Privacy policy

Last updated: 5th August 2026

1. Name and Address of the Controller

Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member States of the European Union, and the Georgian Personal Data Protection Law:

Werner Mathias Bundschuh (Individual Entrepreneur)
21rebel.store
Georgia, Tbilisi, Gldani Massif, Micro/District III, Building 80
0167 Tbilisi, Georgia
Phone: +995 599 57 10 45
Email: 21rebel.store@pm.me
Website: https://21rebel.store

EU Representative (Art. 27 GDPR):
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following region: European Union (EU). If you want to contact us via our representative Prighter or make use of your data subject rights, please visit: https://app.prighter.com/portal/shopatch (reference: ID-19065088599)

2. Collection of General Data and Information

When you access this website, our hosting provider automatically collects general data and information stored in server log files: browser type and version, the operating system used, the referring website, the sub-pages visited, the date and time of access, an abbreviated/anonymised IP address, and the accessing internet service provider.

We do not use this data to draw conclusions about you. It is required to deliver the website correctly, ensure the security and stability of our systems, and provide law-enforcement authorities with information in the event of a cyber-attack. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

3. Data Processing for Contract Execution (Shopify)

Our store is hosted on Shopify (Shopify International Ltd, Dublin, Ireland). Shopify provides the e-commerce platform that lets us sell our products to you and stores your data on secure servers. When you place an order, we process your data (name, address, email, order and payment details) to fulfil the purchase contract. Legal basis: Art. 6(1)(b) GDPR.

Shopify may transfer data to servers in the USA or Canada. Shopify is certified under the EU–US Data Privacy Framework (DPF) and, for Canada, an EU adequacy decision applies. A data processing agreement (DPA) is in place with Shopify.

4. Payment Service Providers

If you choose a payment method at checkout, the relevant payment service provider processes your payment data.

PayPal: If you pay via PayPal, your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Legal basis: Art. 6(1)(b) GDPR.

Bitcoin / crypto payments (OpenNode): If you pay with Bitcoin, the payment is processed via our payment service provider OpenNode (OpenNode, Inc., USA). Transaction data is recorded on the public blockchain; please note that blockchain transactions are public and immutable. Any transfer to the USA is safeguarded by Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR.

Payment service providers generally act as independent controllers for the payment transaction and process your data in accordance with their own privacy policies.

5. Printful — Production and Shipping

We use Printful, Inc. (USA) as a third-party provider for the manufacture and shipment of print-on-demand products. Printful processes your order data (name, address, order details, email) to fulfil the contract. Legal basis: Art. 6(1)(b) GDPR. Transfers to the USA are safeguarded by Standard Contractual Clauses, and a DPA is in place. See the Printful Privacy Policy.

6. Order and Invoice Documents

To create order confirmations and invoices we use an order/invoice app provided by FORSBERG+two ApS (Vedbæk, Denmark), which processes the order data required for this purpose. Denmark is within the EU (no third country); a DPA is in place. Legal basis: Art. 6(1)(b) and (c) GDPR.

7. Advertising and Sales Channels (Meta, Google)

We also present and sell our products via Facebook and Instagram (Meta Platforms Ireland Ltd) and via Google Shopping / YouTube (Google Ireland Ltd). If you interact with our advertisements on these platforms, the providers process your data under their own privacy policies.

On our own online shop, the Meta Pixel and Google tags are loaded only after you have given consent via our cookie banner (see section 9). Legal basis: Art. 6(1)(a) GDPR (consent). See the Meta Privacy Policy and the Google Privacy Policy.

8. Reviews (Judge.me)

We use Judge.me to collect, manage and display customer reviews. The provider is JUDGE.ME LTD, C/O Buckworths, 2nd Floor, 1-3 Worship Street, London EC2A 2AB, United Kingdom (company number 12157706). Its representative in the European Union under Art. 27 GDPR is Buckworths (Ireland) Limited, c/o Workhub, 77 Lower Camden Street, Dublin, Ireland. Judge.me acts as our processor; a DPA is in place.

The following data is processed: your email address and name from your order, the order number and the items ordered, the content of your review including star rating and date, and, when you open a page containing reviews, your IP address together with technical information about your browser and device.

Providing a name is optional; reviews without a name are published as "Anonymous". Your email address is never published. It is used solely to link your review to an actual order and to notify you if we reply to your review.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in presenting our offering transparently). Review requests sent to customers after an order are based on Section 7(3) of the German Act Against Unfair Competition (UWG) in conjunction with Art. 6(1)(f) GDPR. You may object to these requests at any time at no cost beyond basic transmission rates; every review request contains an unsubscribe link.

Judge.me is established in the United Kingdom. For sending review requests, Judge.me uses the email service Postmark, which processes data in the United States. Transfers to countries outside the EU/EEA are safeguarded by the Standard Contractual Clauses that form part of the data processing agreement. See the Judge.me Privacy Policy.

Reviews are stored for as long as they are published. You may request deletion of your review at any time. Our Review Policy explains how we ensure that reviews come from genuine purchasers and the criteria under which we publish them.

9. Cookies and Consent Management

Our shop sets technically necessary cookies that are required for it to function. Analytics and marketing cookies/tools (e.g. the Meta Pixel, Google tags) are used only with your explicit consent, given via our cookie banner when you enter the website. Legal basis: Art. 6(1)(a) GDPR.

Our consent banner is provided by Pandectes OÜ (Kuusalu vald, Estonia), which records and documents your consent choices; a DPA is in place. You can review the tools used and withdraw your consent at any time with effect for the future via the cookie settings on the website.

10. Contact

If you contact us by email or via a contact form, the data you provide (e.g. name, email, message) is stored to process your enquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contract) or Art. 6(1)(a)/(f) GDPR. Enquiries are deleted once they are no longer required, at the latest after 6 months, unless statutory retention periods apply.

11. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about products, offers and news. Subscription uses a double opt-in procedure: after you register, we send a confirmation email and only add you to the list once you confirm. Legal basis: Art. 6(1)(a) GDPR (consent).

The newsletter is sent via Shopify (see section 3). We evaluate whether newsletters are opened and which links are clicked, in order to measure and improve deliverability and relevance. You can unsubscribe and withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter or by emailing 21rebel.store@pm.me.

12. Routine Erasure and Blocking of Personal Data

We process and store your personal data only for as long as necessary to achieve the purpose of storage or as required by statutory retention periods (in particular tax and commercial law). Once the purpose ceases or a retention period expires, the data is routinely erased or blocked.

13. Your Rights

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interest (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7(3)).

To exercise your rights, contact us at 21rebel.store@pm.me. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR): for Georgia, the Georgian Personal Data Protection Service; EU residents may also contact their national data protection authority.

14. International Data Transfers

Where processors are located outside the EU/EEA, transfers are safeguarded by adequacy decisions and/or Standard Contractual Clauses: Shopify (USA/Canada — DPF / adequacy), Printful and OpenNode (USA — SCC), Judge.me (United Kingdom) and its email sub-processor Postmark (USA), both covered by the Standard Contractual Clauses contained in the Judge.me data processing agreement. PayPal (Luxembourg), FORSBERG+two (Denmark) and Pandectes (Estonia) process data within the EU.

15. Changes to this Privacy Policy

We update this privacy policy when our practices change. The "last updated" date above reflects the current version.