Privacy policy
This English translation is provided for your convenience. Only the German version is legally binding.
Last updated: 25 October 2026
1. Controller
The controller responsible for processing personal data on this website is:
Robin Herwegh
trading as Robin Herwegh Commerce
Wolgaster Straße 12
13355 Berlin
Germany
Email: robin@moventerra.com
2. General information
We take the protection of your personal data seriously. In this privacy policy, we inform you about which personal data we process when you visit www.moventerra.com, place an order or contact us.
Personal data is any information relating to an identified or identifiable person. This includes, for example, name, address, email address, order data, IP address and information about your use of our website.
We only process personal data where there is a legal basis for doing so. Depending on the purpose, processing takes place in particular:
– to perform a contract or pre-contractual measures under Art. 6(1)(b) GDPR,
– to comply with legal obligations under Art. 6(1)(c) GDPR,
– on the basis of your consent under Art. 6(1)(a) GDPR, or
– to protect legitimate interests under Art. 6(1)(f) GDPR.
3. Shopify and hosting
Our online shop runs on the e-commerce platform Shopify. The provider for merchants in the European Economic Area is:
Shopify International Limited
Ireland
Shopify provides us with the technical infrastructure for the shop, checkout, order management, payment processing and other shop functions.
When you use our shop, Shopify processes in particular:
– IP address and device information,
– browser and usage data,
– cookie and session information,
– contact, billing and delivery data,
– order and transaction data, and
– information for fraud prevention and security.
Insofar as Shopify processes this data on our behalf, processing is based on a data processing agreement. Processing serves to provide the shop, perform the contract, ensure technical security and our legitimate interest in a secure and functional online shop.
You can find more information in Shopify's consumer privacy policy.
4. Shopify Network Intelligence
We use Shopify Network Intelligence and related advanced Shopify features.
Shopify may use information about interactions with our shop together with information from interactions with Shopify and other Shopify merchants. This serves, among other things:
– to improve and personalise Shopify services,
– to optimise shop performance,
– for fraud prevention and security, and
– to improve measurement and ad targeting.
For certain advanced services, Shopify may process personal data as an independent controller. Other Shopify merchants do not receive direct access to our customer data.
Where consent is required, non-essential processing only takes place after your selection in the cookie banner. You can change your selection at any time via the cookie settings in the shop.
You can find more information and ways to exercise your rights against Shopify in the Shopify privacy portal.
5. Server logs and technical security
When you access our website, technically necessary data is processed. This may include:
– IP address,
– date and time of access,
– page or file accessed,
– amount of data transferred,
– browser type and version,
– operating system,
– referrer URL, and
– technical error and security information.
Processing serves the secure and trouble-free operation of the website, error detection and the prevention of abusive or fraudulent activity.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of our online shop.
6. Cookies and consent management
We use cookies and similar technologies. Cookies are small files that can be stored on or read from your device.
Technically necessary cookies
Some cookies are required for the shop, basket, checkout, payment processing, fraud prevention and your privacy settings to work.
Storage or access takes place, where necessary, under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The subsequent processing of personal data is based in particular on Art. 6(1)(b) or (f) GDPR.
Analytics and marketing cookies
We only use non-essential analytics and marketing technologies if you have given your prior consent via our cookie banner.
The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR.
You can withdraw or adjust your consent at any time with effect for the future via the cookie settings provided in the shop.
7. Orders, contract processing and customer account
When you order from us, we process the data required for the order. This includes in particular:
– first and last name,
– email address and, where applicable, phone number,
– billing and delivery address,
– products ordered,
– selected personalisations,
– payment method and payment status,
– shipping and tracking information, and
– communication about the order.
We use this data to process your order, make your product, allocate payments, organise delivery and handle queries, complaints or guarantee requests.
The legal basis is Art. 6(1)(b) GDPR. Where we are required to retain certain data for tax or commercial law reasons, this is additionally based on Art. 6(1)(c) GDPR.
Customer account
You can optionally use a customer account. You sign in via Shopify with your email address and a verification code. In your customer account, you can view your orders and their status, manage your addresses and – for non-personalised products – declare your withdrawal.
This involves processing in particular your email address, name, addresses and order history. The legal basis is Art. 6(1)(b) GDPR. You can ask us by email to delete your customer account at any time; statutory retention obligations for order data remain unaffected.
8. Personalisation and route data
To personalise your keepsake, we process the details you enter in the product form. Depending on the product, these include in particular:
– title, subtitle and name on the keepsake,
– motorcycle and travel dates,
– distance, riding time and number of laps,
– the chosen route or challenge, colour style, background and route colour, and
– for a Custom Route, the GPX file you upload.
Processing is necessary to make the product you configured. The legal basis is Art. 6(1)(b) GDPR.
GPX files for a Custom Route
A GPX file contains the coordinates of your route and, depending on the app, further details such as timestamps, elevation values, device information or a tour or user name. The start and end points of a route may allow conclusions about places such as where you live.
The file is first processed directly in your browser to create the preview. For this, your browser retrieves elevation data and place names from external services (see section 9). The GPX file itself is not transmitted to these services.
Only when you add the Custom Route to your basket and order it is the GPX file transmitted to Shopify together with your order and stored for us. We use it solely to make your relief and to handle queries about your order. The legal basis is Art. 6(1)(b) GDPR. The storage period is set out in section 17.
Easify Product Options
For selecting and transmitting personalisations for certain products, in particular our event keepsakes, we use Easify Product Options. The provider is:
Tigren JSC / EasifyApps
130 Nguyen Duc Canh
Hoang Mai, Hanoi
Vietnam
Via Easify, the following may be processed in particular: the selected challenge, the name on the keepsake, distance, riding time and number of laps, the selected route colour, product and variant information, and metadata associated with the order.
Easify processes data on our behalf. As processing may take place outside the European Economic Area, the necessary data protection safeguards, in particular appropriate contractual agreements, are in place.
You can find more information in the Easify Product Options privacy policy.
9. External services for maps, 3D preview and icons
To display maps, elevation profiles, the 3D preview and icons on our website, your browser loads content from servers of external providers. For technical reasons, your IP address is transmitted to the respective provider, together with browser information and the requested resource. We have no influence on whether and for how long the providers store this data.
– Terrain Tiles via Amazon Web Services (AWS): elevation data for the relief, the 3D preview and elevation profiles. The map tiles retrieved reveal the approximate map area. More information: AWS privacy notice.
– Nominatim (OpenStreetMap Foundation): place names for the start and end points of a Custom Route. The coordinates of these points are transmitted for this purpose. More information: OpenStreetMap Foundation privacy policy.
– OpenFreeMap: map display on our route pages. More information: openfreemap.org.
– jsDelivr: delivery of program libraries, including for the 3D display and country flags. More information: jsDelivr privacy policy.
– Google Fonts (Google Ireland Limited): delivery of the "Material Symbols" icon font. More information: Google privacy policy.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a functional, fast and appealing presentation of our website and of the preview of your product. Where data is processed outside the European Economic Area, section 16 applies.
10. Payment processing
Depending on the payment method selected, we transmit the data required to process the payment to Shopify Payments or the payment service provider you have chosen.
This data may include:
– name and contact details,
– billing address,
– order value and currency,
– transaction and payment status, and
– information for fraud prevention.
Full credit card details are generally processed directly by the respective payment service provider and are not fully visible to us.
The legal basis for the transfer is Art. 6(1)(b) GDPR. Payment service providers may additionally process data as independent controllers, in particular for identity verification, fraud prevention, credit checks and compliance with legal obligations.
Shopify Payments, credit card, Apple Pay and Google Pay
Credit card payments as well as Apple Pay and Google Pay are processed via Shopify Payments and the payment providers involved.
Apple's privacy terms additionally apply to Apple Pay. Google's privacy terms additionally apply to Google Pay.
PayPal
If you select PayPal, data is transmitted to the following provider:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
You can find more information in the PayPal privacy statement.
Klarna
If you select a Klarna payment method, data is transmitted to the following provider:
Klarna Bank AB (publ)
Sveavägen 46
111 34 Stockholm
Sweden
Klarna may in particular carry out identity, address, credit and fraud checks. We have no influence on Klarna's decision to provide certain payment methods.
You can find more information in Klarna's privacy information.
11. Shipping providers
To deliver your order, we transmit the necessary data to the shipping provider used. This includes in particular name, delivery address and, where applicable, email address or phone number for shipping notifications.
Depending on the order, we ship with:
– DHL,
– DPD or
– Hermes.
The transfer takes place to perform the purchase contract under Art. 6(1)(b) GDPR.
Your email address or phone number is only transmitted for voluntary shipping notifications if this is necessary to perform the contract or if there is corresponding consent or another legal basis.
12. Invoicing and accounting with Lexware Office
We use Lexware Office for invoicing and accounting. The provider is:
Haufe-Lexware GmbH & Co. KG
Munzinger Straße 9
79111 Freiburg
Germany
Order, invoice and payment data is transferred automatically from Shopify to Lexware Office. This includes in particular:
– name and billing address,
– invoice number and invoice date,
– products ordered and prices,
– tax information, and
– payment status.
Processing takes place to perform the contract and to comply with commercial and tax law obligations under Art. 6(1)(b) and (c) GDPR.
13. Contact and Google Workspace
If you contact us by email or via a contact form, we process the data you provide. This may include name, email address, subject, message and any files you voluntarily send.
We use Google Workspace for our business email communication. The provider is:
Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland
Processing takes place to handle your enquiry. If the enquiry relates to an order or a possible contract, the legal basis is Art. 6(1)(b) GDPR. For general enquiries, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in efficient and personal communication.
14. Meta Pixel and Conversions API
With your consent, we use the Meta Pixel and the Meta Conversions API. The provider is:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
These services allow us to understand how visitors interact with our shop and our ads on Facebook and Instagram. This lets us measure the effectiveness of our advertising and build audiences for relevant ads.
The following may be processed in particular:
– IP address and device information,
– browser data,
– pages and products viewed,
– basket and purchase events,
– order value and currency,
– cookie and pixel identifiers, and
– contact information transmitted in hashed form for advanced matching.
With the Meta Pixel, data is collected via the browser. With the Conversions API, event data may additionally be transmitted to Meta server-side.
Processing for analytics and marketing purposes only takes place with your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via the cookie settings.
We and Meta may be joint controllers for the collection and transmission of certain event data. Further processing by Meta is subject to Meta's privacy terms.
You can find more information in the Meta privacy policy.
15. Instagram and LinkedIn
We maintain company profiles on Instagram and LinkedIn. Our website only contains links to these profiles. Simply visiting our website does not transfer any data to these platforms via these links.
The respective platform only opens when you click a link. The platform provider may then process personal data such as your IP address, device information and information about your visit.
Instagram is provided by Meta Platforms Ireland Limited. Meta's privacy information additionally applies when you use our Instagram profile.
For users in the European Economic Area, LinkedIn is provided by:
LinkedIn Ireland Unlimited Company
Wilton Plaza
Wilton Place
Dublin 2
Ireland
You can find more information in the LinkedIn privacy policy.
Where the platforms provide us with anonymised or aggregated statistics on the use of our profiles, we use them to improve our communication and public presence. The legal basis is Art. 6(1)(f) GDPR.
16. Recipients of personal data and international data transfers
We only pass on personal data if this is necessary for the purposes stated or permitted by law.
Possible recipients include in particular:
– Shopify and its sub-processors,
– EasifyApps,
– the providers for maps, 3D preview and icons named in section 9,
– payment service providers,
– shipping providers,
– Lexware Office,
– Google Workspace,
– Meta, after consent has been given,
– tax advisers, authorities or other legally authorised bodies.
We do not sell personal data.
When using Shopify, Easify, Amazon Web Services, jsDelivr, Google, Meta and individual payment services, data may be processed outside the European Union or the European Economic Area.
Data is only transferred if the requirements of Art. 44 et seq. GDPR are met. Depending on the recipient, transfers are based in particular on:
– an adequacy decision of the European Commission,
– the EU-US Data Privacy Framework for appropriately certified US companies, or
– standard contractual clauses of the European Commission and supplementary safeguards.
17. Storage period
We only store personal data for as long as it is necessary for the respective purpose or as long as statutory retention obligations apply.
In particular, the following principles apply:
– Order and contract data is stored for the duration of contract processing and thereafter in accordance with statutory limitation and retention periods.
– Accounting records and invoice data are generally retained for eight years.
– Commercial and business letters are generally retained for six years.
– Uploaded GPX files are stored for making your relief and for queries, complaints or guarantee cases, and then deleted unless there are legal reasons for further storage.
– Contact enquiries unrelated to a contract are deleted once the enquiry has been fully dealt with and there are no legal or legitimate reasons for further storage.
– Records of consent are stored for as long as necessary to prove lawful processing.
– Marketing and analytics data is no longer processed for these purposes once consent has been withdrawn, unless there are legal reasons for further storage.
Longer storage may be necessary if data is needed to establish, exercise or defend legal claims.
18. Your data protection rights
Subject to the statutory requirements, you have in particular the following rights:
– access to your personal data processed by us,
– rectification of inaccurate or incomplete data,
– erasure of your data,
– restriction of processing,
– data portability,
– objection to certain processing, and
– withdrawal of consent given, with effect for the future.
Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
If we process data on the basis of legitimate interests, you can object on grounds relating to your particular situation. You can object to processing for direct marketing purposes at any time without giving any particular reason.
To exercise your rights, a message to the following address is sufficient:
19. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. In particular, you can contact the authority responsible for our registered office:
Berlin Commissioner for Data Protection and Freedom of Information
You can find current contact details at www.datenschutz-berlin.de.
20. Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
However, completely risk-free data transmission over the internet cannot be guaranteed.
21. Changes to this privacy policy
We update this privacy policy when our data processing, the services we use or the legal requirements change.
The current version is always available on our website.
