Privacy

This notice explains what happens to personal data when you visit this shop, place an order or write to us. It covers this website. Where a third party processes data under its own responsibility — a payment provider at checkout, for example — its own notice applies in addition, and we say so at that point.

1. Who is responsible

The controller for the processing described here is the operator of this shop: aloura, Sörensenstraße 38, 24143 Kiel, Germany, email shcommerce@outlook.com. The full registered details, including the legal form and the representative, are in the imprint.

We have not appointed a data protection officer. Questions about your data go to the address above and are answered from it.

2. What we process, and why

2.1 Visiting the site

The platform that hosts this shop records technical data on every request: the IP address, the date and time, the page requested, the referring page, and information about the browser and device. This is needed to deliver the pages to you, to keep the site stable and to detect misuse. The legal basis is our legitimate interest in operating a secure and functioning website, Article 6(1)(f) GDPR.

2.2 Placing an order

To fulfil an order we process your name, billing and delivery address, email address, telephone number if you give one, the contents of the order, the payment method and the transaction details our payment provider returns to us. The legal basis is performance of the contract, Article 6(1)(b) GDPR, and for the retention described below, compliance with a legal obligation, Article 6(1)(c) GDPR.

2.3 Customer accounts

An account is optional; you can order as a guest. If you create one, we process the email address and password you register, together with your order history and any addresses you save, so that you can sign in and look up past orders. The legal basis is performance of the contract, Article 6(1)(b) GDPR. You can delete the account at any time by writing to us.

2.4 Writing to us

When you use the contact form or write by email we process your name, email address, order number if you give one, and whatever you put in the message, in order to answer you. The legal basis is Article 6(1)(b) GDPR where the message concerns a contract, and otherwise our legitimate interest in answering enquiries, Article 6(1)(f) GDPR.

2.5 Marketing email

We send marketing email only to people who have asked for it. The legal basis is your consent, Article 6(1)(a) GDPR, and section 7(2) no. 3 UWG. Every marketing email carries an unsubscribe link, and withdrawing consent is as easy as giving it. Withdrawal does not affect the lawfulness of what was sent before.

2.6 Cookies and similar technologies

The shop sets cookies that are strictly necessary for it to work at all — keeping your basket, keeping you signed in, and protecting checkout against fraud. These are set on the basis of section 25(2) TTDSG and do not need your consent.

Any cookie that is not strictly necessary — analytics or advertising — is set only after you consent, on the basis of section 25(1) TTDSG and Article 6(1)(a) GDPR, and you can withdraw that consent at any time. At the time of writing this shop runs no analytics, advertising or tracking tool of its own. If one is added, this notice and the consent banner will be updated before it goes live.

3. Who else processes your data

• Shopify. The shop runs on Shopify. For merchants outside North America the contracting entity is Shopify International Limited, Ireland. Shopify processes the data described above on our instructions as a processor under Article 28 GDPR.
• Payment providers. The provider you choose at checkout receives the data it needs to take the payment. It processes that data under its own responsibility and under its own privacy notice, which is shown to you before you pay.
• Carriers. The parcel carrier receives the name, delivery address and, where you gave one, the email address or telephone number needed to deliver the parcel and to notify you about it.
• Fulfilment partners. Where an item is shipped to you directly by a supplier rather than from our own stock, that supplier receives the delivery details needed to send it.
• Email and messaging. The systems we use to receive and answer your messages process the content of those messages on our instructions.

We do not sell personal data and we do not pass it on for anyone else's advertising.

4. Transfers outside the EU and the EEA

Some of the processors above operate infrastructure or support outside the European Economic Area. Where personal data is transferred to a country without an adequacy decision by the European Commission, the transfer is covered by the European Commission's standard contractual clauses together with the additional measures agreed with that processor.

5. How long we keep it

• Order and invoice data. Retained for the statutory periods under German commercial and tax law — up to ten years for accounting records under section 147 of the German Fiscal Code and section 257 of the Commercial Code. The period runs from the end of the calendar year in which the document was created.
• Customer accounts. For as long as the account exists. After deletion, only what the retention periods above require is kept.
• Correspondence. For as long as needed to deal with the matter and to answer any follow-up, then deleted unless it forms part of a record that has to be retained.
• Marketing consent. Until you withdraw it. The record that consent was given and withdrawn is kept as evidence.
• Technical log data. Kept short-term by the platform for security and stability, then deleted or aggregated.

6. Automated decision-making

We do not take decisions about you by automated means alone. Payment providers may run their own fraud screening on a transaction as part of deciding whether to authorise it; where that happens it is described in the provider's own notice, shown to you at checkout.

7. Your rights

Under the GDPR you have the right to ask us for access to your personal data (Article 15), to have it corrected (Article 16) or erased (Article 17), to have processing restricted (Article 18), to receive it in a portable form (Article 20), and to object to processing based on our legitimate interests (Article 21). Where processing rests on consent, you may withdraw that consent at any time with effect for the future (Article 7(3)).

Write to shcommerce@outlook.com. We answer within one month.

You also have the right to complain to a supervisory authority. The authority competent for us is the Independent Centre for Privacy Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein), Holstenstraße 98, 24103 Kiel, Germany. You may also complain to the authority where you live.

8. Is giving us data obligatory?

No. But the data marked as required at checkout is what we need to conclude and perform the contract; without it we cannot take the order. Everything else is optional.

9. Changes

We update this notice when the processing it describes changes — for example if an analytics tool or a new payment provider is added. The version on this page is always the one in force.