Privacy policy

Last updated: October 18, 2026

1. Controller

The controller responsible for data processing on rainbowchain.net ("Rainbow Chain") is:

Great Products and Ideas LLC
5830 E 2nd St, Ste 7000 #17723, Casper, WY 82609, USA
represented by Nepta eG, acting through Michael Rentmeister
Email: info@greatproductsandideas.com

EU representative (Art. 27 GDPR):
Nepta eG
Staufener Strasse 9a
79238 Ehrenkirchen
Germany
Email: info@greatproductsandideas.com
You may also contact our EU representative with any questions regarding data protection.

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Overview

We process personal data only to the extent necessary to provide the shop, process your orders, respond to your inquiries, on the basis of your consent, or to comply with legal obligations. The legal bases are in particular Art. 6(1)(a) (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interests) GDPR.

3. Hosting and Shop System (Shopify)

Our shop runs on the e-commerce platform Shopify, provided by Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, ON K2P 2L8, Canada. As our processor, Shopify stores and processes, among other things, the shop content, order and customer data, and technical access data on our behalf.

When you visit the shop, technically necessary data is collected automatically (server log files): IP address, date and time, page accessed, referrer URL, browser type and operating system. This data is required to deliver the shop securely and reliably. The legal basis is Art. 6(1)(f) GDPR.

The European Commission has adopted an adequacy decision for Canada. Where data is transferred to the USA or other third countries, this is done on the basis of the EU-U.S. Data Privacy Framework (where the recipient is certified) or the EU Standard Contractual Clauses. Further information: shopify.com/legal/privacy.

4. Controller Based in the USA

As our company is based in the USA, the data you submit is also processed in the USA. This is necessary for processing your order (Art. 49(1)(b) GDPR). We protect your data with appropriate technical and organizational measures and handle it in accordance with GDPR standards.

5. Customer Account and Orders

To process an order, we process: name, shipping and billing address, email address, phone number (if provided), order data (products, prices, time of order) and payment status. You can place an order as a guest without a customer account; if you create an account, we additionally store your login data and your order history.

The purpose is the performance of the purchase contract, including shipping, customer service and warranty. The legal basis is Art. 6(1)(b) GDPR. Due to retention obligations under commercial and tax law, we store order and invoice data for up to 10 years (Art. 6(1)(c) GDPR). You may request the deletion of your customer account at any time.

6. Production and Shipping (Printify)

Our products are made to order (print-on-demand). For this purpose, we share your name, your shipping address, your email address and phone number (if provided) and the order details with Printify, Inc. (USA). Printify forwards the data to the respective print provider and shipping company that manufacture and deliver your product. Depending on the destination country, these print partners are located in the EU, the United Kingdom, the USA, Canada, Australia or other countries.

The legal basis is Art. 6(1)(b) GDPR. Where data is transferred to third countries, this is done on the basis of Standard Contractual Clauses or because it is necessary for the performance of the contract (Art. 49(1)(b) GDPR). More information: printify.com/privacy-policy.

Shipping service providers (e.g. DHL, DPD, UPS, postal and parcel services of the destination country) receive your name and shipping address and, where applicable, your email address or phone number for delivery notifications, to the extent necessary for delivery.

7. Payment Processing (Shopify Payments / Shop Pay)

Payments are processed via Shopify Payments. Payment data (e.g. card details) is processed directly by the payment service provider; we do not have access to full card numbers. The parties involved are Shopify and the payment processor Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA, and, where applicable, the providers of Apple Pay or Google Pay if you use them.

With Shop Pay, Shopify stores your payment and shipping details at your request for faster checkout in all Shopify stores; the Shop Pay privacy policy additionally applies to this. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in fraud prevention (Art. 6(1)(f) GDPR).

8. Contacting Us

If you contact us by email or via the contact form, we process the information you provide (name, email address, message) to handle your inquiry. The legal basis is Art. 6(1)(b) GDPR where the inquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the data once your inquiry has been fully dealt with and no retention obligations apply.

9. Newsletter

If you subscribe to our newsletter, we use your email address to send you information about products, offers and news. Subscription takes place via a double opt-in procedure: you will receive an email in which you confirm your subscription. We store the time of subscription and confirmation as well as your IP address as proof.

The newsletter is sent via Shopify Email (Shopify Inc.). In order to improve the newsletter, it may be recorded whether a newsletter was opened and which links were clicked. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time via the unsubscribe link in every email or by sending us a message.

If you have made a purchase from us, we may send recommendations for our own similar products to the email address you provided in that context (§ 7(3) UWG (German Act Against Unfair Competition), Art. 6(1)(f) GDPR). You may object to this at any time without incurring any costs other than the transmission costs at the basic rates.

10. Cookies and Similar Technologies

Our shop uses cookies and similar technologies. We set technically necessary cookies (e.g. shopping cart, checkout, language settings, security, storing your cookie preferences) on the basis of § 25(2) TDDDG and Art. 6(1)(b) or (f) GDPR.

We set all other cookies, for example for analytics (Shopify Analytics) or marketing, only with your consent via our cookie banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time with effect for the future via the cookie settings in the footer of the page. An overview of the cookies used by Shopify is available at shopify.com/legal/cookies.

We recognize the "Global Privacy Control" (GPC) signal as an objection to the sharing of your data for advertising purposes.

11. Recipients

Your data is received only by the service providers named above within the scope of their respective tasks and – where required by law – by public authorities (e.g. tax and customs authorities). Your data is not passed on to third parties for advertising purposes.

12. Storage Period

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods (generally 6 or 10 years for business and accounting records). The data is deleted thereafter.

13. Your Rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to withdraw your consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.

To exercise your rights, simply send an email to info@greatproductsandideas.com.

Right to lodge a complaint: You may lodge a complaint with any data protection supervisory authority, in particular in the EU Member State of your habitual residence. A list of authorities is available at edpb.europa.eu.

14. Information for Users Outside the EU

Residents of certain U.S. states (e.g. California) have additional rights, including the right to access, deletion, correction, and to opt out of the "sale" or "sharing" of personal information. We do not sell personal information. Please send requests to the email address stated above; we will not discriminate against you for exercising your rights.

15. Minors

Our offering is not directed at children under the age of 16. We do not knowingly collect data from children.

16. Changes

We will update this Privacy Policy if our processing or the legal situation changes. The version published here at any given time applies.