Privacy policy

Privacy Policy

Last updated: June 10, 2026

We appreciate your interest in our services. Protecting your personal data is important to us. Below, we inform you in accordance with Art. 13 GDPR about the collection and processing of your data.

1. Controller

SH-Promotion GmbH
Schenefelder Str. 17
25596 Wacken, Germany
Email: festivalstore@wacken.com
Managing Directors: Holger Hübner, Thomas Jensen

2. Purposes and Legal Bases of Data Processing

We process your personal data for the following purposes:

  • Order processing (Art. 6(1)(b) GDPR)

  • Customer account management (Art. 6(1)(b) GDPR)

  • Provision of the wacken.id SSO service (Art. 6(1)(b) GDPR)

  • Payment processing via third-party providers (Art. 6(1)(b) GDPR)

  • Shipping and pickup (Art. 6(1)(b) GDPR)

  • Customer service via contact form (Art. 6(1)(b) and (f) GDPR)

  • Advertising and newsletters (Art. 6(1)(a), (b) and (f) GDPR)

  • Website analysis and optimization via cookies and tracking (Art. 6(1)(a) GDPR)

  • Security and fraud prevention (Art. 6(1)(f) GDPR)

  • Service improvement, communication, account management (Art. 6(1)(f) GDPR)

3. Categories of Data and Recipients

We only share your data when necessary for contract fulfillment or as required by law. Recipients may include:

  • Textildruck Europa GmbH (shipping of group shirts)

  • Modul Kombinat GmbH (locker booking)

  • Soulbus Katja Schroedter (Massages)

  • Sonja Storm und Nori Storm GbR (tattoo appointments)

  • Payment service providers (depending on the selected payment method)

  • Brevo (newsletter dispatch)

  • Shopify Inc. (shop platform and hosting)

  • Wilderness International (donation target at checkout)

We have data processing agreements in place with all service providers pursuant to Art. 28 GDPR.

4. Data Transfers to Third Countries

Platforms like Shopify, and services such as Google Analytics or Facebook Pixel may transfer data to third countries (e.g., the USA). These transfers are based on the EU Commission’s standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Shopify also processes your data in accordance with its own privacy policy: https://www.shopify.com/legal/privacy

5. Newsletters and Customer Communication

You can voluntarily subscribe to our newsletter. Subscription is managed through a double opt-in process via the provider Brevo. You may unsubscribe at any time using the link in the email.

Existing customers occasionally receive emails about similar products. You may opt out of this usage at any time.

6. Cookies and Tracking

Our website uses cookies and tracking tools such as Google Analytics and Facebook Pixel to analyze user behavior and improve our offerings. Usage is based on your consent (Art. 6(1)(a) GDPR), which you can grant or refuse via our cookie banner.

Shopify sets additional cookies for functionality, analytics, security, and marketing. A detailed overview is available at: https://www.shopify.com/legal/cookies

Most browsers accept cookies by default. You can reject or delete cookies via your browser settings. Please note that this may limit website functionality. Our website recognizes the "Global Privacy Control" signal, which automatically takes your privacy preferences into account. Learn more at: https://globalprivacycontrol.org/

We also use personal data collected via cookies for:

  • Improving services and shopping experience

  • Security and fraud prevention

  • Marketing and personalized advertising

7. Storage Period

We store your data for as long as necessary to fulfill the respective purpose:

  • Contract and order data: 10 years (in line with tax retention obligations)

  • Newsletter data: until consent is withdrawn

  • Tracking data: according to the settings of the respective services

After the relevant retention periods, your data will be deleted or anonymized.

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

  • Access to stored data (Art. 15 GDPR)

  • Correction of inaccurate data (Art. 16 GDPR)

  • Erasure (Art. 17 GDPR)

  • Restriction of processing (Art. 18 GDPR)

  • Data portability (Art. 20 GDPR)

  • Objection to processing (Art. 21 GDPR)

  • Withdrawal of consent (Art. 7(3) GDPR)

To exercise your rights, please contact:
Email: festivalstore@wacken.com

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the competent data protection supervisory authority. The responsible authority is:

State Commissioner for Data Protection Schleswig-Holstein
Holstenstraße 98, 24103 Kiel, Germany
https://www.datenschutzzentrum.de

Effective date: June 10, 2026