Privacy policy

This notice explains how GABRIELE AMLUNG collects and uses personal data when you visit jondahlunga.shop or place an order, and what rights you have. It is written to meet the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and section 25 of the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG) for cookies and similar technologies.

Controller

GABRIELE AMLUNG, Thalfinger Straße 62/2, 89233 Neu-Ulm, Germany. Email service@jondahlunga.shop, telephone +49 731 970755. We are the controller for the processing described here, which means we decide why and how the data is used. We have not appointed a data protection officer; privacy questions and requests to exercise the rights below go to the contact details at the end of this notice.

What we collect

• Order data: name, delivery and billing address, email address, telephone number, ordered items, order value and order number.
• Payment data: the payment method and the confirmation returned by our payment provider. Card numbers are handled by the provider and never reach our systems.
• Technical data: IP address, browser type, device type, pages viewed, and the cookies described below.
• Correspondence: the content of messages you send us and our replies.

Why we use it and on what legal basis

We use order and payment data to perform the contract with you (article 6(1)(b) GDPR), including delivery, handling returns and answering questions about an order. We use data where necessary to comply with tax, accounting and consumer-protection obligations (article 6(1)(c) GDPR), for example keeping invoices for the statutory period and recording the withdrawal information we must give you. We use technical data on the basis of our legitimate interest in keeping the shop secure, available and working (article 6(1)(f) GDPR), and that interest is limited to security, fault diagnosis and aggregate statistics. Where you subscribe to our newsletter we use your email address on the basis of your consent (article 6(1)(a) GDPR), which you may withdraw at any time through the link in every message. Consent is also the basis for any cookie that is not strictly necessary.

Cookies and similar technologies

Under section 25(1) TDDDG, storing information on your device or reading information from it requires your consent, except where it is strictly necessary to provide the service you asked for. We set the cookies needed for the basket, the session, the checkout and security without consent because section 25(2) TDDDG exempts them, and the shop cannot work without them. Any cookie that analyses how the shop is used, remembers a preference or supports advertising is set only after you agree, and you can change or withdraw that agreement at any time through the cookie settings in the footer. Withdrawing consent does not affect processing that took place before it, and you can also delete cookies in your browser, although the basket and checkout may then stop working.

Who receives the data

Our shop platform Shopify International Ltd, established in Ireland, processes order data on our behalf as a processor under article 28 GDPR. Payment providers process payments; the carriers that deliver a parcel receive the delivery address and telephone number; our email provider carries messages; our tax adviser and accountant receive invoice data. All processors act on written instructions and under data-processing agreements, and they may use the data only for the purpose we have set. We do not sell personal data and we do not pass it to anyone for their own advertising.

Transfers outside the European Economic Area

We do not routinely transfer personal data outside the European Economic Area. Our platform provider is established in the European Union and processes order data within it. Where a group company or a subcontractor of a provider processes data outside the EEA, the transfer relies on an adequacy decision of the European Commission, such as the decision for Canada, or on the Commission's standard contractual clauses together with the additional measures the provider has put in place. You may ask us for information about the safeguard that applies to a particular transfer.

How long we keep it

Order and invoice data are kept for ten years to meet the retention duties in section 147 of the Abgabenordnung (German Fiscal Code) and, where it applies, section 257 of the Handelsgesetzbuch. Business correspondence is kept for six years, general enquiries for two years after the matter is closed, and technical logs for 30 days. Newsletter data is kept until you withdraw consent, and a record of the consent itself is kept for as long as the consent can be relied on. Data that is no longer needed is deleted or anonymised.

Your rights

You may request access to your data (article 15 GDPR), correction of anything inaccurate (article 16), deletion (article 17), restriction of processing (article 18), data portability (article 20), and you may object to processing based on legitimate interest (article 21). Where processing rests on consent, you may withdraw it at any time with effect for the future (article 7(3)). To exercise any of these, email service@jondahlunga.shop or write to Thalfinger Straße 62/2, 89233 Neu-Ulm, Germany; we answer within one month, and we extend that period by up to two further months only where a request is complex, telling you why. Exercising these rights is free of charge.

Complaint to a supervisory authority

You may lodge a complaint with the data protection supervisory authority of the German federal state in which we are established (Landesdatenschutzbeauftragte), or with any supervisory authority in the European Union, including the one in the country where you live or work (article 77 GDPR). We would prefer the chance to put a matter right first, so please write to us as well.

Security and automated decisions

Order data travels over an encrypted connection. Access is limited to the people who need it to fulfil your order or answer your message, and the platform is protected by access controls and audit logs. We do not use automated decision-making that produces legal effects or similarly significantly affects you (article 22 GDPR), and we do not build advertising profiles from order data. The shop is not directed at children and we do not knowingly collect data from a child.

Changes and contact

We may update this notice when the law or our processing changes; the version published here at the time of your order applies to it. Questions about this notice, or a request under the rights above: service@jondahlunga.shop, +49 731 970755, or GABRIELE AMLUNG, Thalfinger Straße 62/2, 89233 Neu-Ulm, Germany.