Privacy notice

1. Controller and contact

The controller for the processing described below in the LABGROWNLOVE online shop is Dominik Klein, trading as Dominik Klein Consulting, Auf dem Steinacker 1, 52391 Vettweiß, Germany. For privacy enquiries: info@labgrownlove.de, telephone: +49 1522 3156091.

This notice covers our shop, orders and related communications. For services for which a provider is independently responsible, that provider's privacy information also applies. Merely using our shop does not constitute consent to optional data processing.

2. Categories of data, purposes and legal bases

We process data you provide, technical data generated when you use the shop and information we receive from relevant providers to handle payment, shipping or other commissioned services. This includes in particular:

Contact and account information, such as name, address, email address and, where applicable, telephone number;
Order and contract data, such as products, ring size, configuration, engraving requests, order numbers, invoices, payment results and delivery status;
Communication data from enquiries, consultations, complaints, appointment bookings and reviews;
Technical usage data such as IP address, time, browser, device, pages accessed and technical identifiers, and usage events where relevant analytics and advertising functions are used.

Processing to take pre-contractual steps at your request, handle orders, delivery, payments and defects is based on Article 6(1)(b) GDPR. We fulfil statutory retention and documentation obligations on the basis of Article 6(1)(c) GDPR. Securing and reliably operating the shop, preventing misuse and asserting or defending claims serve our legitimate interests under Article 6(1)(f) GDPR. Advertising and analytics requiring consent are based on Article 6(1)(a) GDPR.

Order details marked as required are needed for the contract; without them an order may not be processed. Voluntary information and consent to advertising are not prerequisites for a purchase.

3. Shop platform and technical operation

Our shop uses Shopify. For customers in the European Economic Area, Shopify International Limited in Ireland is involved in particular; other Shopify companies and technical subcontractors in other countries may also process data. Shopify provides hosting, shop and order administration, checkout, customer accounts and security functions, among other services. Technical connection data and the customer and order data required for each function are processed for these purposes.

Where Shopify processes data on our instructions, it acts as a processor. Shopify may be independently responsible for certain services of its own, such as Shop and Shop Pay. Details, recipients and information about international transfers can be found in Shopify's privacy notice and its consumer information. Requests concerning processing for which Shopify is independently responsible can also be submitted through Shopify's privacy portal.

Technical logs are processed to provide the service, analyse errors and defend against attacks. The legal basis is Article 6(1)(f) GDPR; our interest is a secure and functioning shop. Security-related data may be retained until an incident is clarified and for legal enforcement.

4. Orders, payment and shipping

Payment and shipping providers receive the data required for contract performance. Full card or banking access details entered directly with a payment provider are processed by that provider. We receive the payment information required to allocate and process the transaction.

Depending on the payment method selected at checkout, Shopify Payments or Shop Pay, PayPal or Klarna are involved in particular. The services and notices offered there are decisive. Payment providers also process certain data under their own responsibility, for example to meet statutory obligations, prevent fraud or, for relevant payment methods, assess creditworthiness. Information is available from Shopify, PayPal and Klarna. A payment provider's decision about a payment method must be distinguished from a decision by us.

Post/DHL or DHL Express and the shipping platforms Sendcloud or Packlink may be used for shipping. In particular, name, delivery address, shipment data and contact details needed for agreed delivery notifications are transmitted. The order-status function provided through StatusPro processes the information needed to display your order and its processing status. The legal basis for necessary performance is Article 6(1)(b) GDPR, and for statutory documentation obligations Article 6(1)(c) GDPR.

5. Configurator, wishlist and other shop functions

Product selection and presentation involve, among others, Pencil Design (pencildesign.co), Jewelith by Keyideas and product options from Qikify/Tepo. When these functions are accessed, technical connection data and your product selection and configuration may be processed. We use this information to display your selection and, if you order, to manufacture and fulfil your product.

The wishlist is provided through Wishlist Plus by Swym. It stores selected products and associates them through technical identifiers or a customer account you use. Shared wishlists can be viewed by people with the corresponding sharing link. Other functions concern language selection and translation through Weglot, delivery estimates through Omega and the display of offers and timing information through BOGOS and Essential Apps. Loading external functions may transmit your IP address, browser data and pages accessed to the provider.

The legal basis is Article 6(1)(b) GDPR where processing is necessary for a function you request or a contract, or Article 6(1)(f) GDPR for a user-friendly and reliable shop presentation. Where a function involves non-essential access to terminal equipment, behavioural analysis or advertising, consent under Article 6(1)(a) GDPR and section 25(1) TDDDG is required. Merely integrating an app does not create an exception to this consent requirement.

6. Enquiries, consultations and appointment bookings

If you contact us by email, contact form, telephone or an available chat function, we process your contact details and message content to handle your request. For questions about an order or pre-contractual advice, the legal basis is Article 6(1)(b) GDPR. We handle other enquiries on the basis of our legitimate interest in appropriate communication under Article 6(1)(f) GDPR.

Shopify Forms may be used for forms, the Calendly integration by F2 for appointment bookings, and the app by Roar for linking to WhatsApp. When WhatsApp is used, WhatsApp Ireland Limited also processes communication and usage data under its own responsibility. You can alternatively contact us by email. Please do not send payment access details or particularly sensitive information through chat services.

7. Newsletters and email marketing

Klaviyo is among the services used for newsletters, signup forms and marketing communications. For these purposes, we process your email address, any voluntary profile information and evidence of your registration and consent. The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with section 7 UWG. The same requirements apply to promotional reminders about an uncompleted purchase. Entering an email address at checkout alone does not constitute newsletter consent.

Any person-specific measurement of opens and link clicks and linking with purchase or usage data to create advertising profiles requires sufficiently comprehensive consent. You may withdraw consent at any time with effect for the future, in particular through the unsubscribe link in the email or by contacting us. Unsubscribing does not affect necessary messages concerning fulfilment of your order. Provider information is available in Klaviyo's privacy notice.

8. Cookies, consent and access to terminal equipment

Cookies and similar technologies store information on your device or access it. Access strictly necessary for a function expressly requested, such as a cart or checkout function, may be permitted without separate consent under section 25(2), no. 2 TDDDG. Subsequent processing of personal data also requires a legal basis under the GDPR.

Non-essential analytics, advertising and comparable technologies require your prior consent under section 25(1) TDDDG; the associated processing of personal data is based on Article 6(1)(a) GDPR. You may withdraw consent at any time for the future. To do so, use the privacy settings offered in the shop or contact us. Browsers also offer ways to delete stored cookies and block new ones; this may affect shop functionality. Merely deleting cookies does not automatically end all server-side processing.

9. Analytics and advertising measurement

The following analytics and advertising technologies are integrated into the shop. Their non-essential access to terminal equipment and analysis of personal usage data require prior consent:

Google Tag Manager and Google Analytics: management of tags and analysis of shop usage and events, such as page views and purchase interactions. Online identifiers, technical device information, pages accessed and event data may be processed. The provider for European users is Google Ireland Limited; Google companies in other countries may be involved. Tag Manager may trigger further services whose requirements apply separately. Google privacy information.
Meta Pixel: measurement of page views, product interactions, cart and checkout events, attribution to advertising and creation of advertising audiences. Meta may link this data to an account held with Meta. The provider is Meta Platforms Ireland Limited; international Meta companies may be involved. Meta's applicable joint-controller terms govern joint collection and transmission; subsequent processing for Meta's own purposes is performed by Meta. Meta privacy information.
Lucky Orange: analysis of shop interactions, including interaction analysis, heatmaps and session recordings. Page views, clicks, scrolling and mouse movements, and technical device and session data may be recorded. The provider is Lucky Orange LLC, USA. Lucky Orange privacy information.
OpenAI advertising measurement: the OpenAI measurement pixel attributes shop events to advertisements and evaluates their effectiveness. Page and event data, online identifiers and device and connection data may be processed. For data from the European Economic Area, OpenAI Ireland Limited is involved under the Ad Tools terms. OpenAI and we generally act as separate controllers; a different processor arrangement depends on expressly agreed restricted processing. OpenAI privacy information and Ad Tools data protection terms.

Advertising services may create usage profiles and link events across devices or services. Refusing or withdrawing the consent required for this must not prevent a purchase.

10. Reviews and Trusted Shops

Judge.me is among the services integrated for customer reviews. If you submit a review, its content, any images you upload and the details needed to attribute it are processed. Please do not publish third parties' personal data. Displaying a review you submit for publication serves that requested publication and our legitimate interest in authentic product information. Promotional review invitations by email require appropriate consent.

The Trusted Shops Trustbadge displays trust and review information and may provide access to buyer protection. When it is accessed, technical connection data in particular is transmitted to Trusted Shops. Signing up for buyer protection or using additional services involves the contact and order data necessary for those services. The legal basis depends on the function: Article 6(1)(f) GDPR for displaying trust information, Article 6(1)(b) GDPR for requested services, and Article 6(1)(a) GDPR for additional functions requiring consent. Non-essential access to terminal equipment additionally requires consent. Agreements with Trusted Shops apply to jointly controlled processing steps; Trusted Shops independently processes its own membership and protection services. Further information and contacts: Trusted Shops and Judge.me.

11. Other recipients and international transfers

In addition to the providers named above, providers acting on instructions for technical maintenance, data management, accounting and customer service may receive access insofar as necessary for their tasks. Data may be transmitted to authorities, courts and legal or tax advisers to fulfil statutory obligations or enforce legal rights. Each disclosure is purpose-specific and based on the relevant legal basis.

International providers may process data outside the EU and EEA, particularly in the USA and Canada. The additional requirements of Articles 44 et seq. GDPR must be met. Depending on the provider and processing, an applicable adequacy decision, approved binding corporate rules or EU standard contractual clauses with supplementary safeguards where necessary may be used. A transfer to the USA is not justified merely because a provider is based there; reliance on an adequacy decision requires that it actually applies to the recipient.

Information about the safeguards used for a particular transfer and a copy or means of obtaining them are available from us on request and in the linked provider information. Third countries may have different governmental access powers and avenues for legal protection.

12. Retention periods

We retain personal data only for as long as needed for the stated purpose or required by law. Enquiries not subject to retention requirements are deleted after final handling once no legitimate grounds for further storage remain. Customer account data is processed until the account is deleted or the data is no longer necessary; order data subject to retention requirements is retained separately.

Depending on the document, commercial and tax records are generally subject to retention periods of six, eight or ten years, usually beginning at the end of the relevant calendar year. Legal requirements may extend periods in individual cases. Data needed for legal claims is retained with restricted processing until that purpose ceases, in particular until applicable limitation periods expire.

Newsletter data is generally used for sending until consent is withdrawn or you unsubscribe. Evidence of consent and necessary suppression records may be stored longer to demonstrate lawfulness and respect your unsubscribe request. The lifetime of individual cookies and retention periods at providers depend on the purpose and specific settings; further information about processing concerning you is available on request.

13. Your rights

Subject to the statutory conditions, you have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future (Article 7(3)). The lawfulness of processing before withdrawal remains unaffected.

You may object to processing based on Article 6(1)(e) or (f) GDPR on grounds relating to your particular situation (Article 21(1)). You may object at any time, without giving reasons, to processing for direct marketing, including associated profiling (Article 21(2) and (3)).

Under the conditions of Article 22 GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Information about any automated decisions by independently responsible payment providers is available in their notices.

To exercise your rights, send a message to info@labgrownlove.de. We may request information necessary to identify you securely. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), particularly in the Member State of your residence, workplace or the alleged infringement. The competent authority for our registered location is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia: www.ldi.nrw.de.