Privacy Policy
Latest version: 10 June 2026
This Privacy Policy explains how personal data is processed when you visit this website, use the online shop, place an order, contact us or submit a membership application or club enquiry.
This website combines two legally separate areas:
Shop / online shop / purchases
The online shop is operated by Concrete Current GmbH. The exclusive contracting party for purchases in the online shop is Concrete Current GmbH.
Club / membership / club communications
Club content, memberships, membership applications and club-related communications concern Surf Club München e.V.
1. Controllers
1.1 Controller for the online shop
The controller responsible for processing personal data in connection with the online shop, orders, payments, shipping, returns, shop communications and commercial offers is:
Concrete Current GmbH i.G.
Schwanthalerstr. 141, 80339 Munich
Email: Shop@concretecurrent.de
[INSERT TELEPHONE NUMBER, IF AVAILABLE]
[INSERT COMMERCIAL REGISTER / HRB]
[INSERT MANAGEMENT]
Concrete Current GmbH operates the online shop under licence from Surf Club München e.V.
1.2 Controller for club matters
The controller responsible for processing personal data in connection with club content, memberships, membership applications, club communications and club matters is:
Surf Club München e.V.
Ottostrasse 3, 80333 Munich
Email: praesidium@surfclubmunchen.de
VR 211258, Register of Associations at the Munich Local Court
Dr Martin Grün, President
Judith Thoma, Vice President
Frederik Hollenhorst, Treasurer
Where processing concerns both areas, it is described accordingly in this Privacy Policy.
2. General use of the website
When you visit this website, technically necessary data is processed in order to provide the website, operate it securely and reliably and analyse errors.
This may include, in particular:
- IP address
- date and time of access
- pages and files accessed
- browser type and version
- operating system
- referrer URL
- device information
- technical log data
The processing takes place to provide the website, ensure IT security and maintain the reliability of the service.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and functional operation of the website and online shop.
3. Online shop, orders and customer account
When you place an order in the online shop or use a customer account, Concrete Current GmbH processes the data required to process the order and perform the purchase contract.
This includes, in particular:
- name
- billing address
- delivery address
- email address
- telephone number, if provided
- order data
- product data
- payment information
- shipping information
- returns and complaint data
- communications relating to the order
This data is processed to accept orders, process payments, deliver products, provide customer service, handle returns and complaints and meet legal obligations.
The legal bases are Article 6(1)(b) GDPR for the performance of a contract or pre-contractual measures and Article 6(1)(c) GDPR for compliance with legal obligations, in particular commercial and tax-law retention obligations.
4. Payment processing
Payment data is processed as part of an order in order to process payments. The payment methods currently available are shown at checkout.
Depending on the selected payment method, payment data may be transmitted to payment service providers, for example Shopify Payments, PayPal, credit-card providers, Klarna, Apple Pay, Google Pay or other providers shown at checkout.
The processing takes place to perform the purchase contract and process the payment.
The legal basis is Article 6(1)(b) GDPR. Where statutory documentation or retention obligations apply, Article 6(1)(c) GDPR is an additional legal basis.
5. Shipping and fulfilment
To deliver ordered products, Concrete Current GmbH processes shipping and contact details and, where necessary, passes them to shipping providers or fulfilment partners.
This includes, in particular:
- name
- delivery address
- email address
- telephone number, where required for delivery
- order and shipping information
The processing takes place to perform the purchase contract. The legal basis is Article 6(1)(b) GDPR.
6. Shopify
The online shop is technically operated through Shopify.
Shopify provides the technical infrastructure for the online shop, including hosting, shop features, checkout, payment integration, order management and other technical functions.
Personal data may be transmitted to and processed by Shopify. This includes, in particular, technical data, usage data, order data, payment information and communications relating to use of the online shop.
Shopify may also process data outside the European Union or European Economic Area. In that case, appropriate safeguards for international data transfers are used, in particular standard contractual clauses where required.
Further information about processing by Shopify is available in Shopify’s privacy information.
The legal bases are Article 6(1)(b) GDPR where processing is required to carry out orders, Article 6(1)(f) GDPR for the secure and economical operation of the online shop and Article 6(1)(c) GDPR where legal obligations are concerned.
7. Contacting us
If you contact us by email, contact form or another method, we process the data you provide in order to deal with your enquiry.
This includes, in particular:
- name
- email address
- telephone number, if provided
- content of the enquiry
- communication history
Concrete Current GmbH is responsible for shop enquiries, orders, returns or complaints. Surf Club München e.V. is responsible for club enquiries, membership, club communications and club-related topics.
The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a contract or pre-contractual measures and Article 6(1)(f) GDPR where processing is required to respond to general enquiries.
8. Membership and club forms
If you submit a membership application, complete a club form or communicate with Surf Club München e.V. about membership or club matters, Surf Club München e.V. processes the personal data required for that purpose.
This may include, in particular:
- name
- address
- email address
- telephone number
- date of birth, where required for membership
- membership type
- information from the membership application
- acceptance of the Club Statutes and Membership Fee Schedule
- payment or contribution information, where fees are collected
- communications relating to membership
This data is processed to review membership applications, administer memberships, enable club communications, administer fees and meet obligations under association law.
The legal bases are Article 6(1)(b) GDPR for pre-contractual measures and the membership relationship, Article 6(1)(c) GDPR for compliance with legal obligations and Article 6(1)(f) GDPR for legitimate club interests, in particular the organisation and administration of the club.
If membership applications are processed through an external service such as Google Forms, Typeform, Tally, Shopify Forms or another form app, that provider may process personal data as a service provider or independent provider. The service used will be identified in the form or in this Privacy Policy.
Form provider currently used for memberships:
[INSERT OR DELETE: GOOGLE FORMS / SHOPIFY FORMS / OTHER PROVIDER]
9. Newsletter and marketing
If you register for a newsletter or subscribe to marketing communications, we process your email address and, where applicable, other information in order to send you information about products, drops, collaborations, culture, club information or other content.
The newsletter is sent only where consent has been given or another legal permission applies.
The legal basis is Article 6(1)(a) GDPR where processing is based on consent. You may withdraw your consent at any time with effect for the future, for example through the unsubscribe link in the newsletter.
Where newsletters or marketing are provided through Shopify, Shopify Email, Klaviyo, Mailchimp or other providers, data is transmitted to the relevant provider.
Newsletter provider currently used:
[INSERT OR DELETE: SHOPIFY EMAIL / KLAVIYO / MAILCHIMP / OTHER PROVIDER]
10. Cookies and similar technologies
This website uses cookies and similar technologies. Cookies may be required to provide the website and online shop technically, for example for the shopping cart, checkout, login, security and language settings.
Cookies or similar technologies may also be used for analytics, marketing or personalisation purposes where you have consented to this.
Technically necessary cookies are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of the website and online shop.
We obtain consent for non-essential cookies, in particular analytics, tracking or marketing cookies. The legal basis is Article 6(1)(a) GDPR. The provisions of the German Telecommunications Digital Services Data Protection Act may also apply to access to or storage of information on a terminal device. According to common guidance from German chambers of commerce, advertising, tracking or marketing cookies generally require active consent.
You can change your cookie settings at any time through the cookie or consent tool used.
Consent tool currently used:
[INSERT OR DELETE: SHOPIFY CUSTOMER PRIVACY / CONSENTMO / COOKIEBOT / OTHER TOOL]
11. Analytics, tracking and advertising
We currently do not use any external analytics or marketing-tracking services.
12. Social media and external links
This website may contain links to social-media profiles or external websites.
When you click an external link, you leave this website. The respective providers are responsible for processing data on external websites or platforms.
We have no influence over the nature or extent of processing by external platforms.
13. Content, media and embedded services
This website may embed content such as videos, images, maps, social-media posts or other external content.
When such content is accessed, personal data may be transmitted to the respective provider, in particular the IP address, device information and usage data.
Where such services are not technically necessary, they are embedded only on the basis of your consent.
Embedded services currently used:
[INSERT OR DELETE: YOUTUBE / VIMEO / GOOGLE MAPS / INSTAGRAM / NONE / OTHER]
14. Disclosure of personal data
Personal data is disclosed only where this is required for the relevant purposes, a legal obligation exists, consent has been given or a legitimate interest applies.
Recipients of personal data may include, in particular:
- Shopify and technical service providers
- payment service providers
- shipping providers
- fulfilment partners
- IT and hosting service providers
- newsletter and marketing service providers
- tax advisers and accounting providers
- public authorities, where required by law
- form providers for membership applications, where used
- Surf Club München e.V., where club matters are concerned
- Concrete Current GmbH, where shop or order matters are concerned
15. Retention period
We retain personal data only for as long as necessary for the relevant purposes or for as long as statutory retention obligations apply.
Order, invoice and accounting data may be retained for periods prescribed by commercial and tax law.
Data from membership applications and memberships is retained for the duration of membership and thereafter only where required to meet legal obligations, establish, exercise or defend legal claims or administer the club.
Contact enquiries are deleted once they are no longer required, unless statutory retention obligations or legitimate interests prevent deletion.
16. International data transfers
Use of Shopify, payment service providers, newsletter providers, form tools or other service providers may involve the transfer of personal data to countries outside the European Union or European Economic Area.
In such cases, data is transferred only where an appropriate legal basis exists, in particular an adequacy decision by the European Commission or appropriate safeguards such as standard contractual clauses.
17. Rights of data subjects
Subject to the requirements of the GDPR, data subjects have the following rights in particular:
- the right to obtain information about personal data being processed
- the right to rectification of inaccurate data
- the right to erasure
- the right to restriction of processing
- the right to data portability
- the right to object to certain processing
- the right to withdraw consent with effect for the future
- the right to lodge a complaint with a data-protection supervisory authority
These rights are governed in particular by Articles 15 et seq. GDPR and include access, rectification, erasure, restriction, data portability and objection.
18. Right to object
Where personal data is processed on the basis of Article 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation.
Where personal data is processed for direct marketing, you may object to that processing at any time.
19. Withdrawal of consent
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.
Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
20. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes data-protection law.
In particular, the competent authority may be the supervisory authority for your place of residence or the authority responsible for the respective controller.
21. Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
Absolute security cannot, however, be guaranteed for data transmitted over the internet.
22. Amendments to this Privacy Policy
We may amend this Privacy Policy where legal requirements, technical features, service providers used or our processing activities change.
The current version published on this website applies.
23. Data-protection contact
For questions about processing personal data in connection with the online shop, orders, payments, shipping or returns, please contact:
Concrete Current GmbH
Email: Shop@concretecurrent.de
Address: Schwanthalerstr. 141, 80339 Munich
For questions about processing personal data in connection with club memberships, membership applications or club communications, please contact:
Surf Club München e.V.
Email: praesidium@SURFCLUBMUNCHEN.de
Address: Ottostrasse 3, 80333 Munich