Privacy policy

Privacy Policy

Last updated: October 2026

Protecting your personal data matters to us. Below we explain how we process personal data when you use our online shop oldpatek.de.

1. Controller

Velnora Global Limited
Unit 308, 3/F, Chevalier House
45–51 Chatham Road South
Tsim Sha Tsui, Kowloon, Hong Kong
Email: support@oldpatek.com

We are based in Hong Kong, outside the EU. Processing of your data by us in Hong Kong is necessary for the performance of the contract concluded with you (Art. 49(1)(b) GDPR); otherwise we use appropriate safeguards such as standard contractual clauses (see section 15).

2. Hosting and shop system (Shopify)

Our shop runs on Shopify International Ltd., Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. Shopify provides infrastructure, shop system, database, checkout and order processing and processes in particular IP addresses, device and browser data, order and contact data. Legal bases: Art. 6(1)(b) and (f) GDPR.

3. Server log files

When you visit the website, IP address, date and time, browser and version, operating system, referrer URL and pages accessed are recorded automatically for technical provision, security and error analysis (Art. 6(1)(f) GDPR).

4. Orders and contract performance

To process your order we use your name, billing and delivery address, email address, phone number (if provided), order and payment information and communication data (Art. 6(1)(b) GDPR). Where commercial and tax retention obligations apply, we store this data under Art. 6(1)(c) GDPR.

5. Customer account

If you create a customer account, we store your data for future orders and access to your order history (Art. 6(1)(b) GDPR). You can have your account deleted at any time unless retention obligations apply.

6. Contact and help forms

If you contact us by email or through our contact, help or return forms, we process your name, email address, order number, message and any further information you provide (e.g. photos) to handle your request (Art. 6(1)(b) or (f) GDPR).

7. Payment providers

To process payments we share the necessary data (name, billing and delivery address, email address, amount, order information, IP and device data for fraud prevention) with the relevant payment provider (Art. 6(1)(b) and (f) GDPR):

  • Airwallex (Airwallex (Hong Kong) Limited or the Airwallex entity responsible for your payment) for card payments and processing of Klarna.
  • Klarna: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. Klarna may process data for identity and credit checks.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
  • Apple Pay: Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland.
  • Google Pay: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

8. Fraud prevention and payment disputes

We check orders automatically and manually for irregularities (e.g. IP address, device data, mismatches between billing and delivery address). If a payment is disputed (chargeback, Klarna or PayPal case), we provide the payment provider with the evidence required, in particular order, payment, shipping, tracking and delivery data and relevant communication. The legal basis is our legitimate interest in establishing, exercising and defending legal claims and preventing fraud (Art. 6(1)(f) GDPR). We do not make solely automated decisions with legal effect within the meaning of Art. 22 GDPR.

9. Shipping providers

For delivery we share your name, delivery address and, where necessary, email address and phone number with the shipping and logistics providers used (e.g. DHL, DPD, UPS, YunExpress and other regional or international partners) (Art. 6(1)(b) GDPR).

10. Cookies and consent management

We use technically necessary cookies (Art. 6(1)(f) GDPR, Section 25(2) TDDDG) and – only with your consent – analytics and marketing cookies (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You manage your consent via Shopify's cookie banner and can withdraw it at any time with effect for the future.

11. Analytics and marketing services (consent only)

  • Google Analytics and Google Tag Manager: Google Ireland Limited, Ireland.
  • Meta Pixel and Conversions API: Meta Platforms Ireland Limited, Ireland.
  • TikTok Pixel: TikTok Technology Limited, Ireland.
  • Microsoft Clarity: Microsoft Corporation, Redmond, USA. Heatmaps, click analysis and session recordings.

This involves in particular IP address (shortened where possible), device and browser data, pages visited, cart actions and purchases, based on your consent (Art. 6(1)(a) GDPR).

12. Email newsletter

If you subscribe to our newsletter, we use your email address based on your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email. Transactional emails about your order are sent regardless, for contract performance.

13. Social media

We maintain profiles on Facebook, Instagram, YouTube and TikTok. When you visit them, the platform operators process data under their own privacy policies.

14. Retention

We store personal data only as long as necessary. Data needed for possible payment disputes or legal proceedings is kept until the relevant dispute or limitation periods expire. Commercial and tax retention periods may require storage for up to ten years.

15. Transfers to third countries

For some services (e.g. processing by us in Hong Kong, Microsoft Clarity in the USA, international shipping partners) data may be processed outside the EU/EEA, based on an adequacy decision (e.g. EU-US Data Privacy Framework), standard contractual clauses or, where necessary for contract performance, Art. 49(1)(b) GDPR.

16. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and to withdraw consent with effect for the future (Art. 15–20, 7(3) GDPR). An email to support@oldpatek.com is sufficient.

Right to object: Where we process data based on legitimate interests, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You may object to direct marketing at any time without reasons.

You may also lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence.

17. Information for customers in the USA

Depending on your US state, you may opt out of the sharing of personal data for targeted advertising via our privacy settings page. We treat a Global Privacy Control signal as such an opt-out. We do not sell personal data for money.

18. Data security

We use appropriate technical and organisational measures and SSL/TLS encryption. Please do not send passwords or full payment details by email.

19. Changes

We update this policy when legal requirements or our services change. The version published here applies.