Privacy policy

This English version is provided for convenience. The German version is legally binding.

We only process personal data to the extent necessary to operate this website, handle your enquiries and orders, or send the newsletter. Here you can find out which data this is, what we use it for and what rights you have.

1. Controller

Represented by the managing directors Dogan Yüksel, Semi Fadhila.

2. Hosting and server log files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you access the pages, the host processes technically necessary data: IP address, date and time, page accessed, browser and operating system, and the previously visited page. This serves the secure and stable delivery of the website (Art. 6 (1) (f) GDPR). Log data is deleted automatically after a short period.

Forms, job applications and notifications from the shop are processed on Vercel servers in Frankfurt am Main. A data processing agreement is in place with Vercel (Art. 28 GDPR). Where data is transferred to the USA, this is covered by Vercel's certification under the EU-US Data Privacy Framework (adequacy decision of the EU Commission, Art. 45 GDPR); the EU Commission's standard contractual clauses have also been agreed.

3. Cookies and browser storage

This website does not set cookies for analytics or advertising and does not use tracking services; for the Shopify checkout see section 6. Fonts and icons are not loaded from third parties.

Your cart is stored in your browser (localStorage) so that it is kept when you change pages, as are – if you enter them – an order reference or cost centre and a VAT ID. While you sign in to your customer account, the browser keeps a verification value and the page to return to for the duration of the session (sessionStorage). When you sign in to your customer account, the browser also stores the sign-in (an access key from Shopify) as well as your name, email address and, if applicable, your profile picture for display in the menu; these are deleted when you sign out. This storage is strictly necessary for the service you requested (Section 25 (2) No. 2 TDDDG). You can delete it at any time in your browser settings.

4. Contact form and email

When you contact us via the contact form or by email, we process your first name, last name, email address, subject and message, and – if provided – company and phone number. We use this information to handle your enquiry and send you a confirmation of receipt.

The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract or an order, otherwise our legitimate interest in answering enquiries (Art. 6 (1) (f) GDPR). We delete the data once your enquiry has been fully processed and no statutory retention obligations apply.

Job applications: If you apply via the online application on the careers page or via the contact form with the subject “Job application”, we process your details (name, email address and – if provided – phone number, place of residence, profile link, start date, salary expectations and message) and the uploaded documents (PDF, JPG or PNG) to carry out the application procedure, i.e. to initiate an employment relationship (Art. 6 (1) (b) GDPR). Only the people who decide on the hiring receive the documents. If no employment relationship is established, we delete the documents six months after the procedure has ended; we keep them for this period to be able to defend ourselves against claims under the General Equal Treatment Act (Art. 6 (1) (f) GDPR). Longer storage, for example for future vacancies, only with your consent.

Online withdrawal: If you withdraw from a contract using our withdrawal function, we process your name, email address, order number, order date and the items stated, as well as the date and time of receipt. We need this information to process the withdrawal and to confirm its receipt to you by email as required by law (Art. 6 (1) (c) GDPR in conjunction with Section 356a BGB). We retain it together with the order records for as long as commercial and tax law requires.

Email delivery: We send form messages (including job applications and their attachments), confirmation emails, the newsletter and review requests via Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor (Art. 28 GDPR). The emails are sent from servers in Ireland (EU), but Resend also processes the data in the USA. Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); the EU Commission's standard contractual clauses apply in addition.

Mailboxes: Our mailboxes are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which stores the emails in Germany on our behalf (Art. 28 GDPR).

5. Newsletter

For the newsletter, we only need your email address. We use the double opt-in procedure: after signing up, you receive an email with a confirmation link. Only when you click it do we add you to the mailing list. To be able to prove your consent, we store the sending of the confirmation email and the time at which you confirmed your subscription.

You can also subscribe to the newsletter at checkout or in your customer account. Your consent is then stored by Shopify (see section 6), likewise with a confirmation link. Shopify notifies us of subscriptions and unsubscriptions automatically, and we apply the change to the mailing list.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time via the unsubscribe link in every email or by sending us a message. Sending and address management are handled by Resend (see section 4). We do not evaluate whether you open the newsletter or click links in it; open and click tracking is switched off.

After you unsubscribe, we remove your address from the mailing list. Storing it on a block list to prevent future mailings is permitted.

6. Shop, orders and payment

You can add products to the cart on this website. The ordering process itself – entering delivery and billing addresses, choosing the payment method and completing the order – takes place in the Shopify checkout (Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland). Shopify's privacy policy also applies there. Shopify processes the data on our behalf; data may also be transferred to Shopify Inc. in Canada (adequacy decision of the EU Commission) and to the USA (standard contractual clauses). In the checkout, Shopify sets cookies that are technically necessary for the ordering process and fraud prevention (Section 25 (2) No. 2 TDDDG).

Google in the checkout: The checkout includes tags from Google, via the Shopify app “Google & YouTube” and via a custom pixel (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). They report page views in the checkout and completed purchases (order value, items, order number) to Google so that we can measure the success of our ads on Google and YouTube and analyse how the shop is used. Cookies are set and your IP address and information about your device and browser are transmitted. The tags only run with your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Without consent the tags stay off, and your order does not depend on it. You can withdraw your consent at any time with effect for the future by deleting the cookies in your browser or sending us a message. Google may transfer data to Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). More in Google's privacy policy.

Whether a pack is available is retrieved by your browser directly from Shopify when you open the product page. Shopify receives your IP address and technical information about your browser (Art. 6 (1) (f) GDPR; our legitimate interest is showing up-to-date availability). When you choose “Proceed to checkout”, the website hands your cart over to Shopify: items, quantities and – if provided – order reference or cost centre and VAT ID (Art. 6 (1) (b) GDPR).

Customer account: The customer account is provided by Shopify. You sign in with your email address and a one-time code that Shopify sends you by email; there is no password. In the account we process your name, email address, phone number, delivery addresses, your orders including shipment tracking and your newsletter setting, and – if you upload one – a profile picture. So that your cart is the same on all devices, we store it in the account for signed-in customers. Your browser stores the sign-in session as well as your name, email address and, if applicable, your profile picture locally on your device (localStorage); they are deleted when you sign out. Your browser retrieves orders and invoices directly from Shopify; they do not pass through our server. The legal basis is Art. 6 (1) (b) GDPR. If you would like your account deleted, simply send us a message; we then retain order data only as long as statutory obligations require.

We process your order data to perform the contract (Art. 6 (1) (b) GDPR) and retain it in accordance with commercial and tax law obligations (Art. 6 (1) (c) GDPR). Depending on the payment method you choose, we pass the necessary payment data to the respective payment provider (PayPal, Klarna, credit card processing, Apple Pay, Google Pay, Shop Pay). For deferred payment methods such as invoice or instalments via Klarna or PayPal, the provider may carry out an identity and credit check; the provider is responsible for this itself and informs you in its own privacy notice. For delivery, we pass your name and delivery address to the shipping company we use (usually DHL), and your email address or phone number only where necessary to announce or arrange delivery (Art. 6 (1) (b) GDPR).

Review requests: A few days after shipping your order, we ask you by email to rate us on Google. For this we use the email address from your order (Section 7 (3) UWG, Art. 6 (1) (f) GDPR; our legitimate interest is feedback on our products). You can object to this at any time without incurring any costs other than transmission costs at basic rates: via the “No more review requests” link in each of these emails or by sending us a message. You will still receive order and shipping emails. The emails are sent via Resend (see section 4).

7. Social networks and embedded videos

We link to our profiles on LinkedIn, YouTube, Instagram, X and Facebook and to the review form of our Google Business Profile with simple links. No plugins are loaded and no data is transferred before you click a link. The platforms' own privacy policies apply there.

WhatsApp: You can reach our management on WhatsApp via a simple link (wa.me). Only when you click it and write to us does WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) process your message and your phone number; data may also be transferred to the USA. We only use your message to answer your enquiry (Art. 6 (1) (b) or (f) GDPR). If you do not want this, you can also reach us by phone, email or contact form.

YouTube videos: On the Production, About us and News pages we show videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Until you click “Play video”, you only see a preview image from our own server; no connection to YouTube is made. Only when you click does the player load in privacy-enhanced mode (youtube-nocookie.com). Your IP address and technical data are then transferred to Google, including to the USA. The legal basis is your consent by clicking (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Google's privacy policy applies: policies.google.com/privacy. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to withdraw consent at any time with effect for the future (Art. 7 (3)).

Right to object: Where we process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany (Art. 77 GDPR).

For all data protection matters, contact us at info@yourmask-berlin.de or via the contact form.

Last updated: October 2026