Privacy policy

(Datenschutzerklärung)

Last updated: 02.07.2026

1. Controller (Verantwortlicher)

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Lauren Schürstedt, Loitzer Straße 22, 32120 Hiddenhausen, Germany.

Email: jewelrybyelfcloset@gmail.com

(A data protection officer is not required to be appointed, as this business does not meet the thresholds under Art. 37 GDPR / § 38 BDSG.)

2. Your Rights as a Data Subject

Under the GDPR, you have the right to:

Access the personal data I hold about you (Art. 15 GDPR)

Rectification of inaccurate data (Art. 16 GDPR)

Erasure of your data (“right to be forgotten”), where legally permissible (Art. 17 GDPR)

Restriction of processing in certain circumstances (Art. 18 GDPR)

Data portability — receive your data in a structured, machine-readable format (Art. 20 GDPR)

Object to processing based on legitimate interests (Art. 21 GDPR)

Withdraw consent at any time, with effect for the future, where processing is based on consent (Art. 7(3) GDPR)

To exercise any of these rights, contact me at jewelrybyelfcloset@gmail.com.

You also have the right to lodge a complaint with a supervisory authority. The competent authority is generally the data protection authority of the German state (Bundesland) in which the business is registered, or your own state’s authority if you reside elsewhere in the EU. A list of German authorities is available at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html

3. Hosting and Website Provision

This shop is operated on the Shopify platform, provided by Shopify International Limited (Ireland) / Shopify Inc. (Canada). When you visit the website, Shopify automatically processes certain technical data (e.g. IP address, browser type, device information, referring URL, timestamps) in server log files to operate and secure the site.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a secure, functioning website)

Recipient: Shopify (data may be processed in Canada and the USA; Shopify participates in the EU–US Data Privacy Framework and/or relies on EU Standard Contractual Clauses as a safeguard for such transfers)

More information: Shopify’s own privacy practices at https://www.shopify.com/legal/privacy

4. Cookies

This site uses only technically necessary cookies required for core shop functions — e.g. keeping items in your cart, maintaining your session during checkout, and load balancing. These do not require your consent under § 25(2) No. 2 TTDSG, because they are essential to provide the service you actively request.

This site does not currently use analytics, advertising, or tracking cookies (e.g. Google Analytics, Meta/Facebook Pixel). If that changes in the future, this policy will be updated and, where legally required, a consent mechanism will be added before such cookies are set.

5. Data Collected When You Place an Order

When you make a purchase, I collect:

Full name

Billing and shipping address

Email address and phone number

Order details and payment information (processed via third-party payment providers, see Section 7)

Legal basis: Art. 6(1)(b) GDPR (processing necessary for the performance of a contract with you) and Art. 6(1)(c) GDPR (compliance with legal obligations, e.g. tax and commercial record-keeping law).

Retention: Order and invoice data is retained for 10 years as required under German commercial and tax law (§ 147 AO, § 257 HGB), even if you later request deletion of other data. Data not subject to statutory retention is deleted once it is no longer needed for the purpose it was collected for.

6. Contact / Email Inquiries

If you contact me by email (jewelrybyelfcloset@gmail.com), I process the information you provide (name, email address, message content) solely to respond to your inquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual inquiries) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries directed at me).

7. Payment Service Providers

Depending on the option you choose at checkout, your payment data is shared with and processed by the following providers to complete your transaction securely. I do not store your full payment card details myself.

Shopify Payments — processing of credit/debit cards (Visa, Mastercard, American Express, UnionPay), Shop Pay, and local payment methods (Bancontact, eps); Ireland/USA, EU Standard Contractual Clauses apply
PayPal — Payment via PayPal — PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
Klarna — “Buy now, pay later” / installment options — Klarna Bank AB, Sweden
Google Pay — Payment via Google Pay — Google Ireland Limited
Apple Pay — Payment via Apple Pay — Apple Distribution International, Ireland

Each provider acts as an independent controller for the payment data it processes and has its own privacy policy, which I encourage you to review. Processing is necessary to fulfill your order (Art. 6(1)(b) GDPR).

8. Shipping Service Providers

To deliver your order, I share your name and shipping address with the shipping carrier(s) used to dispatch your package.

Legal basis: Art. 6(1)(b) GDPR (necessary to perform the delivery you ordered).

9. Recipients of Your Data

Beyond the parties named above (Shopify, payment providers, shipping carriers, Judge.me, and the wishlist app provider), I do not sell, rent, or share your personal data with third parties. Data is only disclosed further where required by law (e.g. to tax authorities) or with your explicit consent.

10. Product Reviews (Judge.me)

I use the third-party app Judge.me to collect and display customer reviews on product pages. If you submit a review, the following data is processed:

Name and (optionally) photo, which are displayed publicly alongside your review

Email address, used to verify the review and (if you opt in) to send a review request after purchase

The content of your review

Legal basis: Art. 6(1)(a) GDPR (your consent, given by submitting the review) for the public display of your name/photo, and Art. 6(1)(f) GDPR (legitimate interest in requesting feedback from verified buyers) for review-request emails.

Recipient: Judge.me Pte. Ltd. (Singapore), which processes this data on my behalf as a processor. Data may be transferred outside the EEA; Judge.me relies on EU Standard Contractual Clauses as a safeguard. See Judge.me’s privacy policy: https://judge.me/privacy

You may request that a submitted review (including your name/photo) be edited or removed at any time by contacting me at jewelrybyelfcloset@gmail.com, or by withdrawing consent directly with Judge.me.

11. Wishlist Feature

This site offers a wishlist feature provided via the third-party app Advanced Wishlist by HulkApps (HulkApps.com). If you use it, the app stores the products you save, associated with your browser/device (via a cookie or local storage) or, if you’re logged into a customer account, with your account. As the shop owner, I am able to see aggregated or individual wishlist activity through the app’s dashboard.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing this convenience feature and understanding product interest/demand).
Recipient: HulkApps, acting as a processor on my behalf. Data may be processed outside the EEA; in that case, EU Standard Contractual Clauses serve as the transfer safeguard. See HulkApps’ privacy policy for details: https://www.hulkapps.com/pages/privacy-policy

You can clear your wishlist at any time via the site’s wishlist page, or contact me to request deletion of any wishlist data tied to your account.

12. Data Security

I take appropriate technical and organizational measures to protect your data against unauthorized access, loss, misuse, or disclosure, including SSL/TLS encryption of data in transit, secure storage via Shopify’s infrastructure, and restricted access to personal data. No method of transmission over the internet is 100% secure, and I cannot guarantee absolute security, but I take reasonable, industry-standard precautions.

13. Third-Party Links

This website may contain links to third-party websites (e.g. social media platforms). I have no control over and am not responsible for the privacy practices of these external sites. Please review their respective privacy policies before sharing personal data with them.

14. Automated Decision-Making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

15. Changes to This Privacy Policy

I may update this privacy policy from time to time to reflect changes in legal requirements or the services used on this site (e.g. if analytics or a newsletter are introduced in the future). The current version is always available on this page. Material changes will be indicated by an updated “Last updated” date.