Privacy policy
As of: 5 November 2026
This is a translation for convenience. The German version is authoritative.
This privacy policy informs you which personal data we process when you visit our online shop arrowsmith-xbow.de, order from us or contact us, and which rights you have.
1. Controller
Arrowsmith, owner Hansjürgen Geißler, Am Erlenbach 7, 67468 Frankenstein, Germany. Phone: +49 6329 9927996, email: hansgeissler@yahoo.de.
We are not obliged to appoint a data protection officer. If you have questions about data protection, please use the contact details above.
2. Visiting the shop
Server log files. Each time a page is requested, our host’s server automatically processes: IP address, date and time, requested page, amount of data transferred, the previously visited page (referrer), and browser and operating system. This is necessary to deliver the shop and to fend off attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). The host deletes the log files regularly, at the latest by the end of the following calendar month.
Hosting. The shop runs on a server of Timme Hosting GmbH & Co. KG, Marie-Curie-Straße 5, 21337 Lüneburg, Germany. The servers are located in Germany. The shop also sends its emails, such as order confirmations, via the host’s mail server. We have concluded a data processing agreement with the host under Art. 28 GDPR.
Fonts. All fonts are stored on our server; no connection to font providers such as Google Fonts is made when a page is loaded.
3. Cookies
We only use cookies that are technically necessary to operate the shop (Section 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR):
- Session (session-): keeps your shopping cart and your login during your visit; deleted when you close the browser or when the session expires
- Time zone (timezone): shows times in your time zone
- Cookie settings (cookie-preference): stores your choice in the cookie notice
- PayPal and Google Pay payments: enable payment processing via Shopware Payments (section 6)
We do not embed videos from YouTube or Vimeo. You can change your cookie choice at any time using the “Cookie settings” link at the bottom of every page.
4. Customer account and order
For an order, with or without a customer account, we process: salutation, first and last name, billing and delivery address, email address, date of birth, the items ordered, payment method and payment status. We need this data to conclude and perform the contract (Art. 6(1)(b) GDPR). A customer account is optional; you can have it deleted at any time.
Date of birth and age verification. We sell crossbows and pistol crossbows, which under the German Weapons Act may only be supplied to persons aged 18 or over. We therefore ask for your date of birth and check your age before shipping. The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR) and performance of the contract (Art. 6(1)(b) GDPR). The date of birth is a mandatory field for every order because our shop system cannot limit the request to individual items and we check uniformly before shipping. For orders without a crossbow we use it for nothing else; in this respect the legal basis is our legitimate interest in a uniform, reliable ordering process (Art. 6(1)(f) GDPR).
ID copy for delivery outside Germany. If we deliver a crossbow outside Germany, the courier does not check the recipient’s age. We will therefore ask you by email after your order for a copy of your ID document. You may black out all details except name, photo, date of birth and validity. We use the copy only to verify your age and delete it at the latest seven days after the check. With the order we only record that and when we verified your age. The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR); you make the copy yourself and send it voluntarily (Section 20(2) German Identity Card Act, PAuswG). Without an ID copy we cannot ship a crossbow outside Germany.
Retention. We keep order and invoice data for as long as commercial and tax law requires (Section 257 HGB, Section 147 AO; up to ten years depending on the document). After that it is deleted. We delete the data of a customer account when you delete the account, unless a retention obligation applies.
Product reviews. With a customer account you can review products. The stars, title and text of your review are published; your first name appears in the page source (structured data for search engines). The legal basis is your consent, which you give by submitting the review (Art. 6(1)(a) GDPR); we will delete the review on request.
5. Shipping
For delivery we transmit your name and delivery address to DHL (Deutsche Post AG / DHL Paket GmbH, Bonn, Germany), for cash on delivery also the amount to be collected. For shipments containing a crossbow within Germany we use the DHL service “Ident-Check”: for this we additionally transmit your date of birth; the courier checks your ID on delivery. The legal basis is performance of the contract and age verification (Art. 6(1)(b) and (c) GDPR).
We only pass your email address on to DHL if you tick the box “My email address can be sent to the shipping provider.” at checkout. DHL uses it to announce the delivery to you. The legal basis is your consent (Art. 6(1)(a) GDPR). It is voluntary; your parcel will be delivered without it as well. You can withdraw your consent at any time with effect for the future, for example by email to us; if the parcel has already been shipped, please also contact DHL. We do not pass your phone number on to DHL.
6. Payment
Prepayment and cash on delivery. For prepayment you transfer the amount to our account; for cash on delivery you pay the DHL courier. For this we process name, amount and order number.
Shopware Payments. We process payments with PayPal, credit or debit card, Apple Pay, Google Pay and Klarna via “Shopware Payments” of shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany; the payment service provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. If you choose one of these payment methods, we transmit name, address, email address, amount and order number to the payment service provider. With Klarna, the provider may carry out an identity and credit check; Klarna’s privacy notice applies to this. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). The payment service providers may also transfer data to countries outside the EU, such as the USA; they rely on appropriate safeguards under Art. 46 and 47 GDPR (EU standard contractual clauses or binding corporate rules). Details can be found in the privacy policies of PayPal and Klarna.
The scripts required for this from Shopware Payments (storefront.shopware-payments.services.shopware.io) and PayPal (www.paypal.com), and for Apple Pay and Google Pay also from Apple or Google, are only loaded by the shop at checkout and only if you have selected one of these payment methods there. In doing so, your IP address and technical data of your browser are transmitted to these providers. This is necessary for the payment you requested (Section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR). These scripts are not loaded on the other pages of the shop.
7. Contact and withdrawal
If you write to us via the contact form or by email, or call us, we process your details (name, email address, content of the enquiry) to answer your enquiry (Art. 6(1)(b) GDPR, otherwise (f)). Messages from the contact form and notifications about orders are sent by email to our mailbox at Yahoo (Yahoo International Limited, The EXO Building, North Wall Quay, Dublin 1, Ireland). Yahoo may also transfer data to countries outside the EU, such as the USA, and relies on EU standard contractual clauses (Art. 46 GDPR). We delete the enquiry once it has been dealt with and no retention obligation applies.
Back-in-stock notification. If you sign up for a notification on a product page, we store your email address, the item, the language and the time of sign-up and confirmation. We first send you an email with a confirmation link (double opt-in). Only after you confirm do we write to you, once, as soon as the item is available; we then delete the entry. We delete unconfirmed entries after 7 days and confirmed entries after 12 months at the latest. You can unsubscribe at any time using the link in our emails. The legal basis is your consent (Art. 6(1)(a) GDPR). We send the emails via our host’s mail server (section 2).
If you declare a withdrawal using the “Revoke a contract” function or the withdrawal form, we process your details to handle the withdrawal and to confirm receipt to you (Art. 6(1)(c) GDPR).
8. Service providers
In addition to the providers mentioned, we use a service provider for setting up and maintaining the shop (Tim Luca Wachter, Fairwaydevs.com, Mannheim, Germany), who acts on our instructions on the basis of a data processing agreement under Art. 28 GDPR.
The shop runs on the Shopware software of shopware AG, Ebbinghoff 10, 48624 Schöppingen, Germany. For licence billing, the shop transmits revenue figures to shopware AG, without details of individual customers. The shipping extension of Pickware GmbH runs on our server and transmits shipment data only to DHL (section 5). We use Shopware’s AI functions in the shop administration only for product data.
We do not send a newsletter.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future. To do so, please use the contact details in section 1.
You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.
10. Obligation to provide data and automated decision-making
We need the details marked as mandatory in the order to conclude the contract; without them we cannot deliver. Automated decision-making including profiling under Art. 22 GDPR does not take place on our side; for Klarna, the provider’s information applies.