Privacy policy

 

Last updated: 9 July 2026

1. Name and Address of the Controller

Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member States of the European Union, and the Georgian Personal Data Protection Law:

Werner Mathias Bundschuh (Individual Entrepreneur)
21rebel.store
Georgia, Tbilisi, Gldani Massif, Micro/District III, Building 80
0167 Tbilisi, Georgia
Phone: +995 599 57 10 45
Email: 21rebel.store@pm.me
Website: https://21rebel.store

EU Representative (Art. 27 GDPR):
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following region: European Union (EU). If you want to contact us via our representative Prighter or make use of your data subject rights, please visit: https://app.prighter.com/portal/shopatch (reference: ID-19065088599)

2. Collection of General Data and Information

When you access this website, our hosting provider automatically collects general data and information stored in server log files: browser type and version, the operating system used, the referring website, the sub-pages visited, the date and time of access, an abbreviated/anonymised IP address, and the accessing internet service provider.

We do not use this data to draw conclusions about you. It is required to deliver the website correctly, ensure the security and stability of our systems, and provide law-enforcement authorities with information in the event of a cyber-attack. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

3. Data Processing for Contract Execution (Shopify)

Our store is hosted on Shopify (Shopify International Ltd, Dublin, Ireland). Shopify provides the e-commerce platform that lets us sell our products to you and stores your data on secure servers. When you place an order, we process your data (name, address, email, order and payment details) to fulfil the purchase contract. Legal basis: Art. 6(1)(b) GDPR.

Shopify may transfer data to servers in the USA or Canada. Shopify is certified under the EU–US Data Privacy Framework (DPF) and, for Canada, an EU adequacy decision applies. A data processing agreement (DPA) is in place with Shopify.

4. Payment Service Providers

If you choose a payment method at checkout, the relevant payment service provider processes your payment data.

PayPal: If you pay via PayPal, your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Legal basis: Art. 6(1)(b) GDPR.

Bitcoin / crypto payments (OpenNode): If you pay with Bitcoin, the payment is processed via our payment service provider OpenNode (OpenNode, Inc., USA). Transaction data is recorded on the public blockchain; please note that blockchain transactions are public and immutable. Any transfer to the USA is safeguarded by Standard Contractual Clauses. Legal basis: Art. 6(1)(b) GDPR.

Payment service providers generally act as independent controllers for the payment transaction and process your data in accordance with their own privacy policies.

5. Printful — Production and Shipping

We use Printful, Inc. (USA) as a third-party provider for the manufacture and shipment of print-on-demand products. Printful processes your order data (name, address, order details, email) to fulfil the contract. Legal basis: Art. 6(1)(b) GDPR. Transfers to the USA are safeguarded by Standard Contractual Clauses, and a DPA is in place. See the Printful Privacy Policy.

6. Order and Invoice Documents

To create order confirmations and invoices we use an order/invoice app provided by FORSBERG+two ApS (Vedbæk, Denmark), which processes the order data required for this purpose. Denmark is within the EU (no third country); a DPA is in place. Legal basis: Art. 6(1)(b) and (c) GDPR.

7. Advertising and Sales Channels (Meta, Google)

We also present and sell our products via Facebook and Instagram (Meta Platforms Ireland Ltd) and via Google Shopping / YouTube (Google Ireland Ltd). If you interact with our advertisements on these platforms, the providers process your data under their own privacy policies.

On our own online shop, the Meta Pixel and Google tags are loaded only after you have given consent via our cookie banner (see section 9). Legal basis: Art. 6(1)(a) GDPR (consent). See the Meta Privacy Policy and the Google Privacy Policy.

8. Reviews and Trust Mark (Trusted Shops)

We use the trust mark and customer-review services of Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany, to display our trust badge and collect buyer reviews. For this, Trusted Shops and we act as joint controllers under Art. 26 GDPR. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a trustworthy shop) and, for review invitations, Art. 6(1)(a) GDPR (consent). Germany is within the EU (no third country). See the Trusted Shops Privacy Policy.

9. Cookies and Consent Management

Our shop sets technically necessary cookies that are required for it to function. Analytics and marketing cookies/tools (e.g. the Meta Pixel, Google tags) are used only with your explicit consent, given via our cookie banner when you enter the website. Legal basis: Art. 6(1)(a) GDPR.

Our consent banner is provided by Pandectes OÜ (Kuusalu vald, Estonia), which records and documents your consent choices; a DPA is in place. You can review the tools used and withdraw your consent at any time with effect for the future via the cookie settings on the website.

10. Contact

If you contact us by email or via a contact form, the data you provide (e.g. name, email, message) is stored to process your enquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contract) or Art. 6(1)(a)/(f) GDPR. Enquiries are deleted once they are no longer required, at the latest after 6 months, unless statutory retention periods apply.

11. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about products, offers and news. Subscription uses a double opt-in procedure: after you register, we send a confirmation email and only add you to the list once you confirm. Legal basis: Art. 6(1)(a) GDPR (consent).

The newsletter is sent via Shopify (see section 3). We evaluate whether newsletters are opened and which links are clicked, in order to measure and improve deliverability and relevance. You can unsubscribe and withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter or by emailing 21rebel.store@pm.me.

12. Routine Erasure and Blocking of Personal Data

We process and store your personal data only for as long as necessary to achieve the purpose of storage or as required by statutory retention periods (in particular tax and commercial law). Once the purpose ceases or a retention period expires, the data is routinely erased or blocked.

13. Your Rights

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interest (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7(3)).

To exercise your rights, contact us at 21rebel.store@pm.me. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR): for Georgia, the Georgian Personal Data Protection Service; EU residents may also contact their national data protection authority.

14. International Data Transfers

Where processors are located outside the EU/EEA, transfers are safeguarded by adequacy decisions and/or Standard Contractual Clauses: Shopify (USA/Canada — DPF / adequacy), Printful and OpenNode (USA — SCC). PayPal (Luxembourg), Trusted Shops (Germany), FORSBERG+two (Denmark) and Pandectes (Estonia) process data within the EU.

15. Changes to this Privacy Policy

We update this privacy policy when our practices change. The "last updated" date above reflects the current version.