of Article 6(1)(e) or Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.

Where your personal data is processed for direct marketing purposes, you have the right to object to that processing at any time without giving reasons. This also applies to profiling to the extent that it is related to such direct marketing. Following your objection, your personal data will no longer be processed for direct marketing purposes.

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.

The supervisory authority responsible for our registered place of business is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany

Postal address:
Postfach 10 29 32
70025 Stuttgart
Germany

Telephone: +49 711 615541-0
Email: poststelle@lfdi.bwl.de

https://www.baden-wuerttemberg.datenschutz.de/

You may also lodge a complaint with another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

18. Security

We implement appropriate technical and organisational measures to protect personal data against loss, manipulation, destruction and unauthorised access.

Please note that transmission of information over the internet can never be completely protected against all risks. You should therefore avoid sending particularly confidential information through unsecured communication channels.

19. External Links

Our website may contain links to websites and services operated by third parties. The relevant third-party operator is responsible for the processing of personal data on those external websites. Please review the privacy information provided by the relevant third party.

20. Changes to This Privacy Policy

We may update this Privacy Policy if our processing activities, services or applicable legal requirements change.

The current version will be published on our website. The date shown at the beginning of this Privacy Policy indicates when it was last updated.