Privacy Policy

 

1. Controller

The entity responsible for the processing of personal data on this website is:

Vitalii Saiian
trading as EURO PERFUME
Schillerstrasse 40
49811 Lingen
Germany

E-Mail: europerfumeshop@gmail.com

2. General Information

We process personal data exclusively within the scope of applicable data protection regulations, in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), and the Telecommunications-Digital Services-Data Protection Act (TDDDG).

Personal data is any information relating to an identified or identifiable natural person.

This privacy policy informs you about which personal data is processed when using our online shop, the purposes for which processing takes place, the legal basis for such processing, and your rights.

3. Shopify and Hosting

Our online shop is operated using the Shopify platform.

The provider for users and merchants in the European Economic Area is:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Shopify provides the technical infrastructure for the operation and display of our online shop.

In this context, the following data in particular may be processed:

• IP address;
• Browser and device information;
• Pages visited and technical access data;
• Shopping cart contents;
• Customer and contact information;
• Order and transaction data;
• Payment and shipping information;
• Cookie and consent settings.

Processing is carried out for the technical provision and security of the online shop as well as for the execution of orders.

The legal bases are Art. 6 (1) lit. b GDPR, insofar as processing is necessary for the performance of a contract or pre-contractual measures, and Art. 6 (1) lit. f GDPR due to our legitimate interest in a secure, stable, and functional online shop.

Insofar as legal retention obligations exist, processing is also carried out on the basis of Art. 6 (1) lit. c GDPR.

Shopify International Limited generally processes data of users from the European Economic Area in Ireland first. Associated Shopify companies and other subcontractors may be used to provide the services.

4. Server Log Files

When accessing our website, technical access data is processed automatically.

This can include, in particular:

• IP address;
• Date and time of access;
• Page or file accessed;
• Referrer URL;
• Browser type and version;
• Operating system;
• Volume of data transferred;
• Technical error and status information.

Processing is carried out for the provision of the website, error analysis, ensuring system security, and preventing unauthorized access.

The legal basis is Art. 6 (1) lit. f GDPR.

Data is deleted as soon as it is no longer required for these purposes and there are no legal, security-related, or evidentiary reasons for further storage.

5. Orders and Contract Fulfillment

When you place an order, we process the following data in particular:

• First and last name;
• Billing and delivery address;
• E-mail address;
• Phone number, if provided or required;
• Products ordered;
• Order number;
• Order, payment, and delivery status;
• Selected payment and shipping method;
• Transaction information;
• Communication in connection with the order;
• If applicable, IP address and technical order data.

Processing is carried out to process your order, handle payment, manage delivery, address queries, cancellations, returns, and complaints, and to comply with tax and commercial law obligations.

The legal bases are:

• Art. 6 (1) lit. b GDPR for contract fulfillment;
• Art. 6 (1) lit. c GDPR for legal retention and documentation obligations;
• Art. 6 (1) lit. f GDPR to prevent misuse and fraud, and to assert, exercise, or defend legal claims.

6. Customer Account

You can voluntarily create a customer account.

In this context, the following data in particular may be processed:

• Name;
• E-mail address;
• Delivery and billing addresses;
• Phone number, if provided;
• Order history;
• Account settings.

Processing is carried out for the setup and management of the customer account and to simplify future orders.

The legal basis is Art. 6 (1) lit. b GDPR.

You may request the deletion of your customer account at any time. Order, billing, and transaction data subject to legal retention obligations will only be deleted after the respective periods have expired.

7. Payment Processing

To perform a payment, the data required for the chosen payment method is transmitted to the respective payment service provider.

Depending on the payment methods currently available in the checkout, the following services may be used:

Shopify Payments

Provider:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

In this context, name, address, payment details, transaction amount, currency, order information, IP address, as well as browser and device information may be processed.

PayPal

Provider:

PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg

If PayPal is selected, the customer, order, and transaction data required for payment processing are transmitted to PayPal.

Apple Pay and Google Pay

When using Apple Pay or Google Pay, payment processing is handled via the respective wallet and the underlying payment service provider.

Generally, we only receive the information necessary to confirm, assign, and execute the payment.

Other Payment Methods

If other payment methods such as Klarna, credit card, or other payment services are offered in the checkout, processing is carried out by the respective selected payment service provider.

The providers available for the specific order process will be displayed to you before the order is completed.

The legal basis for payment processing is Art. 6 (1) lit. b GDPR.

Insofar as data is processed for fraud prevention, identity verification, or compliance with legal obligations, processing may additionally be based on Art. 6 (1) lit. c or lit. f GDPR.

8. Shipping Service Providers

To deliver your order, we transmit the data required for this purpose to the commissioned shipping service provider.

Depending on the order, the following providers may be used, in particular:

• DHL;
• Deutsche Post;
• Other shipping service providers specified in the checkout or the shipping confirmation.

The data transmitted includes, in particular:

• Name;
• Delivery address;
• Order or shipment information;
• If applicable, e-mail address or phone number for delivery notifications.

Processing is carried out for the purpose of delivery on the basis of Art. 6 (1) lit. b GDPR.

Insofar as contact data is transmitted exclusively for additional delivery notifications, this is done based on Art. 6 (1) lit. a or lit. b GDPR, depending on the specific arrangement.

9. Contact

When you contact us via e-mail, contact form, social networks, or other means of communication, we process the information provided by you.

This can include, in particular:

• Name;
• E-mail address;
• Username on the respective social network;
• Phone number;
• Content and time of the message;
• Order number and order details;
• Transmitted files, images, and documents.

Processing is carried out for the purpose of processing and responding to your inquiry.

The legal basis is Art. 6 (1) lit. b GDPR if the inquiry is related to a contract, an order, or pre-contractual measures.

For general inquiries, processing is based on Art. 6 (1) lit. f GDPR due to our legitimate interest in proper customer communication.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Cookies are small files or pieces of information that can be stored on or read from your device.

10.1 Technically Necessary Technologies

Technically necessary cookies and technologies are used to provide the basic functions of the online shop.

These include, in particular:

• Shopping cart and checkout;
• Customer account login;
• Security and fraud prevention;
• Storage of privacy, language, and region settings;
• Technical stability and error resolution.

Insofar as storing information on your device or accessing it is strictly necessary, this is done based on § 25 (2) TDDDG.

Subsequent processing of personal data is based on Art. 6 (1) lit. b or lit. f GDPR, depending on the respective purpose.

10.2 Optional Technologies

Analysis, comfort, and marketing technologies that are not strictly necessary for the operation of the online shop are only activated if you have previously provided consent via the cookie banner.

The legal bases are § 25 (1) TDDDG and Art. 6 (1) lit. a GDPR.

You can change or revoke your consent at any time via the cookie settings with effect for the future.

For storage and access operations on the device that are not strictly necessary, § 25 TDDDG generally requires informed consent.

11. Consent Management

We use the privacy and consent functions of Shopify or a compatible consent management system.

In this context, the following data in particular may be processed:

• Consent status;
• Selected cookie categories;
• Time of selection;
• Region;
• Browser and device information;
• Technical identifiers.

Processing is carried out for the management, storage, and documentation of your privacy choices.

The legal bases are Art. 6 (1) lit. c and lit. f GDPR as well as, where necessary, Art. 6 (1) lit. a GDPR.

You can change your selection at any time via the cookie settings.

12. Analysis and Marketing Services

We may use analysis and marketing services to evaluate the use of our online shop, to improve the technical and economic performance of our website, to measure the success of advertisements, and to display interest-based advertising.

Such services are only activated if:

1. The respective service is actually set up in our online shop, and
2. You have previously provided consent via the cookie banner.

Depending on the features currently enabled, services of the following providers may be used, in particular:

• Meta Platforms Ireland Limited;
• Google Ireland Limited;
• TikTok Technology Limited;
• Shopify International Limited;
• Other analysis or marketing providers expressly designated in the cookie banner.

In this context, the following data in particular may be processed:

• IP address;
• Browser and device information;
• Cookie and event identifiers;
• Pages visited;
• Search queries and interactions;
• Products viewed;
• Shopping cart contents;
• Purchases and order values;
• Origin of the website visit;
• Approximate location;
• If applicable, hashed contact information;
• Reactions to advertisements.

Processing may serve the following purposes, in particular:

• Reach measurement;
• Statistical analysis of website usage;
• Conversion tracking;
• Attribution of orders to advertisements;
• Creation and management of target audiences;
• Remarketing;
• Optimization of advertising campaigns;
• Fraud and misuse prevention.

You can find information about which services are currently active in our cookie settings.

The legal bases are § 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR.

Granted consent can be revoked at any time via the cookie settings with effect for the future.

13. Meta Services

If enabled and covered by your consent, services of

Meta Platforms Ireland Limited
Merrion Road
Dublin 4, D04 X2K5
Ireland

may be used.

These may include, in particular, Meta Pixel, Conversions API, and features of the Facebook and Instagram sales channel.

Processing serves, in particular, the measurement of advertising success, order attribution, target audience creation, and the display of relevant advertising on Facebook and Instagram.

14. Google Services

If enabled and covered by your consent, services of

Google Ireland Limited
Gordon House
Barrow Street
Dublin 4
Ireland

may be used.

These may include, in particular, Google Analytics, Google Ads, conversion tracking, remarketing, and Google Tag Manager.

Processing serves, in particular, the analysis of website usage, measurement of advertising success, attribution of orders to advertising campaigns, and the optimization of our online offerings.

15. TikTok Services

If enabled and covered by your consent, services of

TikTok Technology Limited
10 Earlsfort Terrace
Dublin, D02 T380
Ireland

may be used.

These may include, in particular, TikTok Pixel, Events API, conversion tracking, and remarketing features.

Processing serves, in particular, the measurement of the success of TikTok advertising, target audience creation, and optimization of advertising campaigns.

16. Newsletter and Promotional E-mails

If you subscribe to our newsletter or expressly consent to receiving promotional e-mails, we process, in particular:

• E-mail address;
• If applicable, name;
• Time of registration;
• Proof of consent;
• IP address and technical registration information;
• If applicable, opening and clicking behavior.

Processing is carried out to send information about products, offers, promotions, and news.

The legal basis is your consent according to Art. 6 (1) lit. a GDPR.

Shopify Email, Shopify Forms, or another technically integrated newsletter service may be used for sending.

Insofar as an external newsletter service is used, it receives the data required for sending as a service provider or independent controller.

You can revoke your consent at any time with effect for the future, in particular via the unsubscribe link in every promotional e-mail.

The legality of the processing carried out until the revocation remains unaffected.

Order confirmations, shipping notifications, invoices, and other messages required for contract fulfillment are not promotional e-mails and are sent based on Art. 6 (1) lit. b or lit. c GDPR.

17. Social Networks

We maintain company profiles on social networks and communication platforms, in particular on:

• Instagram;
• Facebook;
• TikTok;
• WhatsApp.

When you visit our profiles or communicate with us via these platforms, personal data may be processed by the respective platform operator.

We have only limited influence on the nature, scope, and duration of this processing. Additionally, the privacy policies of the respective platforms apply.

If only links to social networks are used on our website, data transmission to the respective platform generally only occurs when you click on the link.

Embedded content, social media feeds, and tracking technologies are only loaded in accordance with legal requirements and, where necessary, with your consent.

18. Embedded content

Our website may contain content from external providers, such as:

• videos;
• maps;
• social media posts;
• fonts;
• product reviews;
• chat or support functions.

When such content is loaded, technical data, in particular the IP address and browser information, may be transmitted to the respective provider.

Non-essential external content is only loaded if you have previously provided your consent.

The legal bases are Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

To the extent that content is technically strictly necessary, processing may be based on Section 25 (2) TDDDG and Art. 6 (1) (b) or (f) GDPR.

19. Data transfer to third countries

In the context of using Shopify, payment services, analytics, marketing, communication, or newsletter services, personal data may be processed outside the European Union or the European Economic Area.

Data is only transferred if the legal requirements of Art. 44 et seq. GDPR are met.

Possible bases include, in particular:

• an adequacy decision by the European Commission;
• a valid certification under the EU–US Data Privacy Framework;
• standard contractual clauses of the European Commission;
• other appropriate safeguards;
• in legally provided exceptional cases, your explicit consent.

20. Storage duration

We store personal data only for as long as it is necessary for the respective purpose or as required by statutory retention periods.

In particular, the following principles apply:

• order, invoice, payment, and tax-relevant data are stored in accordance with statutory retention obligations;
• data in a customer account is generally stored until the account is deleted;
• contact inquiries are deleted after final processing, provided no further storage is required;
• newsletter data is stored until the consent is withdrawn;
• proofs of consent are stored for as long as required to fulfill statutory accountability obligations;
• technical and security-related data are deleted as soon as they are no longer required for the respective purpose;
• data may be stored for longer if this is necessary for the establishment, exercise, or defense of legal claims.

21. Data security

We implement appropriate technical and organizational measures to protect personal data against loss, manipulation, unauthorized access, and unauthorized disclosure.

In particular, our website uses SSL or TLS encryption.

You can generally recognize an encrypted connection by "https://" in your browser's address bar.

22. Your rights

Under the GDPR, you have the following rights in particular:

• right of access pursuant to Art. 15 GDPR;
• right to rectification pursuant to Art. 16 GDPR;
• right to erasure pursuant to Art. 17 GDPR;
• right to restriction of processing pursuant to Art. 18 GDPR;
• right to data portability pursuant to Art. 20 GDPR;
• right to object pursuant to Art. 21 GDPR;
• right to withdraw consent pursuant to Art. 7 (3) GDPR;
• right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.

Consent given can be withdrawn at any time with effect for the future.

The legality of the processing carried out until the withdrawal remains unaffected.

To exercise your rights, a notification to the following address is sufficient:

europerfumeshop@gmail.com

23. Right to object

To the extent that personal data is processed on the basis of Art. 6 (1) (f) GDPR, you have the right, pursuant to Art. 21 GDPR, to object to the processing on grounds relating to your particular situation.

If personal data is processed for the purpose of direct marketing, you may object to this processing at any time without providing reasons.

Following your objection, the data will no longer be used for direct marketing.

24. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.

For companies based in Lower Saxony, the following authority is particularly responsible:

Der Landesbeauftragte für den Datenschutz Niedersachsen
Prinzenstraße 5
30159 Hannover
Germany

25. Changes to this privacy policy

We reserve the right to amend this privacy policy if legal requirements, technical functions, service providers used, or our business processes change.

The current version published on this website applies.

---