Cart

Privacy Policy

This is a translation provided for your convenience. Only the German version is legally binding.

Below we explain which personal data we process when you visit this website or place an order, and which rights you have.

1. Controller

METRA
Leon Wohlgemuth
Sonntagstraße 11, 42275 Wuppertal, Germany
Email: info@metra.at

We are not legally required to appoint a data protection officer.

2. Visiting the website and hosting

When you visit this website, your browser automatically sends data to our hosting provider's server, where it is temporarily stored in log files:

Purpose: delivering the content, system security and stability, investigating misuse.
Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the secure and trouble-free operation of the website.
Retention: no longer than seven days, unless the data is exceptionally needed longer to investigate a specific security incident.

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. We also send the emails relating to your order via IONOS servers.

3. Contact by email

If you email us, we process your email address, your name and the content of your message in order to answer your inquiry.
Legal basis: Art. 6(1)(b) GDPR if the inquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering inquiries).
Retention: until your inquiry has been fully dealt with, unless statutory retention obligations apply.

4. Cart, order and payment

a) Cart

In your browser's local storage (keys “metra-cart” and “metra-zone”) we only store which products are in your cart, in which quantities, and which shipping region you have selected. This information does not leave your device until you click a payment button. It is deleted after 30 days or after a successful order.
Legal basis: Section 25(2) no. 2 TDDDG (service requested by you) and Art. 6(1)(b) GDPR.

b) Order processing

To process your order, we use your name, shipping address, email address, the items ordered and payment details (payment method, amount, status – no complete card or account details). We send you the order confirmation by email.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (retention obligations under tax and commercial law).
Retention: we keep order and accounting data for up to ten years in accordance with statutory periods (Section 147 AO, Section 257 HGB).

c) Payment service provider Stripe

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). For this purpose, we load the “Stripe.js” library from Stripe's servers on the cart page only. Your IP address, information about your browser and device and, for fraud prevention, usage data of this page are transmitted to Stripe; Stripe may set cookies for this purpose. When you pay, Stripe also receives your order, contact and payment data and carries out automated fraud checks. Stripe is itself responsible for part of this processing, for example due to regulatory obligations. Data may be transferred to Stripe, Inc. in the USA; Stripe is certified under the EU-U.S. Data Privacy Framework and also uses standard contractual clauses. More information: stripe.com/privacy.
Legal basis: Art. 6(1)(b) GDPR; for loading Stripe.js and fraud prevention, Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR (legitimate interest in secure payment processing).

d) Apple Pay, Google Pay and PayPal

If you choose one of these payment methods, your order and contact data is transmitted via Stripe to the respective provider, which processes the payment under its own responsibility:

Legal basis: Art. 6(1)(b) GDPR.

e) Shipping

For delivery, we pass your name and shipping address on to the shipping company we use (Deutsche Post AG / DHL Paket GmbH, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany).
Legal basis: Art. 6(1)(b) GDPR.

f) Protection against misuse

To protect checkout against automated mass requests, we store an encrypted, non-reversible short value derived from your IP address for no longer than ten minutes when payment is opened. If the payment buttons fail to load, we store technical details about this (browser and device identifier, loading times, blocked addresses) without your IP address for no more than seven days in order to fix the error.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure checkout operation).

g) Reach measurement with the TikTok pixel (only with your consent)

If you agree to “Marketing and reach measurement” in the consent banner, we load the TikTok pixel provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. Cookies and similar identifiers are then stored on and read from your device. Among other things, your IP address, information about your browser and device, the page you visited, the time and type of your actions on this website and a pseudonymous identifier are transmitted to TikTok. TikTok analyses this data to measure which visits lead to a purchase and to display advertising; it also processes the data for its own purposes and is an independent controller in that respect. Transfers to recipients outside the EU, including the USA, Singapore and the People's Republic of China, are possible; TikTok bases these on standard contractual clauses. We cannot guarantee a level of protection equivalent to that in the EU; in the People's Republic of China in particular, authorities have far-reaching access powers and there are no comparable legal remedies. The storage period is up to 13 months. More information: tiktok.com/legal/privacy-policy-eea.
Legal basis: Section 25(1) TDDDG and Art. 6(1)(a) GDPR (consent); for the third-country transfer additionally Art. 49(1)(a) GDPR.
Withdrawal: You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer of every page. This does not affect the lawfulness of processing carried out until then.

5. Cookies and local storage

Without your consent we only store what is technically necessary: the information required for the cart (section 4 a), your choice in the consent banner and – exclusively on the cart page – the cookies from Stripe that are necessary for payment (section 4 c). No consent is required for this (Section 25(2) no. 2 TDDDG).

Technologies that require consent are only used after you have agreed in the banner; at present this applies exclusively to the TikTok pixel (section 4 g). Rejecting is just as easy as accepting, and the website remains fully usable without a decision. We store your choice under the key “metra-consent” on your device for twelve months, after which we ask again. You can change or withdraw it at any time via “Cookie settings” in the footer.

6. Fonts and external resources

All design elements are delivered from our own server; we do not use external font services (such as Google Fonts). The exceptions are Stripe.js on the cart page (section 4 c) and, after your consent, the TikTok pixel (section 4 g).

7. Links to TikTok Shop and social networks

This website contains simple links to the TikTok Shop and to our profiles on TikTok and Instagram – no embedded content or plugins. Data is only transmitted when you click a link; from then on, the respective provider is responsible:

Data may also be transferred to countries outside the EU. Please refer to the privacy notices of the respective providers.

8. Data security

This website is delivered exclusively via encrypted connections (TLS). We also use technical and organizational measures to protect your data against loss, manipulation and unauthorized access.

9. Automated decisions

We do not make any automated decisions within the meaning of Art. 22 GDPR. Stripe checks payments automatically for fraud prevention (section 4 c); if a payment is declined as a result, you can contact us at any time.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). An informal message to info@metra.at is sufficient.

Right to object under Art. 21 GDPR

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany

11. Last updated

September 2026.