Privacy policy

1. Controller

Ferrum Culina
Owner: Fynn Hackbusch
Krummholzstraße 17a
79206 Breisach am Rhein
Deutschland
Phone: +49 1573 0487583
E-Mail: ferrumculina@gmail.com

2. Principles and legal bases

We process personal data only where necessary to provide and secure the store, take pre-contractual steps and perform contracts, handle enquiries, comply with legal obligations or on the basis of valid consent. Depending on the processing, the relevant legal bases include Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract and pre-contractual steps), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests).

3. Shopify

Our online store is operated using Shopify. For merchants in Europe, Shopify International Limited, Ireland, is the principal Shopify contracting entity. In providing the store, Shopify may process technical usage data, device and browser information, contact, customer-account, cart, order, payment and transaction information. Depending on the function, Shopify may act as a processor or, for certain services, as an independent controller. Information on Shopify's processing is available in Shopify's consumer privacy information at privacy.shopify.com.

4. Shopify Network Intelligence

Shopify Network Intelligence is currently enabled. Shopify may therefore use customer data together with data from interactions with Shopify and other Shopify merchants to provide enhanced services, for example for security, store performance, personalization and, where permitted and accepted by the customer, advertising functions. Where consent is required in the EEA for non-essential processing, choices made through Shopify's cookie banner or privacy settings are respected. Information on rights relating to Shopify and options to withdraw consent or object is available through Shopify's privacy portal at privacy.shopify.com.

5. Technical access data

When the store is accessed, technically necessary information is processed. This may include IP address, date and time, pages viewed, referrer information, browser type and version, operating system, device information, security data and error logs. Processing serves in particular to provide a secure and functional store, analyse errors and prevent abuse. Where processing is not already required for contract performance or legal obligations, it is based on our legitimate interest in a secure and stable online store under Art. 6(1)(f) GDPR.

6. Orders and contract performance

When an order is placed, we process in particular first and last name, email address, phone number where provided or required, delivery and billing address, order number, ordered products and variants, order value, payment status and shipping, tracking, return, withdrawal, complaint and refund information. Processing is necessary for contract performance under Art. 6(1)(b) GDPR. Where statutory documentation and retention duties apply, further processing is based on Art. 6(1)(c) GDPR.

7. DSers, AliExpress and current supplier

We use DSers and the AliExpress sourcing marketplace to operate our fulfilment model. For a specific order, data necessary for delivery, in particular name, delivery address, phone number where required, order information and ordered products, may be transmitted through these systems to the current supplier. According to the business information published on the sourcing marketplace, the current seller/supplier is Shuangtongli (Hong Kong) Limited
Room 21, Unit A, 11/F, Tianhui Industrial Building
3 Hing Wang Street
Tuen Mun District, New Territories
Hong Kong Special Administrative Region
Email: hhh222220106@163.com. This supplier is located outside the EEA. Data is shared only insofar as necessary for ordering, fulfilment, shipping, tracking or handling specific delivery issues. Processing necessary for contract performance is based on Art. 6(1)(b) GDPR.

8. International transfers in fulfilment

As part of fulfilment, personal data may be transferred to third countries, in particular China or Hong Kong. Such transfers are subject to the requirements of Arts. 44 et seq. GDPR. Depending on the provider involved, adequacy decisions, standard contractual clauses or other lawful transfer mechanisms may be used. Where an individual transfer is directly necessary to perform a contract concluded at the customer's request, Art. 49(1)(b) GDPR may additionally apply in the exceptional circumstances provided by law.

9. Payment processing

Data required for the selected payment method is transmitted to the relevant payment provider. The methods actually offered in the specific checkout are decisive. Depending on the customer's choice, Shopify Payments and Shop Pay, participating card networks and banks, Apple Pay, Google Pay, PayPal or Klarna may process data. Processing required for payment is based on Art. 6(1)(b) GDPR. Payment providers may also process data under their own responsibility to comply with legal obligations such as fraud prevention, identity checks or anti-money-laundering requirements.

PayPal

If PayPal is selected, payment is processed in particular by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes account, contact, transaction and security data required for the payment in accordance with its own privacy terms.

Klarna

If a Klarna payment method is selected, data required for payment and, where applicable, credit or identity checks may be transmitted to Klarna Bank AB (publ), Sweden. The nature and extent of processing depend on the specific Klarna payment method selected and Klarna's privacy information.

10. Customer account

We use Shopify's customer account functionality. Customers can sign in using their email address, and Shopify may send a time-limited security code by email. The account may display orders, order status and available return, cancellation and withdrawal options. Processing is necessary for contract and account management under Art. 6(1)(b) GDPR.

11. Contact, messaging and customer service

If you contact us by email, telephone, contact form, Shopify messaging or another provided communication channel, we process the information you provide to handle the enquiry. This may include name, email address, phone number, order number, message content and photos or attachments voluntarily submitted. For contract-related enquiries, the legal basis is Art. 6(1)(b) GDPR; for other business enquiries, processing may be based on our legitimate interest in efficient handling under Art. 6(1)(f) GDPR.

12. Returns, withdrawals and complaints

For return, withdrawal and complaint requests, we process in particular identity and contact data, order number, product information, voluntary information about the issue, photos where provided and return/refund information. Processing is necessary to exercise and fulfil statutory and contractual rights and obligations under Art. 6(1)(b) and, where legally required, Art. 6(1)(c) GDPR.

13. Google & YouTube / Google Pixel

Our Shopify store currently uses the “Google & YouTube” integration with a related Google app pixel. After required consent, it may process usage and conversion events, online identifiers, device and browser information, viewed pages, cart and purchase events and information used to measure advertising effectiveness. Depending on configuration, processing may also be used to deliver or optimize advertising. For many Google services involving users in the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible. Where consent is required, processing is based on Art. 6(1)(a) GDPR and applicable ePrivacy rules. Consent can be changed or withdrawn for the future through the store's privacy settings.

14. Additional marketing pixels

Meta Pixel and Pinterest Tag are not currently described as active services in this policy because they are not enabled under the currently confirmed store setup. If additional analytics or marketing services are activated in the future, this privacy policy will be updated and any required consent controls will be configured accordingly.

15. Cookies and similar technologies

Our store uses cookies, local storage technologies, pixels and similar technologies. Strictly necessary technologies may be used in particular for the cart, checkout, security, customer accounts, language, region and payment processing. In applicable regions, required consent is obtained through Shopify's cookie/privacy banner before non-essential analytics, personalization and marketing technologies are used. Consent-based personal-data processing relies on Art. 6(1)(a) GDPR and applicable ePrivacy rules.

16. Consent management

We currently use Shopify's automated privacy settings, including its cookie banner in the regions for which it is configured. Consent to non-essential technologies can be changed or withdrawn for the future through the privacy settings provided in the store. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

17. Email marketing

Marketing emails are sent only where there is valid consent or another lawful basis. Where marketing is based on consent, Art. 6(1)(a) GDPR applies. Consent may be withdrawn at any time for the future, including through an unsubscribe link. Transactional messages such as order, payment, shipping, return or security notifications, by contrast, are sent to perform the contract or comply with legal obligations and are not newsletters.

18. Recipients of personal data

Personal data may be disclosed, only where necessary and supported by an appropriate legal basis, in particular to Shopify, payment providers, DSers, AliExpress, the specific supplier, shipping and logistics providers, Google, communication and IT service providers, tax or legal advisers and public authorities. Data is disclosed for other purposes only where there is a lawful basis or you have consented.

19. Retention

We retain personal data only for as long as necessary for the relevant processing purpose, contract performance, legal defence or statutory commercial, tax or other retention duties. When the purpose ceases and applicable periods expire, data is deleted or anonymised unless another legal basis permits or requires further retention.

20. Your rights

Subject to the statutory conditions, you have rights including access, rectification, erasure, restriction of processing, data portability and objection to certain processing. Consent may be withdrawn at any time for the future. To exercise your rights, contact us at ferrumculina@gmail.com. Where Shopify processes data in its own responsibility, Shopify's privacy and data-subject-rights tools may also be used.

21. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority particularly relevant to Ferrum Culina's place of business is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Germany.

22. Data security and changes

We and the platform and service providers we use apply appropriate technical and organisational measures to protect personal data. However, completely risk-free transmission over the internet cannot be guaranteed. We update this privacy policy if services, processing activities or legal requirements change. The version published in the store is the current version.