This privacy policy informs you about the processing of personal data when visiting our websites www.broadway-fashion.com and www.my-broadway.com (hereinafter referred to as “Website”).
Protecting your data is important to us. We process your personal data solely in accordance with legal regulations, in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications Telemedia Data Protection Act (TTDSG).
1. Controller
Broadway Fashion GmbH
Modering 5
22457 Hamburg
Germany
Email: datenschutz@broadway-fashion.com
2. Data Protection Officer
If you have any questions about data protection, please contact our Data Protection Officer:
Email: datenschutz@broadway-fashion.com
3. General Information on Data Processing
We only process users’ personal data to the extent necessary for the operation of a functional website and for providing our content and services. Processing is based on legal permissions or your explicit consent.
4. Legal Basis for Processing
We process your data on the following legal bases:
Art. 6(1)(a) GDPR – Consent
Art. 6(1)(b) GDPR – Contract performance or pre-contractual measures
Art. 6(1)(f) GDPR – Legitimate interests, provided your interests do not override ours
Art. 49(1) GDPR – Data transfer to third countries without adequacy decision (e.g., USA)
5. Hosting & Infrastructure
Our website is hosted by an external service provider. The following data is automatically processed:
IP address
Date and time of access
Browser type and version
Referrer URL
Visited pages
Transferred data volumes
This processing ensures the stability, functionality, and security of the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
Storage duration: Log files are deleted after 30 days, unless relevant to security.
6. Content Delivery & Security via Cloudflare
To secure our website and improve loading times, we use the CDN and security service Cloudflare, provided by:
Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA.
Your IP address may be processed by Cloudflare and transferred to the USA.
Legal basis: Art. 6(1)(f) GDPR
Third-country transfer: Cloudflare is certified under the EU-U.S. Data Privacy Framework (DPF)
https://www.dataprivacyframework.gov/
7. Use of Cookies & Consent Management
We use cookies and similar technologies to provide certain functionalities and analyze user behavior.
Consent is managed via the tool CCM19 (Papoo Software & Media GmbH, Bonn). Upon first visit, you can choose via the cookie banner whether to allow non-essential cookies (e.g., for statistics or marketing).
Cookie Categories:
Essential cookies – required for technical functionality (no consent required)
Statistics cookies – e.g., Matomo, Google Analytics
External services – e.g., Google Maps
Consent may be withdrawn or adjusted at any time.
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25 TTDSG
8. Web Analytics with Matomo (Locally Hosted)
We use the open-source tool Matomo to analyze user behavior. The processing takes place anonymously on our own servers (no third-party access, no international data transfers).
IP addresses are anonymized before storage
No user profiles
No third-party cookies
Legal basis: Art. 6(1)(a) GDPR (only with consent via CCM19)
Data transfer: None
9. Web Analytics with Google Analytics
We also use Google Analytics, provided by:
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Cookies are set and usage data transferred to Google servers in the USA.
Third-country transfer: Google is certified under the EU-U.S. Data Privacy Framework.
More info: https://policies.google.com/privacy/frameworks
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG (consent via CCM19)
Withdrawal: possible anytime via cookie settings
10. Google Maps
We use Google Maps to display locations. Provider: Google LLC, USA. The service is only loaded after active consent via the cookie banner.
Processed data: IP address, location data (if enabled), technical metadata
Legal basis: Art. 6(1)(a) GDPR
Third-country transfer: Google is DPF certified
11. Contractual Data Processing (e.g., Orders)
When placing orders through our website, the following personal data is processed:
Name, address
Email address
Payment and order data
These are required for processing, shipping, and invoicing.
Legal basis: Art. 6(1)(b) GDPR
Storage: Deleted after statutory retention periods (e.g., tax, commercial law)
12. Your Rights
You have the following rights as a data subject:
Access (Art. 15 GDPR)
Rectification (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction (Art. 18 GDPR)
Data portability (Art. 20 GDPR)
Objection (Art. 21 GDPR)
Withdrawal of consent (Art. 7(3) GDPR)
Contact: datenschutz@broadway-fashion.com
13. Duration of Storage
We store personal data only as long as required for its purpose or statutory obligations. Once the purpose is fulfilled or retention periods expire, the data is deleted.
14. Data Sharing and Third-Country Transfers
Data is only shared if:
Required for contract execution
You have provided consent
There is a legal obligation
Third-country transfers only occur with Google and Cloudflare (both DPF certified).
15. Data Security
We apply technical and organizational security measures (Art. 32 GDPR) to protect your data against loss, destruction, or unauthorized access. Transmission is SSL-encrypted.
16. Supervisory Authority
You have the right to lodge a complaint with a supervisory authority:
Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Str. 22, 20459 Hamburg
Web: https://datenschutz-hamburg.de
17. Amendments to this Privacy Policy
We may update this policy to reflect legal changes or adjustments to our services.
Effective date of this privacy policy: July 2025