Privacy policy
PRIVACY POLICY
Last updated: 30 July 2026
Bags Beyond GbR operates this website and online store at bagsbeyond.com. This Privacy Policy explains how we collect, use and protect your personal information when you visit our website, submit a custom bag request, place an order or contact us.
1. WHO IS RESPONSIBLE FOR YOUR DATA
The data controller responsible for this website is:
Bags Beyond GbR
represented by Anabel Mihaljevic and Baris Salman
Eigenhaustraße 2
81673 München
Germany
Email: info(at)bagsbeyond(dot)com
Phone: +49 163 1530443
We are not legally required to appoint a Data Protection Officer. You can address all data protection matters directly to the contact details above.
2. PERSONAL INFORMATION WE COLLECT
Depending on how you use our website, we may collect and process the following personal information:
Contact and order information
- name
- email address
- phone number, if provided
- billing address
- shipping address
- order details
- payment status
- delivery information
Custom request information
- descriptions of your bag idea
- preferences such as size, shape, colour, leather, straps, hardware and details
- uploaded images, sketches, screenshots, drawings, moodboards or reference photos
- any additional information you choose to send us through our request form or by email
Communication information
- messages you send to us
- customer support requests
- email communication related to your request or order
Technical and usage information
- IP address
- browser and device information
- pages visited
- time and date of your visit
- cookie and similar technology information, depending on your cookie settings
Payment information
Payments are processed through Shopify and/or external payment providers. We do not store your full credit card or payment card details ourselves. We may receive information such as the payment status, payment method, order value and transaction details.
3. HOW WE COLLECT YOUR INFORMATION
We collect personal information directly from you when you:
- submit a custom bag request
- upload images or references
- place an order
- contact us by email or through a form
- use our website
We may also collect technical information automatically through cookies and similar technologies when you visit our website.
4. IS PROVIDING YOUR DATA MANDATORY?
You are not legally obliged to provide us with any personal information.
However, some information is necessary for us to work with you. In our custom request form these fields are marked as required: your name, your email address, at least one reference image or a description of your idea, and confirmation that you have read this Privacy Policy. Without them we cannot review your idea, prepare a quote or contact you, and we will not be able to process your request.
All other fields — size, exact measurements, leather, colour, hardware, additional notes — are optional. Not providing them has no consequence other than that we may need to ask follow-up questions.
For an order, we additionally need your billing and shipping address and payment information. Without them a contract cannot be concluded or fulfilled.
5. HOW WE USE YOUR PERSONAL INFORMATION
To process custom bag requests
We use the information, images and references you provide to understand your idea, review whether the design is possible, prepare a quote and communicate with you about your request.
To process and fulfil orders
We use your information to process payments, confirm orders, arrange production, manage shipping, provide quality control and deliver your bag to you.
To communicate with you
We use your contact details to answer questions, send updates about your request or order and provide customer support.
To operate and improve our website
We may use technical and usage information to keep our website running, understand how visitors use the website and improve the shopping experience.
For security and fraud prevention
We may use personal information where necessary to keep our store, checkout and customer communication safe and secure, including protecting against fraud, misuse or unauthorised access.
To comply with legal obligations
We may process and store certain information where required by law, for example for tax, accounting, legal or regulatory reasons.
6. LEGAL BASIS FOR PROCESSING
If you are located in the European Economic Area, we process your personal information on the following legal bases:
Performance of a contract and pre-contractual measures — Art. 6 (1) (b) GDPR
This is our main legal basis. It covers handling your custom request, reviewing your uploaded images and references, preparing a quote, processing an order, arranging production, quality control and delivering your bag. Because your reference material is what your request consists of, processing it is necessary in order to respond to your enquiry at all.
Consent — Art. 6 (1) (a) GDPR
We rely on consent only where processing goes beyond what is needed to handle your request. This applies in particular to publishing the reference material you have sent us, to publishing anything that would identify you personally, and to optional cookies. Consent is always separate, voluntary and marked as optional, and you may withdraw it at any time with effect for the future.
Legal obligation — Art. 6 (1) (c) GDPR
We retain certain records where we are legally required to do so, in particular under German tax and commercial law.
Legitimate interests — Art. 6 (1) (f) GDPR
We may process data where necessary for our legitimate business interests, such as operating and securing our website, preventing fraud and misuse, answering enquiries and improving our services, provided that your rights and interests do not override these interests. You have the right to object to this processing at any time — see section 15.
7. CUSTOM IMAGES AND REFERENCE MATERIALS
When you submit a custom bag request, you may upload or send us images, screenshots, sketches, moodboards or other references.
We use these materials to understand your idea, review the feasibility of the design, create a quote and support the production of your bag. Where necessary for production, relevant reference material is shared with our makers, as described in section 10. The legal basis is Art. 6 (1) (b) GDPR.
Your own reference material stays private. We do not publish the images, sketches or moodboards you send us, and we do not share them with anyone other than our production partners, without your separate and explicit consent. Where you do give us that consent, you can withdraw it at any time by writing to info(at)bagsbeyond(dot)com, and we will remove the material from our own channels going forward.
Photographs we take ourselves
We may photograph finished bags ourselves and use those images on our website and social media channels. These are product photographs: they show the bag, not you, and they are not published together with your name or any other detail that would identify you. If you would prefer us not to photograph your bag at all, simply tell us — a note in your request or an email is enough, and we will respect it without asking why.
Please only upload images or materials that you are allowed to share with us. Do not upload sensitive personal information or images of other people unless you have their permission.
8. WHO WE SHARE YOUR INFORMATION WITH
We may share personal information with service providers where necessary to run our business and provide our services. We only share what is necessary for the relevant purpose. Recipients may include:
- Shopify International Ltd., which hosts our online store and checkout
- payment providers used to process your payment, including Shopify Payments and PayPal
- Globo Software Solution JSC, also known as Powerful Form Builder, the Shopify app we use to receive custom requests and uploaded files
- our email and communication providers
- shipping and delivery providers, including DHL where applicable
- our production partners in Bali, Indonesia, as described in section 10
- IT, hosting and analytics providers
- tax, accounting or legal advisors, where necessary
Where these providers process personal data on our behalf, we have concluded data processing agreements with them in accordance with Art. 28 GDPR.
9. SHOPIFY
Our store is powered by Shopify. Shopify processes personal information to provide the online store, checkout, payment and related services. Information you submit through our website may be processed by Shopify and its service providers.
You can learn more about how Shopify processes personal information here:
https://privacy.shopify.com/en
10. PRODUCTION PARTNERS IN INDONESIA
Your custom bag is produced by our trusted makers in Bali, Indonesia. Where necessary for production, we share relevant design information, reference images, measurements and order details with them.
We do not share more information than necessary. Our production partners do not receive your payment details, and they generally do not need your full contact or address details.
Indonesia is a third country for which the European Commission has not issued an adequacy decision under Art. 45 GDPR. The level of data protection there is therefore not automatically equivalent to that of the EU. To protect your data, this transfer takes place on the basis of the EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR, supplemented by additional safeguards, in particular data minimisation: we transfer only the design-related information required for production.
You can request further information on the safeguards in place by writing to info(at)bagsbeyond(dot)com.
11. INTERNATIONAL DATA TRANSFERS
Besides the transfer described in section 10, some of our service providers may process data outside the European Economic Area.
Form and upload tool in Vietnam
Our custom request form is provided by Globo Software Solution JSC, based in Vietnam. The information and files you submit through the form may be processed on their infrastructure. Vietnam is a third country without an adequacy decision from the European Commission. This transfer takes place on the basis of the EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR.
Other providers, including the United States
Where our hosting, email or payment providers process data outside the EEA, the transfer takes place on the basis of an adequacy decision by the European Commission, for example the EU-U.S. Data Privacy Framework, on the basis of EU Standard Contractual Clauses, or on another legal transfer mechanism recognised under Chapter V GDPR.
You can request further information on the safeguards in place by writing to info(at)bagsbeyond(dot)com.
12. COOKIES AND SIMILAR TECHNOLOGIES
Our website uses cookies and similar technologies. Under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG), we store or access information on your device only where this is strictly necessary to provide the service you requested, or where you have given your prior consent.
Strictly necessary cookies
These are required for the website and checkout to function — for example to keep your cart, maintain your session, apply your language and currency settings, store your cookie preferences and protect against fraud. They are set by Shopify, do not require consent, and are typically stored between the end of your session and up to 12 months.
Analytics cookies
We use Shopify's built-in store analytics, which is part of the platform our shop runs on. It tells us how many people visit the store, which pages they look at and how they found us. The cookies involved are set by Shopify, for example _shopify_y and _shopify_s, are only set once you have given your consent, and are stored for up to 12 months. We have not installed any additional analytics tools of our own.
Marketing cookies
We do not use marketing or advertising cookies, we do not run tracking pixels, and we do not use retargeting. Should this change, we will update this Privacy Policy and ask for your consent beforehand.
You can withdraw or change your cookie consent at any time via the cookie settings on our website, and you can delete or block cookies through your browser settings. Blocking strictly necessary cookies may mean that parts of the store, including checkout, no longer work.
13. NO AUTOMATED DECISION-MAKING
We do not use automated decision-making within the meaning of Art. 22 GDPR, and we do not carry out profiling. Every custom request is reviewed personally by us together with our makers, and every quote is prepared by a human.
14. HOW LONG WE KEEP YOUR INFORMATION
We keep personal information only for as long as necessary for the purposes described in this Privacy Policy, and delete it once the purpose no longer applies and no statutory retention period requires us to keep it.
In concrete terms:
- Enquiries that do not lead to an order, including uploaded reference material: deleted no later than 6 months after our last contact.
- Custom request and design information relating to a completed order, including reference material: kept for up to 24 months after delivery, so that we can answer follow-up questions, handle warranty matters or reproduce a repair.
- Reference material you have consented to us publishing: kept for as long as your consent applies, and deleted from our own channels after withdrawal.
- Product photographs we have taken ourselves: kept for as long as we use them for our portfolio. They contain no information that identifies you.
- Invoices, order records and accounting documents: 10 years, as required by section 147 of the German Fiscal Code (AO).
- Commercial correspondence: 6 years, as required by section 257 of the German Commercial Code (HGB).
- Customer accounts, where created: for the duration of the account. You can request deletion at any time.
- Server log data: routinely deleted after 30 days at the latest.
We do not retain data beyond these periods unless we are legally obliged to do so or need it to assert, exercise or defend legal claims.
15. YOUR RIGHTS
Depending on where you live, and in particular if you are located in the European Economic Area, you have the following rights regarding your personal information:
- right of access to your personal information (Art. 15 GDPR)
- right to rectification of inaccurate information (Art. 16 GDPR)
- right to erasure (Art. 17 GDPR)
- right to restriction of processing (Art. 18 GDPR)
- right to data portability (Art. 20 GDPR)
- right to withdraw consent at any time, where processing is based on consent (Art. 7 (3) GDPR)
- right to lodge a complaint with a data protection authority (Art. 77 GDPR)
Right to object — Art. 21 GDPR
Where we process your personal data on the basis of our legitimate interests, as described in section 6, you have the right to object to that processing at any time on grounds relating to your particular situation. If you object, we will stop processing your data for those purposes unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is necessary to establish, exercise or defend legal claims.
Where personal data is processed for direct marketing purposes, you may object at any time without giving reasons, and we will stop that processing immediately.
To exercise your rights, contact us at info(at)bagsbeyond(dot)com. We will respond within one month, unless a longer period is permitted by law.
16. COMPLAINTS
If you have any concerns about how we process your personal data, please contact us first at info(at)bagsbeyond(dot)com.
If you are located in the European Economic Area, you also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
https://www.lda.bayern.de
You may also contact the supervisory authority of your habitual residence or place of work.
17. CHILDREN
Our website and our products are not directed at children. We do not knowingly collect personal information from persons under the age of 16. If you are under 16, please do not submit a request or place an order without the consent of a parent or guardian. If we become aware that we have collected data from a child without the required consent, we will delete it.
18. SOCIAL MEDIA AND THIRD-PARTY LINKS
Our website contains links to our profiles on Instagram and TikTok. These are simple hyperlinks, not embedded plugins or feeds. No data is transmitted to these platforms when you merely visit our website — a connection is established only once you actively click a link and leave our site.
From that point on, the privacy policy of the respective platform applies, and we have no influence over the data processed there:
- Instagram, Meta Platforms Ireland Ltd.: https://privacycenter.instagram.com/policy
- TikTok, TikTok Technology Ltd.: https://www.tiktok.com/legal/privacy-policy-eea
Please note that these providers may process data outside the European Economic Area and may combine it with an existing profile if you are logged in.
The same applies to any other third-party websites we link to, such as payment providers. We are not responsible for their privacy practices or content.
19. SECURITY
We take appropriate technical and organisational measures to protect your personal information, including encrypted transmission via TLS/SSL and access controls on the systems we use. However, no method of transmission over the internet or of electronic storage is completely secure.
Please do not send highly sensitive personal information through our contact form or by email unless it is necessary.
20. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes to our website, services or legal requirements. The updated version will be published on this page with a new "Last updated" date. Where changes are substantial, we will inform you separately where required by law.
21. CONTACT
If you have any questions about this Privacy Policy or how we process your personal information, you can contact us at:
Bags Beyond GbR
represented by Anabel Mihaljevic and Baris Salman
Eigenhaustraße 2
81673 München
Germany
Email: info(at)bagsbeyond(dot)com
Phone: +49 163 1530443