Data protection mail order

Data protection and German mail order law - a very hot potato, for many years!

Anyone who dares to operate a mail order business in Germany has to deal with many, many laws and regulations before they are even allowed to go online.  One of the unpleasant issues is data protection.

For now, this is not legal advice, but my life experience. If you want legal relevant information, you are wrong here.
In principle, the principle of data economy applies in the German mail order business, i.e. the customer must only give you the information about himself that you really need. You sell by prepayment? No reason to ask for your date of birth or phone number.
Yes, you will say, but I would like to send the customer a voucher for his birthday and in case of delivery problems I would like to call him.
That may be, but is that what your customer wants? Today, you get so many e-mails and phone calls that you are not happy about another e-mail. Often not even if it contains a coupon (at least not on a Monday morning, but that's another topic).

In principle, I think you should collect as little data as possible. Stop storing your customer's IP address every time they log in. Refrain from sending the full IP to Google for analysis. And don't send a separate email for every breath you take. And don't slam other people's PCs full of your cookie files.

Instead:

• Send everything in one. Order confirmation, terms and conditions, cancellation policy, all that crap in one email.
• Inform your customer about cookies and let him decide if and which ones he wants to accept.
• Involve your customer in the topic of data protection by pointing him to the privacy policy in the checkout process, and design it so that your customer feels well taken care of.
• Turn off IP storage or analyze visitor data anonymously.
• Only send emails to customers who have a customer account (not a guest) and explicitly wish to do so, so that no one can add their neighbor to your mailing list. Use a so-called double opt-in procedure for newsletters and send newsletters only via external providers.