Privacy policy

1. Controller

Ambinoid Cosmetics and Supplements UG (haftungsbeschränkt)
Brunnenstraße 187, 10119 Berlin, Germany
Email: contact@ambinoid.com · Phone: +49 30 9221 9124

No data protection officer has been appointed, as the statutory conditions requiring one are not met.

2. Hosting and shop platform

This shop runs on the Shopify platform (Shopify International Limited, Dublin, Ireland; Shopify Inc., Ottawa, Canada). When you access our pages, server log data is processed automatically: IP address, date and time, page accessed, browser type and operating system. The legal basis is Art. 6 (1) (f) GDPR (secure and trouble-free operation of the website). A data processing agreement pursuant to Art. 28 GDPR is in place with Shopify.

3. Order processing

To process an order we handle your name, delivery and billing address, email address, phone number (where provided) as well as order and payment data. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract).

We pass this data on to the shipping company engaged to deliver your order and to our tax adviser insofar as this is necessary to meet tax obligations.

Payment is processed, depending on the method you choose, by FOXPAY UG (haftungsbeschränkt) (Germany) for payments by online banking, QR code or card, and by our bank in the case of advance transfer. For payments via FoxPay we pass on to FoxPay, in particular, your name, email address, order number and the amount, so that the payment link can be sent to you by email. Payment data is transmitted directly to the provider concerned and processed there under its own responsibility; complete card details are not passed to us. The legal basis is Art. 6 (1) (b) GDPR.

4. Contacting us

If you write to us by email, by phone or through the contact form, we process your details in order to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries and otherwise Art. 6 (1) (f) GDPR.

5. Email marketing

We use Klaviyo (Klaviyo Inc., Boston, USA) to send newsletters and to analyse their use. We process your email address, your opening and click behaviour and your order history. Sign-up uses a double opt-in procedure. The legal basis is your consent under Art. 6 (1) (a) GDPR. You may withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by contacting us.

6. Cookies and similar technologies

Strictly necessary cookies, for instance for the shopping cart, the language setting and session management, are set on the basis of § 25 (2) TDDDG without consent.

All other cookies and tracking technologies, in particular the analytics and marketing functions of Klaviyo, are only used with your express consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can change your selection at any time through the cookie settings.

7. Map display (Google Maps)

The footer of our pages shows where our store is. As long as you have not given consent, only a graphic hosted by ourselves is displayed there; no connection to Google is established.

Only once you expressly request the map, or have agreed to the embedding of external content, do we load a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your IP address is transmitted to Google in the process and may be transferred to the United States. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG; you may withdraw it at any time with effect for the future.

8. Age verification

On your first visit you are asked whether you are 18 or older. Your answer is stored locally in your browser only (local storage, for 30 days), so that the question does not reappear on every page. It is transmitted neither to us nor to any third party, and no cookie is set for it. The legal basis is Art. 6 (1) (c) GDPR (compliance with a legal obligation regarding the protection of minors).

9. Transfers to third countries

Some of the services named above process data in the United States and in Canada. An adequacy decision of the European Commission is in place for Canada. Transfers to the United States take place on the basis of the EU-US Data Privacy Framework or the standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.

10. Retention period

We store personal data only for as long as is necessary for the purposes described. Order and invoice data are subject to commercial and tax retention periods and are kept accordingly for up to ten years.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You may withdraw any consent given at any time with effect for the future.

To exercise your rights, a message to contact@ambinoid.com is sufficient.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.