Your data isn't
our secret ingredient.

GARLIC BOY GbR, Genthiner Str. 51, 10785 Berlin, Germany. Email: hey@mygarlicboy.com. Phone: +49 176 4181 7000.

GARLIC BOY GbR is the controller for the processing described in this policy.

This website, mygarlicboy.com, is hosted by Netlify. Delivering it to your browser necessarily involves Netlify processing basic technical request data, which can include your IP address and related connection information, in order to serve the site securely and reliably. We don't use this for analytics, advertising, or profiling — no such tools are active on this site.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in providing, maintaining and protecting a secure, reliable public website.

Our ecommerce services run on Shopify and are hosted separately from this website. This includes checkout, orders, order status pages, free pickup at Genthiner Str. 51 in Berlin, local delivery to eligible Berlin postcodes and postcode 16540, and return requests. Withdrawals sent through the online withdrawal form on this website are covered in section 04.

Cart on our product pages: the cart is shown on this website, but its contents are kept by Shopify. When you add, change or remove a product, your browser sends the request directly to Shopify (Shopify's Storefront API), and Shopify returns the cart and the checkout link. These requests contain the products and quantities, not your name or contact details; as with any request, Shopify receives your IP address and browser information. If a cart is already remembered in your current browser session (see section 06), your browser asks Shopify for it when you open a product page. Checkout itself then takes place on Shopify.

When you use our Shopify-powered checkout, order or other ecommerce services, GARLIC BOY GbR processes the information needed to provide them. Depending on what you use, this can include your name, email address, phone number (if you provide it), billing and delivery address, order details, cart and transaction information, and technical and device information needed to operate and secure the service.

We use this information to process and fulfil your order, arrange pickup or delivery, show you your order status, handle returns and withdrawal requests, answer questions about your order, and protect our shop against misuse and fraud.

Payment information is processed through the payment services made available at checkout. GARLIC BOY GbR does not receive or store your full payment-card details.

Legal basis: Art. 6(1)(b) GDPR — processing necessary to perform our contract with you or to take steps you've asked for before entering one, including the cart, orders, pickup or delivery, returns and withdrawals; Art. 6(1)(c) GDPR where we must keep order and transaction records to meet statutory accounting and tax obligations; Art. 6(1)(f) GDPR — our legitimate interest in operating a secure shop and preventing fraud.

Shopify's role: GARLIC BOY GbR is the controller for our own customer relationship, order fulfilment and store operations. For Shopify's core ecommerce services, Shopify generally processes customer personal data on our behalf as a service provider. For certain Shopify services or features, Shopify may process personal data for its own purposes as an independent controller, as described in Shopify's Consumer Privacy Policy.

There's no contact form on this site — every "contact" link is a mailto link that opens your own email software. If you choose to send us an email, GARLIC BOY GbR receives your address, message, and anything else you include, in order to reply. Our business mailboxes run on Google Workspace, which processes that email on our behalf.

Legal basis: Art. 6(1)(b) GDPR where your message concerns a contract or steps you've asked us to take before entering one; Art. 6(1)(f) GDPR — our legitimate interest in responding to and managing enquiries — for general messages.

Retention: we keep enquiry emails until the matter is resolved, and only longer where contractual, legal or statutory record-keeping obligations require it.

Online withdrawal form: you can withdraw from a contract with us using our withdrawal form at mygarlicboy.com/withdraw/. When you send it, we receive your name, your email address, the details you give to identify your order (order number and/or other details), and whether you are withdrawing from your entire order or only some products — and, if only some, which ones. We add the date and time we received your declaration and a reference number. We don't ask for a reason, your phone number, your address or a customer account, and we don't store your IP address with your declaration.

We use these details to receive and handle your withdrawal, to confirm receipt to you by email, to notify our team, and to keep a record of which declaration we received and when. Your declaration is received by our server functions at Netlify and stored in Netlify Blobs; the confirmation of receipt and our internal notification are sent through our email delivery provider, Resend; and our team's copy arrives in our Google Workspace mailbox (see section 08).

Legal bases, by purpose:

Receiving your declaration through this electronic withdrawal function and confirming its receipt: Art. 6(1)(c) GDPR in conjunction with § 356a BGB — the law requires us to provide this function and to acknowledge receipt of your declaration.

Handling the contractual consequences of your withdrawal, such as the return and the refund: Art. 6(1)(b) GDPR.

Keeping a record of which declaration we received and when, as evidence, and protecting the form against misuse: Art. 6(1)(f) GDPR — our legitimate interest in being able to establish, exercise or defend legal claims and in keeping the form secure.

Keeping a particular record for longer where a specific statutory retention obligation applies to it (see section 09): Art. 6(1)(c) GDPR together with that obligation.

Retention: see section 09.

You can sign up for our newsletter in the form on our homepage. We then email you about new products, events and special offers. To sign up, you enter your email address and tick the consent box; we don't ask for anything else.

Double opt-in: after you send the form, we email you a confirmation link. You are only added to our newsletter once you click that link — if you don't, you won't receive the newsletter. To be able to show that you agreed, we keep a record of your sign-up and confirmation, including when they happened.

Brevo: the form, the confirmation email and the newsletter itself are handled by our email marketing provider, Brevo, on our behalf (see section 08). Brevo's form script is only loaded once you start filling in the form; Brevo then receives your IP address and browser information, as with any request. Brevo may also use some of this data on its own side to keep its platform secure, for example to detect attempted fraud or hacking — see Brevo's Privacy Policy.

Legal bases: sending you the newsletter: Art. 6(1)(a) GDPR — your consent. Keeping a record of your consent, and keeping your address marked as unsubscribed after you unsubscribe so that you aren't emailed again: Art. 6(1)(f) GDPR — our legitimate interest in being able to prove your consent and in respecting your unsubscribe.

Unsubscribing: you can withdraw your consent at any time, with effect for the future, using the unsubscribe link in every email we send, or by emailing hey@mygarlicboy.com. This doesn't affect the lawfulness of the emails we sent before you withdrew.

Retention: see section 09.

On mygarlicboy.com: we use no analytics, advertising trackers, tracking pixels, or marketing cookies, and no browser storage for tracking purposes. Our own code sets no cookies. Netlify Web Analytics is not enabled, our fonts are self-hosted, and no Shopify script files are loaded on this website.

Cart memory: when you add a product to the cart on one of our product pages, our own cart code saves your Shopify cart ID in your browser's session storage (under the name garlicBoyCartId), so the same cart is still there when you move between pages or reload. It contains only that cart ID — no name, contact or payment details. It is kept only for your current browser session and is deleted by your browser when that session ends, usually when you close the tab or window; it is removed earlier if Shopify no longer recognises the cart. Nothing is saved if you never add a product.

Legal basis: § 25(2) no. 2 TDDDG — saving the cart ID for the browser session is strictly necessary to provide the cart you have explicitly asked for, so no consent is needed; Art. 6(1)(b) GDPR — steps you have asked us to take before entering into a contract, for the related processing by us and Shopify.

On our Shopify-hosted services: our checkout and other Shopify-powered ecommerce services may use cookies or similar technologies required to provide checkout, order handling, security and related ecommerce functionality.

All fonts on this site are self-hosted. There are no YouTube, Instagram, map, or social-widget embeds anywhere on the site — links to Instagram are ordinary outbound links, not embeds. The only third-party script is in our newsletter sign-up form, which loads Brevo's form script once you start filling it in (section 05). Once you leave our site, the destination's own privacy practices apply. Our Shopify-hosted checkout is covered in sections 03 and 05 above.

Netlify (Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA) — our hosting provider, processes technical request data necessary to deliver and protect the website. For our online withdrawal form, it also runs the server functions that receive your declaration and stores the declaration in Netlify Blobs on our behalf. These functions run in Netlify's US East region (Ohio, United States), and the declarations are stored there. Netlify processes this data under its Data Processing Agreement, which is part of Netlify's terms, and may engage subprocessors. Transfers of personal data to the United States are based on the EU-U.S. Data Privacy Framework, under which Netlify is certified; if that framework cannot be relied on, the EU Standard Contractual Clauses in Netlify's Data Processing Agreement apply instead.

Google Workspace (Google) — our email provider, processes business correspondence on our behalf, including notifications of withdrawals sent through our online form. Google may engage subprocessors, and applicable safeguards — including Standard Contractual Clauses where required — apply to restricted international transfers.

Shopify — our ecommerce platform, including the cart requests our product pages send to Shopify's Storefront API. For its core ecommerce services, Shopify generally processes order and related data on our behalf as a service provider; for certain services or features, it may process personal data for its own purposes as an independent controller (see section 03). Shopify may engage subprocessors, and where personal data is transferred outside the EU/EEA, appropriate safeguards — including Standard Contractual Clauses where applicable — apply.

Resend — operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA — our email delivery provider. For withdrawals sent through our online form, it sends your confirmation of receipt and our internal notification on our behalf. To do so, it processes your email address, our notification address and the content of these emails — which includes your name, the details identifying your order and your withdrawal declaration — together with technical sending information such as delivery status. We have switched off open and click tracking for these emails. Our emails are sent from Resend's EU sending region (Ireland). This does not mean that your data is stored only in the EU: Resend stores account data, including email metadata and logs, in the United States. Resend processes this data on our behalf under its Data Processing Addendum, which is part of Resend's Terms of Service. Transfers to the United States are based on the EU Standard Contractual Clauses incorporated into that agreement.

Brevo — Sendinblue SAS (trading as Brevo), 17 rue Salneuve, 75017 Paris, France — our email marketing provider. For our newsletter, it runs the sign-up form, sends the confirmation and newsletter emails, and stores your email address and the record of your consent on our behalf, under a data processing agreement with us. According to Brevo, it processes and stores this data on servers in the European Union. Brevo may also process some of this data as an independent controller to keep its platform secure (see section 05).

Payment information is handled by the payment services made available at checkout, to the extent needed to complete your payment.

We don't sell your personal data.

We keep personal data only for as long as it's needed for the purpose it was collected for, and longer only where the law requires it.

Order and transaction data: for as long as needed to fulfil your order, including returns and withdrawals, and beyond that where statutory accounting, tax or other legal obligations require us to keep records.

Withdrawal declarations (records from our online withdrawal form, stored in Netlify Blobs): we keep these so that we can show which declaration we received and when, should questions or claims arise about the withdrawal or the refund. Our general retention period for these records is three years, informed by the regular limitation period under §§ 195 and 199 BGB: we normally review and delete them in our January review following the end of the third calendar year after the year in which we received the declaration. Where a particular record is also subject to a longer statutory retention obligation — for example as business correspondence or a document relevant for tax purposes — we keep that record until the longer period ends. If a dispute about a withdrawal is still ongoing at the time of the review, we keep the records needed until it has been resolved.

Withdrawal notifications in our mailbox: the copies of withdrawal notifications in our Google Workspace mailbox are subject to the same retention rule and are reviewed and deleted together with the related records.

Email data at Resend: Resend, which sends the confirmation and notification emails, keeps email and log data for 30 days under the plan we currently use, as documented by Resend. This period is set by Resend and is separate from our own retention periods above.

Newsletter: while you are subscribed, we keep your email address and the record of your consent. If you don't confirm your sign-up, you aren't added to our newsletter. If you unsubscribe, we stop sending you the newsletter and keep your address marked as unsubscribed, together with the record of your consent, so that you aren't emailed again by mistake and we can show that you had agreed. If you want your address deleted completely, email us at hey@mygarlicboy.com.

Cart ID in your browser: for your current browser session only (see section 06).

Enquiry emails: until the matter is resolved, and longer where contractual, legal or statutory record-keeping obligations apply.

Technical data: as needed to operate and secure the website and our shop, in line with our service providers' operational and legal obligations.

Under the GDPR, you have rights over your personal data — detailed below. They also apply to withdrawal declarations sent through our online form. If you contact us about one, you may include its reference number (GBW-…) to help us find it; this is optional, and we will handle your request without it. Where we must keep a declaration to meet a statutory retention obligation, or need it to establish, exercise or defend legal claims, we may keep it until that need ends instead of deleting it (Art. 17(3)(b) and (e) GDPR), and we then use it only for that purpose.

We'll update this page when what we actually do changes — for example before we add analytics, marketing features, new embeds, new service providers, or Shopify functionality loaded directly on this website.

Last updated: 27 October 2026