Skip to content

Privacy Policy

Last updated: October 2026

This English translation is provided for convenience. The German version is legally binding. View the German version (Datenschutzerklärung)

We take the protection of your personal data seriously. Below, we explain which personal data are processed when you visit this website, for what purposes and on what legal basis this takes place, and which rights you have.

1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:

In-Product GmbH
Mendener Straße 14
51105 Köln, Germany
Managing Director: Guido Kalle
Phone: +49 (0)171 6412807
Email: info@in-product.de

Our company is not legally required to appoint a data protection officer and has therefore not appointed one. If you have any questions about data protection, please contact us directly using the contact details above.

2. General information on data processing

As a matter of principle, we process personal data only to the extent necessary to provide a functional website and to respond to your enquiries, or where you have given your consent. The legal bases are, in particular, Art. 6(1)(b) GDPR (contract or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interests) and, for unlocking custom designs in the configurator, your consent (Art. 6(1)(a) GDPR).

This is a static website: its pages are delivered as ready-made HTML files. There are no user accounts, no login and no database in which visitor data are stored. Section 6 explains which data our forms store temporarily on our web space.

3. Hosting with IONOS and server log files

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (“IONOS”). Our form endpoints and our email mailbox also run on IONOS (see section 6). We have concluded a data processing agreement with IONOS pursuant to Art. 28 GDPR; IONOS processes the data only on our instructions. According to IONOS, no data are transferred to third countries outside the EU.

Each time this website is accessed, IONOS automatically records the following access data (server log files):

  • IP address – anonymised by IONOS as soon as it is collected and used only to determine the approximate location of access
  • date and time of access
  • page or file accessed
  • referrer URL (the page visited previously)
  • browser type and version, operating system and device type

These data are used solely to provide the website technically, to ensure its stable operation and to detect and fend off misuse or attacks. They are not combined with other data sources or analysed for marketing purposes. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our website securely and without errors. IONOS stores the log files for no longer than eight weeks and then deletes them. For more information, please see the IONOS information on data processing by web hosting products.

4. No cookies, no analytics, no tracking

This website does not set any cookies. We do not use any web analytics or tracking services, advertising or marketing tools, or social media plugins. No usage profiles are created. A cookie banner is therefore not required.

Should we use an analytics tool in the future, we will update this privacy policy accordingly beforehand.

5. Fonts, images and videos

The font used on this website (Chivo) is hosted locally on our server. No fonts are loaded from external providers such as Google Fonts, and no files are loaded via external content delivery networks (CDNs). All images and videos are likewise delivered directly from our own web space. Your IP address is therefore not transmitted to third-party providers when you visit this website.

6. Contact form and configurator

If you send us an enquiry via the contact form or via “Request design” in the CityShopper configurator, we process the following data:

  • name
  • email address
  • company (optional)
  • phone number (optional)
  • preferred material and planned quantity (selection)
  • your message
  • for a design request: a summary of your design (design name, colours, print) and – if you have selected “Include my design” – a preview image of the print area and the design file; the design file contains the images and custom fonts used in your design
  • your confirmation, by ticking the checkbox, that you have taken note of this privacy policy, as well as the language, page and time of your enquiry

We process data from the contact form and from “Request design” exclusively in order to respond to your enquiry and to clarify any follow-up questions. Your data are not disclosed to third parties. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary in order to take steps prior to entering into a contract (e.g. a request for a quote). In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6(1)(f) GDPR).

If you unlock custom designs in the configurator, we process your name, email address, company, website and phone number (optional), your consent together with its wording, the version of the consent text and the time (as proof under Art. 7(1) GDPR), basic data on your design (design name, colours of the bag and handles, mode “custom design” or reference design and, for a custom design, the number of print elements and the print background) as well as the language, the page you were on and what triggered the unlock (e.g. “file dropped onto the print area”). Your images, logos and custom fonts are not transmitted. We use these data to contact you about your design and to send you a quote. Your data are not disclosed to third parties. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, e.g. by email to hello@shopybag.com. On your device, the browser’s local storage merely records that the unlock has taken place – without your details.

After submission, our web server sends the data from these forms via an encrypted connection, authenticated with the credentials of our mailbox, through the mail server of IONOS SE to our mailbox hello@shopybag.com. This mailbox is operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, with which a data processing agreement pursuant to Art. 28 GDPR is in place. The form data are not stored in a database on the web server, and we do not send a confirmation email to your address.

If a message cannot be delivered when you submit the form, it is stored in full (including any attachments) in a non-public area of our web space so that no enquiry is lost. In the event of a temporary fault, for example if the mail server cannot be reached, it is delivered automatically later. If the mail server permanently rejects the message, it is not resent automatically; we are notified of the rejection. A message stored in this way is deleted immediately after successful delivery, and otherwise after 30 days at the latest.

To protect against automated spam submissions, we only use our own measures in all forms – no third-party CAPTCHA services and no cookies:

  • a field that is invisible to visitors (known as the honeypot technique); if it is filled in, the submission is discarded;
  • a form token that is fetched from our server when the form is opened. It only contains the time it was issued and a signature – no IP address and no identifier of your device – and is not stored anywhere. Submissions without a valid token or sent within a few seconds of opening the form are discarded; the forms therefore require JavaScript;
  • a limit on the number of enquiries: for this purpose, we derive pseudonymised check values (HMAC) from your IP address using a secret key; the IP address itself is not stored. One check value limits the number of your enquiries within 10 minutes, a second one the number within 24 hours (daily quota). The key for this second check value changes every day;
  • the detection of enquiries that were sent twice: for this purpose, a pseudonymised check value (HMAC) is stored – derived from your email address and message for the contact form, additionally from a checksum of the attached files for “Request design”, and from your email address, company and website when you unlock custom designs;
  • rejected submissions are logged with the time, the form, the reason and a shortened sender address (e.g. “h***@example.com”) – no more than 30 entries per hour, beyond that only the number per reason; this log is deleted after 14 days.

The check value for the 10-minute limit and the check value for duplicate enquiries are no longer taken into account after 10 minutes, the check value for the daily quota after 24 hours. Expired check values are deleted the next time a form is opened, or at the latest during the daily automatic maintenance.

The legal basis for these protective measures is our legitimate interest in a secure form that is protected against misuse (Art. 6(1)(f) GDPR).

Your data are deleted as soon as they are no longer required for the respective purpose – for enquiries, as a rule, once your enquiry has been conclusively dealt with; for an unlock, once you withdraw your consent or our contact regarding your design has been concluded – unless statutory retention obligations (in particular under commercial and tax law) prevent this.

7. Contact by email or telephone

If you contact us by email or telephone, we process the data you provide (e.g. your name, email address or phone number and the content of your enquiry) in order to deal with your request. The same purposes, legal bases (Art. 6(1)(b) or (f) GDPR) and erasure periods apply as for the contact form. Your data are not disclosed to third parties.

8. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries you send via the contact form, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar and by the padlock symbol. When encryption is enabled, the data you transmit to us cannot be read by third parties.

9. Your rights

As a data subject, you have the following rights with regard to your personal data:

  • right of access (Art. 15 GDPR)
  • right to rectification (Art. 16 GDPR)
  • right to erasure (Art. 17 GDPR)
  • right to restriction of processing (Art. 18 GDPR)
  • right to data portability (Art. 20 GDPR)
  • right to object to processing (Art. 21 GDPR)

To exercise your rights, an informal message to hello@shopybag.com or to the postal address given above is sufficient.

Right to object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority competent for In-Product GmbH is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.

10. Status and amendments to this privacy policy

This privacy policy is current as of October 2026. We will update it as soon as the functions of this website or the legal requirements change. The version published on this page at any given time applies.