Privacy policy

Oktatec Privacy Policy (as of 13 January 2026)

This English version is provided for informational purposes only.
The legally binding version of this Privacy Policy is the German version.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Arkonis GmbH
(trading under the brand “Oktatec”)
Gewerbepark Birkenhain 4–8
63589 Linsengericht
Germany

Email: info@oktatec.de

2. General Information on Data Processing

We process personal data exclusively in accordance with the GDPR and the applicable national data protection laws.

Personal data means any information relating to an identified or identifiable natural person (e.g. name, address, email address, IP address).

3. Hosting and Shop Platform (Shopify)

Our online shop is operated using the Shopify platform.

Provider:
Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4
Ireland

Shopify provides the technical infrastructure, hosting services and shop software and processes personal data in the context of providing and operating the shop.

Processed Data

• Master and contact data
• Contract and order data
• Payment and transaction data
• Usage and device information (e.g. IP address)

Legal Bases

• Art. 6(1)(b) GDPR (performance of a contract)
• Art. 6(1)(f) GDPR (secure and efficient operation of the shop)

Third-Country Transfers

In the context of using Shopify, personal data may be transferred to third countries, in particular to the United States.

Such transfers are carried out on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular on the basis of Standard Contractual Clauses of the European Commission and – where applicable – the EU–US Data Privacy Framework.

4. Access Data / Server Log Files

When visiting our website, the following data are automatically collected:

• IP address
• Date and time of access
• Pages accessed
• Browser type and version
• Operating system
• Referrer URL

Purposes

• Technical provision of the website
• System security
• Prevention of misuse and fraud

Legal basis: Art. 6(1)(f) GDPR

Storage period: maximum 7 days, unless longer retention is required for security-related reasons.

5. Cookies & Cookie Consent Tool

We use cookies and similar technologies.

Categories:

• Technically necessary cookies
• Statistical cookies
• Marketing cookies

Cookies requiring consent are only set after active consent via Shopify’s cookie consent tool.

Legal Bases:

• § 25(2) No. 2 TTDSG (technically necessary cookies)
• Art. 6(1)(f) GDPR (processing of necessary cookies)
• § 25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR (statistical and marketing cookies)

The cookie consent tool stores your consent decision, including time and category, in order to demonstrate compliance with legal requirements.

You may withdraw your consent at any time via the cookie settings.

6. Contact

If you contact us (e.g. by email or contact form), we process:

• Name
• Email address
• Content of the inquiry

Legal bases:

• Art. 6(1)(b) GDPR (pre-contractual measures)
• Art. 6(1)(f) GDPR (communication)

7. Customer Account and Orders

In the context of orders and customer accounts, we process:

• Name and address
• Contact details
• Order and contract data
• Payment data

Legal basis: Art. 6(1)(b) GDPR

Retention Periods

• Commercial law: 6 years
• Tax law: 10 years

Providing the required personal data is necessary for concluding and performing the contract. Without this data, a contract cannot be concluded.

8. Payment Processing

Payment processing is carried out via the following payment service providers:

8.1 Payment Methods

• PayPal
• Klarna
• Credit card
• Advance payment (bank transfer)
• Sofortüberweisung

Depending on the selected payment method, personal data are transmitted to the respective payment service provider.

Processed Data

• Name
• Billing and delivery address
• Payment and transaction data
• Additional data required for payment processing

Recipients

• Respective payment service providers
• Where applicable, involved credit or financial institutions

Legal Bases

• Art. 6(1)(b) GDPR (payment processing)
• Art. 6(1)(f) GDPR (fraud prevention)

9. Shipping Service Providers

For delivery of ordered goods, we transmit personal data (name, delivery address, if applicable contact details) to commissioned shipping service providers.

Purpose: performance of the contract / delivery
Legal basis: Art. 6(1)(b) GDPR

10. Sale of Weapons, Ammunition and FSK-18 Items

Age and Acquisition Authorization Verification

We distribute weapons, ammunition and FSK-18 items via our shop.

10.1 Purpose

To comply with statutory obligations (in particular youth protection and firearms legislation), we carry out age verification and, where applicable, verification of acquisition authorization.

10.2 Processed Data

• Identity data (name, address)
• Date of birth
• Where legally required, information on acquisition authorization (e.g. firearms ownership card – WBK)

10.3 Recipients

Personal data may – where legally required – be transmitted to:

• Competent authorities
• Shipping service providers (e.g. for age-verified delivery)
• Payment service providers (e.g. identity/payment verification)

10.4 Legal Bases

• Art. 6(1)(c) GDPR (legal obligation)
• Art. 6(1)(b) GDPR (performance of contract)
• Art. 6(1)(f) GDPR (lawful and compliant distribution)

10.5 Retention Period

Data are stored only as long as required to comply with statutory documentation and retention obligations.

11. Data Subject Rights

Data subjects have, in particular, the following rights:

• Art. 15 GDPR – Right of access
• Art. 16 GDPR – Right to rectification
• Art. 17 GDPR – Right to erasure
• Art. 18 GDPR – Right to restriction of processing
• Art. 20 GDPR – Right to data portability
• Art. 21 GDPR – Right to object
• Art. 77 GDPR – Right to lodge a complaint with a supervisory authority

Competent Supervisory Authority:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Postfach 3163
65021 Wiesbaden
Germany

12. Storage Duration

Personal data are deleted as soon as the purpose for processing no longer applies and no statutory retention obligations exist.

In addition, the specific retention periods mentioned in the respective sections apply.

13. Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy. The current version is available on our website.