TROIKA

Privacy Policy

‌Effective Date: October 30, 2026‌

Welcome to the privacy policy of TROIKA Onlineshop GmbH, operating the e-commerce website www.troikaonlineshop.com. We are fully committed to protecting the personal data and privacy rights of every user who browses, shops, and interacts with our platform, which specializes in compact, durable travel smalls designed to make every journey smooth, organized and completely hassle-free. This policy is drafted in full compliance with the EU General Data Protection Regulation (GDPR, also referred to as DSGVO in German), Germany’s Telecommunications, Digital Services and Data Protection Act (TDDDG), the German Federal Data Protection Act (BDSG), and all applicable European and German data protection regulations. It clearly outlines how we collect, process, store, share and protect your personal information, as well as the full scope of your legal rights regarding your data.

1. Data Controller Identity

For all personal data processing activities described in this policy, the data controller as defined under Article 4 of the GDPR is:
‌TROIKA Onlineshop GmbH‌

  • Registered Address: Nisterfeld 11, 57629 Müschenbach, Germany
  • Contact Email: zippo@troikaonlineshop.com
  • Contact Telephone: +49 2662 7779

If you have any questions, concerns or requests related to your personal data, you can reach out to our dedicated data protection team at any time via the contact channels listed above.

2. Scope of Personal Data We Collect

We strictly adhere to the ‌data minimization principle‌ required by the GDPR, and only collect information that is directly necessary to deliver our travel smalls products, fulfill order obligations, and ensure the stable and secure operation of our platform. The personal data we may collect includes:

  1. ‌Information you voluntarily provide to us when making purchases or creating accounts‌: Your full name, residential address (billing and delivery address), contact email address, phone number, and payment-related information required to process transactions.
  2. ‌Automatically collected technical information when you access our website‌: Your device IP address, device identifiers, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and information about your browsing behavior on www.troikaonlineshop.com.
  3. ‌Order and interaction data‌: Your order history, selected travel essentials, communication records with our customer support team, and any information you submit when participating in our marketing newsletter subscriptions or feedback surveys.

All categories of collected data are closely related to our business of providing curated compact travel essentials, and we will never collect irrelevant or excessive personal information from you without your explicit consent.

3. Legal Bases and Purposes for Data Processing

All of our personal data processing activities are supported by clear legal foundations under Article 6 of the GDPR, and we only use your data for the explicitly stated purposes listed below:

3.1 Processing Based on Article 6(1)(b) GDPR: Performance of Contract

We process your necessary personal information to fulfill the sales contract we enter into with you:

  • To process your payment, arrange product shipment, and ensure your selected travel smalls are delivered to the address you provided.
  • To send you order status updates, shipping notifications, and after-sales support for your purchase.
  • To process your 30-day unused return requests for full refunds or exchanges, as stated on our website.

3.2 Processing Based on Article 6(1)(f) GDPR: Legitimate Interests

We process a limited set of your data when it is necessary for our legitimate business interests, without overriding your fundamental privacy rights:

  • Storing your IP address to maintain the security of our website, prevent unauthorized access, and protect against fraud during transactions.
  • Conducting anonymized statistical analysis of platform browsing data to optimize our product display, improve the user experience of browsing our curated travel essentials collection, and ensure our website runs stably for all global users.
  • Keeping transaction records for internal business accounting, which aligns with legitimate operational needs.

3.3 Processing Based on Article 6(1)(a) GDPR: Your Explicit Consent

We will only process your non-essential personal data after you provide clear, opt-in explicit consent:

  • When you voluntarily subscribe to our newsletter, we will use your email address to send you updates about fresh picks for light travel, new product launches of fan-favorite travel gear, and exclusive promotional information. You can withdraw this consent at any time, and we will stop sending you marketing communications immediately after your opt-out request.
  • For non-necessary cookies and tracking tools (such as website analytical tools that help us understand user preferences for travel product categories), we will only load these tools after you provide explicit consent in compliance with TDDDG requirements.

3.4 Processing Based on Article 6(1)(c) GDPR: Compliance with Legal Obligations

We will process your personal data when it is necessary to comply with our legal responsibilities as a company registered in Germany, such as retaining transaction records to meet local tax regulatory requirements.

4. Cookie and Tracking Technology Policy

In full compliance with the TDDDG provisions, we categorize all cookies used on www.troikaonlineshop.com to strictly regulate data tracking activities:

  1. ‌Technically Necessary Cookies‌: These cookies are essential to enable the basic functions of our website, such as maintaining your shopping cart status, remembering your login session, and preventing fraudulent transactions during checkout. Per TDDDG Section 25(2)(2), these strictly necessary cookies do not require your prior consent, as they are processed based on the need to perform the sales contract and our legitimate interest in ensuring the basic function of the site.
  2. ‌Non-Necessary Cookies‌: All other cookies, including analytical cookies, advertising cookies, and social media plug-in cookies, require your separate, explicit opt-in consent before they are activated. We have deployed a fully compliant Consent Management Platform (CMP) on our website, which displays a clear consent banner with three equally prominent buttons: “Accept All Cookies”, “Customize Settings”, and “Reject All Cookies”. We will never use pre-checked consent boxes, hide the reject option in secondary menus, or treat your continued browsing on the site as implied consent. You can adjust or withdraw your cookie consent at any time via the fixed “Cookie Settings” entry located in the footer of every page of our website. We also permanently store your consent records, including the timestamp of your selection and the version of our consent notice, to fulfill our GDPR accountability obligations.

5. Personal Data Recipients and Third-Party Data Processors

We will never sell, rent, or trade your personal data to any unrelated third parties for commercial purposes. We only share your necessary data with strictly vetted third-party service providers who act as data processors on our behalf, and we have signed legally compliant Data Processing Agreements (DPAs) with every one of these partners as required by Article 28 of the GDPR:

  • ‌Payment Service Providers‌: We share only the necessary transaction data with certified payment processors to securely process your payments, ensuring the security of your bank account and payment information.
  • ‌Logistics and Delivery Partners‌: We share your full name and delivery address with our global shipping carriers, to ensure your ordered travel smalls can be delivered to your designated destination within 7-14 business days, as stated on our website.
  • ‌Cloud and IT Service Providers‌: We use trusted cloud service providers to host our website and user data, and all these providers are required to implement strict technical and organizational measures to protect your personal data.
  • ‌Authorized Customer Service Tools‌: We use licensed customer support systems to manage your inquiry records, so our team can respond promptly to your questions about travel product materials, delivery status, return policies and other related topics.

All of our third-party partners are bound by strict data protection obligations that are no less stringent than the requirements laid out in this policy and the GDPR.

6. Cross-Border Personal Data Transfers

In principle, all your personal data collected via www.troikaonlineshop.com is stored and processed within the European Economic Area (EEA). If it is ever necessary to transfer your data to a third country outside the EEA (for example, if we use a global analytics tool whose server is located outside the EEA), we will take all legally required measures to ensure your personal data receives the same level of protection as required under GDPR rules. We will sign the standard data protection clauses (SCCs) formally adopted by the European Commission with the relevant recipient, to establish legally enforceable safeguards for your cross-border data transfer. You can contact us via the contact information listed in Section 1 at any time to request a copy of these relevant safeguard documents.

7. Personal Data Retention Period

We will not retain your personal data for any longer than what is strictly necessary to fulfill the original purposes for which the data was collected:

  • Transaction and order related data: We will retain these data for 10 years after the completion of your order, to meet German local tax and commercial legal record-keeping requirements. After this statutory retention period expires, we will securely delete or anonymize this data.
  • Marketing newsletter data: We will retain your email address for marketing purposes until you explicitly withdraw your consent and request to unsubscribe from our newsletter, at which point we will immediately remove your email from our marketing list.
  • Technical browsing data (such as IP address logs): We will retain this data for a maximum of 30 days, unless there is an ongoing security incident or legal investigation that requires extended retention of these logs.

Once the retention period for your personal data expires, we will ensure all data is permanently erased through secure technical methods, to eliminate any risk of privacy leakage.

8. Your Legal Rights Under Data Protection Laws

As a data subject under the GDPR, you are entitled to the following comprehensive legal rights regarding your personal data at any time:

  1. ‌Right of Access‌: You have the right to request a free copy of all personal data we hold about you, and obtain information about how and why we process your data.
  2. ‌Right to Rectification‌: If you find that any of your personal information stored on our platform (such as your delivery address or contact phone number) is inaccurate, you can submit a request to us, and we will correct the data without unnecessary delay.
  3. ‌Right to Erasure (Right to be Forgotten)‌: You can request us to delete all your personal data stored on our platform, under the conditions permitted by law. We will process your request promptly, unless we are legally obligated to retain certain data to comply with legal regulatory requirements.
  4. ‌Right to Restriction of Processing‌: You have the right to request that we suspend the processing of your personal data, for example when you contest the accuracy of your data, or when you object to our processing activities based on our legitimate interests.
  5. ‌Right to Data Portability‌: You can request us to provide all the personal data you have submitted to us in a structured, commonly used, machine-readable format, and you have the right to transmit this data to another data controller without obstruction from our side.
  6. ‌Right to Object‌: You can object at any time to the processing of your personal data that we conduct based on our legitimate interests. If we cannot demonstrate compelling legitimate grounds for the processing that override your rights, we will stop the relevant processing activities immediately.
  7. ‌Right to Withdraw Consent‌: You can withdraw any consent you previously granted to us for data processing activities (such as newsletter subscription or non-necessary cookie usage) at any time. The withdrawal of consent will not affect the legality of any processing we conducted before the withdrawal.
  8. ‌Right to Lodge a Complaint‌: If you believe our processing of your personal data violates applicable data protection laws, you have the right to submit a complaint to the competent local data protection authority in Germany or in your country of residence.

To exercise any of the above rights, you can send us a request via the contact email zippo@troikaonlineshop.com. We will respond to your request within one month as required by GDPR rules, without charging any fees, unless your request is manifestly excessive or repetitive.

9. Data Security Protection Measures

In strict accordance with the requirements of Article 32 of the GDPR, we have implemented comprehensive technical and organizational measures to protect your personal data from unauthorized access, accidental destruction, damage, leakage or misuse:

  • All data transmission between your browser and our website uses HTTPS encryption, to ensure that your personal information cannot be intercepted during transmission over public networks.
  • We have deployed strict access control mechanisms for all our internal data systems, only granting the minimum level of data access permission to authorized employees who need to process your data to fulfill their job duties.
  • We carry out regular security audits, data backup and vulnerability testing for all our IT systems, to continuously improve our data protection capabilities. In the extremely unlikely event of a personal data breach that poses a high risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours after becoming aware of the breach, and notify you directly without undue delay when the law requires.

10. Updates to This Privacy Policy

We may revise and update this privacy policy on an irregular basis to adapt to changes in our business operations, new regulatory requirements, or updates to our service functions. When we make material changes to this policy, we will update the “Effective Date” at the top of this page, and post a prominent notification on the homepage of www.troikaonlineshop.com to inform you of the key changes. We encourage you to review this policy periodically to stay informed about how we protect your personal data.

11. Final Contact Information

If you have any questions, comments, or concerns about any content of this privacy policy, or about our data protection practices, please do not hesitate to contact us at:
TROIKA Onlineshop GmbH
Email: zippo@troikaonlineshop.com
Telephone: +49 2662 7779
Address: Nisterfeld 11, 57629 Müschenbach, Germany