Privacy Policy

1. Privacy at a glance

The protection of your personal data is important to us. We process your data exclusively on the basis of the statutory provisions, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG). This policy informs you about which data we process when you visit our online shop freshlens.eu, place orders or contact us, why we do so and what rights you have.

2. Controller

The controller responsible for data processing is:

Freshlens.eu, owner: Enes Davulcu
Lanferbruchstraße 1, 45899 Gelsenkirchen, Germany
Email: support@freshlens.eu

We have not appointed a data protection officer, as we are not legally required to do so. If you have any data protection questions, you can reach us at the email address above.

3. Hosting, shop system and server log files

Our online shop runs on the Shopify platform (Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland, as well as Shopify Inc., Ottawa, Canada, and other affiliated companies). Shopify processes data on our behalf (processing under Art. 28 GDPR) to operate the shop, manage orders and customers and protect against misuse. When you access our pages, technically necessary data such as IP address, date and time, page accessed, and browser and device information are processed in server log files. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the shop). Shopify may also process data in third countries such as Canada and the USA. The transfer is based on the adequacy decision of the EU Commission (Canada, EU-US Data Privacy Framework) or on EU Standard Contractual Clauses.

Shopify also delivers fonts and content via its own content delivery networks (cdn.shopify.com, fonts.shopifycdn.com), as a result of which your IP address is transmitted to these servers (Art. 6(1)(f) GDPR).

4. Cookies, consent and similar technologies

We use cookies and similar technologies (e.g. local storage, pixels). We use technically necessary technologies (e.g. shopping cart, checkout, security, storing your cookie selection) without consent (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). All other technologies, in particular for statistics and marketing, are only used with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). On your first visit, you can use our consent banner to select which categories you wish to allow. You can withdraw or change your consent at any time with effect for the future via the cookie settings on our website. The lawfulness of the processing carried out until then remains unaffected.

5. Orders and contract performance

When you place an order, we process your name, billing and delivery address, email address, optionally your telephone number, order data (products, prices, time of order), the selected payment method and payment status, as well as shipment tracking data. The purpose is the performance of the purchase contract, delivery, payment processing, customer service and handling of returns. The legal basis is Art. 6(1)(b) GDPR. Due to retention obligations under German commercial and tax law (including Section 147 AO, Section 257 HGB), we store order and invoice data for up to 10 years (Art. 6(1)(c) GDPR). Providing your data is necessary to conclude the contract; without it, we cannot carry out the order.

To prevent payment fraud and misuse, Shopify analyses orders automatically (fraud analysis). The legal basis is our legitimate interest in fraud prevention (Art. 6(1)(f) GDPR). We may put high-risk orders on hold for manual review or reject them.

6. Customer account

If you create a customer account, we store your account data and order history so that you can view your orders and complete future orders more quickly (Art. 6(1)(b) GDPR). You can have your account deleted at any time. Statutory retention obligations may, however, prevent the deletion of certain data.

7. Payment processing

For payment processing, we pass on the necessary data to the payment service providers you have selected (Art. 6(1)(b) GDPR). Depending on your choice, these are:

• Shopify Payments (credit card, Apple Pay, Google Pay, possibly other payment methods) via Shopify and its payment service provider Stripe Payments Europe, Ltd., Ireland;
• PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (privacy policy: paypal.com/de/legalhub/paypal/privacy-full);
• Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (privacy policy: klarna.com/de/datenschutz). For purchases on invoice, Klarna may carry out an identity and credit check and make automated decisions in this context. Klarna is the controller for this processing; you can find information on this in Klarna's privacy policy;
• Apple Pay (Apple Distribution International Ltd., Cork, Ireland) and Google Pay (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your card details are not passed on to us.

If you choose the payment method bank transfer (prepayment), no external payment service provider is involved: you transfer the amount directly to our business account at our bank. We only receive the usual transfer data (including name, IBAN, payment reference), which our bank provides to us for matching the incoming payment (Art. 6(1)(b) GDPR).

We do not receive payment data (e.g. full card numbers). We only see information such as payment status and payment method.

8. Shipping and shipment tracking

For delivery, we pass on your name, delivery address and, where necessary or provided by you, your email address or telephone number to the shipping service provider DHL (DHL Paket GmbH, Straßchensweg 10, 53113 Bonn, Germany) (Art. 6(1)(b) GDPR). If you so wish, DHL uses your email address for delivery notifications, provided you have consented to this vis-à-vis DHL (Art. 6(1)(a) GDPR). For shipment tracking, we use a shipment tracking app (Track123) which processes order and shipment data (name, order number, tracking number, delivery status) in order to show you the status of your shipment (Art. 6(1)(b) and (f) GDPR).

9. Contacting us (contact form, email, WhatsApp)

If you contact us via the contact form, by email or via WhatsApp, we process the information you provide (name, contact details, content of the message, order number if applicable) in order to handle your request (Art. 6(1)(b) or (f) GDPR). We delete the data as soon as it is no longer required for the purpose and no statutory retention obligations prevent deletion, usually after your request has been dealt with and the warranty or limitation periods have expired. With WhatsApp, communication takes place via WhatsApp Ireland Limited (Meta group); metadata may be transferred to the USA in this context. Alternatively, you can write to us at any time by email or via the contact form. The use of WhatsApp is voluntary; your message constitutes consent to the processing of the data you provide (Art. 6(1)(a) GDPR).

10. Newsletter and email marketing (Klaviyo)

If you subscribe to our newsletter, we process your email address and any other voluntary information (e.g. first name) in order to send you information, offers and discount promotions. If you also provide your date of birth, we use it exclusively via our email marketing tool Klaviyo to send you a discount on your birthday; we do not collect your date of birth for any other purpose. Registration takes place using the double opt-in procedure; you will receive a confirmation email for this. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 3 UWG). We measure whether and how you open our emails and which links you click in order to improve our content. You can withdraw your consent at any time, e.g. via the unsubscribe link in every email or by emailing us. We store your data until you withdraw your consent.

We use Klaviyo, Inc., 125 Summer Street, Suite 600, Boston, MA 02110, USA as a service provider (processor). The transfer to the USA is based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. Klaviyo also uses cookies and scripts on our website to attribute visits and sign-ups; this only takes place with your consent (section 4). If you purchase goods from us and we have received your email address in the process, we may send you email advertising for our own similar goods even without your express consent, provided you have not objected to such use (Section 7(3) UWG). You can object to such use at any time without incurring any costs other than the transmission costs according to the basic rates.

11. Reviews (Trustpilot, Judge.me)

After your order, we may invite you by email to submit a review. For this purpose, we pass on your email address and name as well as order information to our review service providers, insofar as we use them: Trustpilot A/S, Pilestræde 58, 1112 København K, Denmark, and Judge.me. The legal basis is our legitimate interest in customer feedback and quality assurance (Art. 6(1)(f) GDPR, Section 7(3) UWG). You may object at any time. If you submit a review, it will be published with the name you provided. Publication is based on your consent (Art. 6(1)(a) GDPR) or our legitimate interest. To display the reviews on our website, scripts of the providers are loaded which transmit your IP address; this only takes place insofar as you have consented to the corresponding category or insofar as it is technically necessary.

12. Web analytics and marketing (only with consent)

We only use the following services if you have consented via the consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time (section 4). Cookie storage period: depending on the provider, between a few days and a maximum of two years. If you do not consent, these services will not be activated.

12.1 Google Analytics 4, Google Ads and Google Tag

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for data transfers to the USA: Google LLC, EU-US Data Privacy Framework). We use Google Analytics 4 to analyse website usage (e.g. pages visited, time spent, origin, device type, conversions) as well as Google Ads (conversion tracking and remarketing) to manage ads and measure their success. In doing so, cookies and identifiers (e.g. _ga, _gcl_au) are set and data such as a shortened IP address, device and usage data are transmitted to Google. The data is processed pseudonymously.

12.2 Meta Pixel (Facebook / Instagram)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. We use the Meta Pixel to measure conversions, optimise advertisements and create target audiences. In doing so, cookies (e.g. _fbp) are set and data such as IP address, browser data, pages visited and events (e.g. shopping cart, purchase) are transmitted to Meta, possibly also to the USA (Data Privacy Framework or Standard Contractual Clauses). Insofar as Meta processes data for its own purposes, Meta is (jointly) responsible for this.

12.3 Pinterest

Provider: Pinterest Europe Ltd., Palmerston House, Fenian Street, Dublin 2, Ireland. We use the Pinterest Tag to measure advertising success (e.g. cookie _pin_unauth).

12.4 Microsoft Clarity and Microsoft Advertising

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. With Microsoft Clarity, we analyse user behaviour on an anonymised or pseudonymised basis (clicks, scrolling behaviour, mouse movements, session recordings and heatmaps) in order to improve the shop. Sensitive input fields are masked. Clarity sets cookies (e.g. _clck, _clsk). Data may be transferred to the USA (Data Privacy Framework or Standard Contractual Clauses). Microsoft Advertising may likewise be integrated to measure the success of ads.

12.5 Shopify Analytics and web pixels

Shopify collects usage and conversion data in order to provide us with statistics about the shop and to connect the advertising channels mentioned above (Shopify web pixels and Consent Tracking API). Processing takes place in accordance with your consent selection.

12.6 Other services for conversion optimisation

To optimise our shop, we use applications that load scripts on our site, e.g. Justuno (pop-ups and conversion optimisation), Hextom (announcement bar and sales boost notices), ConversionBear (trust badges) and a banner service. These may set cookies or similar identifiers and transmit IP address, device and usage data. We only use them after you have given your consent or only with technically necessary functions. Processing is based on Art. 6(1)(a) or (f) GDPR. Shogun (page builder) loads content and a pixel script to evaluate page usage.

13. Withdrawal function

If you use the electronic withdrawal function on our website ("Withdraw from contract" button in the footer), we process the data entered there (name, order number, email address, notice of withdrawal) in order to handle your withdrawal and send you a confirmation (Art. 6(1)(b) and (c) GDPR). The function is provided by a service provider (Revoq), which processes the data on our behalf.

14. Receivables management, dunning procedures and legal enforcement

If you do not pay a claim that is due, we process the data required for enforcement (name, address, order and payment data, correspondence) and, where necessary, pass it on to lawyers, debt collection service providers, the competent dunning court or court and authorities (Art. 6(1)(b) and (f) GDPR). We store this data until the proceedings have been concluded and beyond that in accordance with the statutory limitation and retention periods. In the event of a declaration of loss under our General Terms and Conditions, we process the information you provide therein to clarify the facts and to assert or defend against claims (Art. 6(1)(b) and (f) GDPR). Data may also be passed on to our tax advisers and accountants (Art. 6(1)(c) GDPR).

15. Social networks

On our website, we link to our Instagram profile (Meta Platforms Ireland Limited). These are simple links without the integration of plug-ins. Data is only transmitted to Instagram once you click on the link. Instagram's privacy policy applies.

16. Recipients and transfers to third countries

Recipients of your data are the service providers named in this policy (hosting, payment, shipping, marketing, analytics, reviews, communication), our bank (for prepayment), tax advisers and, where applicable, lawyers, debt collection service providers and courts. Some service providers are based in the USA or in other third countries. We ensure the lawfulness of such transfers by means of adequacy decisions (in particular the EU-US Data Privacy Framework) or EU Standard Contractual Clauses and supplementary measures. You can request a copy of the safeguards from us.

17. Storage period

We only store personal data for as long as is necessary for the respective purpose. We retain contract, order and invoice data for up to 10 years in accordance with tax and commercial law requirements. We store newsletter data until you withdraw your consent, and contact requests until they have been dealt with and the limitation periods have expired. Cookie data has the lifetime stated in the consent banner.

18. Automated decision-making

We do not engage in solely automated decision-making, including profiling, which produces legal effects concerning you. Please note the information on payment service providers (section 7) and on fraud prevention (section 5).

19. Your rights

Under the GDPR, you have the following rights:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)
• Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR. Where your data is processed for direct marketing purposes, you may object to this at any time without giving reasons. To exercise your rights, write to us at support@freshlens.eu.

20. Competent supervisory authority

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de

21. Changes to this policy

We amend this privacy policy if our offering or the legal situation changes. The current version on this page applies.