Important Notice:
This English translation of the Privacy Policy is provided for convenience only. In the event of any discrepancies, inconsistencies, or legal uncertainties in the English version, the German version shall prevail.

Privacy Policy

1) Introduction and Contact Details of the Controller

1.1

We are pleased that you are visiting our website and thank you for your interest. In the following, we inform you about how your personal data is handled when using our website. Personal data means all data by which you can be personally identified.

1.2

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Derya Tavas
Deryadesigns
Mühlenstr. 33
76275 Ettlingen
Germany

Email: deryadesigns.shop@gmail.com

The controller responsible for processing personal data is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

2) Data Collection When Visiting Our Website

2.1

When you use our website for informational purposes only, meaning if you do not register or otherwise provide us with information, we only collect data that your browser transmits to the page server (so-called “server log files”). When you access our website, we collect the following data, which is technically necessary for us to display the website to you:

• Our visited website

• Date and time at the moment of access

• Amount of data sent in bytes

• Source/reference from which you accessed the page

• Browser used

• Operating system used

• IP address used (if applicable: in anonymized form)

Processing is carried out in accordance with Art. 6 (1) lit. f GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. However, we reserve the right to subsequently review the server log files if there are concrete indications of unlawful use.

2.2

For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this website uses SSL or TLS encryption. You can recognize an encrypted connection by the character string “https://” and the lock symbol in your browser line.

3) Hosting & Content Delivery Network

3.1 Shopify

For hosting our website and displaying page content, we use the system of the following provider:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland (“Shopify”)

Data is also transferred to:
Shopify Inc.
150 Elgin St
Ottawa, ON K2P 1L4
Canada

All data collected on our website is processed on the provider’s servers. We have concluded a data processing agreement with the provider to ensure the protection of our website visitors’ data and to prohibit unauthorized disclosure to third parties.

For data transfers to Canada, an adequate level of data protection is ensured by an adequacy decision of the European Commission.

3.2 Cloudflare

We use a Content Delivery Network from the following provider:

Cloudflare Inc.
101 Townsend St.
San Francisco, CA 94107
USA

This service enables us to deliver large media files such as graphics, page content, or scripts more quickly via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6 (1) lit. f GDPR.

We have concluded a data processing agreement with the provider to ensure the protection of our website visitors’ data and to prohibit unauthorized disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision of the European Commission.

3.3 imgix

We use a Content Delivery Network from the following provider:

Zebrafish Labs Inc.
423 Tehama St.
San Francisco, CA 94103
USA

This service enables us to deliver large media files such as graphics, page content, or scripts more quickly via a network of regionally distributed servers. Processing is carried out to safeguard our legitimate interest in improving the stability and functionality of our website in accordance with Art. 6 (1) lit. f GDPR.

We have concluded a data processing agreement with the provider to ensure the protection of our website visitors’ data and to prohibit unauthorized disclosure to third parties.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection based on an adequacy decision of the European Commission.

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, i.e. small text files that are stored on your device. Some of these cookies are automatically deleted after closing the browser (so-called “session cookies”), while others remain on your device for a longer period and allow page settings to be saved (so-called “persistent cookies”). In the latter case, you can find the storage duration in your web browser’s cookie settings overview.

If personal data is processed through individual cookies used by us, processing is carried out in accordance with Art. 6 (1) lit. b GDPR either for the performance of the contract, in accordance with Art. 6 (1) lit. a GDPR in the case of consent, or in accordance with Art. 6 (1) lit. f GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly, effective design of the site visit.

You can configure your browser so that you are informed about the setting of cookies and can decide individually about their acceptance or exclude the acceptance of cookies for specific cases or in general.

Please note that if cookies are not accepted, the functionality of our website may be limited.

5) Contacting Us

5.1 Judge.me

For review reminders, we use the services of the following provider:

Judge.me Ltd.
c/o Buckworths
2nd Floor, 1–3 Worship Street
London, England, EC2A 2AB
United Kingdom

Exclusively on the basis of your explicit consent in accordance with Art. 6 (1) lit. a GDPR, we transmit your email address and, if applicable, other customer data to the provider so that they may contact you via email with a review reminder.

You may revoke your consent at any time with future effect, either by contacting us or the provider.

We have concluded a data processing agreement with the provider to ensure the protection of our website visitors’ data and to prohibit unauthorized disclosure to third parties.

An adequate level of data protection is ensured by an adequacy decision of the European Commission.

5.2

When contacting us (e.g. via contact form or email), personal data is processed exclusively for the purpose of handling and responding to your request and only to the extent necessary for this purpose.

The legal basis for processing this data is our legitimate interest in responding to your request in accordance with Art. 6 (1) lit. f GDPR. If your contact aims at concluding a contract, the additional legal basis for processing is Art. 6 (1) lit. b GDPR.

Your data will be deleted once it can be inferred from the circumstances that the matter in question has been conclusively resolved and provided there are no statutory retention obligations to the contrary.

 

6) Data Processing When Opening a Customer Account

In accordance with Art. 6 (1) lit. b GDPR, personal data will continue to be collected and processed to the extent necessary if you provide it to us when opening a customer account. The data required for account registration can be found in the input form on our website.

You may delete your customer account at any time by sending a message to the controller at the contact details stated above. After deletion of your customer account, your data will be deleted provided that all contracts concluded through the account have been fully processed, no statutory retention periods apply, and we have no legitimate interest in further storage.

7) Use of Customer Data for Direct Advertising

7.1 Subscription to Our Email Newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address. Providing additional data is voluntary and may be used to address you personally.

We use the double opt-in procedure for newsletter subscriptions to ensure that you only receive newsletters after explicitly confirming your consent by clicking a verification link sent to your email address.

By activating the confirmation link, you grant us consent to use your personal data in accordance with Art. 6 (1) lit. a GDPR. We store your IP address entered by your Internet Service Provider (ISP), as well as the date and time of registration, in order to trace possible misuse of your email address at a later point in time.

The data collected during newsletter registration is used strictly for this purpose.

You can unsubscribe from the newsletter at any time via the unsubscribe link included in the newsletter or by contacting the controller named above. After unsubscribing, your email address will be immediately removed from our newsletter distribution list unless you have expressly consented to further use of your data or we reserve the right to further data use as permitted by law and disclosed in this Privacy Policy.

7.2 Seguno

Our email newsletters are sent via the following provider:

Seguno Software, Inc.
104 City Hall Plaza, Suite 200
Durham, NC 27701
USA

Based on our legitimate interest in effective and user-friendly newsletter marketing, we transfer the data you provide during newsletter registration to this provider in accordance with Art. 6 (1) lit. f GDPR so they can send newsletters on our behalf.

Subject to your explicit consent in accordance with Art. 6 (1) lit. a GDPR, the provider may also perform statistical analysis of newsletter campaigns using web beacons or tracking pixels embedded in emails to measure open rates and interactions with newsletter content.

Device information (such as time of access, IP address, browser type, and operating system) may also be collected and analyzed but is not merged with other data sets.

You may revoke your consent to newsletter tracking at any time with future effect.

We have concluded a data processing agreement with the provider that protects the data of our website visitors and prohibits disclosure to third parties.

For data transfers to the USA, the provider relies on the European Commission’s Standard Contractual Clauses to ensure an adequate level of data protection.

7.3 Product Availability Notification by Email

For temporarily unavailable products, you may subscribe to email notifications about product availability. We will send you a one-time email when the selected product becomes available again.

The only mandatory information required for this notification is your email address. Additional information is voluntary and may be used to address you personally.

We use the double opt-in procedure to ensure that you only receive notifications after explicitly confirming your consent by clicking a verification link sent to your email address.

By activating the confirmation link, you grant us consent to use your personal data in accordance with Art. 6 (1) lit. a GDPR.

You may unsubscribe from these notifications at any time by contacting the controller named above. After unsubscribing, your email address will be removed from the notification list unless further storage is legally permitted.

7.4 Cart Reminder Emails

If you abandon your purchase before completing your order, you may choose to receive a one-time email reminder regarding the contents of your shopping cart.

The only mandatory information required is your email address. Additional information is voluntary and may be used to address you personally.

We use the double opt-in procedure to ensure that reminders are only sent after explicit confirmation via a verification link.

By activating the confirmation link, you consent to the use of your personal data in accordance with Art. 6 (1) lit. a GDPR for sending cart reminders.

You may unsubscribe from cart reminders at any time by contacting the controller named above.

8) Data Processing for Order Fulfillment

8.1 General Order Processing

To the extent necessary for contract fulfillment for delivery and payment purposes, the personal data collected by us will be passed on to the commissioned transport company and the commissioned credit institution in accordance with Art. 6 (1) lit. b GDPR.

If we owe updates for goods with digital elements or digital products based on a corresponding contract, we process the contact data you provided during ordering in order to personally inform you about legally required updates pursuant to Art. 6 (1) lit. c GDPR.

We also work with the following service providers to process your order.

8.2 EasyDHL

For shipping preparation, we use:

247APPS UG (haftungsbeschränkt)
In der Goldgrube 28
56073 Koblenz
Germany

Digital shipping labels containing delivery information are transferred solely for order fulfillment.

8.3 Order Printer Pro

For order processing we use:

FORSBERG+TWO
Tranegårdsvej 74
2900 Hellerup
Denmark

Name, address, and additional personal data may be transferred to this provider for order processing and accounting purposes in accordance with Art. 6 (1) lit. b and lit. f GDPR.

8.4 Post & DHL Shipping (Official)

For shipping preparation, we use:

Deutsche Post DHL Research And Innovation GmbH
Kurt-Schumacher-Str. 1
53113 Bonn
Germany

Shipping labels containing delivery information are transferred solely for order fulfillment.

8.5 Transfer of Personal Data to Shipping Providers

Deutsche Post
Transport provider: Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn, Germany

If you consent during checkout, we may provide your email address and/or phone number before delivery to coordinate delivery or send delivery notifications.

DHL
Transport provider: DHL Paket GmbH, Sträßchensweg 10, 53113 Bonn, Germany

If you consent during checkout, we may provide your email address and/or phone number before delivery to coordinate delivery or send delivery notifications.

You may revoke this consent at any time with future effect.

8.6 Use of Payment Service Providers

Depending on your selected payment method, payment data may be transmitted to payment service providers for transaction processing in accordance with Art. 6 (1) lit. b GDPR.

Supported providers include:

• Apple Pay (Apple Distribution International, Ireland)

• BLIK (Polski Standard Płatności, Poland)

• giropay (paydirekt GmbH, Germany)

• Google Pay (Google Ireland Limited, Ireland)

• Klarna (Klarna Bank AB, Sweden)

• PayPal (PayPal Europe S.à r.l. et Cie, Luxembourg)

• Shopify Payments (Shopify International Limited, Ireland)

• TWINT (TWINT AG, Switzerland)

Depending on the payment method selected, providers may process:

• Name

• Billing address

• Payment details

• Transaction ID

• Order amount

• Currency

• Creditworthiness data (where applicable)

Certain providers (e.g. Klarna or PayPal invoice/payment in installments) may conduct credit checks based on legitimate interests pursuant to Art. 6 (1) lit. f GDPR.

 

9) Web Analytics Services

9.1 Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by:

Google Ireland Limited
Gordon House
4 Barrow Street
Dublin, D04 E5W5
Ireland (“Google”)

Google Analytics 4 enables analysis of your use of our website.

By default, Google Analytics 4 does not use cookies unless you explicitly consent to cookies. Instead, information about your usage behavior is collected through so-called “pings” (small data packets sent to the host of a device). This information includes your IP address, which is shortened by Google to exclude direct personal identification.

The information is transmitted to Google servers and further processed there. Transfers to Google LLC in the USA may also occur.

Google uses this information on our behalf to evaluate your website usage, compile reports on website activity, and provide additional services related to website and internet usage.

The shortened IP address transmitted by your browser within Google Analytics is not merged with other Google data.

Data collected via Google Analytics 4 is stored for two months and then deleted.

All processing described above, including data transfer via pings and possible use of Google Analytics cookies, only occurs if you have given explicit consent in accordance with Art. 6 (1) lit. a GDPR.

You may revoke your consent at any time with future effect by disabling this service via the cookie consent tool provided on the website.

We have concluded a data processing agreement with Google to protect visitor data and prevent unauthorized disclosure.

Further privacy information:

• https://business.safety.google/intl/en/privacy/

• https://policies.google.com/privacy

Demographic Features

Google Analytics 4 may use the feature “Demographics” to generate statistics about age, gender, and interests of visitors based on advertising and third-party data.

This helps identify target groups for marketing purposes. The collected data cannot be linked to a specific individual and is deleted after two months.

Google Signals

This website may use Google Signals for cross-device reporting.

If you have enabled personalized ads and linked your devices to your Google account, Google may—subject to your consent—analyze usage across devices and create models for cross-device conversions.

We do not receive personal data from Google, only statistical reports.

User IDs

Google Analytics 4 may also use User IDs.

If you consent to Google Analytics and log into your customer account across multiple devices, activities such as conversions may be analyzed across devices.

For data transfers to the USA, Google participates in the EU-US Data Privacy Framework.

9.2 Shopify Analytics

This website uses the web analytics service of:

Shopify International Limited
Victoria Buildings, 2nd Floor
1–2 Haddington Road
Dublin 4, D04 XN32
Ireland

Data may also be transferred to:

Shopify Inc.
150 Elgin St
Ottawa, ON K2P 1L4
Canada

Using cookies and similar technologies (tracking pixels, web beacons, and algorithms), the service collects pseudonymized visitor data including:

• IP address

• Browser information

• Device information

• Usage behavior

This data is used for statistical analysis and creation of pseudonymized usage profiles.

This may include movement analysis (heatmaps), showing:

• duration of page visits

• scrolling behavior

• clicks

• text entries

• mouse movement

All such processing occurs only with your explicit consent under Art. 6 (1) lit. a GDPR.

You may withdraw consent at any time through the cookie consent tool.

We have concluded a data processing agreement with Shopify.

Canada ensures an adequate level of data protection through an adequacy decision of the European Commission.

10) Website Functionalities

10.1 Pinterest Plugins

Our website uses plugins of the social network provided by:

Pinterest Europe Ltd.
Palmerston House, 2nd Floor
Fenian Street
Dublin 2
Ireland

These plugins enable direct interactions with Pinterest content.

To improve privacy protection, plugins are integrated using a “2-click” or “Shariff” solution, meaning no connection to Pinterest servers is established when loading the page.

Only when you activate the plugin and consent to data transfer under Art. 6 (1) lit. a GDPR does your browser establish a direct connection to Pinterest servers.

The following data may be transferred:

• IP address

• Browser information

• Device information

• Page history

If logged into Pinterest, interactions may also be published on your Pinterest profile and visible to your contacts.

Data may also be transferred to Pinterest Inc., USA.

We have concluded a data processing agreement with Pinterest.

For data transfers to the USA, Pinterest relies on Standard Contractual Clauses of the European Commission.

10.2 hCaptcha

This website uses the CAPTCHA service of:

Intuition Machines, Inc.
350 Alabama St
San Francisco, CA 94110
USA

The service verifies whether input is made by a human or through automated processing to prevent spam, DDoS attacks, and abuse.

The provider may process:

• IP address

• Browser type

• Operating system

• Date and duration of visit

Legal basis is our legitimate interest in preventing abuse and spam pursuant to Art. 6 (1) lit. f GDPR.

We have concluded a data processing agreement with the provider.

For data transfers to the USA, Standard Contractual Clauses are used.

11) Tools and Miscellaneous

11.1 Cookie Consent Tool

This website uses a cookie consent tool to obtain legally required user consent for cookies and cookie-based applications.

The tool appears as an interactive interface where users can consent to specific cookies/services.

Only cookies/services requiring consent are activated after user approval.

The tool stores technically necessary cookies to save your cookie preferences.

Personal data is generally not processed.

If personal data (such as IP address) is processed for storing or documenting consent, processing occurs under:

• Art. 6 (1) lit. f GDPR (legitimate interest in legally compliant consent management)

• Art. 6 (1) lit. c GDPR (legal obligation)

Where necessary, we have concluded a data processing agreement with the provider.

Further information about the cookie consent tool can be found directly in the tool interface on our website.

11.2 Judge.me

To verify and publish customer reviews, we use:

Judge.me Ltd.
c/o Buckworths
2nd Floor, 1–3 Worship Street
London, England, EC2A 2AB
United Kingdom

When submitting a review, the following data may be collected and processed:

• First and last name

• Email address

• Order date and order number

• Product name and international references (GTIN/ISDN)

This data is used to verify whether the review belongs to an actual purchase and to prevent review abuse.

Processing is based on Art. 6 (1) lit. f GDPR due to our legitimate interest in ensuring authentic customer reviews.

After review verification is completed, the provider deletes the data.

The United Kingdom ensures an adequate level of data protection through an adequacy decision of the European Commission.

12) Rights of the Data Subject

12.1 Your Rights

Under applicable data protection law, you have the following rights regarding the processing of your personal data by the controller:

• Right of access pursuant to Art. 15 GDPR

• Right to rectification pursuant to Art. 16 GDPR

• Right to erasure pursuant to Art. 17 GDPR

• Right to restriction of processing pursuant to Art. 18 GDPR

• Right to notification pursuant to Art. 19 GDPR

• Right to data portability pursuant to Art. 20 GDPR

• Right to withdraw consent granted pursuant to Art. 7 (3) GDPR

• Right to lodge a complaint pursuant to Art. 77 GDPR

12.2 Right to Object

IF WE PROCESS YOUR PERSONAL DATA BASED ON OUR OVERRIDING LEGITIMATE INTEREST WITHIN THE FRAMEWORK OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME WITH FUTURE EFFECT FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, FURTHER PROCESSING MAY BE RESERVED IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13) Duration of Storage of Personal Data

The duration of storage of personal data depends on the respective legal basis, the purpose of processing, and—where applicable—the relevant statutory retention period (e.g. retention periods under commercial and tax law).

When processing personal data based on explicit consent pursuant to Art. 6 (1) lit. a GDPR, the data concerned will be stored until you revoke your consent.

If statutory retention periods exist for data processed within contractual or quasi-contractual obligations on the basis of Art. 6 (1) lit. b GDPR, such data will be routinely deleted after expiration of the retention periods, provided it is no longer required for contract fulfillment or contract initiation and/or we have no legitimate interest in further storage.

When processing personal data on the basis of Art. 6 (1) lit. f GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for processing which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.

When processing personal data for direct marketing purposes on the basis of Art. 6 (1) lit. f GDPR, such data will be stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the specific processing situations described in this Privacy Policy, stored personal data will otherwise be deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.