1. Controller
The controller responsible for processing personal data in this shop is:
NaillyPRO Shop
Cuxhavener Straße 128b
21149 Hamburg
Germany
Email: info@naillypro.de
2. General information on data processing
We process personal data only to the extent necessary to operate the shop, process orders, communicate with customers, comply with legal obligations, or protect legitimate interests. Where consent is required, we process data only on the basis of that consent.
The relevant legal bases include in particular Article 6(1)(a) GDPR for consent, Article 6(1)(b) GDPR for performance of a contract or pre-contractual measures, Article 6(1)(c) GDPR for legal obligations, and Article 6(1)(f) GDPR for legitimate interests.
3. Hosting and Shopify platform
Our shop is operated through Shopify. When you visit and use the shop, Shopify may process technical access data, order and customer data, payment and shipping information, and communication data.
Provider:
Shopify International Ltd.
2nd Floor, 1-2 Victoria Buildings
Haddington Road
Dublin 4, D04 XN32
Ireland
Where Shopify or affiliated companies process data outside the EU or EEA, this is carried out using the applicable data protection safeguards, in particular Standard Contractual Clauses where required.
Processing through Shopify enables us to provide the online shop, accept orders, prepare payments, organise shipping, manage customer accounts, and secure the shop technically. The legal bases are Article 6(1)(b), (c), and (f) GDPR.
4. Orders and customer accounts
When you place an order or use a customer account, we process the data required for the order, delivery, payment, customer service, returns, and statutory documentation obligations. This includes in particular your name, address, email address, telephone number, billing and delivery address, ordered products, payment status, shipping status, and communication content.
The legal basis is Article 6(1)(b) GDPR. Article 6(1)(c) GDPR applies to tax and commercial retention obligations.
5. Payment processing
Depending on the selected payment method, payment data is transmitted to the respective payment service provider. This is necessary to process payments, issue refunds, and reduce the risk of fraud or misuse.
Payment providers used:
- Shopify Payments
- PayPal
The legal basis is Article 6(1)(b) GDPR. Security and fraud prevention measures may be based on Article 6(1)(f) GDPR.
6. Shipping and delivery
To deliver your order, we transmit the required data to shipping and logistics service providers. This includes in particular your name, delivery address, email address, telephone number, tracking number, and order information where required for delivery, tracking, or delivery notifications.
Shipping service provider used:
- DHL
The legal basis is Article 6(1)(b) GDPR. Where we transmit contact details for delivery notifications, this is also done for performance of the contract or on the basis of legitimate interests in reliable delivery.
7. Contacting us
If you contact us by email, contact form, or another communication channel, we process your information to handle your enquiry. This may include your name, contact details, order number, message content, and technical metadata.
The legal basis is Article 6(1)(b) GDPR where your enquiry relates to a contract or order. In all other cases, we process the data on the basis of Article 6(1)(f) GDPR because we have a legitimate interest in responding to enquiries.
8. Cookies and similar technologies
Our shop uses cookies and similar technologies. Some are technically necessary for the shop to function, for example for the shopping cart, checkout, login, security, and language settings. Other technologies, such as analytics, marketing, or personalisation, are used only where consent is required and you have provided that consent.
Technically necessary cookies and storage access are based on Section 25(2) TDDDG and, where personal data is processed, on Article 6(1)(b) or (f) GDPR. Cookies and similar technologies requiring consent are based on Section 25(1) TDDDG and Article 6(1)(a) GDPR.
9. Analytics and marketing
We currently do not actively use any additional analytics or marketing tracking tools. The Triple Whale app is installed but has not yet been configured. Before activation, the privacy policy, cookie information, and consent management will be updated accordingly.
10. Social media and external links
Our shop may contain links to external platforms. When you click such a link, you leave our shop. The respective provider is responsible for data processing on the linked websites.
If social media plugins, embedded content, videos, or maps are loaded directly in the future, this privacy policy will be updated accordingly.
11. Retention
We retain personal data only for as long as necessary for the respective purposes. We retain order, invoice, and accounting data in accordance with statutory retention obligations. We retain communication data for as long as required to process the enquiry, provide evidence, or establish, exercise, or defend legal claims.
12. Recipients of data
We disclose personal data only where necessary for the stated purposes, where a legal obligation exists, where you have consented, or where a legitimate interest applies. Recipients may include in particular shop platforms, payment service providers, shipping providers, IT service providers, tax advisers, legal advisers, authorities, and banks.
13. Rights of data subjects
Subject to the GDPR, you have in particular the right of access, rectification, erasure, restriction of processing, data portability, and objection to certain processing. Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority at your place of residence or the authority responsible for us may in particular have jurisdiction.
14. Obligation to provide data
To place an order, you must provide the data required to conclude the contract, process payment, and deliver the goods. Without this data, we cannot process your order. Voluntary information is marked accordingly or follows from the respective input field.
15. Changes to this privacy policy
We update this privacy policy when technical, organisational, or legal requirements change. The version published in the shop at the relevant time applies.