Privacy Policy
This is a translation for your convenience; the German version is legally binding.
1. Controller
The controller for data processing in this online shop is:
Himeno Tanaka Nagori
c/o Autorenglück #28603
Albert-Einstein-Straße 47
02977 Hoyerswerda
Germany
Phone: +49 (0) 160 91952776
Email: nagori.upcycling@gmail.com
No data protection officer has been appointed, as there is no legal obligation to do so.
2. Visiting the website and hosting
Each time you visit our shop, the server processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referrer and browser identification. We need this data to deliver the website and to ensure its security and stability (Art. 6(1)(f) GDPR). Server logs are automatically overwritten after a short time.
Our shop is hosted by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, on servers in the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with Contabo.
The connection to our shop is encrypted via TLS (HTTPS). Fonts and all other files are loaded from our own server; no content from Google Fonts or other external servers is embedded.
3. Cookies
We only use cookies that are technically necessary to run the shop, e.g. for the cart, login, the selected language and currency and your cookie settings (§ 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR). We do not use any analytics or advertising tools. PayPal cookies are only loaded when you start a payment via PayPal (see section 6). You can change your settings at any time via the cookie notice or the cookie settings in the footer.
4. Orders and customer account
When you place an order, we process the data required to perform the contract: name, shipping and billing address, email address, phone number if provided, ordered items and payment status (Art. 6(1)(b) GDPR). If you create a customer account, we also store this data in your account so that you can order faster in future and view your orders; passwords are only stored in encrypted form (as a hash). You can have your account deleted at any time. You can also order as a guest.
For delivery, we pass your name and shipping address to the shipping company we use (Art. 6(1)(b) GDPR). We only pass on your email address or phone number if this is necessary for delivery notifications.
Due to commercial and tax law requirements, we keep order and invoice data for up to ten years (§ 257 HGB, § 147 AO; Art. 6(1)(c) GDPR).
5. Emails
We send order confirmations, shipping information and replies to your enquiries via our email account with Google (Gmail), provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to Google LLC in the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists. The legal basis is Art. 6(1)(b) GDPR or, for enquiries, Art. 6(1)(f) GDPR.
6. Payment via PayPal
All payment methods (PayPal, credit or debit card, Apple Pay, Google Pay) are processed by PayPal. Provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. For the payment, we transmit the necessary data to PayPal (including name, address, email address, order amount and order number); PayPal does not pass your card or account details on to us. The legal basis is Art. 6(1)(b) GDPR. PayPal may carry out identity and credit checks to prevent fraud. With Apple Pay and Google Pay, data is also exchanged with Apple or Google. PayPal's privacy statement applies: www.paypal.com/de/legalhub/privacy-full.
7. Sign in with Google
If we offer sign-in with a Google account and you use it, we receive your name and email address from Google in order to create your customer account or sign you in (Art. 6(1)(b) GDPR). The provider is Google Ireland Limited (address see section 5). Using it is voluntary; you can also register with an email address and password.
8. Newsletter
If you subscribe to our newsletter, we use your email address to send you news about our pieces (Art. 6(1)(a) GDPR). Subscription uses the double opt-in procedure: you only receive the newsletter after confirming via the link in the confirmation email. You can unsubscribe at any time via the link in every issue or by emailing us.
9. Contacting us
If you contact us by email, phone or contact form, we process your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR). We delete the data when it is no longer needed for this purpose and no retention obligations apply.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). An email to us is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte), Devrientstraße 5, 01067 Dresden, Germany.
No automated decision-making, including profiling, takes place.
11. Changes
We update this privacy policy when our shop or the legal situation changes. The version published here applies.