Privacy policy

(Datenschutzerklärung)

Last updated: 21.09.2026

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Lauren Schürstedt
Loitzer Straße 22
32120 Hiddenhausen
Germany

Email: jewelrybyelfcloset@gmail.com

A data protection officer is not required to be appointed based on the circumstances currently applicable to this business. This assessment may change if the nature or scale of the processing activities changes.

2. Your Data Protection Rights

Under the GDPR, you have the following rights, subject to the applicable statutory requirements:

Right of access (Art. 15 GDPR): You may request information about whether and how your personal data is being processed and obtain a copy of your personal data.
Right to rectification (Art. 16 GDPR): You may request correction of inaccurate or completion of incomplete personal data.
Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where the legal requirements are met.
Right to restriction of processing (Art. 18 GDPR): You may request restriction of processing in the circumstances provided by law.
Right to data portability (Art. 20 GDPR): Where applicable, you may receive personal data that you have provided to me in a structured, commonly used and machine-readable format and request its transmission to another controller.
Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(e) or (f) GDPR, you may object to processing on grounds relating to your particular situation. You have an unconditional right to object to processing for direct marketing purposes, including profiling related to direct marketing.
Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority.

To exercise your rights, please contact:

jewelrybyelfcloset@gmail.com

Competent supervisory authority

As the business is established in North Rhine-Westphalia, the competent state data protection supervisory authority is generally:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany
Email: poststelle@ldi.nrw.de

You may also lodge a complaint with another competent supervisory authority, in particular the authority in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement, where permitted under Art. 77 GDPR.

3. Hosting and Shopify

This online shop is operated using Shopify.

For merchants in Europe, Shopify International Limited, Ireland, is generally Shopify’s primary contracting entity. Shopify may also use affiliated companies and other service providers in providing its services.

Depending on the particular Shopify service and processing activity, Shopify may process personal data on my behalf as a processor or may process certain data for its own purposes as an independent controller.

When you visit or use the shop, technical information may be processed, including:

IP address;
browser and device information;
operating system;
referring URL;
date and time of access;
information concerning requests made to the website;
security and fraud-prevention information; and
other technical information required to operate, secure and improve the Shopify service.

The purposes of this processing include providing and securing the website, preventing abuse and fraud, maintaining technical functionality and processing customer orders.

Where processing is necessary to provide the online shop or fulfil a contract, the legal basis is Art. 6(1)(b) GDPR. Where processing is necessary for website security, fraud prevention or the legitimate operation of the shop, the legal basis is generally Art. 6(1)(f) GDPR.

Shopify may process personal data outside the European Economic Area. Shopify states that transfers are protected using applicable mechanisms including the European Commission’s adequacy decision for Canada, Standard Contractual Clauses and other legally recognised safeguards, depending on the transfer. (Shopify Help Center)

Further information can be found in:

Shopify’s Privacy Policy

and

Shopify’s Data Processing Addendum

4. Cookies and Similar Technologies

This website uses cookies and similar technologies.

Some cookies and similar technologies are technically necessary to provide functions that you have expressly requested, such as:

maintaining the shopping cart;
enabling checkout;
maintaining a session;
remembering necessary shop settings; and
maintaining the security and functionality of the website.

Under § 25(2) No. 2 TDDDG, consent is not required for storing or accessing information on a user’s device where this is strictly necessary to provide a digital service expressly requested by the user. (Gesetze im Internet)

Where cookies or similar technologies are not strictly necessary for the requested service, they are only used where the applicable legal requirements, including consent under § 25 TDDDG and Art. 6(1)(a) GDPR where applicable, have been satisfied.

Analytics and advertising

At the time this Privacy Policy was last updated, I do not intentionally use Google Analytics, Meta Pixel or other third-party advertising or analytics tools for tracking visitors.

If additional analytics, advertising, personalisation or similar technologies are introduced, this Privacy Policy will be updated and, where required, an appropriate consent mechanism will be provided before those technologies are activated.

Please note that Shopify and installed Shopify apps may use certain technologies required for their own technical, security or service functions. The exact technologies used may depend on the Shopify configuration, theme and apps installed.

5. Orders and Customer Accounts

When you place an order, I process the personal data necessary to process and fulfil your purchase.

Depending on the circumstances, this may include:

first and last name;
billing address;
shipping address;
email address;
telephone number, where provided or required;
order number;
products purchased;
order value;
delivery information;
payment method and payment-related information;
correspondence concerning the order; and
information required to comply with legal obligations.

The purposes of processing include:

processing and fulfilling your order;
communicating with you about your order;
arranging delivery;
processing returns, refunds and complaints;
preventing fraud and misuse;
maintaining accounting and business records; and
complying with legal obligations.

The legal bases are primarily:

Art. 6(1)(b) GDPR — performance of a contract or steps taken at your request before entering into a contract; and
Art. 6(1)(c) GDPR — compliance with legal obligations, particularly accounting and tax obligations.

Where processing is necessary to protect legitimate business interests, such as preventing fraud or asserting or defending legal claims, the legal basis may be Art. 6(1)(f) GDPR.

6. Retention of Order and Accounting Data

I retain personal data only for as long as necessary for the relevant purpose or where a statutory retention obligation applies.

Order, accounting and tax records may be subject to statutory retention periods under German commercial and tax law, including § 147 AO and § 257 HGB. Depending on the type of record, statutory retention periods can extend for several years.

Where personal data is subject to a statutory retention obligation, processing is restricted to the purposes permitted by law during that period.

After the applicable retention period has expired, the relevant data is deleted unless another lawful reason for continued retention applies.

7. Contact by Email

If you contact me by email, I process the information you provide in order to respond to your request.

Depending on the nature of your inquiry, this may include:

your name;
email address;
contact details;
the content of your message;
order information; and
any documents or information you voluntarily provide.

The legal basis is:

Art. 6(1)(b) GDPR, where your inquiry concerns entering into or performing a contract; or
Art. 6(1)(f) GDPR, where processing is based on my legitimate interest in responding to general business inquiries.

I retain correspondence only for as long as necessary to handle the inquiry and, where applicable, for the period necessary to establish, exercise or defend legal claims or comply with statutory retention obligations.

8. Payment Providers

Depending on the payment method selected during checkout, payment-related personal data is processed by the relevant payment provider.

Payment methods available through the shop may include:

Shopify Payments;
PayPal;
Klarna;
Google Pay;
Apple Pay; and
other payment methods made available through Shopify from time to time.

The relevant payment provider may process payment and transaction information, billing information, device information, fraud-prevention information and other information necessary to process or authorise the transaction.

I generally do not receive or store your complete payment card number.

The processing necessary to complete your purchase is generally based on Art. 6(1)(b) GDPR. Payment providers may process certain data as independent controllers for their own legal, security, fraud-prevention or regulatory purposes.

Please consult the privacy information of the payment provider you select for details of its own processing activities.

9. Shipping and Delivery Providers

To fulfil your order, I provide the shipping provider with the information necessary to deliver your purchase.

Depending on the delivery service used, this may include:

name;
shipping address;
telephone number, where necessary;
email address, where necessary for delivery notifications; and
shipment or order reference.

The legal basis is Art. 6(1)(b) GDPR, as processing is necessary to fulfil the delivery component of your contract.

Shipping providers may process certain information as independent controllers for their own operational, security and legal purposes.

10. Product Reviews – Judge.me

I use the Judge.me Shopify application to collect and display customer reviews.

If you submit a review, Judge.me may process information such as:

your review content;
display name;
email address;
photographs or other media you choose to provide;
information linking the review to your purchase; and
technical information necessary to operate the review service.

Your display name and any photograph or other information you voluntarily choose to publish may be displayed publicly alongside your review.

Judge.me states that it generally acts as a processor for personal data it receives from merchants in connection with customer reviews, while it may act as an independent controller in other circumstances. (judge.me)

The legal basis for processing your review information in connection with a review you voluntarily submit is generally Art. 6(1)(a) GDPR, where consent is required for the relevant publication or processing.

Where review requests are sent to customers following a purchase, the legal basis may be Art. 6(1)(f) GDPR, provided the applicable legal requirements for such communications are satisfied.

Judge.me uses service providers and may transfer personal data outside the EEA. Judge.me states that it uses Standard Contractual Clauses and other applicable safeguards for international transfers. (judge.me)

You may request correction or deletion of your review or related personal data by contacting me at:

jewelrybyelfcloset@gmail.com

You may also use the functions made available by Judge.me where applicable.

Further information:

Judge.me Privacy Policy

11. Wishlist

This website uses the Advanced Wishlist application provided by HulkApps/Shop Circle.

If you use the wishlist function, information concerning the products you add to your wishlist may be stored using cookies, local storage or your customer account, depending on the functionality and whether you are logged in.

Depending on the configuration of the application, this may include:

products added to your wishlist;
information associated with your customer account;
technical identifiers;
browser or device information; and
other information necessary to provide the wishlist function.

The purpose of processing is to provide the wishlist functionality and, where applicable, maintain the wishlist across visits or devices.

Where the wishlist function is expressly requested by you, the legal basis may be Art. 6(1)(b) GDPR where the processing is necessary to provide that functionality as part of the service.

Where processing is not necessary for a contract but is based on my legitimate interest in providing and improving the wishlist function, the legal basis is Art. 6(1)(f) GDPR.

If the wishlist requires storing or accessing information on your device that is not strictly necessary for a service you have expressly requested, the requirements of § 25 TDDDG, including consent where required, apply. (Gesetze im Internet)

HulkApps/Shop Circle may process personal data in connection with the app and its services. Its current privacy policy identifies Shop Circle Ltd, trading as HulkApps, as the relevant company and describes its GDPR practices. (HulkApps)

Further information:

HulkApps Privacy Policy

You may delete wishlist information through the functionality provided on the website or contact me at jewelrybyelfcloset@gmail.com where you wish to request deletion of personal data that I control.

12. Other Recipients and Service Providers

Personal data may be disclosed to service providers and other recipients where this is necessary for the purposes described in this Privacy Policy.

These may include, depending on the services actually used:

Shopify and Shopify group companies;
payment service providers;
shipping and delivery providers;
Judge.me;
HulkApps/Shop Circle;
IT and hosting service providers;
accounting or tax service providers;
professional advisers; and
public authorities where required by law.

Where a service provider processes personal data on my behalf, an appropriate data-processing agreement or other legally required arrangement is used where required by Art. 28 GDPR.

I do not sell your personal data.

Personal data is not disclosed to third parties for purposes unrelated to the purposes described in this Privacy Policy unless there is an applicable legal basis, such as your consent, a contractual necessity, a legal obligation or a legitimate interest.

13. International Data Transfers

Some service providers used by the shop may process personal data outside the European Economic Area (EEA).

Where personal data is transferred to a third country, I take reasonable steps to ensure that the transfer is permitted under Chapter V GDPR.

Depending on the recipient and destination, transfers may be based on:

an adequacy decision adopted by the European Commission;
Standard Contractual Clauses approved by the European Commission;
Binding Corporate Rules; or
another legally recognised transfer mechanism.

Where required, additional safeguards may be used.

For example, Shopify states that it uses applicable transfer mechanisms including the European Commission’s adequacy decision for Canada and Standard Contractual Clauses for relevant international transfers. (Shopify Help Center)

14. Data Security

I take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

These measures may include:

encrypted data transmission using TLS/SSL;
access controls;
restricted access to personal data;
secure systems and hosting infrastructure;
appropriate authentication and account-security measures; and
security measures provided by contracted service providers.

Security measures are reviewed and adapted where appropriate to reflect technical developments and the risks associated with processing.

15. Third-Party Websites and External Links

This website may contain links to third-party websites, including social media platforms, payment providers and other external services.

When you follow such a link, you leave this website and the third party may process personal data in accordance with its own privacy policy.

I have no control over the privacy practices of third-party websites and am not responsible for their processing activities.

16. Automated Decision-Making and Profiling

I do not independently carry out automated decision-making that produces legal effects or similarly significant effects on you within the meaning of Art. 22 GDPR.

However, third-party service providers, particularly payment providers and fraud-prevention services, may use automated processes for purposes such as fraud detection, payment authorisation or risk assessment.

Where such processing is carried out by a third party as an independent controller, the provider’s own privacy information and applicable terms apply.

17. Data Protection Officer

Based on the processing activities currently carried out by this business, I am not required to appoint a data protection officer under Art. 37 GDPR and § 38 BDSG.

If the circumstances of the business or its processing activities change such that the appointment of a data protection officer becomes legally required, this assessment will be reviewed.